diff --git a/.github/DockerfileBackendTests b/.github/DockerfileBackendTests
index 87a65214ab..2ce47ea714 100644
--- a/.github/DockerfileBackendTests
+++ b/.github/DockerfileBackendTests
@@ -28,7 +28,7 @@ ENV PATH="${PATH}:/usr/local/go/bin"
 ENV GO_PATH=/usr/local/go/bin/go
 
 # UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /usr/local/cargo/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /usr/local/cargo/bin/uv /usr/local/bin/uv
 
 ENV TZ=Etc/UTC
 
diff --git a/.github/workflows/ai-evals-scheduled.yml b/.github/workflows/ai-evals-scheduled.yml
index cc1c0d6763..580a757c21 100644
--- a/.github/workflows/ai-evals-scheduled.yml
+++ b/.github/workflows/ai-evals-scheduled.yml
@@ -1,25 +1,22 @@
 name: AI Evals (scheduled)
 
-# Full ai_evals suites on current models, posted to the AI evals dashboard in
-# the windmill-prod workspace (f/ai/ai_evals_dashboard) so quality is tracked
-# over time. Weekly, since one pass of every suite at --runs 3 costs about 50M
-# tokens per model: every suite runs on MODELS, and global (the mode users get)
-# also runs on GLOBAL_EXTRA_MODELS, one flagship per other provider. Run it by
-# hand to measure a branch against main.
+# The global (AI chat) and cli suites on current models, posted to the AI evals
+# dashboard in the windmill-prod workspace (f/ai/ai_evals_dashboard) so quality is
+# tracked over time. Weekly: one global pass at --runs 3 is about 45M tokens per
+# model. Each mode and model is its own job, so a slow model neither delays nor
+# shares a timeout with the others. Run it by hand to measure a branch against
+# main, or to include the flow, app and script suites.
 on:
   schedule:
     - cron: "0 3 * * 1"
   workflow_dispatch:
     inputs:
       modes:
-        description: "Space-separated modes"
-        default: "global flow app script cli"
+        description: "Space-separated modes (global, cli, flow, app, script)"
+        default: "global cli"
       models:
-        description: "Space-separated model aliases (bun run cli -- models)"
-        default: "sonnet-5.5"
-      global_extra_models:
-        description: "Extra model aliases for global mode only"
-        default: "gpt-6-astra gemini-3.8-flash"
+        description: "Space-separated model aliases (bun run cli -- models); cli skips those it has no agent for"
+        default: "sonnet-5.5 opus-5.5 gpt-6.1-sol gpt-6-astra deepseek-v4-pro"
       runs:
         description: "Runs per case"
         default: "3"
@@ -31,8 +28,7 @@ concurrency:
   group: ai-evals-scheduled-${{ github.ref }}
 
 env:
-  MODELS: ${{ inputs.models || 'sonnet-5.5' }}
-  GLOBAL_EXTRA_MODELS: ${{ inputs.global_extra_models || 'gpt-6-astra gemini-3.8-flash' }}
+  MODELS: ${{ inputs.models || 'sonnet-5.5 opus-5.5 gpt-6.1-sol gpt-6-astra deepseek-v4-pro' }}
   RUNS: ${{ inputs.runs || '3' }}
   REASONING: ${{ inputs.reasoning }}
   # Routes on the cloud instance are prefixed with their workspace.
@@ -42,14 +38,31 @@ jobs:
   setup:
     runs-on: ubuntu-latest
     outputs:
-      modes: ${{ steps.modes.outputs.modes }}
+      matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
-      - id: modes
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: ai_evals/core
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+
+      - id: matrix
         env:
-          MODES: ${{ inputs.modes || 'global flow app script cli' }}
+          MODES: ${{ inputs.modes || 'global cli' }}
+        # cli takes only the aliases with a `cli` entry in ai_evals/core/models.ts.
         run: |
-          echo "modes=$(jq -cn --arg m "$MODES" '$m | split(" ")
-            | map(select(IN("global", "flow", "app", "script", "cli")))')" >> "$GITHUB_OUTPUT"
+          cli_models=$(bun -e '
+            import { EVAL_MODELS } from "./ai_evals/core/models.ts";
+            console.log(JSON.stringify(EVAL_MODELS.filter((m) => m.cli)
+              .flatMap((m) => [m.id, ...m.aliases]).map((a) => a.toLowerCase())));')
+          echo "matrix=$(jq -cn --arg modes "$MODES" --arg models "$MODELS" --argjson cli "$cli_models" '
+            def words: split(" ") | map(select(. != ""));
+            [ $modes | words[] | select(IN("global", "flow", "app", "script", "cli")) as $mode
+              | $models | words[]
+              | select($mode != "cli" or (ascii_downcase | IN($cli[])))
+              | {mode: $mode, model: .} ]')" >> "$GITHUB_OUTPUT"
 
   evals:
     needs: setup
@@ -58,7 +71,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        mode: ${{ fromJSON(needs.setup.outputs.modes) }}
+        include: ${{ fromJSON(needs.setup.outputs.matrix) }}
     services:
       postgres:
         image: postgres:16
@@ -118,10 +131,15 @@ jobs:
         working-directory: ./cli
         run: bun install && ./gen_wm_client.sh && ./windmill-utils-internal/gen_wm_client.sh
 
-      - name: Run ${{ matrix.mode }} evals
+      - name: Install Codex CLI
+        if: matrix.mode == 'cli'
+        run: npm install --global @openai/codex@0.159.3
+
+      - name: Run ${{ matrix.mode }} evals on ${{ matrix.model }}
         working-directory: ./ai_evals
         env:
           MODE: ${{ matrix.mode }}
+          MODEL: ${{ matrix.model }}
           WMILL_AI_EVAL_BACKEND_URL: http://localhost:8000
           WMILL_AI_EVAL_BACKEND_WORKSPACE: integration-tests
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -131,14 +149,10 @@ jobs:
         run: |
           bun install
           mkdir -p results
-          models="$MODELS"
-          [ "$MODE" = global ] && models="$models $GLOBAL_EXTRA_MODELS"
           reasoning=()
           [ -n "$REASONING" ] && [ "$MODE" != cli ] && reasoning=(--reasoning "$REASONING")
-          for m in $models; do
-            bun run cli -- run "$MODE" --model "$m" --runs "$RUNS" "${reasoning[@]}" \
-              --output "$PWD/results/$MODE-$m.json" || echo "::warning::$MODE on $m errored"
-          done
+          bun run cli -- run "$MODE" --model "$MODEL" --runs "$RUNS" "${reasoning[@]}" \
+            --output "$PWD/results/$MODE-$MODEL.json" || echo "::warning::$MODE on $MODEL errored"
 
       - name: Post results to the dashboard
         if: always()
@@ -166,7 +180,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: ai-evals-${{ matrix.mode }}
+          name: ai-evals-${{ matrix.mode }}-${{ matrix.model }}
           path: |
             ai_evals/logs
             ai_evals/results
diff --git a/.github/workflows/backend-test-windows.yml b/.github/workflows/backend-test-windows.yml
index 54a62ec495..3468449753 100644
--- a/.github/workflows/backend-test-windows.yml
+++ b/.github/workflows/backend-test-windows.yml
@@ -63,7 +63,7 @@ jobs:
 
       - uses: denoland/setup-deno@v2
         with:
-          # Pin to the Deno version shipped in the runtime image (Dockerfile) so CI
+          # Pin to the Deno version shipped in the full runtime image (docker/DockerfileFull) so CI
           # tests what production runs, instead of floating on the latest v2.x.
           deno-version: 2.2.1
 
@@ -81,7 +81,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v7
         with:
-          version: "0.11.24"
+          version: "0.13.0"
 
       - uses: shivammathur/setup-php@v2
         with:
diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index a2087025b7..73f955131e 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -50,7 +50,7 @@ jobs:
           dotnet-version: "9.0.x"
       - uses: denoland/setup-deno@v2
         with:
-          # Pin to the Deno version shipped in the runtime image (Dockerfile) so CI
+          # Pin to the Deno version shipped in the full runtime image (docker/DockerfileFull) so CI
           # tests what production runs, instead of floating on the latest v2.x.
           deno-version: 2.2.1
       - uses: actions/setup-go@v7
@@ -64,7 +64,7 @@ jobs:
           node-version: "24"
       - uses: astral-sh/setup-uv@v7
         with:
-          version: "0.11.24"
+          version: "0.13.0"
       - uses: shivammathur/setup-php@v2
         with:
           php-version: "8.3"
@@ -295,4 +295,4 @@ jobs:
           # never reaches it. Pin the target dir (matching the cache step above) so
           # its own tests run off this compile rather than a second bundled build.
           (cd windmill-duckdb-ffi-internal && export CARGO_TARGET_DIR="$PWD/target" && ./build_dev.sh && cargo test --release -p windmill_duckdb_ffi_internal)
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) PHP_PATH=$(which php) COMPOSER_PATH=$(which composer) RUBY_PATH=$(which ruby) RUBY_BUNDLE_PATH=$(which bundle) RUBY_GEM_PATH=$(which gem) POWERSHELL_PATH=$(which pwsh) DOTNET_PATH=$(which dotnet) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp,run_inline,smtp,http_trigger --all -- --nocapture --test-threads=10
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) PHP_PATH=$(which php) COMPOSER_PATH=$(which composer) RUBY_PATH=$(which ruby) RUBY_BUNDLE_PATH=$(which bundle) RUBY_GEM_PATH=$(which gem) POWERSHELL_PATH=$(which pwsh) DOTNET_PATH=$(which dotnet) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp,run_inline,smtp,http_trigger,openidconnect --all -- --nocapture --test-threads=10
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index d420ff1f00..475d7860d8 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -27,7 +27,7 @@ jobs:
           DATABASE_URL: postgres://postgres:changeme@postgres:5432/windmill
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always --health-interval 10s --health-timeout 5s
           --health-retries 5 --health-cmd "curl
@@ -111,7 +111,7 @@ jobs:
           DATABASE_URL: postgres://postgres:changeme@postgres:5432/windmill
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always --health-interval 10s --health-timeout 5s
           --health-retries 5 --health-cmd "curl
@@ -125,7 +125,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -136,7 +136,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -147,7 +147,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -188,7 +188,7 @@ jobs:
           DATABASE_URL: postgres://postgres:changeme@postgres:5432/windmill
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always --health-interval 10s --health-timeout 5s
           --health-retries 5 --health-cmd "curl
@@ -202,7 +202,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -213,7 +213,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -224,7 +224,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -235,7 +235,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -246,7 +246,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -257,7 +257,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
 
@@ -268,7 +268,7 @@ jobs:
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           MODE: worker
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always
     steps:
@@ -309,7 +309,7 @@ jobs:
           DATABASE_URL: postgres://postgres:changeme@postgres:5432/windmill
           LICENSE_KEY: ${{ secrets.WM_LICENSE_KEY_CI }}
           WORKER_GROUP: main
-          WORKER_TAGS: deno,bun,go,python3,bash,dependency,flow,nativets
+          WORKER_TAGS: bun,go,python3,bash,dependency,flow,nativets
         options: >-
           --pull always --health-interval 10s --health-timeout 5s
           --health-retries 5 --health-cmd "curl
diff --git a/.github/workflows/npm_on_release.yml b/.github/workflows/npm_on_release.yml
index 631ab53153..a2bd974daa 100644
--- a/.github/workflows/npm_on_release.yml
+++ b/.github/workflows/npm_on_release.yml
@@ -18,16 +18,19 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   publish_chat_sdk:
-    runs-on: ubicloud-standard-8
+    # Published by npm trusted publishing (OIDC), which npm accepts only from
+    # GitHub-hosted runners and npm >= 11.5.1: keep both, there is no token to fall back on.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v7
         with:
-          node-version: "20.x"
+          node-version: "24.x"
           registry-url: "https://registry.npmjs.org"
       - run: cd chat-sdk && npm ci && npm run build && npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   publish_cli:
     runs-on: ubicloud-standard-8
     steps:
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index afbaa8e7b0..fdce702331 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.821.0"
+  ".": "1.830.0"
 }
diff --git a/AGENTS.md b/AGENTS.md
index 8451a0a600..a57215cde5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,12 +33,16 @@ Open-source platform for internal tools, workflows, API integrations, background
   administers behind `external_instance` data tables and Ducklake catalogs: its invariants (one
   lifecycle lock, managed-object markers, the setup gate, per-cluster roles, fork copy ownership)
   and how to run one locally
+- **Data table viewer roles**: `docs/datatable-viewer-roles.md`, on what a connection naming no
+  role holds: the default role as a floor, where the viewer comes from, why an admin's roles are
+  not the viewer's, the per-role-set logins and the order their rows and logins are written in
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
 - **Operator write rights**: `docs/operator-write-rights.md` — which `operator_settings` flags are
   enforced rather than cosmetic, and why a right that is granted-unless-withdrawn needs `Option`
   fields and a jsonb merge rather than a serde default
-- **Operator builder rights**: `docs/operator-builder-rights.md` — the workspace setting that lets
-  operators compose flows, what the composition check must cover, and why it costs a full seat
+- **Operator builder rights**: `docs/operator-builder-rights.md` — the workspace settings that let
+  operators compose flows and full-code apps, what the composition check must cover, which
+  raw-app endpoint stays closed on purpose, and why either right costs a full seat
 - **Auth surface**: `docs/auth-surface.md` — credential precedence, session/cache invalidation
   scope, which token labels email their owner at expiry, how OAuth login matches `login_type`, and
   that every superadmin route refuses `$WM_TOKEN`. Read before designing anything that creates
@@ -90,6 +94,12 @@ are for a plain checkout with nothing running.
 - **Login**: `admin@windmill.dev` / `changeme`
 - **Instance settings**: navigate to `/#superadmin-settings`
 - **Migrations**: use `cargo sqlx migrate add -r <name>` from `backend/` to create new migrations (never generate timestamps manually)
+- **Resource types ship through the hub, not migrations.** A new type, a provider's credential
+  included, is a `hub/<app>/<app>.resource_type.json` in `windmill-labs/windmill-integrations`
+  and reaches instances by hub sync; a product name its identifier misses (`typesafe` →
+  "TypeSafe") is that file's `display_name`, not a word in `resourceTypeDisplay.ts`'s map. Only a
+  type Windmill itself defines and reads as a product object (`ai_skill`, `ai_instruction`) is
+  also seeded by a migration, so the feature works before a sync. For local testing, insert the row.
 
 ### Per-worktree ports and database
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8aa66a785d..80939b1b47 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,224 @@
 # Changelog
 
+## [1.830.0](https://github.com/windmill-labs/windmill/compare/v1.829.0...v1.830.0) (2026-10-09)
+
+
+### Features
+
+* add a jobs:run:dependencies token scope for lock generation ([#11643](https://github.com/windmill-labs/windmill/issues/11643)) ([1dc4ed5](https://github.com/windmill-labs/windmill/commit/1dc4ed5e7fb86c9658f1f877e7b92cd9dab5e283))
+* let operators compose full-code apps when the workspace grants it ([#11229](https://github.com/windmill-labs/windmill/issues/11229)) ([02e4697](https://github.com/windmill-labs/windmill/commit/02e4697157112581e9e2a9303180077126db714b))
+* operators get AI sessions ([#11443](https://github.com/windmill-labs/windmill/issues/11443)) ([338c4e9](https://github.com/windmill-labs/windmill/commit/338c4e921dc3185d886c8b040f253285adf20efb))
+* replace the hub_sync script with an opt-in daily server sync ([#11624](https://github.com/windmill-labs/windmill/issues/11624)) ([2b55a8a](https://github.com/windmill-labs/windmill/commit/2b55a8afbc8a86c6cebe97b1cab02c313b986f22))
+* retry transient AI provider failures before output reaches readers ([#11623](https://github.com/windmill-labs/windmill/issues/11623)) ([d3ddef0](https://github.com/windmill-labs/windmill/commit/d3ddef0b7ec4705aa578c4eca24b96e9152485bd))
+* stop offering deno for new scripts, ship it only on full images ([#11648](https://github.com/windmill-labs/windmill/issues/11648)) ([cda7883](https://github.com/windmill-labs/windmill/commit/cda78830fde1b96bd3de2674e23c245b50e3c051))
+
+
+### Bug Fixes
+
+* **cli:** count superadmins as able to preserve ownership on push ([#11653](https://github.com/windmill-labs/windmill/issues/11653)) ([70db567](https://github.com/windmill-labs/windmill/commit/70db567a78b1e1bc9e2dcc9ff2139951d778117e))
+* harden app secret validation ([#11655](https://github.com/windmill-labs/windmill/issues/11655)) ([8556a7b](https://github.com/windmill-labs/windmill/commit/8556a7bebe093e0bd61c33d67415fd553f0070ad))
+* open the chat + menu without waiting on the skills and mcp fetches ([#11645](https://github.com/windmill-labs/windmill/issues/11645)) ([1fea1aa](https://github.com/windmill-labs/windmill/commit/1fea1aa6609d644e02bac8d16186f9a2dfcb63cd))
+* say Running on a chat run card only once its job exists ([#11627](https://github.com/windmill-labs/windmill/issues/11627)) ([d046187](https://github.com/windmill-labs/windmill/commit/d046187e3edd01535240c6080b483afe154ae189))
+
+## [1.829.0](https://github.com/windmill-labs/windmill/compare/v1.828.0...v1.829.0) (2026-10-09)
+
+
+### Features
+
+* add an api base url instance setting for displayed urls ([#11628](https://github.com/windmill-labs/windmill/issues/11628)) ([6acf185](https://github.com/windmill-labs/windmill/commit/6acf1858540e83b65b5218c50c98af692092d22e))
+* add Pi template to the AI sandbox picker ([#11619](https://github.com/windmill-labs/windmill/issues/11619)) ([a85d0b7](https://github.com/windmill-labs/windmill/commit/a85d0b76cc494aaa4a484a273ec534bdc2958102))
+* agent nits: multi-select, memory-off notice, agent step label ([#11622](https://github.com/windmill-labs/windmill/issues/11622)) ([c52ba2f](https://github.com/windmill-labs/windmill/commit/c52ba2fd30e19986522420ff02fae224a075b4f6))
+* export worker cpu, memory and occupancy metrics ([#11629](https://github.com/windmill-labs/windmill/issues/11629)) ([5d90f96](https://github.com/windmill-labs/windmill/commit/5d90f96863b64e9bc88ed35429f8068a6a788d1e))
+* let a job see that its worker is draining ([#11612](https://github.com/windmill-labs/windmill/issues/11612)) ([588d846](https://github.com/windmill-labs/windmill/commit/588d8463dfa1c8936b8753b5f0fd794ecb115203))
+* let workspace admins delete other users' drafts ([#11644](https://github.com/windmill-labs/windmill/issues/11644)) ([68376fc](https://github.com/windmill-labs/windmill/commit/68376fc011ef6406a820c69217058316514d3f8d))
+* per-script resource rollup and heaviest scripts table ([#11631](https://github.com/windmill-labs/windmill/issues/11631)) ([442357d](https://github.com/windmill-labs/windmill/commit/442357dbe8db0c52995572acd7385dedf4efdc42))
+* pipeline editor: assets-only view, Fix actions and draft triggers ([#11440](https://github.com/windmill-labs/windmill/issues/11440)) ([3dae553](https://github.com/windmill-labs/windmill/commit/3dae553576ba23b2c1f56e4deac01305c4645c01))
+
+
+### Bug Fixes
+
+* advertise the actual signing algorithm in OIDC discovery ([#11637](https://github.com/windmill-labs/windmill/issues/11637)) ([98fc65a](https://github.com/windmill-labs/windmill/commit/98fc65a16bbe2bc9515cdd5443304053c4322274))
+* ask a workspace for its session backups before pushing to it ([#11641](https://github.com/windmill-labs/windmill/issues/11641)) ([2ea846f](https://github.com/windmill-labs/windmill/commit/2ea846f563f5a77cbd3eae2eddee9e38a3700d00))
+* keep instance settings users sub-tabs from being squashed ([#11633](https://github.com/windmill-labs/windmill/issues/11633)) ([fb22e5c](https://github.com/windmill-labs/windmill/commit/fb22e5ce368eba9146e0d51b8fdabb52ca9f68f0))
+* keep raw app deploy panel settings shared with the editor ([#11616](https://github.com/windmill-labs/windmill/issues/11616)) ([0a95ea4](https://github.com/windmill-labs/windmill/commit/0a95ea47facaede2545cc4741d4a70c1c847e11a))
+* load schedules once per page load, poll critical alerts every 30s ([#11639](https://github.com/windmill-labs/windmill/issues/11639)) ([1b4e686](https://github.com/windmill-labs/windmill/commit/1b4e686b2f5de3138df0c3b6ed627ea0fe0a2f7d))
+* name the open workspace settings tab in the page header breadcrumb ([#11617](https://github.com/windmill-labs/windmill/issues/11617)) ([e233908](https://github.com/windmill-labs/windmill/commit/e233908c1e99a246dc7c94fa86ea82c5cbe9d6b3))
+* **python:** add missing import-to-package mappings for common modules ([#11638](https://github.com/windmill-labs/windmill/issues/11638)) ([ab8606f](https://github.com/windmill-labs/windmill/commit/ab8606f37921913ef1410da735abb5742c025225))
+* send hub script completions to the workspace handlers ([#11613](https://github.com/windmill-labs/windmill/issues/11613)) ([d685332](https://github.com/windmill-labs/windmill/commit/d685332771dcdfc718d7a2077fe1cdb3b323909b))
+* set WM_END_USER_EMAIL on direct script and flow runs ([#11636](https://github.com/windmill-labs/windmill/issues/11636)) ([2bdeceb](https://github.com/windmill-labs/windmill/commit/2bdeceba7fb6815cf3150ecb856afb8eb3872e44))
+* store a WAC parent's first start and wall duration ([#11625](https://github.com/windmill-labs/windmill/issues/11625)) ([8f28a58](https://github.com/windmill-labs/windmill/commit/8f28a5860595dbe558e6777a06bb97b6ec6a3e67))
+* sync back volume files rewritten to the same size ([#11620](https://github.com/windmill-labs/windmill/issues/11620)) ([2758920](https://github.com/windmill-labs/windmill/commit/2758920f1182ddd12e6473a644a4a966a435522e))
+* uniform decrypt error and clear stored credentials on logout ([#11632](https://github.com/windmill-labs/windmill/issues/11632)) ([987c321](https://github.com/windmill-labs/windmill/commit/987c321ebcd305df79fa945e941abc2b2e1d3e95))
+
+## [1.828.0](https://github.com/windmill-labs/windmill/compare/v1.827.0...v1.828.0) (2026-10-08)
+
+
+### Features
+
+* add gpt-6.1-sol to the chat, agent steps and weekly ai evals ([#11584](https://github.com/windmill-labs/windmill/issues/11584)) ([8f7e0c7](https://github.com/windmill-labs/windmill/commit/8f7e0c72848b56fa97f6f0141d930c7d15044864))
+* add wmill user list and document post-suspend approvers context ([#11600](https://github.com/windmill-labs/windmill/issues/11600)) ([1c2667c](https://github.com/windmill-labs/windmill/commit/1c2667cd5530925893cf69fd622938b6ffa55d1d))
+* ask before minting the frontend sdk token in the raw app editor ([#11604](https://github.com/windmill-labs/windmill/issues/11604)) ([6e948b0](https://github.com/windmill-labs/windmill/commit/6e948b07d13b85e9251c3a200bf149f167649bc4))
+* improve data table roles and grants UX ([#11562](https://github.com/windmill-labs/windmill/issues/11562)) ([d7d18f0](https://github.com/windmill-labs/windmill/commit/d7d18f00af4e2df8fcb1362c9439d2250d0ce4b6))
+* one page header across routes, and one sidebar for operators and developers ([#11310](https://github.com/windmill-labs/windmill/issues/11310)) ([41162b2](https://github.com/windmill-labs/windmill/commit/41162b270c70ddac6a256bde9acf31a629990e24))
+
+
+### Bug Fixes
+
+* add retry to runScriptByPathAsync and runScriptByHashAsync ([#11485](https://github.com/windmill-labs/windmill/issues/11485)) ([3f3b1c2](https://github.com/windmill-labs/windmill/commit/3f3b1c2c308ddaba377db45308711e7c660d8775))
+* describe exponential retry as multiplier × seconds^attempt ([#11546](https://github.com/windmill-labs/windmill/issues/11546)) ([a2e51cd](https://github.com/windmill-labs/windmill/commit/a2e51cdbaafb7d71b8e8bbd818e40c472098f9ba))
+* keep capturing job logs after a non-UTF-8 output line ([#11595](https://github.com/windmill-labs/windmill/issues/11595)) ([0e7d974](https://github.com/windmill-labs/windmill/commit/0e7d974ce9b468353ecb6618dace710704690687))
+
+
+### Performance Improvements
+
+* load public raw apps without the loading screen ([#11608](https://github.com/windmill-labs/windmill/issues/11608)) ([c09764f](https://github.com/windmill-labs/windmill/commit/c09764fa6516badddbdbb520af32e5d1541cf996))
+
+## [1.827.0](https://github.com/windmill-labs/windmill/compare/v1.826.0...v1.827.0) (2026-10-07)
+
+
+### Features
+
+* audit instance settings writes, stable audit OTel target ([#11593](https://github.com/windmill-labs/windmill/issues/11593)) ([0792332](https://github.com/windmill-labs/windmill/commit/0792332859a88b1359ea1be64250d38dd071a0a9))
+* default new raw apps to react 19 and ask for the data setup ([#11586](https://github.com/windmill-labs/windmill/issues/11586)) ([818ddd5](https://github.com/windmill-labs/windmill/commit/818ddd5d31bd81507e274dd18022c1cdbd9be842))
+* export queue delay as OTel and Prometheus metrics ([#11588](https://github.com/windmill-labs/windmill/issues/11588)) ([7565349](https://github.com/windmill-labs/windmill/commit/75653496e542550039cbe5c413d8fcb9d395cea8))
+* pause a worker group without stopping its workers ([#11596](https://github.com/windmill-labs/windmill/issues/11596)) ([95c4b30](https://github.com/windmill-labs/windmill/commit/95c4b3096cf10c1fe59de7a1a6876dfb5f02c39f))
+* run AI decision steps on OpenAI's Decisions API ([#11590](https://github.com/windmill-labs/windmill/issues/11590)) ([046df9e](https://github.com/windmill-labs/windmill/commit/046df9e44db2f2fae3059ccd7a3d6c6955ee8971))
+
+
+### Bug Fixes
+
+* avoid URLSearchParams.keys() so the frontend check passes ([#11599](https://github.com/windmill-labs/windmill/issues/11599)) ([fc6c84c](https://github.com/windmill-labs/windmill/commit/fc6c84c6974bba1850e90a088fad5460c8c93ba3))
+* let recover: true from the error handler turn nested failures green ([#11559](https://github.com/windmill-labs/windmill/issues/11559)) ([03e484e](https://github.com/windmill-labs/windmill/commit/03e484e59757c0d4d6f74511d9aa5a1e2f94af67))
+* run dependency resolution and build steps under nsjail ([#11609](https://github.com/windmill-labs/windmill/issues/11609)) ([a238d01](https://github.com/windmill-labs/windmill/commit/a238d01ef6a8c285aef6886c974904f24339f7a2))
+* scope the python wheel cache to workspaces with their own registry ([#11597](https://github.com/windmill-labs/windmill/issues/11597)) ([14381ce](https://github.com/windmill-labs/windmill/commit/14381cefee6fb2b0ece52fbf0001c2ce61bde1a1))
+* type snowflake columns in database manager insert and alter forms ([#11578](https://github.com/windmill-labs/windmill/issues/11578)) ([f2fb156](https://github.com/windmill-labs/windmill/commit/f2fb15603b2e0d11bd5d04dd675212a5e4a7b9d7))
+
+## [1.826.0](https://github.com/windmill-labs/windmill/compare/v1.825.0...v1.826.0) (2026-10-07)
+
+
+### Features
+
+* count OIDC signatures and reuse server-side tokens ([#11556](https://github.com/windmill-labs/windmill/issues/11556)) ([e277735](https://github.com/windmill-labs/windmill/commit/e277735788c260239a063063459776ec01f7d907))
+* isolate the raw-app editor preview when the app opts into sandboxing ([#11572](https://github.com/windmill-labs/windmill/issues/11572)) ([fa25397](https://github.com/windmill-labs/windmill/commit/fa253976e213c1053d1832c1d1fb7bedf7ce8c45))
+* job_token_scopes OIDC claim ([#11551](https://github.com/windmill-labs/windmill/issues/11551)) ([d493eff](https://github.com/windmill-labs/windmill/commit/d493eff237f96a353fb6f5715a15bcad61d24433))
+* set up a new app in one modal over its AI session, fix its deploy ([#11582](https://github.com/windmill-labs/windmill/issues/11582)) ([7190185](https://github.com/windmill-labs/windmill/commit/71901852fb3cc40515d6675a0a88cd158e942d56))
+
+
+### Bug Fixes
+
+* export getWorkspace and other client helpers as named exports ([#11581](https://github.com/windmill-labs/windmill/issues/11581)) ([bf201be](https://github.com/windmill-labs/windmill/commit/bf201be11e95f0fc3e12353531f25bb3ceb0f8f3))
+* give the dbt workspace settings page a header like its siblings ([#11576](https://github.com/windmill-labs/windmill/issues/11576)) ([38aa4ea](https://github.com/windmill-labs/windmill/commit/38aa4eaa1200db52e67a18ef9a7c5dc4d60a4948))
+* ignore schedule missed-run counters in workspace compare ([#11570](https://github.com/windmill-labs/windmill/issues/11570)) ([eab3dd5](https://github.com/windmill-labs/windmill/commit/eab3dd5a52bc8faf57bb84c85bd74eb20ebd8ec7))
+* keep chat tool cards collapsed the way the user left them ([#11575](https://github.com/windmill-labs/windmill/issues/11575)) ([c71ecad](https://github.com/windmill-labs/windmill/commit/c71ecad6f9cf3727a305b5f9038dcbe6a54398b8))
+* keep run status buttons from selecting the flow input node ([#11579](https://github.com/windmill-labs/windmill/issues/11579)) ([8661797](https://github.com/windmill-labs/windmill/commit/866179730a9798346d3950f27dd625c3358e690a))
+* make every trigger and schedule editor control respect read-only mode ([#11569](https://github.com/windmill-labs/windmill/issues/11569)) ([52a99c3](https://github.com/windmill-labs/windmill/commit/52a99c3047e1add477e36919b15a745f7d2604a0))
+* strip NUL from ai agent output and job args before jsonb writes ([#11568](https://github.com/windmill-labs/windmill/issues/11568)) ([cf4bec6](https://github.com/windmill-labs/windmill/commit/cf4bec611f6df8a45b238afe5b8da3e3a5748bf9))
+
+## [1.825.0](https://github.com/windmill-labs/windmill/compare/v1.824.1...v1.825.0) (2026-10-06)
+
+
+### Features
+
+* choose build with AI or code when creating a raw app ([#11560](https://github.com/windmill-labs/windmill/issues/11560)) ([431f861](https://github.com/windmill-labs/windmill/commit/431f86138815fce432e282e8ac495953c5ecf98a))
+* confine jobs:read to the runnable paths it names ([#11550](https://github.com/windmill-labs/windmill/issues/11550)) ([b371af3](https://github.com/windmill-labs/windmill/commit/b371af31c96e6890fe9223233d2c6e53ddea67d4))
+* open a run as a pushed page on the narrow runs page ([#11541](https://github.com/windmill-labs/windmill/issues/11541)) ([fd8de45](https://github.com/windmill-labs/windmill/commit/fd8de45cc7cfcba2c374dd86f87f4d3e8aec6ded))
+* say a canceled team plan is canceled, not past due ([#11539](https://github.com/windmill-labs/windmill/issues/11539)) ([18e44d3](https://github.com/windmill-labs/windmill/commit/18e44d31742b8d16852b8c6ae663979666e064d7))
+
+
+### Bug Fixes
+
+* group raw app edits that carry a file diff in the ai chat ([#11558](https://github.com/windmill-labs/windmill/issues/11558)) ([5912d30](https://github.com/windmill-labs/windmill/commit/5912d300a550a33674fd73740d613d1b434fbba1))
+* honor custom timeout in setup phases and name the limit hit ([#11557](https://github.com/windmill-labs/windmill/issues/11557)) ([4fd4f76](https://github.com/windmill-labs/windmill/commit/4fd4f76d0df740cb3eebed1a0625b970484807fc))
+* search slow runs filters by time windows instead of timing out ([#11549](https://github.com/windmill-labs/windmill/issues/11549)) ([2bf9cfc](https://github.com/windmill-labs/windmill/commit/2bf9cfcd59e1101695160524c31a4da1a41699dc))
+* serve the raw-app preview shell sandboxed, load a blob copy in the editor ([#11554](https://github.com/windmill-labs/windmill/issues/11554)) ([5f92daa](https://github.com/windmill-labs/windmill/commit/5f92daab6d0ecac30dd384e1b0f302af13fdd9ab))
+* simplify the run page AI card to a prompt and a chat button ([#11561](https://github.com/windmill-labs/windmill/issues/11561)) ([8c74f75](https://github.com/windmill-labs/windmill/commit/8c74f75de3fa62b07186ca4f56dae4a7e4758034))
+
+## [1.824.1](https://github.com/windmill-labs/windmill/compare/v1.824.0...v1.824.1) (2026-10-05)
+
+
+### Bug Fixes
+
+* keep monaco's diff engine out of the app shell bundle ([#11542](https://github.com/windmill-labs/windmill/issues/11542)) ([0908dee](https://github.com/windmill-labs/windmill/commit/0908dee897e0f87b97418a23ede3662d96270340))
+
+## [1.824.0](https://github.com/windmill-labs/windmill/compare/v1.823.1...v1.824.0) (2026-10-05)
+
+
+### Features
+
+* add an AI decision flow step (TypeSafe's Jev, Cloudflare's Clef) ([#11474](https://github.com/windmill-labs/windmill/issues/11474)) ([3cba8a7](https://github.com/windmill-labs/windmill/commit/3cba8a7e4cca3ef20ba73a7dad79d892bdc9fed8))
+* add notion oauth provider ([#11528](https://github.com/windmill-labs/windmill/issues/11528)) ([8b2dc1e](https://github.com/windmill-labs/windmill/commit/8b2dc1e46c7f4e3859263f18b686ce6f3ce6fd30))
+* **ai-chat:** show per-file diffs for raw app edits ([#11521](https://github.com/windmill-labs/windmill/issues/11521)) ([ec0883a](https://github.com/windmill-labs/windmill/commit/ec0883a627b06b6ba2a393d5cf66ddf6ebc4cd0d))
+* bill team-plan service accounts as half a seat ([#11298](https://github.com/windmill-labs/windmill/issues/11298)) ([3aee181](https://github.com/windmill-labs/windmill/commit/3aee1815746f0116f5662f162ad1e234717af90d))
+* card layout and load-more for the audit logs page ([#11507](https://github.com/windmill-labs/windmill/issues/11507)) ([af1a29a](https://github.com/windmill-labs/windmill/commit/af1a29a3cb33386f61a759ec0dd5eec0ccefefc2))
+* offer audit-log and drive-metadata scopes for google oauth connects ([#11527](https://github.com/windmill-labs/windmill/issues/11527)) ([c4e7c71](https://github.com/windmill-labs/windmill/commit/c4e7c714e455f958d9a927c4bc4eb23256324780))
+* offer slack read scopes for files, user groups, emoji and dms ([#11526](https://github.com/windmill-labs/windmill/issues/11526)) ([b5fda7d](https://github.com/windmill-labs/windmill/commit/b5fda7d5af7105fde69beb68410984350af2ac7e))
+
+
+### Bug Fixes
+
+* bound s3 ai attachment downloads before encoding ([#11534](https://github.com/windmill-labs/windmill/issues/11534)) ([92fbfc0](https://github.com/windmill-labs/windmill/commit/92fbfc03d219544c16e8f7db47a547f9ff402c27))
+* collapse queued and running chat tool calls into a waiting row ([#11523](https://github.com/windmill-labs/windmill/issues/11523)) ([4f30982](https://github.com/windmill-labs/windmill/commit/4f30982ce3f7abc64a31890f8e88c31c1c2e0803))
+* disable postgres triggers whose replication slot was invalidated ([#11536](https://github.com/windmill-labs/windmill/issues/11536)) ([85248ee](https://github.com/windmill-labs/windmill/commit/85248eee786b633def40c42b6007fc7b907fb09e))
+* evaluate field conditions and step test inputs in QuickJS ([#11487](https://github.com/windmill-labs/windmill/issues/11487)) ([c962d37](https://github.com/windmill-labs/windmill/commit/c962d3766b1a250ba960e413556890d5919ebc94))
+* flush proxied responses before the dev supervisor closes the client ([#11530](https://github.com/windmill-labs/windmill/issues/11530)) ([cefb195](https://github.com/windmill-labs/windmill/commit/cefb1953764e714d79556e2f8065cfbec78acb86))
+* label the default slack scopes and list them first in the connect dialog ([#11529](https://github.com/windmill-labs/windmill/issues/11529)) ([e76781c](https://github.com/windmill-labs/windmill/commit/e76781cc2709fda08403e14c1a0a01957e430db1))
+* run each ai eval model in its own job and let the docs tools reach the backend ([#11533](https://github.com/windmill-labs/windmill/issues/11533)) ([222dad1](https://github.com/windmill-labs/windmill/commit/222dad1d8cc9cbb6925fdff709e00a49bb63bc4a))
+* show the flow row edit button to builder operators ([#11535](https://github.com/windmill-labs/windmill/issues/11535)) ([6c4e34c](https://github.com/windmill-labs/windmill/commit/6c4e34cd0dd9b4329084214c40695f5915947cc2))
+
+## [1.823.1](https://github.com/windmill-labs/windmill/compare/v1.823.0...v1.823.1) (2026-10-05)
+
+
+### Bug Fixes
+
+* python results with a KeyError-raising __getattr__ fail the job ([#11517](https://github.com/windmill-labs/windmill/issues/11517)) ([3fff1bd](https://github.com/windmill-labs/windmill/commit/3fff1bd3dcedce22c58d988ad2e725e3d4e96e0e))
+* stream the ai chat compaction request ([#11514](https://github.com/windmill-labs/windmill/issues/11514)) ([289d3c3](https://github.com/windmill-labs/windmill/commit/289d3c3941c2d9997bf0476bf9bfdfd948542c55))
+
+## [1.823.0](https://github.com/windmill-labs/windmill/compare/v1.822.0...v1.823.0) (2026-10-04)
+
+
+### Features
+
+* redesign the service logs page ([#11506](https://github.com/windmill-labs/windmill/issues/11506)) ([0f65df2](https://github.com/windmill-labs/windmill/commit/0f65df24d2cabd9d8daa71c103969e6392e37b4f))
+
+
+### Bug Fixes
+
+* apply the pg keepalive settings to the postgres trigger connection ([#11512](https://github.com/windmill-labs/windmill/issues/11512)) ([33f6de0](https://github.com/windmill-labs/windmill/commit/33f6de0cd20f45ff56770f946a4731e5b13bf677))
+* bound the datatable migration lock wait and reap a dead holder ([#11510](https://github.com/windmill-labs/windmill/issues/11510)) ([711e08c](https://github.com/windmill-labs/windmill/commit/711e08c1d20a326142235c83d8805b7990bf6e6d))
+* bound the pg cached-connection reset probe so a vanished server fails fast ([#11505](https://github.com/windmill-labs/windmill/issues/11505)) ([d4a423f](https://github.com/windmill-labs/windmill/commit/d4a423f567e1fb5e21016a2be61d858ab61a4d4f))
+* cancel an abandoned pg query and close failed connections cleanly ([#11511](https://github.com/windmill-labs/windmill/issues/11511)) ([26856b8](https://github.com/windmill-labs/windmill/commit/26856b8061c28eade191c7d85a32b74ca44c4fea))
+* delete a flow chat turn with its flow run, not its step jobs ([#11477](https://github.com/windmill-labs/windmill/issues/11477)) ([35ec16d](https://github.com/windmill-labs/windmill/commit/35ec16d12728531ab90632116913e98f80d1cc05))
+* drop a fork's datatable database despite connected sessions ([#11509](https://github.com/windmill-labs/windmill/issues/11509)) ([fa419af](https://github.com/windmill-labs/windmill/commit/fa419af9b3f7d65a607bb8ea2bcea58223f743c4))
+
+## [1.822.0](https://github.com/windmill-labs/windmill/compare/v1.821.0...v1.822.0) (2026-10-03)
+
+
+### Features
+
+* add a cancel-only jobs:cancel token scope, optionally path-scoped ([#11479](https://github.com/windmill-labs/windmill/issues/11479)) ([4bc7e0d](https://github.com/windmill-labs/windmill/commit/4bc7e0d7bad22e9e1a3532ca747ed863f90213ba))
+* add an instance setting routing all dependency jobs to one tag ([#11486](https://github.com/windmill-labs/windmill/issues/11486)) ([3d1d249](https://github.com/windmill-labs/windmill/commit/3d1d2495567274b4c48babb374e7716c4ed24ecc))
+* add trigger, tag, run-as and digest claims to job OIDC tokens ([#11481](https://github.com/windmill-labs/windmill/issues/11481)) ([4beb1f9](https://github.com/windmill-labs/windmill/commit/4beb1f9420524425c354e82729e4e35c5bf65451))
+* log pg job progress, warn on stalls, detect dead db connections ([#11491](https://github.com/windmill-labs/windmill/issues/11491)) ([d722772](https://github.com/windmill-labs/windmill/commit/d7227726be2b082bbfb204abb75a3ff081db77de))
+* read the OIDC signing key from a file and rotate it ([#11482](https://github.com/windmill-labs/windmill/issues/11482)) ([d949484](https://github.com/windmill-labs/windmill/commit/d949484e7ba9911cf128387e096f78c917fb3f35))
+* replace the AI input filling toggle with an additional prompt ([#11501](https://github.com/windmill-labs/windmill/issues/11501)) ([e952298](https://github.com/windmill-labs/windmill/commit/e952298f84d04cbb11f0c44c32435f0b711bf3bf))
+* restricted job tokens per script and flow ([#11484](https://github.com/windmill-labs/windmill/issues/11484)) ([e7fc1b2](https://github.com/windmill-labs/windmill/commit/e7fc1b2e2e9b358b414d0ca0eaf2753e142dded7))
+
+
+### Bug Fixes
+
+* keep a resource default set in the schema when the script is redeployed ([#11495](https://github.com/windmill-labs/windmill/issues/11495)) ([68f8f19](https://github.com/windmill-labs/windmill/commit/68f8f19b33768451ebab267b36f931a6f386c678))
+* let instances withhold signing secrets from the settings API ([#11483](https://github.com/windmill-labs/windmill/issues/11483)) ([99e96d3](https://github.com/windmill-labs/windmill/commit/99e96d3f781decda8fed2cbd5409cbc5c3520eaa))
+* let legacy draft-only items be discarded from the home page ([#11488](https://github.com/windmill-labs/windmill/issues/11488)) ([98274a7](https://github.com/windmill-labs/windmill/commit/98274a73361618ff37a929584e5b5f519b71a912))
+* never reuse a pg connection a script left inside a transaction ([#11497](https://github.com/windmill-labs/windmill/issues/11497)) ([b7f74cd](https://github.com/windmill-labs/windmill/commit/b7f74cd56294cdb7052e311c5a68de9ee0bb4122))
+* read inet and cidr results with their prefix, including arrays ([#11476](https://github.com/windmill-labs/windmill/issues/11476)) ([ae093b7](https://github.com/windmill-labs/windmill/commit/ae093b7666cefc3777be0e45144bb272732846d0))
+* stop the pg executor cache from pinning a pooler slot ([#11490](https://github.com/windmill-labs/windmill/issues/11490)) ([eed7e7d](https://github.com/windmill-labs/windmill/commit/eed7e7d9e6bb375daebbb323b1288c36a278f977))
+* unstick postgres jobs on large results with custom-typed columns ([#11475](https://github.com/windmill-labs/windmill/issues/11475)) ([14801fd](https://github.com/windmill-labs/windmill/commit/14801fdd68407add824bfa2c679c0e8cb4788610))
+
+
+### Performance Improvements
+
+* keep a pg executor connection per database ([#11492](https://github.com/windmill-labs/windmill/issues/11492)) ([013b302](https://github.com/windmill-labs/windmill/commit/013b302d484b967443cbf747fb9f2ecbb1145033))
+
 ## [1.821.0](https://github.com/windmill-labs/windmill/compare/v1.820.0...v1.821.0) (2026-10-01)
 
 
diff --git a/Dockerfile b/Dockerfile
index 8d229dba56..c6a4ccc55f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,7 +83,6 @@ COPY /python-client/docs/ /frontend/static/pydocs/
 
 RUN npm run generate-backend-client
 ENV NODE_OPTIONS "--max-old-space-size=8192"
-ARG VITE_BASE_URL ""
 # Must be declared for the build-arg to reach the bundle. See frontend/svelte.config.js.
 ARG WM_BUILD_VERSION=""
 # Read more about macro in docker/dev.nu
@@ -142,10 +141,10 @@ FROM ${DEBIAN_IMAGE}
 
 ARG TARGETPLATFORM
 ARG POWERSHELL_VERSION=7.5.0
-ARG KUBECTL_VERSION=1.36.2
+ARG KUBECTL_VERSION=1.37.1
 ARG HELM_VERSION=3.21.4
 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.27.1
 ARG APP=/usr/src/app
 ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
@@ -242,7 +241,7 @@ ENV PATH="${PATH}:/usr/local/go/bin"
 ENV GO_PATH=/usr/local/go/bin/go
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtimes to temp build location (will copy with world-writable perms later)
 # --compile-bytecode precompiles the stdlib to .pyc so jobs don't recompile it on every run
@@ -287,8 +286,6 @@ COPY --from=builder /frontend/build /static_frontend
 COPY --from=builder /windmill/target/release/windmill ${APP}/windmill
 COPY --from=windmill_duckdb_ffi_internal_builder /windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so ${APP}/libwindmill_duckdb_ffi_internal.so
 
-COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno
-
 COPY --from=oven/bun:1.4.0 /usr/local/bin/bun /usr/bin/bun
 
 # Install windmill CLI
diff --git a/README.md b/README.md
index 87fc66f399..e9ed6381f1 100644
--- a/README.md
+++ b/README.md
@@ -150,7 +150,7 @@ You can run scripts locally by passing the right environment variables for the `
 - **Frontend**: Svelte 5
 - **Sandboxing**: [nsjail](https://github.com/google/nsjail) and PID namespace isolation
 - **Runtimes**:
-  - TypeScript/JavaScript: Bun (default) and Deno
+  - TypeScript/JavaScript: Bun (default); Deno only on the `windmill-full` images
   - Python: python3 with uv for dependency management
   - Go, Bash, PowerShell, PHP, Rust, C#, Java, Ansible
 
@@ -318,7 +318,7 @@ running options.
    This will also avoid compile time issue with sqlx's `query!` macro.
 2. (optional, linux only) Install [nsjail](https://github.com/google/nsjail) and have it accessible in
    your PATH
-3. Install bun, deno and python3 (+ any languages you want to use), have the bins at `/usr/bin/bun`,`/usr/bin/deno`, and
+3. Install bun and python3 (+ any languages you want to use), have the bins at `/usr/bin/bun` and
    `/usr/local/bin/python3` or set the corresponding environment variables.
 4. (optional) Install the [lld linker](https://lld.llvm.org/)
 5. Go to `frontend/`:
diff --git a/ai_evals/README.md b/ai_evals/README.md
index bff4294e52..44870ba2a2 100644
--- a/ai_evals/README.md
+++ b/ai_evals/README.md
@@ -89,7 +89,21 @@ Notes:
 
 - the command also prints accepted alias spellings such as `gpt-4o`, `gpt-55`, `claude-opus-4.6`, and `claude-haiku-4.5`
 - frontend modes (`flow`, `script`, `app`, `global`) can use Anthropic, OpenAI, Gemini, and DeepSeek-backed aliases
-- `cli` mode always uses the Anthropic agent SDK, so only Anthropic aliases are valid there
+- `cli` mode runs a coding agent over the workspace, chosen by the alias's `cli` entry; aliases without one are rejected there:
+
+  | Agent | Models | Label | Needs |
+  | --- | --- | --- | --- |
+  | Claude Code (`@anthropic-ai/claude-agent-sdk`) | Claude aliases | `anthropic:<model>` | `ANTHROPIC_API_KEY` |
+  | Claude Code on DeepSeek's Anthropic-compatible endpoint | `deepseek-v4-pro` | `claude-code:<model>` | `DEEPSEEK_API_KEY` |
+  | Codex (`codex exec --json`) | `gpt-6.1-sol`, `gpt-6-astra` | `codex:<model>` | `codex` on `PATH` (CI pins 0.159.3), `OPENAI_API_KEY` |
+
+  Codex runs with a throwaway `HOME`, so your own `~/.codex` config and skills stay out of the run. It has no
+  Skill tool: it finds `.agents/skills` on its own and loads a skill by reading its `SKILL.md`, so the trace
+  records any command that touches `.agents/skills/<name>/SKILL.md` as a `Skill` call to `<name>`, just
+  before that command, or just after it when the command mutates something before reading the skill. Its shell commands are recorded as `Bash` and its patches as `Edit`, so the
+  `invokes skill … before first mutation` checks compare the same things for both agents. Codex has no
+  turn cap; a run stops at `maxTurns` rounds of tool calls (parallel calls count once) and fails, as a
+  Claude Code run does at its cap.
 - the judge model is separate and currently defaults to `claude-sonnet-5-5`; use `--skip-judge` for deterministic-only runs
 
 ## Case Format
@@ -164,6 +178,12 @@ the decrypted value, exactly as against a real backend. The chat's read path pas
 Seed a recognizable secret (the existing fixture uses `sk_live_do_not_leak_me`) and
 assert it via `valueExcludes` to catch a leak.
 
+`runtime.userAnswers` scripts the user's side of `askUserQuestion` in a global case: one
+answer per question, in the order they are asked, and a question past the last answer is
+dismissed, so `userAnswers: []` dismisses every question. Without it the tool reports that
+it cannot ask, and the model usually carries on with its own guess, which makes "asks
+before creating anything" impossible to assert.
+
 `toolExpect.toolCallArgs` entries support `sharedByAtLeast: <n>`: at least `n` recorded
 calls to that tool must carry the same non-blank string in the field. Use it for calls that
 have to share an identifier, like two test runs of one chat conversation.
diff --git a/ai_evals/adapters/cli/codex.test.ts b/ai_evals/adapters/cli/codex.test.ts
new file mode 100644
index 0000000000..fdeda1d26b
--- /dev/null
+++ b/ai_evals/adapters/cli/codex.test.ts
@@ -0,0 +1,71 @@
+import { describe, expect, it } from "bun:test";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { runCodex, toToolInvocations, unwrapShellCommand } from "./codex";
+
+describe("unwrapShellCommand", () => {
+  it("strips the login-shell wrapper Codex reports", () => {
+    expect(unwrapShellCommand(`/usr/bin/zsh -lc 'cat .agents/skills/x/SKILL.md'`)).toBe(
+      "cat .agents/skills/x/SKILL.md"
+    );
+    expect(unwrapShellCommand(`/bin/bash -lc "printf 'hi' > \\"a b\\""`)).toBe(
+      `printf 'hi' > "a b"`
+    );
+    expect(unwrapShellCommand(`/bin/bash -lc 'echo '\\''x'\\'''`)).toBe(`echo 'x'`);
+    expect(unwrapShellCommand(`bash -lc 'wmill sync push'`)).toBe("wmill sync push");
+    expect(unwrapShellCommand(`/bin/bash -lc 'rg -g '"'"'!x'"'"' f'`)).toBe(`rg -g '!x' f`);
+  });
+});
+
+describe("toToolInvocations", () => {
+  it("records reading a SKILL.md as a Skill call before the command", () => {
+    const tools = toToolInvocations({
+      type: "command_execution",
+      command: `/bin/bash -lc 'sed -n 1,200p .agents/skills/write-script-bun/SKILL.md && mkdir f'`,
+    });
+    expect(tools.map((tool) => [tool.tool, tool.input])).toEqual([
+      ["Skill", { skill: "write-script-bun" }],
+      ["Bash", { command: "sed -n 1,200p .agents/skills/write-script-bun/SKILL.md && mkdir f" }],
+    ]);
+  });
+
+  it("records a skill read after a mutation earlier in the same command", () => {
+    const tools = toToolInvocations({
+      type: "command_execution",
+      command: `/bin/bash -lc 'printf main > f/a.ts && cat .agents/skills/write-script-bun/SKILL.md'`,
+    });
+    expect(tools.map((tool) => tool.tool)).toEqual(["Bash", "Skill"]);
+  });
+
+  it("maps a patch to Edit so it counts as a mutation", () => {
+    expect(
+      toToolInvocations({ type: "file_change", changes: [{ path: "a.ts", kind: "add" }] })[0]
+    ).toMatchObject({ tool: "Edit", input: { changes: [{ path: "a.ts", kind: "add" }] } });
+  });
+});
+
+describe("runCodex", () => {
+  it("keeps parallel tool calls in the order they started", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "fake-codex-"));
+    const events = [
+      { type: "item.started", item: { id: "a", type: "command_execution", command: "mkdir f" } },
+      { type: "item.started", item: { id: "b", type: "command_execution", command: "cat .agents/skills/s/SKILL.md" } },
+      { type: "item.completed", item: { id: "b", type: "command_execution", command: "cat .agents/skills/s/SKILL.md" } },
+      { type: "item.completed", item: { id: "a", type: "command_execution", command: "mkdir f" } },
+      { type: "item.completed", item: { id: "c", type: "agent_message", text: "done" } },
+      { type: "turn.completed", usage: { input_tokens: 10, output_tokens: 2 } },
+    ];
+    const lines = events.map((event) => `printf '%s\\n' '${JSON.stringify(event)}'`).join("\n");
+    await writeFile(join(dir, "codex"), `#!/bin/sh\ncat > /dev/null\n${lines}\n`);
+    await chmod(join(dir, "codex"), 0o755);
+    try {
+      const result = await runCodex("p", dir, 12, "m", { PATH: `${dir}:${process.env.PATH}` });
+      expect(result.toolsUsed.map((tool) => tool.tool)).toEqual(["Bash", "Skill", "Bash"]);
+      expect(result.output).toBe("done");
+      expect(result.tokenUsage).toEqual({ prompt: 10, completion: 2, total: 12 });
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/ai_evals/adapters/cli/codex.ts b/ai_evals/adapters/cli/codex.ts
new file mode 100644
index 0000000000..b49c441556
--- /dev/null
+++ b/ai_evals/adapters/cli/codex.ts
@@ -0,0 +1,241 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import type { BenchmarkTokenUsage, CliToolInvocation } from "../../core/types";
+import { isLikelyMutatingBashCommand } from "./mutation";
+
+export interface AgentRunResult {
+  output: string;
+  toolsUsed: CliToolInvocation[];
+  assistantMessageCount: number;
+  tokenUsage: BenchmarkTokenUsage | null;
+  finalContextTokens: number | null;
+}
+
+interface CodexItem {
+  type?: string;
+  text?: string;
+  command?: string;
+  changes?: { path?: string; kind?: string }[];
+  [key: string]: unknown;
+}
+
+interface CodexEvent {
+  type?: string;
+  item?: CodexItem;
+  usage?: { input_tokens?: number; output_tokens?: number };
+  message?: string;
+  error?: { message?: string };
+}
+
+const SKILL_FILE_PATTERN = /\.agents\/skills\/([^/\s'"`*?[]+)\/SKILL\.md/g;
+
+// Drives `codex exec` and maps its events onto the Claude Code tool vocabulary
+// the validators read: shell commands become `Bash`, patches `Edit`, and
+// reading `.agents/skills/<name>/SKILL.md` (how Codex loads a skill) becomes a
+// `Skill` call recorded just before that command.
+export async function runCodex(
+  prompt: string,
+  cwd: string,
+  maxTurns: number,
+  model: string,
+  env: Record<string, string>
+): Promise<AgentRunResult> {
+  // A fresh HOME keeps the user's ~/.codex config and ~/.agents/skills out of the run.
+  const home = await mkdtemp(join(tmpdir(), "wmill-cli-benchmark-codex-home-"));
+  const result: AgentRunResult = {
+    output: "",
+    toolsUsed: [],
+    assistantMessageCount: 0,
+    tokenUsage: null,
+    finalContextTokens: null,
+  };
+  const messages: string[] = [];
+  let failure: string | null = null;
+  let lastError: string | null = null;
+  let stderr = "";
+
+  try {
+    const child = spawn(
+      "codex",
+      [
+        "exec",
+        "--json",
+        "--ephemeral",
+        "--skip-git-repo-check",
+        "--dangerously-bypass-approvals-and-sandbox",
+        "--model",
+        model,
+        "--cd",
+        cwd,
+        "-",
+      ],
+      {
+        cwd,
+        env: {
+          ...env,
+          HOME: home,
+          CODEX_HOME: home,
+          CODEX_API_KEY: env.OPENAI_API_KEY ?? "",
+        },
+        stdio: ["pipe", "pipe", "pipe"],
+      }
+    );
+    // Without this, a missing `codex` binary leaves the stdout loop waiting forever.
+    await new Promise<void>((resolve, reject) => {
+      child.once("spawn", resolve);
+      child.once("error", reject);
+    });
+    child.stdin.on("error", () => {});
+    child.stdin.end(prompt);
+    child.stderr.on("data", (chunk) => {
+      stderr = (stderr + chunk).slice(-4000);
+    });
+    const exited = new Promise<number | null>((resolve, reject) => {
+      child.on("error", reject);
+      child.on("close", resolve);
+    });
+
+    // Codex has no turn cap. A turn starts when the agent issues tool calls with
+    // none in flight, so parallel calls count once, as they do for Claude Code.
+    // Claude Code's cap includes the final reply, so the maxTurns-th tool round is
+    // already over it.
+    // ponytail: parallel calls that finish before the next one starts count as
+    // separate turns; count model calls if Codex ever reports them.
+    let turns = 0;
+    let inFlight = 0;
+    let capped = false;
+    // Parallel calls complete out of order; the trace keeps the order they started in.
+    const slots = new Map<string, number>();
+    const ordered: CliToolInvocation[][] = [];
+    const slotFor = (item: CodexItem) => {
+      const id = typeof item.id === "string" ? item.id : undefined;
+      if (id !== undefined && slots.has(id)) {
+        return slots.get(id)!;
+      }
+      ordered.push([]);
+      if (id !== undefined) {
+        slots.set(id, ordered.length - 1);
+      }
+      return ordered.length - 1;
+    };
+
+    for await (const line of createInterface({ input: child.stdout })) {
+      const event = parseEvent(line);
+      if (!event) {
+        continue;
+      }
+      const item = event.item;
+
+      if (event.type === "item.started" && item && isToolItem(item)) {
+        if (inFlight === 0) {
+          turns += 1;
+        }
+        inFlight += 1;
+        slotFor(item);
+        if (turns >= maxTurns && !capped) {
+          capped = true;
+          child.kill("SIGTERM");
+        }
+      } else if (event.type === "item.completed" && item) {
+        if (item.type === "agent_message") {
+          result.assistantMessageCount += 1;
+          if (typeof item.text === "string") {
+            messages.push(item.text);
+          }
+        } else if (isToolItem(item)) {
+          inFlight = Math.max(0, inFlight - 1);
+          ordered[slotFor(item)] = toToolInvocations(item);
+        }
+      } else if (event.type === "turn.completed" && event.usage) {
+        const prompt = event.usage.input_tokens ?? 0;
+        const completion = event.usage.output_tokens ?? 0;
+        result.tokenUsage = { prompt, completion, total: prompt + completion };
+      } else if (event.type === "turn.failed") {
+        failure = event.error?.message ?? JSON.stringify(event);
+      } else if (event.type === "error") {
+        // Also sent for retries Codex recovers from ("Reconnecting... 1/5").
+        lastError = event.message ?? JSON.stringify(event);
+      }
+    }
+
+    result.toolsUsed = ordered.flat();
+    const code = await exited;
+    if (failure) {
+      throw new Error(`codex: ${failure}`);
+    }
+    // Fail the attempt, as Claude Code does at its cap.
+    if (capped) {
+      throw new Error(`codex: reached maximum number of turns (${maxTurns})`);
+    }
+    if (code !== 0) {
+      throw new Error(`codex exited with ${code}: ${lastError ?? stderr.trim()}`);
+    }
+  } finally {
+    await rm(home, { recursive: true, force: true });
+  }
+
+  result.output = messages.join("\n");
+  return result;
+}
+
+export function toToolInvocations(item: CodexItem): CliToolInvocation[] {
+  const timestamp = Date.now();
+
+  if (item.type === "command_execution" && typeof item.command === "string") {
+    const command = unwrapShellCommand(item.command);
+    // A skill read counts as preceding the command only when nothing before it in
+    // the command mutates; otherwise `printf x > f && cat SKILL.md` would pass a
+    // skill-before-first-mutation check.
+    const before: string[] = [];
+    const after: string[] = [];
+    for (const match of command.matchAll(SKILL_FILE_PATTERN)) {
+      const skill = match[1]!;
+      if (before.includes(skill) || after.includes(skill)) {
+        continue;
+      }
+      (isLikelyMutatingBashCommand(command.slice(0, match.index)) ? after : before).push(skill);
+    }
+    const skillCall = (skill: string) => ({ tool: "Skill", input: { skill }, timestamp });
+    return [
+      ...before.map(skillCall),
+      { tool: "Bash", input: { command }, timestamp },
+      ...after.map(skillCall),
+    ];
+  }
+
+  if (item.type === "file_change") {
+    return [{ tool: "Edit", input: { changes: item.changes ?? [] }, timestamp }];
+  }
+
+  const { id: _id, type, status: _status, ...input } = item;
+  return [{ tool: String(type), input, timestamp }];
+}
+
+// Codex reports commands as run through the user's login shell, e.g.
+// `/usr/bin/zsh -lc 'cat SKILL.md'`.
+export function unwrapShellCommand(command: string): string {
+  const match = command.match(/^(?:\S*\/)?(?:ba|z)?sh -l?c (['"])([\s\S]*)\1$/);
+  if (!match) {
+    return command;
+  }
+  const body = match[2]!;
+  return match[1] === "'"
+    ? body.replaceAll(`'\\''`, "'").replaceAll(`'"'"'`, "'")
+    : body.replace(/\\(["\\$`])/g, "$1");
+}
+
+function isToolItem(item: CodexItem): boolean {
+  return !["agent_message", "reasoning", "todo_list", "error"].includes(item.type ?? "");
+}
+
+function parseEvent(line: string): CodexEvent | null {
+  try {
+    const value = JSON.parse(line);
+    return value && typeof value === "object" ? (value as CodexEvent) : null;
+  } catch {
+    return null;
+  }
+}
diff --git a/ai_evals/adapters/cli/mutation.ts b/ai_evals/adapters/cli/mutation.ts
new file mode 100644
index 0000000000..05b29d68d7
--- /dev/null
+++ b/ai_evals/adapters/cli/mutation.ts
@@ -0,0 +1,10 @@
+export function isLikelyMutatingBashCommand(command: string): boolean {
+  return (
+    /\b(?:mkdir|touch|rm|mv|cp|install|tee)\b/.test(command) ||
+    /\b(?:cat|echo|printf)\b.*(?:>|>>|\|\s*tee\b)/.test(command) ||
+    /\bsed\s+-i\b/.test(command) ||
+    /\bperl\s+-pi\b/.test(command) ||
+    // In command position only: `cat AGENTS.wmill.md` is a read.
+    /(?:^|[;&|(]|\b(?:then|do|xargs)\s)\s*wmill(?:\s|$)/m.test(command)
+  );
+}
diff --git a/ai_evals/adapters/cli/runtime.test.ts b/ai_evals/adapters/cli/runtime.test.ts
index 3ea53ca587..d3e537b659 100644
--- a/ai_evals/adapters/cli/runtime.test.ts
+++ b/ai_evals/adapters/cli/runtime.test.ts
@@ -2,7 +2,9 @@ import { describe, expect, it } from "bun:test";
 import {
   anthropicUsageToBenchmarkTokenUsage,
   extractCliResultTokenUsage,
+  endpointEnv,
   extractProposedWmillCommands,
+  getFirstMutationToolIndex,
   parseWmillInvocationLog,
 } from "./runtime";
 
@@ -147,3 +149,32 @@ push
     ]);
   });
 });
+
+describe("getFirstMutationToolIndex", () => {
+  it("counts wmill only as a command, not in a file name", () => {
+    const bash = (command: string) => ({ tool: "Bash", input: { command }, timestamp: 0 });
+    expect(
+      getFirstMutationToolIndex([
+        bash("cat AGENTS.wmill.md .agents/skills/x/SKILL.md"),
+        bash("ls && wmill generate-metadata"),
+      ])
+    ).toBe(1);
+    expect(getFirstMutationToolIndex([bash("cd f\nwmill sync push")])).toBe(0);
+  });
+});
+
+describe("endpointEnv", () => {
+  it("passes the endpoint only its own key", () => {
+    const env = endpointEnv(
+      { baseUrl: "https://example.test", apiKeyEnv: "DEEPSEEK_API_KEY" },
+      "m",
+      { PATH: "/bin", DEEPSEEK_API_KEY: "ds", OPENAI_API_KEY: "oa", ANTHROPIC_AUTH_TOKEN: "t" }
+    );
+    expect(env).toEqual({
+      PATH: "/bin",
+      ANTHROPIC_BASE_URL: "https://example.test",
+      ANTHROPIC_API_KEY: "ds",
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: "m",
+    });
+  });
+});
diff --git a/ai_evals/adapters/cli/runtime.ts b/ai_evals/adapters/cli/runtime.ts
index b45df70011..e7368db366 100644
--- a/ai_evals/adapters/cli/runtime.ts
+++ b/ai_evals/adapters/cli/runtime.ts
@@ -2,7 +2,14 @@ import { query, type Options } from "@anthropic-ai/claude-agent-sdk";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { delimiter, join } from "path";
 import { fileURLToPath } from "url";
-import { getCliEvalModel, resolveEvalModel, type CliEvalModelConfig } from "../../core/models";
+import {
+  getCliEvalModel,
+  resolveEvalModel,
+  type CliEvalModelConfig,
+} from "../../core/models";
+import { runCodex, type AgentRunResult } from "./codex";
+import { isLikelyMutatingBashCommand } from "./mutation";
+export { formatCliRunModelLabel } from "../../core/models";
 import type {
   BenchmarkTokenUsage,
   CliToolInvocation,
@@ -141,16 +148,94 @@ export async function runPromptAndCapture(
   maxTurns: number = 3,
   modelConfig: CliEvalModelConfig = DEFAULT_CLI_EVAL_MODEL
 ): Promise<PromptRunResult> {
-  const toolsUsed: ToolInvocation[] = [];
-  const skillsInvoked: string[] = [];
-  const bashCommands: string[] = [];
-  let output = "";
-  let assistantMessageCount = 0;
-  let tokenUsage: BenchmarkTokenUsage | null = null;
-  let finalContextTokens: number | null = null;
   const startedAt = Date.now();
   const stubBinDir = join(cwd, WMILL_STUB_DIR_NAME);
   const wmillLogPath = join(cwd, WMILL_LOG_FILE_NAME);
+  const env = {
+    ...getQueryEnv(),
+    PATH: process.env.PATH ? `${stubBinDir}${delimiter}${process.env.PATH}` : stubBinDir,
+    WMILL_BENCHMARK_LOG_PATH: wmillLogPath,
+  };
+
+  await installWmillStub(stubBinDir);
+
+  const run =
+    modelConfig.runtime === "codex"
+      ? await runCodex(prompt, cwd, maxTurns, modelConfig.model, env)
+      : await runClaudeCode(prompt, cwd, maxTurns, modelConfig, env);
+
+  const skillsInvoked: string[] = [];
+  const bashCommands: string[] = [];
+  for (const tool of run.toolsUsed) {
+    if (tool.tool === "Skill" && typeof tool.input.skill === "string") {
+      pushUnique(skillsInvoked, tool.input.skill);
+    }
+    if (tool.tool === "Bash") {
+      for (const command of extractBashCommands(tool.input)) {
+        pushUnique(bashCommands, command);
+      }
+    }
+  }
+
+  const wmillInvocations = await readWmillInvocationLog(wmillLogPath);
+
+  return {
+    output: run.output,
+    durationMs: Date.now() - startedAt,
+    tokenUsage: run.tokenUsage,
+    finalContextTokens: run.finalContextTokens,
+    trace: {
+      toolsUsed: run.toolsUsed,
+      skillsInvoked,
+      assistantMessageCount: run.assistantMessageCount,
+      bashCommands,
+      proposedCommands: extractProposedWmillCommands(run.output),
+      executedWmillCommands: wmillInvocations.map(formatExecutedWmillCommand),
+      wmillInvocations,
+      firstMutationToolIndex: getFirstMutationToolIndex(run.toolsUsed),
+    },
+  };
+}
+
+// Only the endpoint's own key may reach it: a missing key would make Claude Code
+// fall back to the user's Claude login, and the agent's Bash inherits this env,
+// so any other credential could end up in a tool result sent to the endpoint.
+export function endpointEnv(
+  endpoint: NonNullable<CliEvalModelConfig["anthropicEndpoint"]>,
+  model: string,
+  env: Record<string, string>
+): Record<string, string> {
+  const key = env[endpoint.apiKeyEnv];
+  if (!key) {
+    throw new Error(`${endpoint.apiKeyEnv} is not set`);
+  }
+  const rest = Object.fromEntries(
+    Object.entries(env).filter(([name]) => !/KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL/i.test(name))
+  );
+  return {
+    ...rest,
+    ANTHROPIC_BASE_URL: endpoint.baseUrl,
+    ANTHROPIC_API_KEY: key,
+    // Claude Code's background calls default to Haiku, which the endpoint does not serve.
+    ANTHROPIC_DEFAULT_HAIKU_MODEL: model,
+  };
+}
+
+async function runClaudeCode(
+  prompt: string,
+  cwd: string,
+  maxTurns: number,
+  modelConfig: CliEvalModelConfig,
+  env: Record<string, string>
+): Promise<AgentRunResult> {
+  const result: AgentRunResult = {
+    output: "",
+    toolsUsed: [],
+    assistantMessageCount: 0,
+    tokenUsage: null,
+    finalContextTokens: null,
+  };
+  const endpoint = modelConfig.anthropicEndpoint;
 
   const options: Options = {
     cwd,
@@ -158,80 +243,42 @@ export async function runPromptAndCapture(
     maxTurns,
     settingSources: ["project"],
     allowedTools: ["Skill", "Read", "Glob", "Grep", "Bash", "Write", "Edit"],
-    env: {
-      ...getQueryEnv(),
-      PATH: process.env.PATH ? `${stubBinDir}${delimiter}${process.env.PATH}` : stubBinDir,
-      WMILL_BENCHMARK_LOG_PATH: wmillLogPath,
-    },
+    env: endpoint ? endpointEnv(endpoint, modelConfig.model, env) : env,
   };
 
-  await installWmillStub(stubBinDir);
-
   for await (const message of query({ prompt, options })) {
     if (message.type === "assistant") {
-      assistantMessageCount += 1;
+      result.assistantMessageCount += 1;
       const turnContext = anthropicUsageToBenchmarkTokenUsage(
         message.message?.usage
       )?.prompt;
       if (turnContext && turnContext > 0) {
-        finalContextTokens = turnContext;
+        result.finalContextTokens = turnContext;
       }
       const content = message.message?.content;
       if (Array.isArray(content)) {
         for (const block of content) {
           if (block.type === "tool_use") {
-            const input = normalizeToolInput(block.input);
-            toolsUsed.push({
+            result.toolsUsed.push({
               tool: block.name,
-              input,
+              input: normalizeToolInput(block.input),
               timestamp: Date.now()
             });
-
-            if (block.name === "Skill") {
-              const skillInput = input as { skill?: string };
-              if (skillInput.skill) {
-                pushUnique(skillsInvoked, skillInput.skill);
-              }
-            }
-
-            if (block.name === "Bash") {
-              for (const command of extractBashCommands(input)) {
-                pushUnique(bashCommands, command);
-              }
-            }
           } else if (block.type === "text") {
-            output += block.text;
+            result.output += block.text;
           }
         }
       }
     } else if (message.type === "result") {
       const resultMessage = message as { result?: string };
-      tokenUsage = extractCliResultTokenUsage(message) ?? tokenUsage;
+      result.tokenUsage = extractCliResultTokenUsage(message) ?? result.tokenUsage;
       if (typeof resultMessage.result === "string") {
-        output += resultMessage.result;
+        result.output += resultMessage.result;
       }
     }
   }
 
-  const proposedCommands = extractProposedWmillCommands(output);
-  const wmillInvocations = await readWmillInvocationLog(wmillLogPath);
-
-  return {
-    output,
-    durationMs: Date.now() - startedAt,
-    tokenUsage,
-    finalContextTokens,
-    trace: {
-      toolsUsed,
-      skillsInvoked,
-      assistantMessageCount,
-      bashCommands,
-      proposedCommands,
-      executedWmillCommands: wmillInvocations.map(formatExecutedWmillCommand),
-      wmillInvocations,
-      firstMutationToolIndex: getFirstMutationToolIndex(toolsUsed),
-    },
-  };
+  return result;
 }
 
 export function wasSkillInvoked(result: PromptRunResult, skillName: string): boolean {
@@ -242,10 +289,6 @@ export function wasToolUsed(result: PromptRunResult, toolName: string): boolean
   return result.trace.toolsUsed.some((tool) => tool.tool === toolName);
 }
 
-export function formatCliRunModelLabel(modelConfig: CliEvalModelConfig): string {
-  return `${modelConfig.provider}:${modelConfig.model}`;
-}
-
 export function getToolInputs(
   result: PromptRunResult,
   toolName: string
@@ -512,7 +555,7 @@ function formatExecutedWmillCommand(entry: CliWmillInvocation): string {
   return ["wmill", ...entry.argv].join(" ").trim();
 }
 
-function getFirstMutationToolIndex(toolsUsed: ToolInvocation[]): number | null {
+export function getFirstMutationToolIndex(toolsUsed: ToolInvocation[]): number | null {
   for (const [index, tool] of toolsUsed.entries()) {
     if (tool.tool === "Write" || tool.tool === "Edit") {
       return index;
@@ -526,16 +569,6 @@ function getFirstMutationToolIndex(toolsUsed: ToolInvocation[]): number | null {
   return null;
 }
 
-function isLikelyMutatingBashCommand(command: string): boolean {
-  return (
-    /\b(?:mkdir|touch|rm|mv|cp|install|tee)\b/.test(command) ||
-    /\b(?:cat|echo|printf)\b.*(?:>|>>|\|\s*tee\b)/.test(command) ||
-    /\bsed\s+-i\b/.test(command) ||
-    /\bperl\s+-pi\b/.test(command) ||
-    /\bwmill\b/.test(command)
-  );
-}
-
 function pushUnique(values: string[], value: string): void {
   if (!values.includes(value)) {
     values.push(value);
diff --git a/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts b/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
index be8c1d74cc..fe20d77d05 100644
--- a/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
@@ -123,6 +123,7 @@ export interface GlobalEvalOptions {
   planMode?: boolean;
   model?: string;
   maxIterations?: number;
+  userAnswers?: string[];
   provider?: AIProvider;
   backend: WindmillBackendSettings;
   workspaceRoot?: string;
@@ -220,6 +221,7 @@ export async function runGlobalEval(
       onToolCall: options.runContext?.onToolCall,
       options: {
         maxIterations: options.maxIterations,
+        userAnswers: options.userAnswers,
         model,
         workspace: workspaceRoot,
         provider: options.provider,
diff --git a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
index 3d0c6d6734..13aaa59806 100644
--- a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
@@ -85,6 +85,7 @@ export async function runEval<THelpers, TOutput>(
 
   const model = options.model ?? "gpt-4o";
   const maxIterations = options.maxIterations ?? 20;
+  const pendingAnswers = options.userAnswers && [...options.userAnswers];
   const workspace = options.workspace ?? "test-workspace";
   const provider = toFrontendEvalProvider(options.provider);
 
@@ -138,6 +139,12 @@ export async function runEval<THelpers, TOutput>(
     // edit the arguments, so a case can assert what the model proposed but never how
     // it reacts to the user changing something.
     requestRunArgs: async (_toolId, form) => form.args,
+    ...(pendingAnswers && {
+      requestUserQuestion: async () => {
+        const answer = pendingAnswers.shift();
+        return answer === undefined ? undefined : [answer];
+      },
+    }),
     onNewToken: (token: string) => {
       if (shouldEmitMessageStart) {
         onAssistantMessageStart?.();
diff --git a/ai_evals/adapters/frontend/core/shared/types.ts b/ai_evals/adapters/frontend/core/shared/types.ts
index c7af6c43e7..1ff783e258 100644
--- a/ai_evals/adapters/frontend/core/shared/types.ts
+++ b/ai_evals/adapters/frontend/core/shared/types.ts
@@ -16,6 +16,9 @@ export interface ToolCallDetail {
 export interface EvalRunnerOptions {
   backend: WindmillBackendSettings;
   maxIterations?: number;
+  // Scripted answers to the model's questions, one per question in order; a question past
+  // the last one is dismissed. Unset, the run cannot be asked anything.
+  userAnswers?: string[];
   model?: string;
   workspace?: string;
   provider?: AIProvider;
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index 9adb4d05ac..288c67e3eb 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -6,6 +6,8 @@ import { dirname, resolve } from 'path'
 // @ts-ignore - Node.js url
 import { fileURLToPath } from 'url'
 import { handleBenchmarkApiFetch, hasBenchmarkApiHandler } from './mockBackend'
+import { resolveWindmillBackendSettings } from '../../core/windmillBackendSettings'
+import { WindmillBackendClient } from './windmillBackend'
 
 const FRONTEND_DIR = fileURLToPath(new URL('../../../frontend/', import.meta.url))
 
@@ -28,6 +30,11 @@ globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
 	if (typeof url === 'string' && hasBenchmarkApiHandler(url)) {
 		return handleBenchmarkApiFetch(url, init)
 	}
+	// The docs tools read the documentation bundled into the backend: hand them to the
+	// benchmark's real backend, logged in like the AI proxy calls.
+	if (typeof url === 'string' && url.startsWith('/api/docs/')) {
+		return new WindmillBackendClient(resolveWindmillBackendSettings()).request(url.slice('/api'.length), init)
+	}
 	// The parsers behind inferArgs load their wasm from a vite `?url` path, which only a dev
 	// server serves. Unserved, every script schema infers as empty, and the tools then tell the
 	// model its arguments are undeclared, so it rewrites a correct script until it runs out of turns.
@@ -684,6 +691,7 @@ benchmarkIt(
 			resetBenchmarkMockBackend()
 		}
 	},
-	// Full-suite runs (30+ cases at concurrency 2-3) routinely exceed 10 minutes.
-	7_200_000
+	// A full suite on a slow reasoning model runs for hours (gpt-6-astra on global went past
+	// 2h); the CI job's own timeout is the real bound.
+	18_000_000
 )
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 476218a066..b66af3e8dd 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -198,22 +198,127 @@
     - uses the requested placeholder value and description
     - does not create a resource or deploy anything
 
+# A new app that has to store data, with nothing said about where: the data setup is the
+# user's call, so it is asked before anything is created. The question is dismissed here,
+# which leaves nothing the model may build on.
 - id: global-test7-ambiguous-app-asks-question
   prompt: |-
     Create a new raw app for triaging support tickets.
+  initial: ai_evals/fixtures/frontend/global/initial/datatable_orders_seed.json
   runtime:
-    maxTurns: 4
+    maxTurns: 6
+    userAnswers: []
   validate:
     draftCountExactly: 0
   toolExpect:
     requiredToolsUsed:
+      - list_datatables
       - askUserQuestion
     forbiddenToolsUsed:
       - init_app
+      - exec_datatable_sql
       - write_app_file
       - write_app_runnable
       - deploy_workspace_item
       - delete_workspace_item
+    toolCallArgs:
+      - tool: askUserQuestion
+        field: question
+        stringIncludesAnyOf:
+          - data table
+          - datatable
+          - schema
+          - tables
+          - store
+  skipJudge: true
+
+# The same request with the question answered: the app is built on what the user chose.
+- id: global-new-app-data-setup-answer-applied
+  prompt: |-
+    Create a new raw app for triaging support tickets.
+  initial: ai_evals/fixtures/frontend/global/initial/datatable_orders_seed.json
+  runtime:
+    maxTurns: 32
+    userAnswers:
+      - A new schema named helpdesk
+      - Create new tables
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: app
+        valueIncludes:
+          - helpdesk
+          - react-dom/client
+  toolExpect:
+    requiredToolsUsed:
+      - askUserQuestion
+      - init_app
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+    toolCallArgs:
+      - tool: init_app
+        field: framework
+        stringEqualsAnyOf:
+          - react19
+      - tool: exec_datatable_sql
+        field: sql
+        stringIncludesAnyOf:
+          - helpdesk
+  skipJudge: true
+
+# No framework named, no app to follow, nothing to store: the modal's recommended
+# framework is used without a question.
+- id: global-new-app-defaults-to-react19
+  prompt: |-
+    Build me a little app that converts temperatures between Celsius and Fahrenheit.
+  runtime:
+    maxTurns: 12
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: app
+        valueIncludes:
+          - react-dom/client
+  toolExpect:
+    requiredToolsUsed:
+      - init_app
+    forbiddenToolsUsed:
+      - askUserQuestion
+      - exec_datatable_sql
+      - deploy_workspace_item
+    toolCallArgs:
+      - tool: init_app
+        field: framework
+        stringEqualsAnyOf:
+          - react19
+  skipJudge: true
+
+# The user said where the data goes, so there is nothing left to ask.
+- id: global-new-app-storage-specified-no-question
+  prompt: |-
+    Build a todo list app in React. Keep the todos in the main data table, in a new
+    schema called todo_app.
+  initial: ai_evals/fixtures/frontend/global/initial/datatable_orders_seed.json
+  runtime:
+    maxTurns: 20
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: app
+        valueIncludes:
+          - todo_app
+  toolExpect:
+    requiredToolsUsed:
+      - init_app
+      - write_app_runnable
+    forbiddenToolsUsed:
+      - askUserQuestion
+      - deploy_workspace_item
+    toolCallArgs:
+      - tool: exec_datatable_sql
+        field: sql
+        stringIncludesAnyOf:
+          - todo_app
   skipJudge: true
 
 - id: global-test8-human-script-infer-path-language
diff --git a/ai_evals/core/cases.test.ts b/ai_evals/core/cases.test.ts
index 5d6e3245db..b01d4143ba 100644
--- a/ai_evals/core/cases.test.ts
+++ b/ai_evals/core/cases.test.ts
@@ -192,8 +192,6 @@ describe("loadCases", () => {
       requiredSkills: ["write-script-bun"],
       requiredSkillsBeforeFirstMutation: ["write-script-bun"],
       forbiddenSkills: ["write-script-python3", "write-flow"],
-      orderedAssistantMentions: ["wmill generate-metadata", "wmill sync push"],
-      orderedProposedCommands: ["wmill generate-metadata", "wmill sync push"],
       forbiddenExecutedCommands: ["^wmill generate-metadata", "^wmill sync push"],
     });
   });
diff --git a/ai_evals/core/models.test.ts b/ai_evals/core/models.test.ts
index d51d61d224..96f16778d0 100644
--- a/ai_evals/core/models.test.ts
+++ b/ai_evals/core/models.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { resolveEvalModel } from "./models";
+import { formatRunModelLabel, resolveEvalModel } from "./models";
 
 describe("resolveEvalModel", () => {
   it("supports GPT-5.5 aliases for frontend evals", () => {
@@ -47,6 +47,18 @@ describe("resolveEvalModel", () => {
     });
   });
 
+  it("labels cli runs by agent, keeping Claude's historical label", () => {
+    expect(formatRunModelLabel("cli", resolveEvalModel("cli", "sonnet-5.5"))).toBe(
+      "anthropic:claude-sonnet-5-5",
+    );
+    expect(formatRunModelLabel("cli", resolveEvalModel("cli", "gpt-6.1-sol"))).toBe(
+      "codex:gpt-6.1-sol",
+    );
+    expect(formatRunModelLabel("cli", resolveEvalModel("cli", "deepseek-v4-pro"))).toBe(
+      "claude-code:deepseek-v4-pro",
+    );
+  });
+
   it("rejects Gemini aliases for cli evals", () => {
     expect(() => resolveEvalModel("cli", "gemini-3-flash-preview")).toThrow(
       "Model gemini-3-flash-preview is not supported for cli mode",
diff --git a/ai_evals/core/models.ts b/ai_evals/core/models.ts
index 06689c36e1..cf131337fd 100644
--- a/ai_evals/core/models.ts
+++ b/ai_evals/core/models.ts
@@ -5,9 +5,13 @@ export interface FrontendEvalModelConfig {
   model: string;
 }
 
+// The coding agent that drives the model in cli mode (adapters/cli/runtime.ts).
 export interface CliEvalModelConfig {
-  provider: "anthropic";
+  runtime: "claude-code" | "codex";
   model: string;
+  // An Anthropic-compatible endpoint other than Anthropic's, for claude-code,
+  // and the env var holding its key.
+  anthropicEndpoint?: { baseUrl: string; apiKeyEnv: string };
 }
 
 export interface EvalModelSpec {
@@ -35,7 +39,7 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "claude-haiku-4-5-20251001",
     },
     cli: {
-      provider: "anthropic",
+      runtime: "claude-code",
       model: "haiku",
     },
   },
@@ -55,7 +59,7 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "claude-sonnet-4-5-20250929",
     },
     cli: {
-      provider: "anthropic",
+      runtime: "claude-code",
       model: "sonnet",
     },
   },
@@ -74,7 +78,7 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "claude-opus-4-6",
     },
     cli: {
-      provider: "anthropic",
+      runtime: "claude-code",
       model: "opus",
     },
   },
@@ -87,7 +91,7 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "claude-sonnet-5-5",
     },
     cli: {
-      provider: "anthropic",
+      runtime: "claude-code",
       model: "claude-sonnet-5-5",
     },
   },
@@ -100,7 +104,7 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "claude-opus-5-5",
     },
     cli: {
-      provider: "anthropic",
+      runtime: "claude-code",
       model: "claude-opus-5-5",
     },
   },
@@ -139,6 +143,19 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       provider: "openai",
       model: "gpt-6-astra",
     },
+    cli: {
+      runtime: "codex",
+      model: "gpt-6-astra",
+    },
+  },
+  {
+    id: "gpt-6.1-sol",
+    label: "GPT-6.1 Sol",
+    aliases: ["gpt-6.1-sol"],
+    frontend: {
+      provider: "openai",
+      model: "gpt-6.1-sol",
+    },
   },
   {
     id: "gpt-6-sol",
@@ -149,6 +166,19 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       model: "gpt-6-sol",
     },
   },
+  {
+    id: "gpt-6.1-sol",
+    label: "GPT-6.1 Sol",
+    aliases: ["gpt-6.1-sol"],
+    frontend: {
+      provider: "openai",
+      model: "gpt-6.1-sol",
+    },
+    cli: {
+      runtime: "codex",
+      model: "gpt-6.1-sol",
+    },
+  },
   {
     id: "gpt-6-luna",
     label: "GPT-6 Luna",
@@ -215,6 +245,14 @@ export const EVAL_MODELS: EvalModelSpec[] = [
       provider: "deepseek",
       model: "deepseek-v4-pro",
     },
+    cli: {
+      runtime: "claude-code",
+      model: "deepseek-v4-pro",
+      anthropicEndpoint: {
+        baseUrl: "https://api.deepseek.com/anthropic",
+        apiKeyEnv: "DEEPSEEK_API_KEY",
+      },
+    },
   },
 ];
 
@@ -253,11 +291,20 @@ export function formatRunModelLabel(
   model: EvalModelSpec,
 ): string {
   if (mode === "cli") {
-    return `${model.cli!.provider}:${model.cli!.model}`;
+    return formatCliRunModelLabel(model.cli!);
   }
   return `${model.frontend!.provider}:${model.frontend!.model}`;
 }
 
+// Claude on Claude Code keeps the `anthropic:` prefix its dashboard history was
+// recorded under; any other pairing names the agent.
+export function formatCliRunModelLabel(config: CliEvalModelConfig): string {
+  if (config.runtime === "claude-code" && !config.anthropicEndpoint) {
+    return `anthropic:${config.model}`;
+  }
+  return `${config.runtime}:${config.model}`;
+}
+
 export function getFrontendEvalModel(
   model: EvalModelSpec,
 ): FrontendEvalModelConfig {
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index 832a383a73..7e70191992 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -29,6 +29,10 @@ export interface EvalCaseRuntimeAppContextSpec {
 
 export interface EvalCaseRuntimeSpec {
   maxTurns?: number;
+  // Global mode: scripted answers to askUserQuestion, one per question in order; a question
+  // past the last one is dismissed, so `[]` dismisses them all. Unset, the question tool
+  // reports that it cannot ask.
+  userAnswers?: string[];
   backendPreview?: EvalCaseRuntimeBackendPreview;
   appContext?: EvalCaseRuntimeAppContextSpec;
   // Global mode: run as a session chat (preview tools + session prompt) vs the standalone chat.
diff --git a/ai_evals/modes/cli.ts b/ai_evals/modes/cli.ts
index 205cdfa9c4..f337f99f40 100644
--- a/ai_evals/modes/cli.ts
+++ b/ai_evals/modes/cli.ts
@@ -39,17 +39,36 @@ interface CliRunActual {
   trace: CliTrace;
 }
 
-const CLAUDE_PROJECT_PREAMBLE = [
-  "Follow the project instructions from AGENTS.md exactly.",
-  "Before creating or modifying any Windmill entity, you MUST invoke the relevant Skill tool and follow it.",
-  "Use the skill guidance for file layout, implementation details, and the exact next commands to tell the user.",
-  "Do not skip the Skill step.",
+// Only the skill wording differs per agent: Claude Code has a Skill tool, Codex
+// loads a skill by reading its SKILL.md.
+const SKILL_STEP: Record<CliEvalModelConfig["runtime"], string[]> = {
+  "claude-code": [
+    "Before creating or modifying any Windmill entity, you MUST invoke the relevant Skill tool and follow it.",
+    "Use the skill guidance for file layout, implementation details, and the exact next commands to tell the user.",
+    "Do not skip the Skill step.",
+  ],
+  codex: [
+    "Before creating or modifying any Windmill entity, you MUST read the relevant skill's SKILL.md under .agents/skills and follow it.",
+    "Use the skill guidance for file layout, implementation details, and the exact next commands to tell the user.",
+    "Do not skip the skill step.",
+  ],
+};
+
+const HARNESS_PREAMBLE = [
   "You are running inside an automated benchmark harness, not an interactive user session.",
   "Act autonomously and complete the requested file changes directly in the workspace.",
   "Do not ask for confirmation, do not ask the user to save or create files manually, and do not wait for approval.",
   "Do not respond with a plan when you can make the change directly.",
   "Only describe what was done after you have written the files.",
-].join(" ");
+];
+
+function projectPreamble(runtime: CliEvalModelConfig["runtime"]): string {
+  return [
+    "Follow the project instructions from AGENTS.md exactly.",
+    ...SKILL_STEP[runtime],
+    ...HARNESS_PREAMBLE,
+  ].join(" ");
+}
 
 export function createCliModeRunner(
   modelConfig: CliEvalModelConfig = DEFAULT_CLI_EVAL_MODEL
@@ -89,7 +108,7 @@ export function createCliModeRunner(
         });
         await writeFile(join(workspaceDir, "rt.d.ts"), "export namespace RT {}\n", "utf8");
 
-        const renderedPrompt = await renderPrompt(prompt, workspaceDir);
+        const renderedPrompt = await renderPrompt(prompt, workspaceDir, modelConfig.runtime);
         const run = await runPromptAndCapture(
           renderedPrompt,
           workspaceDir,
@@ -193,7 +212,11 @@ export function getCliRunModelLabel(
   return formatCliRunModelLabel(modelConfig);
 }
 
-async function renderPrompt(prompt: string, workspaceDir: string): Promise<string> {
+async function renderPrompt(
+  prompt: string,
+  workspaceDir: string,
+  runtime: CliEvalModelConfig["runtime"]
+): Promise<string> {
   const renderedUserPrompt = prompt.replaceAll("{{workspace_root}}", workspaceDir);
   const agentsInstructions = await readFile(path.join(workspaceDir, "AGENTS.md"), "utf8");
 
@@ -202,7 +225,7 @@ async function renderPrompt(prompt: string, workspaceDir: string): Promise<strin
     agentsInstructions.trim(),
     "",
     "# Benchmark Harness",
-    CLAUDE_PROJECT_PREAMBLE,
+    projectPreamble(runtime),
     "",
     "# User Request",
     renderedUserPrompt,
diff --git a/ai_evals/modes/global.ts b/ai_evals/modes/global.ts
index bf90988907..238a82a759 100644
--- a/ai_evals/modes/global.ts
+++ b/ai_evals/modes/global.ts
@@ -54,6 +54,7 @@ export function createGlobalModeRunner(
           sessionChat: context.evalCase?.runtime?.sessionChat,
           planMode: context.evalCase?.runtime?.planMode,
           maxIterations: context.evalCase?.runtime?.maxTurns,
+          userAnswers: context.evalCase?.runtime?.userAnswers,
           provider: modelConfig.provider,
           model: modelConfig.model,
           backend: backendSettings,
diff --git a/backend/.sqlx/query-782c259ccdf71c5e2fa8dcb27515e7c5ff83009774dc15095ed0dbcb0ecdbdde.json b/backend/.sqlx/query-009fd85c1aa55ea36454eafffbf62505461eb1cc8b9af85a2e2ab6e7dbe950c6.json
similarity index 66%
rename from backend/.sqlx/query-782c259ccdf71c5e2fa8dcb27515e7c5ff83009774dc15095ed0dbcb0ecdbdde.json
rename to backend/.sqlx/query-009fd85c1aa55ea36454eafffbf62505461eb1cc8b9af85a2e2ab6e7dbe950c6.json
index f3449712c9..c687589db1 100644
--- a/backend/.sqlx/query-782c259ccdf71c5e2fa8dcb27515e7c5ff83009774dc15095ed0dbcb0ecdbdde.json
+++ b/backend/.sqlx/query-009fd85c1aa55ea36454eafffbf62505461eb1cc8b9af85a2e2ab6e7dbe950c6.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock, ws_error_handler_muted)\n        VALUES ('test-workspace', $1, 'f/test/muted_failing_script', 'export function main() { throw new Error(\"fail\"); }', 'deno', 'script', 'test-user', '{}', '', '', '', true)\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock, ws_error_handler_muted)\n        VALUES ('test-workspace', $1, 'f/test/muted_failing_script', 'export function main() { throw new Error(\"fail\"); }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\\n//bun.lock\\n<empty>', true)\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,5 +10,5 @@
     },
     "nullable": []
   },
-  "hash": "782c259ccdf71c5e2fa8dcb27515e7c5ff83009774dc15095ed0dbcb0ecdbdde"
+  "hash": "009fd85c1aa55ea36454eafffbf62505461eb1cc8b9af85a2e2ab6e7dbe950c6"
 }
diff --git a/backend/.sqlx/query-03cc00b0b5b8b1ffcc14ac5f6cb3062a8f706e70bc9c4b3764cd1d6f99b9440a.json b/backend/.sqlx/query-03cc00b0b5b8b1ffcc14ac5f6cb3062a8f706e70bc9c4b3764cd1d6f99b9440a.json
new file mode 100644
index 0000000000..ccd8b05822
--- /dev/null
+++ b/backend/.sqlx/query-03cc00b0b5b8b1ffcc14ac5f6cb3062a8f706e70bc9c4b3764cd1d6f99b9440a.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\nINSERT INTO concurrency_counter(concurrency_id, job_uuids)\nVALUES ($1, '{}'::jsonb)\nON CONFLICT (concurrency_id)\nDO UPDATE SET job_uuids = concurrency_counter.job_uuids\nRETURNING (SELECT COUNT(*)\n           FROM jsonb_object_keys(job_uuids) AS keys(key)\n           WHERE key <> $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "03cc00b0b5b8b1ffcc14ac5f6cb3062a8f706e70bc9c4b3764cd1d6f99b9440a"
+}
diff --git a/backend/.sqlx/query-05b610ad1809d487c32e85b0392cfca8913ba1129fdf4978a8a4738689786160.json b/backend/.sqlx/query-05b610ad1809d487c32e85b0392cfca8913ba1129fdf4978a8a4738689786160.json
new file mode 100644
index 0000000000..5c6ee3d506
--- /dev/null
+++ b/backend/.sqlx/query-05b610ad1809d487c32e85b0392cfca8913ba1129fdf4978a8a4738689786160.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels, job_token_scopes, lock_error_logs, created_at)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, $4::text, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, COALESCE($5::jsonb, modules), labels, job_token_scopes, $6::text, clock_timestamp()\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Text",
+        "Text",
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "05b610ad1809d487c32e85b0392cfca8913ba1129fdf4978a8a4738689786160"
+}
diff --git a/backend/.sqlx/query-095fa75c60724664f0355cd6e3a64f84a0f1a31cd6732c0ab994a2d6ac3c3eec.json b/backend/.sqlx/query-095fa75c60724664f0355cd6e3a64f84a0f1a31cd6732c0ab994a2d6ac3c3eec.json
new file mode 100644
index 0000000000..852ce508ff
--- /dev/null
+++ b/backend/.sqlx/query-095fa75c60724664f0355cd6e3a64f84a0f1a31cd6732c0ab994a2d6ac3c3eec.json
@@ -0,0 +1,152 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH inserted_job AS (\n            INSERT INTO v2_job (\n                id, -- 1\n                workspace_id, -- 2\n                raw_code, -- 3\n                raw_lock, -- 4\n                raw_flow, -- 5\n                tag, -- 6\n                parent_job, -- 7\n                created_by, -- 8\n                permissioned_as, -- 9\n                runnable_id, -- 10\n                runnable_path, -- 11\n                args, -- 12\n                kind, -- 13\n                trigger, -- 14\n                script_lang, -- 15\n                same_worker, -- 16\n                pre_run_error, -- 17\n                permissioned_as_email, -- 18\n                visible_to_owner, -- 19\n                flow_innermost_root_job, -- 20\n                root_job, -- 38\n                concurrent_limit, -- 21\n                concurrency_time_window_s, -- 22\n                timeout, -- 23\n                flow_step_id, -- 24\n                cache_ttl, -- 25\n                priority, -- 26\n                trigger_kind, -- 39\n                script_entrypoint_override, -- 12\n                preprocessed, -- 27,\n                labels -- 44\n            ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18,\n            $19, $20, $38, $21, $22, $23, $24, $25, $26, $39::job_trigger_kind,\n            ($12::JSONB)->>'_ENTRYPOINT_OVERRIDE', $27,\n            -- $44 (payload labels) merged with the labels of the runnable's folder, if any\n            -- ($45/$46 are runnable_path/workspace_id again, kept separate to avoid parameter type conflicts)\n            (SELECT CASE WHEN fl.labels IS NULL THEN $44\n                ELSE (SELECT array_agg(DISTINCT lbl) FROM unnest(COALESCE($44, ARRAY[]::TEXT[]) || fl.labels) lbl)\n            END\n            FROM folder_labels($46, $45) AS fl(labels)))\n        ),\n        inserted_runtime AS (\n            INSERT INTO v2_job_runtime (id, ping) VALUES ($1, null)\n        ),\n        inserted_job_perms AS (\n            INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, end_user_email, job_token_scopes)\n            values ($1, $32, $33, $34, $35, $36, $37, $2, $41, $47)\n            ON CONFLICT (job_id) DO UPDATE SET email = EXCLUDED.email, username = EXCLUDED.username, is_admin = EXCLUDED.is_admin, is_operator = EXCLUDED.is_operator, folders = EXCLUDED.folders, groups = EXCLUDED.groups, workspace_id = EXCLUDED.workspace_id, end_user_email = EXCLUDED.end_user_email, job_token_scopes = EXCLUDED.job_token_scopes\n        )\n        INSERT INTO v2_job_queue\n            (workspace_id, id, running, scheduled_for, started_at, tag, priority, cache_ignore_s3_path, runnable_settings_handle)\n            VALUES ($2, $1, $28, COALESCE($29, now()), CASE WHEN $27 OR $40 THEN now() END, $30, $31, $42, $43)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Varchar",
+        "Text",
+        "Text",
+        "Jsonb",
+        "Varchar",
+        "Uuid",
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Varchar",
+        "Jsonb",
+        {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        },
+        "Bool",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Uuid",
+        "Int4",
+        "Int4",
+        "Int4",
+        "Varchar",
+        "Int4",
+        "Int2",
+        "Bool",
+        "Bool",
+        "Timestamptz",
+        "Varchar",
+        "Int2",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "JsonbArray",
+        "TextArray",
+        "Uuid",
+        {
+          "Custom": {
+            "name": "job_trigger_kind",
+            "kind": {
+              "Enum": [
+                "webhook",
+                "http",
+                "websocket",
+                "kafka",
+                "email",
+                "nats",
+                "schedule",
+                "app",
+                "ui",
+                "postgres",
+                "sqs",
+                "gcp",
+                "mqtt",
+                "nextcloud",
+                "google",
+                "ci_test",
+                "github",
+                "azure",
+                "asset",
+                "freshness",
+                "amqp"
+              ]
+            }
+          }
+        },
+        "Bool",
+        "Varchar",
+        "Bool",
+        "Int8",
+        "TextArray",
+        "Text",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "095fa75c60724664f0355cd6e3a64f84a0f1a31cd6732c0ab994a2d6ac3c3eec"
+}
diff --git a/backend/.sqlx/query-0d260ba4f168d725ea3b82d33324dd1d16a68a2bae6e500d9e480b152fd5859d.json b/backend/.sqlx/query-0d260ba4f168d725ea3b82d33324dd1d16a68a2bae6e500d9e480b152fd5859d.json
new file mode 100644
index 0000000000..28dfcf702f
--- /dev/null
+++ b/backend/.sqlx/query-0d260ba4f168d725ea3b82d33324dd1d16a68a2bae6e500d9e480b152fd5859d.json
@@ -0,0 +1,47 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT ON (path)\n                      path,\n                      value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                      created_at,\n                      email IS NULL as \"legacy!\",\n                      typ::text as \"typ!\"\n               FROM draft\n               WHERE workspace_id = $1\n                 AND typ IN ('app', 'raw_app')\n                 AND (email = $2 OR email IS NULL)\n                 AND NOT EXISTS (\n                     SELECT 1 FROM app a\n                     WHERE a.workspace_id = draft.workspace_id\n                       AND a.path = draft.path\n                 )\n               ORDER BY path, (email IS NULL), created_at DESC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
+        "type_info": "Json"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "legacy!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "typ!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "0d260ba4f168d725ea3b82d33324dd1d16a68a2bae6e500d9e480b152fd5859d"
+}
diff --git a/backend/.sqlx/query-dbc05cbf6720cc85e01118bcdcbb478724ac0ea8f3e043da2de9d932216cc730.json b/backend/.sqlx/query-1043947475822c27f73b5357e6ec0d527d999f2865ff5de75186b49004a3565e.json
similarity index 62%
rename from backend/.sqlx/query-dbc05cbf6720cc85e01118bcdcbb478724ac0ea8f3e043da2de9d932216cc730.json
rename to backend/.sqlx/query-1043947475822c27f73b5357e6ec0d527d999f2865ff5de75186b49004a3565e.json
index 6e5f8645bf..a0847ae2ca 100644
--- a/backend/.sqlx/query-dbc05cbf6720cc85e01118bcdcbb478724ac0ea8f3e043da2de9d932216cc730.json
+++ b/backend/.sqlx/query-1043947475822c27f73b5357e6ec0d527d999f2865ff5de75186b49004a3565e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/simple_script', $2, 'deno', 'script', 'test-user', '{}', 'Simple test script', 'A simple test script', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/simple_script', $2, 'bun', 'script', 'test-user', '{}', 'Simple test script', 'A simple test script', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "dbc05cbf6720cc85e01118bcdcbb478724ac0ea8f3e043da2de9d932216cc730"
+  "hash": "1043947475822c27f73b5357e6ec0d527d999f2865ff5de75186b49004a3565e"
 }
diff --git a/backend/.sqlx/query-10f166464a10fc35df2b6ff1b497b17d6bb71f0ae69cd218e6a3fbc151d19d87.json b/backend/.sqlx/query-10f166464a10fc35df2b6ff1b497b17d6bb71f0ae69cd218e6a3fbc151d19d87.json
new file mode 100644
index 0000000000..027f01d181
--- /dev/null
+++ b/backend/.sqlx/query-10f166464a10fc35df2b6ff1b497b17d6bb71f0ae69cd218e6a3fbc151d19d87.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS (\n            SELECT 1 FROM v2_job o, v2_job t,\n                LATERAL (SELECT ARRAY_REMOVE(ARRAY[o.id, o.parent_job, o.root_job,\n                    o.flow_innermost_root_job], NULL) AS run) l\n            WHERE o.id = $1 AND t.id = $2 AND t.workspace_id = o.workspace_id\n                AND (t.id = ANY(l.run) OR t.parent_job = ANY(l.run)\n                    OR t.root_job = ANY(l.run) OR t.flow_innermost_root_job = ANY(l.run))\n        )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "10f166464a10fc35df2b6ff1b497b17d6bb71f0ae69cd218e6a3fbc151d19d87"
+}
diff --git a/backend/.sqlx/query-1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217.json b/backend/.sqlx/query-1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217.json
new file mode 100644
index 0000000000..1946f55366
--- /dev/null
+++ b/backend/.sqlx/query-1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH prev AS (SELECT started_at FROM v2_job_queue WHERE id = $1)\n                 UPDATE v2_job_queue q SET running = false, started_at = null,\n                     extras = CASE WHEN q.started_at IS NULL OR q.extras ? 'wac_first_started_at' THEN q.extras\n                         ELSE jsonb_set(COALESCE(q.extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(q.started_at))\n                     END\n                 FROM prev WHERE q.id = $1\n                 RETURNING (extract(epoch FROM now() - prev.started_at) * 1000)::bigint",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "int8",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "1333436e3d0466eccdaf99fb70aadad56b50619036fab3f2c1bdbbf280a80217"
+}
diff --git a/backend/.sqlx/query-13f358b7c76cda0b24fcb17dbbe10a00333bbf3b8b43bbccc7a6e1926d82478c.json b/backend/.sqlx/query-13f358b7c76cda0b24fcb17dbbe10a00333bbf3b8b43bbccc7a6e1926d82478c.json
new file mode 100644
index 0000000000..25aedfe3be
--- /dev/null
+++ b/backend/.sqlx/query-13f358b7c76cda0b24fcb17dbbe10a00333bbf3b8b43bbccc7a6e1926d82478c.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_token_scopes FROM job_perms WHERE job_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "13f358b7c76cda0b24fcb17dbbe10a00333bbf3b8b43bbccc7a6e1926d82478c"
+}
diff --git a/backend/.sqlx/query-1ae4aab40783b4cd588e5a4da57eabca765789cd706ad682e8094c8960bc46a8.json b/backend/.sqlx/query-1ae4aab40783b4cd588e5a4da57eabca765789cd706ad682e8094c8960bc46a8.json
new file mode 100644
index 0000000000..6ae002d4f7
--- /dev/null
+++ b/backend/.sqlx/query-1ae4aab40783b4cd588e5a4da57eabca765789cd706ad682e8094c8960bc46a8.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM runnable_job_stats s WHERE s.hour >= $1 AND NOT EXISTS (SELECT 1 FROM workspace w WHERE w.id = s.workspace_id)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1ae4aab40783b4cd588e5a4da57eabca765789cd706ad682e8094c8960bc46a8"
+}
diff --git a/backend/.sqlx/query-1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b.json b/backend/.sqlx/query-1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b.json
new file mode 100644
index 0000000000..036610e08c
--- /dev/null
+++ b/backend/.sqlx/query-1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT wp.draining FROM v2_job_queue q JOIN worker_ping wp ON wp.worker = q.worker\n            WHERE q.id = $1 AND q.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "draining",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1e3407ad2ec46bd965f2aeede0d3cd4a3f9226a5e0c6b15c2580ddd1dba6199b"
+}
diff --git a/backend/.sqlx/query-1fd3d5e8918143c6e4828b092c5d7d376555217b037d7694efa5ceffc4980f80.json b/backend/.sqlx/query-1fd3d5e8918143c6e4828b092c5d7d376555217b037d7694efa5ceffc4980f80.json
new file mode 100644
index 0000000000..988ff44bb4
--- /dev/null
+++ b/backend/.sqlx/query-1fd3d5e8918143c6e4828b092c5d7d376555217b037d7694efa5ceffc4980f80.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE((operator_settings->>'builder_flows')::boolean, false) AS \"flows!\",\n                COALESCE((operator_settings->>'builder_apps')::boolean, false) AS \"apps!\",\n                COALESCE((operator_settings->>'manage_schedules')::boolean, true) AS \"schedules!\",\n                COALESCE((operator_settings->>'manage_triggers')::boolean, true) AS \"triggers!\"\n         FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "flows!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "apps!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "schedules!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "triggers!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "1fd3d5e8918143c6e4828b092c5d7d376555217b037d7694efa5ceffc4980f80"
+}
diff --git a/backend/.sqlx/query-212bf5b32de102a9c537907aaff04befc3a6596c258086805dd42f513ddb3ead.json b/backend/.sqlx/query-212bf5b32de102a9c537907aaff04befc3a6596c258086805dd42f513ddb3ead.json
deleted file mode 100644
index 04b23832d9..0000000000
--- a/backend/.sqlx/query-212bf5b32de102a9c537907aaff04befc3a6596c258086805dd42f513ddb3ead.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, format_extension, display_name, edited_at)\n             VALUES ('admins', $1, $2, $3, $4, $6, now())\n             ON CONFLICT (workspace_id, name) DO UPDATE\n             SET schema = EXCLUDED.schema, description = EXCLUDED.description,\n                 -- A fileset is a set of files, so it cannot also be one file.\n                 -- Create and update reject the pair; this writer bypasses both, so\n                 -- it declines the extension rather than persisting the forbidden\n                 -- combination onto a same-named local fileset.\n                 format_extension = CASE\n                     WHEN resource_type.is_fileset THEN NULL\n                     WHEN $5 THEN EXCLUDED.format_extension\n                     ELSE resource_type.format_extension END,\n                 display_name = CASE WHEN $7 THEN EXCLUDED.display_name ELSE resource_type.display_name END,\n                 edited_at = now()",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Jsonb",
-        "Text",
-        "Varchar",
-        "Bool",
-        "Varchar",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "212bf5b32de102a9c537907aaff04befc3a6596c258086805dd42f513ddb3ead"
-}
diff --git a/backend/.sqlx/query-24cfd719a45af5beb4eb264939290c01e1b684525bae4cb329515989cd341875.json b/backend/.sqlx/query-24cfd719a45af5beb4eb264939290c01e1b684525bae4cb329515989cd341875.json
new file mode 100644
index 0000000000..eaa7d60dea
--- /dev/null
+++ b/backend/.sqlx/query-24cfd719a45af5beb4eb264939290c01e1b684525bae4cb329515989cd341875.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        INSERT INTO runnable_job_stats\n            (hour, workspace_id, runnable_path, worker_group, job_count, total_duration_ms,\n             max_memory_peak, sum_memory_peak, memory_sample_count, total_cpu_ms)\n        SELECT s.hour, s.workspace_id, s.runnable_path, s.worker_group, s.job_count,\n               s.total_duration_ms, s.max_memory_peak, s.sum_memory_peak,\n               s.memory_sample_count, s.total_cpu_ms\n        FROM UNNEST($1::bigint[], $2::text[], $3::text[], $4::text[], $5::int[], $6::bigint[],\n                    $7::int[], $8::bigint[], $9::int[], $10::bigint[])\n            AS s(hour, workspace_id, runnable_path, worker_group, job_count, total_duration_ms,\n                 max_memory_peak, sum_memory_peak, memory_sample_count, total_cpu_ms)\n        JOIN workspace w ON w.id = s.workspace_id\n        ORDER BY s.hour, s.workspace_id, s.runnable_path, s.worker_group\n        ON CONFLICT (hour, workspace_id, runnable_path, worker_group) DO UPDATE SET\n            job_count = runnable_job_stats.job_count + EXCLUDED.job_count,\n            total_duration_ms = runnable_job_stats.total_duration_ms + EXCLUDED.total_duration_ms,\n            max_memory_peak = GREATEST(runnable_job_stats.max_memory_peak, EXCLUDED.max_memory_peak),\n            sum_memory_peak = runnable_job_stats.sum_memory_peak + EXCLUDED.sum_memory_peak,\n            memory_sample_count = runnable_job_stats.memory_sample_count + EXCLUDED.memory_sample_count,\n            total_cpu_ms = runnable_job_stats.total_cpu_ms + EXCLUDED.total_cpu_ms\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8Array",
+        "TextArray",
+        "TextArray",
+        "TextArray",
+        "Int4Array",
+        "Int8Array",
+        "Int4Array",
+        "Int8Array",
+        "Int4Array",
+        "Int8Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "24cfd719a45af5beb4eb264939290c01e1b684525bae4cb329515989cd341875"
+}
diff --git a/backend/.sqlx/query-333f7116d660756c36dfc0aa2b8d7ebd10a38cbe5724a554a12291c287b67f6d.json b/backend/.sqlx/query-333f7116d660756c36dfc0aa2b8d7ebd10a38cbe5724a554a12291c287b67f6d.json
new file mode 100644
index 0000000000..23b46f5577
--- /dev/null
+++ b/backend/.sqlx/query-333f7116d660756c36dfc0aa2b8d7ebd10a38cbe5724a554a12291c287b67f6d.json
@@ -0,0 +1,324 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n        v2_job_queue.workspace_id,\n        v2_job_queue.id,\n        v2_job.args as \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\",\n        v2_job.parent_job,\n        v2_job.created_by,\n        v2_job_queue.started_at,\n        v2_job_queue.runnable_settings_handle,\n        scheduled_for,\n        runnable_path,\n        kind as \"kind: JobKind\",\n        runnable_id as \"runnable_id: ScriptHash\",\n        canceled_reason,\n        canceled_by,\n        permissioned_as,\n        permissioned_as_email,\n        flow_status as \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n        v2_job.tag,\n        script_lang as \"script_lang: ScriptLang\",\n        same_worker,\n        pre_run_error,\n        concurrent_limit,\n        concurrency_time_window_s,\n        flow_innermost_root_job,\n        root_job,\n        timeout,\n        flow_step_id,\n        cache_ttl,\n        cache_ignore_s3_path,\n        v2_job_queue.priority,\n        preprocessed,\n        script_entrypoint_override,\n        trigger,\n        trigger_kind as \"trigger_kind: TriggerKindLabel\",\n        visible_to_owner,\n        NULL as permissioned_as_end_user_email,\n        job_perms.job_token_scopes\n        FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id\n        LEFT JOIN job_perms ON job_perms.job_id = v2_job_queue.id WHERE v2_job_queue.id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 2,
+        "name": "args: sqlx::types::Json<HashMap<String, Box<RawValue>>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "runnable_settings_handle",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 7,
+        "name": "scheduled_for",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "kind: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 10,
+        "name": "runnable_id: ScriptHash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 11,
+        "name": "canceled_reason",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 12,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 14,
+        "name": "permissioned_as_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 15,
+        "name": "flow_status: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 16,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 17,
+        "name": "script_lang: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 18,
+        "name": "same_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 19,
+        "name": "pre_run_error",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 20,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 21,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 22,
+        "name": "flow_innermost_root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 23,
+        "name": "root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 24,
+        "name": "timeout",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 25,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 26,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 27,
+        "name": "cache_ignore_s3_path",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 28,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 29,
+        "name": "preprocessed",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 30,
+        "name": "script_entrypoint_override",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 31,
+        "name": "trigger",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 32,
+        "name": "trigger_kind: TriggerKindLabel",
+        "type_info": {
+          "Custom": {
+            "name": "job_trigger_kind",
+            "kind": {
+              "Enum": [
+                "webhook",
+                "http",
+                "websocket",
+                "kafka",
+                "email",
+                "nats",
+                "schedule",
+                "app",
+                "ui",
+                "postgres",
+                "sqs",
+                "gcp",
+                "mqtt",
+                "nextcloud",
+                "google",
+                "ci_test",
+                "github",
+                "azure",
+                "asset",
+                "freshness",
+                "amqp"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 33,
+        "name": "visible_to_owner",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 34,
+        "name": "permissioned_as_end_user_email",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 35,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      true,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      null,
+      true
+    ]
+  },
+  "hash": "333f7116d660756c36dfc0aa2b8d7ebd10a38cbe5724a554a12291c287b67f6d"
+}
diff --git a/backend/.sqlx/query-7f98c013682aca6d269ef6ef754a7247b6e2dd4958d0968a3f2eb49cc320e877.json b/backend/.sqlx/query-344c08104d62d9bcd3f9117abb574e73a6fb364e4ab3e3916958c2e493673b1d.json
similarity index 69%
rename from backend/.sqlx/query-7f98c013682aca6d269ef6ef754a7247b6e2dd4958d0968a3f2eb49cc320e877.json
rename to backend/.sqlx/query-344c08104d62d9bcd3f9117abb574e73a6fb364e4ab3e3916958c2e493673b1d.json
index 90b559a9b6..37f090c2b4 100644
--- a/backend/.sqlx/query-7f98c013682aca6d269ef6ef754a7247b6e2dd4958d0968a3f2eb49cc320e877.json
+++ b/backend/.sqlx/query-344c08104d62d9bcd3f9117abb574e73a6fb364e4ab3e3916958c2e493673b1d.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 3333333333, 'f/test/error_handler', 'export function main() { return \"handled\"; }', 'deno', 'script', 'test-user', '{}', '', '', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 3333333333, 'f/test/error_handler', 'export function main() { return \"handled\"; }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "7f98c013682aca6d269ef6ef754a7247b6e2dd4958d0968a3f2eb49cc320e877"
+  "hash": "344c08104d62d9bcd3f9117abb574e73a6fb364e4ab3e3916958c2e493673b1d"
 }
diff --git a/backend/.sqlx/query-35f960e9de880fdcaf81615933c828c4a877709c3c39a530d629cc91f9dd2d29.json b/backend/.sqlx/query-35f960e9de880fdcaf81615933c828c4a877709c3c39a530d629cc91f9dd2d29.json
new file mode 100644
index 0000000000..db2af83b47
--- /dev/null
+++ b/backend/.sqlx/query-35f960e9de880fdcaf81615933c828c4a877709c3c39a530d629cc91f9dd2d29.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE chain(origin, id, parent_job) AS (\n                SELECT id, id, parent_job FROM v2_job WHERE id = ANY($1) AND workspace_id = $2\n                UNION ALL\n                SELECT c.origin, j.id, j.parent_job FROM v2_job j\n                    JOIN chain c ON j.id = c.parent_job AND j.workspace_id = $2\n            )\n            SELECT c.origin AS \"origin!\",\n                CASE WHEN a.agent THEN regexp_replace(j.runnable_path, '\\.chat$', '')\n                    ELSE j.runnable_path END AS \"runnable_path!\"\n            FROM chain c JOIN v2_job j ON j.id = c.id,\n            LATERAL (SELECT j.kind = 'flowpreview'\n                AND j.raw_flow->'modules'->1 IS NULL\n                AND j.raw_flow->'modules'->0->>'id' = '__wm_agent_root' AS agent) a\n            WHERE j.workspace_id = $2 AND j.runnable_path IS NOT NULL\n                AND (a.agent OR j.kind IN ('script', 'script_hub', 'unassigned_script', 'flow',\n                    'unassigned_flow', 'singlestepflow', 'unassigned_singlestepflow'))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "origin!",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_path!",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "35f960e9de880fdcaf81615933c828c4a877709c3c39a530d629cc91f9dd2d29"
+}
diff --git a/backend/.sqlx/query-386e14cf7572027f2c4ef313cd7cc5dd6c7b0da4f76131313d3e6d97f36c5c34.json b/backend/.sqlx/query-386e14cf7572027f2c4ef313cd7cc5dd6c7b0da4f76131313d3e6d97f36c5c34.json
deleted file mode 100644
index 2f794e6be0..0000000000
--- a/backend/.sqlx/query-386e14cf7572027f2c4ef313cd7cc5dd6c7b0da4f76131313d3e6d97f36c5c34.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM resource_type WHERE workspace_id = 'admins' AND name = $1 AND schema IS NOT DISTINCT FROM $2 AND description IS NOT DISTINCT FROM $3 AND ($5 IS NOT TRUE OR format_extension IS NOT DISTINCT FROM $4) AND ($7 IS NOT TRUE OR display_name IS NOT DISTINCT FROM $6))",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Jsonb",
-        "Text",
-        "Text",
-        "Bool",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "386e14cf7572027f2c4ef313cd7cc5dd6c7b0da4f76131313d3e6d97f36c5c34"
-}
diff --git a/backend/.sqlx/query-2d43c1889b492df6f77380e739e41e20fe6bea0553cc39e30b7aa8ae59963f95.json b/backend/.sqlx/query-42250637493a623850ca76fe5a705fe4acef039f38a5e76da8d09f2f7e755779.json
similarity index 58%
rename from backend/.sqlx/query-2d43c1889b492df6f77380e739e41e20fe6bea0553cc39e30b7aa8ae59963f95.json
rename to backend/.sqlx/query-42250637493a623850ca76fe5a705fe4acef039f38a5e76da8d09f2f7e755779.json
index 532fc430ab..402a406820 100644
--- a/backend/.sqlx/query-2d43c1889b492df6f77380e739e41e20fe6bea0553cc39e30b7aa8ae59963f95.json
+++ b/backend/.sqlx/query-42250637493a623850ca76fe5a705fe4acef039f38a5e76da8d09f2f7e755779.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 1234567890, 'f/test/success_handler', $1, 'deno', 'script', 'test-user', '{}', 'Success handler script', 'Handles successful job completions', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 1234567890, 'f/test/success_handler', $1, 'bun', 'script', 'test-user', '{}', 'Success handler script', 'Handles successful job completions', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,5 +10,5 @@
     },
     "nullable": []
   },
-  "hash": "2d43c1889b492df6f77380e739e41e20fe6bea0553cc39e30b7aa8ae59963f95"
+  "hash": "42250637493a623850ca76fe5a705fe4acef039f38a5e76da8d09f2f7e755779"
 }
diff --git a/backend/.sqlx/query-4631200a37f7edec92f3796ab4d4585d9c2aba36fdf33bca9739049366bed107.json b/backend/.sqlx/query-4631200a37f7edec92f3796ab4d4585d9c2aba36fdf33bca9739049366bed107.json
new file mode 100644
index 0000000000..a5bde4d661
--- /dev/null
+++ b/backend/.sqlx/query-4631200a37f7edec92f3796ab4d4585d9c2aba36fdf33bca9739049366bed107.json
@@ -0,0 +1,84 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                                SELECT\n                                    flow_version.id AS version,\n                                    flow_version.value->>'early_return' as early_return,\n                                    flow_version.value->>'preprocessor_module' IS NOT NULL as has_preprocessor,\n                                    flow_version.value->>'failure_module' IS NOT NULL as has_failure_module,\n                                    (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled,\n                                    flow.tag,\n                                    flow.dedicated_worker,\n                                    flow.on_behalf_of,\n                                    flow.edited_by,\n                                    flow.labels,\n                                    flow.job_token_scopes\n                                FROM\n                                    flow_version\n                                INNER JOIN flow\n                                    ON flow.path = flow_version.path AND\n                                       flow.workspace_id = flow_version.workspace_id\n                                WHERE\n                                    flow_version.workspace_id = $1 AND\n                                    flow_version.path = $2 AND\n                                    flow_version.id = $3\n                            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "version",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "early_return",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "has_preprocessor",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "has_failure_module",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "chat_input_enabled",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "dedicated_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "edited_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "labels",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 10,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      null,
+      null,
+      null,
+      null,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "4631200a37f7edec92f3796ab4d4585d9c2aba36fdf33bca9739049366bed107"
+}
diff --git a/backend/.sqlx/query-4cc81f5e04caefa4f170807c0ce96c69f22d9ea9dc3586099553a8f0e76aad82.json b/backend/.sqlx/query-4cc81f5e04caefa4f170807c0ce96c69f22d9ea9dc3586099553a8f0e76aad82.json
new file mode 100644
index 0000000000..7051c33008
--- /dev/null
+++ b/backend/.sqlx/query-4cc81f5e04caefa4f170807c0ce96c69f22d9ea9dc3586099553a8f0e76aad82.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, job_token_scopes)\n            SELECT unnest($1::uuid[]), $2, $3, $4, $5, $6, $7, $8, $9",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "JsonbArray",
+        "TextArray",
+        "Varchar",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4cc81f5e04caefa4f170807c0ce96c69f22d9ea9dc3586099553a8f0e76aad82"
+}
diff --git a/backend/.sqlx/query-580271c5fe178f5e31f3e211cd7fea97aec4d6d3ec65d3e7402811c7dddbbf64.json b/backend/.sqlx/query-580271c5fe178f5e31f3e211cd7fea97aec4d6d3ec65d3e7402811c7dddbbf64.json
new file mode 100644
index 0000000000..e1f4609346
--- /dev/null
+++ b/backend/.sqlx/query-580271c5fe178f5e31f3e211cd7fea97aec4d6d3ec65d3e7402811c7dddbbf64.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, job_token_scopes)\n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, job_token_scopes\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "580271c5fe178f5e31f3e211cd7fea97aec4d6d3ec65d3e7402811c7dddbbf64"
+}
diff --git a/backend/.sqlx/query-58ea7e2c6b07ffc7ab7387b2ebb542cba3a5532c64a9594d2e0ccdf21dee90d0.json b/backend/.sqlx/query-58ea7e2c6b07ffc7ab7387b2ebb542cba3a5532c64a9594d2e0ccdf21dee90d0.json
new file mode 100644
index 0000000000..e03d995f15
--- /dev/null
+++ b/backend/.sqlx/query-58ea7e2c6b07ffc7ab7387b2ebb542cba3a5532c64a9594d2e0ccdf21dee90d0.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT canceled_by IS NOT NULL FROM v2_job_queue WHERE id = $1 AND workspace_id = $2 AND running",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "58ea7e2c6b07ffc7ab7387b2ebb542cba3a5532c64a9594d2e0ccdf21dee90d0"
+}
diff --git a/backend/.sqlx/query-5a975e486a0cdb0fae4dadd344ad3abc2f67827597ef74fef473e309b1951544.json b/backend/.sqlx/query-5a975e486a0cdb0fae4dadd344ad3abc2f67827597ef74fef473e309b1951544.json
new file mode 100644
index 0000000000..56f5ddbc84
--- /dev/null
+++ b/backend/.sqlx/query-5a975e486a0cdb0fae4dadd344ad3abc2f67827597ef74fef473e309b1951544.json
@@ -0,0 +1,253 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,\n            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle,\n            COALESCE(j.args->'build_binary_only' = 'true'::jsonb, false) AS \"build_binary_only!\",\n            p.job_token_scopes AS \"job_token_scopes?\"\n            FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id\n            LEFT JOIN job_perms p ON p.job_id = j.id\n            WHERE j.id = $1 AND j.workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "runnable_id: ScriptHash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 3,
+        "name": "scheduled_for",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 6,
+        "name": "flow_innermost_root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 7,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "kind!: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 9,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 10,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "script_lang: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 12,
+        "name": "permissioned_as_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 14,
+        "name": "trigger_kind: TriggerKindLabel",
+        "type_info": {
+          "Custom": {
+            "name": "job_trigger_kind",
+            "kind": {
+              "Enum": [
+                "webhook",
+                "http",
+                "websocket",
+                "kafka",
+                "email",
+                "nats",
+                "schedule",
+                "app",
+                "ui",
+                "postgres",
+                "sqs",
+                "gcp",
+                "mqtt",
+                "nextcloud",
+                "google",
+                "ci_test",
+                "github",
+                "azure",
+                "asset",
+                "freshness",
+                "amqp"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 15,
+        "name": "trigger",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 17,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 18,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 19,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 20,
+        "name": "cache_ignore_s3_path",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 21,
+        "name": "runnable_settings_handle",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 22,
+        "name": "build_binary_only!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 23,
+        "name": "job_token_scopes?",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      false,
+      false,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      null,
+      true
+    ]
+  },
+  "hash": "5a975e486a0cdb0fae4dadd344ad3abc2f67827597ef74fef473e309b1951544"
+}
diff --git a/backend/.sqlx/query-60d53c73e67dd7b29cce910fd76b6c87f2994fa2d5f33e0f3ee9effe28614abe.json b/backend/.sqlx/query-60d53c73e67dd7b29cce910fd76b6c87f2994fa2d5f33e0f3ee9effe28614abe.json
new file mode 100644
index 0000000000..f04f994e6a
--- /dev/null
+++ b/backend/.sqlx/query-60d53c73e67dd7b29cce910fd76b6c87f2994fa2d5f33e0f3ee9effe28614abe.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_token_scopes FROM script WHERE hash = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "60d53c73e67dd7b29cce910fd76b6c87f2994fa2d5f33e0f3ee9effe28614abe"
+}
diff --git a/backend/.sqlx/query-6445041033c95fcf52c79c33f34cf6c41fb443f8bd91f12bce0e53f6e91bfb16.json b/backend/.sqlx/query-6445041033c95fcf52c79c33f34cf6c41fb443f8bd91f12bce0e53f6e91bfb16.json
new file mode 100644
index 0000000000..abcdf7baab
--- /dev/null
+++ b/backend/.sqlx/query-6445041033c95fcf52c79c33f34cf6c41fb443f8bd91f12bce0e53f6e91bfb16.json
@@ -0,0 +1,331 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_status SET\n            flow_status = JSONB_SET(\n                JSONB_SET(v2_job_status.flow_status, $2::TEXT[], $3),\n                $4::TEXT[], $5\n            ) - $6::TEXT[],\n            flow_leaf_jobs = CASE\n                WHEN $7::TEXT IS NULL\n                    OR COALESCE(v2_job.flow_innermost_root_job, v2_job_status.id) <> v2_job_status.id\n                THEN v2_job_status.flow_leaf_jobs\n                ELSE JSONB_SET(COALESCE(v2_job_status.flow_leaf_jobs, '{}'::JSONB), ARRAY[$7::TEXT], $8) END\n        FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id\n            LEFT JOIN job_perms ON job_perms.job_id = v2_job_queue.id\n        WHERE v2_job_status.id = $1 AND v2_job_queue.id = $1\n        RETURNING\n            v2_job_queue.workspace_id,\n            v2_job_queue.id,\n            v2_job.args as \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\",\n            v2_job.parent_job,\n            v2_job.created_by,\n            v2_job_queue.started_at,\n            v2_job_queue.runnable_settings_handle,\n            v2_job_queue.scheduled_for,\n            v2_job.runnable_path,\n            v2_job.kind as \"kind: JobKind\",\n            v2_job.runnable_id as \"runnable_id: ScriptHash\",\n            v2_job_queue.canceled_reason,\n            v2_job_queue.canceled_by,\n            v2_job.permissioned_as,\n            v2_job.permissioned_as_email,\n            v2_job_status.flow_status as \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n            v2_job.tag,\n            v2_job.script_lang as \"script_lang: ScriptLang\",\n            v2_job.same_worker,\n            v2_job.pre_run_error,\n            v2_job.concurrent_limit,\n            v2_job.concurrency_time_window_s,\n            v2_job.flow_innermost_root_job,\n            v2_job.root_job,\n            v2_job.timeout,\n            v2_job.flow_step_id,\n            v2_job.cache_ttl,\n            v2_job_queue.cache_ignore_s3_path,\n            v2_job_queue.priority,\n            v2_job.preprocessed,\n            v2_job.script_entrypoint_override,\n            v2_job.trigger,\n            v2_job.trigger_kind as \"trigger_kind: TriggerKindLabel\",\n            v2_job.visible_to_owner,\n            NULL as permissioned_as_end_user_email,\n            job_perms.job_token_scopes",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 2,
+        "name": "args: sqlx::types::Json<HashMap<String, Box<RawValue>>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "runnable_settings_handle",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 7,
+        "name": "scheduled_for",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "kind: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 10,
+        "name": "runnable_id: ScriptHash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 11,
+        "name": "canceled_reason",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 12,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 14,
+        "name": "permissioned_as_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 15,
+        "name": "flow_status: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 16,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 17,
+        "name": "script_lang: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 18,
+        "name": "same_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 19,
+        "name": "pre_run_error",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 20,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 21,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 22,
+        "name": "flow_innermost_root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 23,
+        "name": "root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 24,
+        "name": "timeout",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 25,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 26,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 27,
+        "name": "cache_ignore_s3_path",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 28,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 29,
+        "name": "preprocessed",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 30,
+        "name": "script_entrypoint_override",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 31,
+        "name": "trigger",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 32,
+        "name": "trigger_kind: TriggerKindLabel",
+        "type_info": {
+          "Custom": {
+            "name": "job_trigger_kind",
+            "kind": {
+              "Enum": [
+                "webhook",
+                "http",
+                "websocket",
+                "kafka",
+                "email",
+                "nats",
+                "schedule",
+                "app",
+                "ui",
+                "postgres",
+                "sqs",
+                "gcp",
+                "mqtt",
+                "nextcloud",
+                "google",
+                "ci_test",
+                "github",
+                "azure",
+                "asset",
+                "freshness",
+                "amqp"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 33,
+        "name": "visible_to_owner",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 34,
+        "name": "permissioned_as_end_user_email",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 35,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "TextArray",
+        "Jsonb",
+        "TextArray",
+        "Jsonb",
+        "TextArray",
+        "Text",
+        "Jsonb"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      true,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      null,
+      true
+    ]
+  },
+  "hash": "6445041033c95fcf52c79c33f34cf6c41fb443f8bd91f12bce0e53f6e91bfb16"
+}
diff --git a/backend/.sqlx/query-67db536d06c57f195641f178ce651cbd7b8896984115d55318bb6f4100d72d9a.json b/backend/.sqlx/query-67db536d06c57f195641f178ce651cbd7b8896984115d55318bb6f4100d72d9a.json
new file mode 100644
index 0000000000..cfd88ed5cb
--- /dev/null
+++ b/backend/.sqlx/query-67db536d06c57f195641f178ce651cbd7b8896984115d55318bb6f4100d72d9a.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT $2 IN (parent_job, root_job, flow_innermost_root_job) FROM v2_job\n            WHERE id = $1 AND workspace_id = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "67db536d06c57f195641f178ce651cbd7b8896984115d55318bb6f4100d72d9a"
+}
diff --git a/backend/.sqlx/query-fe17aff543f28cf4d6d09ea7c4c7d18ff6a95a8402468131f5a5f33df91c59e4.json b/backend/.sqlx/query-69e1c04c246c42a3a1d7202b6fb349d0ac779431993e225945ddfb91489cb927.json
similarity index 59%
rename from backend/.sqlx/query-fe17aff543f28cf4d6d09ea7c4c7d18ff6a95a8402468131f5a5f33df91c59e4.json
rename to backend/.sqlx/query-69e1c04c246c42a3a1d7202b6fb349d0ac779431993e225945ddfb91489cb927.json
index c747e99795..751b727d0f 100644
--- a/backend/.sqlx/query-fe17aff543f28cf4d6d09ea7c4c7d18ff6a95a8402468131f5a5f33df91c59e4.json
+++ b/backend/.sqlx/query-69e1c04c246c42a3a1d7202b6fb349d0ac779431993e225945ddfb91489cb927.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 1111111111, 'f/test/error_handler', $1, 'deno', 'script', 'test-user', '{}', 'Error handler script', 'Handles failed job completions', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 1111111111, 'f/test/error_handler', $1, 'bun', 'script', 'test-user', '{}', 'Error handler script', 'Handles failed job completions', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,5 +10,5 @@
     },
     "nullable": []
   },
-  "hash": "fe17aff543f28cf4d6d09ea7c4c7d18ff6a95a8402468131f5a5f33df91c59e4"
+  "hash": "69e1c04c246c42a3a1d7202b6fb349d0ac779431993e225945ddfb91489cb927"
 }
diff --git a/backend/.sqlx/query-706f2227e34971d22a577b33f6aaa7f5755da9997419c4a9d07b30d4da318bea.json b/backend/.sqlx/query-706f2227e34971d22a577b33f6aaa7f5755da9997419c4a9d07b30d4da318bea.json
new file mode 100644
index 0000000000..7c305d1e7a
--- /dev/null
+++ b/backend/.sqlx/query-706f2227e34971d22a577b33f6aaa7f5755da9997419c4a9d07b30d4da318bea.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (\n            workspace_id, hash, path, parent_hashes, summary, description, content,\n            created_by, created_at, archived, schema, deleted, is_template,\n            extra_perms, lock, lock_error_logs, language, kind, tag,\n            envs, concurrent_limit, concurrency_time_window_s, cache_ttl,\n            dedicated_worker, ws_error_handler_muted, priority, timeout,\n            delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,\n            visible_to_runner_only, auto_kind, codebase, has_preprocessor,\n            on_behalf_of, on_behalf_of_email, assets, modules, job_token_scopes\n        )\n        SELECT\n            $1, hash, path, parent_hashes, summary, description, content,\n            created_by, created_at, archived, schema, deleted, is_template,\n            extra_perms, lock, lock_error_logs, language, kind, tag,\n            envs, concurrent_limit, concurrency_time_window_s, cache_ttl,\n            dedicated_worker, ws_error_handler_muted, priority, timeout,\n            delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,\n            visible_to_runner_only, auto_kind, codebase, has_preprocessor,\n            -- Same three forms and the same prefix-first rule as permissioned_as_exists,\n            -- superadmin fallback included: one acting outside their workspaces has no usr\n            -- row but still authenticates.\n            CASE WHEN on_behalf_of LIKE 'u/%' THEN\n                    (SELECT on_behalf_of WHERE EXISTS (\n                        SELECT 1 FROM usr u WHERE u.workspace_id = $1::varchar\n                          AND u.username = substring(on_behalf_of from 3)\n                        UNION ALL\n                        SELECT 1 FROM password p WHERE p.super_admin\n                          AND (p.username = substring(on_behalf_of from 3)\n                               OR p.email = substring(on_behalf_of from 3))))\n                 WHEN on_behalf_of LIKE 'g/%' THEN\n                    (SELECT on_behalf_of WHERE EXISTS (\n                        SELECT 1 FROM group_ g WHERE g.workspace_id = $1::varchar\n                          AND g.name = substring(on_behalf_of from 3)))\n                 ELSE\n                    (SELECT on_behalf_of WHERE EXISTS (\n                        SELECT 1 FROM usr u WHERE u.workspace_id = $1::varchar\n                          AND u.username = on_behalf_of\n                        UNION ALL\n                        SELECT 1 FROM password p WHERE p.email = on_behalf_of\n                          AND p.super_admin))\n            END, on_behalf_of_email, assets, modules, job_token_scopes\n        FROM script\n        WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "706f2227e34971d22a577b33f6aaa7f5755da9997419c4a9d07b30d4da318bea"
+}
diff --git a/backend/.sqlx/query-71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e.json b/backend/.sqlx/query-71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e.json
new file mode 100644
index 0000000000..ba1cc13fac
--- /dev/null
+++ b/backend/.sqlx/query-71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e.json
@@ -0,0 +1,45 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH deleted AS (\n            DELETE FROM v2_job_queue WHERE id = $1\n            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,\n                (extras->>'wac_first_started_at')::timestamptz AS first_started_at,\n                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms\n        ), completed AS (\n            INSERT INTO v2_job_completed AS cj\n                ( workspace_id\n                , id\n                , started_at\n                , duration_ms\n                , extras\n                , result\n                , result_columns\n                , canceled_by\n                , canceled_reason\n                , flow_status\n                , workflow_as_code_status\n                , memory_peak\n                , status\n                , worker\n                )\n            SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),\n                CASE WHEN d.first_started_at IS NULL THEN d.run_ms\n                    ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,\n                CASE WHEN d.first_started_at IS NOT NULL\n                    THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,\n                $3::text::jsonb, $10,\n                CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                s.flow_status, s.workflow_as_code_status, $8,\n                CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                    WHEN $7::BOOL THEN 'skipped'::job_status\n                    WHEN $2::BOOL THEN 'success'::job_status\n                    ELSE 'failure'::job_status END,\n                d.worker\n            FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n            RETURNING cj.started_at, cj.duration_ms,\n                COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms\n        ), parent_ping AS (\n            UPDATE v2_job_runtime r SET ping = now()\n            FROM v2_job_queue q\n            WHERE r.id = $11 AND q.id = r.id AND q.workspace_id = $12\n                AND EXISTS (SELECT 1 FROM completed)\n        )\n        SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",\n            last_run_ms AS \"last_run_ms!\" FROM completed",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "started_at?",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "last_run_ms!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Bool",
+        "Text",
+        "Bool",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Int4",
+        "Int8",
+        "TextArray",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      null
+    ]
+  },
+  "hash": "71c9e0c0f1d9eba0f24c8e410ca2f2a64dc559e3228d3b763f68b1ad3491ae6e"
+}
diff --git a/backend/.sqlx/query-71de038f332593e2177f33284854b6c0bfe9bb4999f2c4e9082a4c5f3b341496.json b/backend/.sqlx/query-71de038f332593e2177f33284854b6c0bfe9bb4999f2c4e9082a4c5f3b341496.json
deleted file mode 100644
index b647ec29fa..0000000000
--- a/backend/.sqlx/query-71de038f332593e2177f33284854b6c0bfe9bb4999f2c4e9082a4c5f3b341496.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            id,\n            runnable_path,\n            permissioned_as_email,\n            parent_job\n        FROM v2_job\n        WHERE workspace_id = 'test-workspace'\n            AND permissioned_as_email = 'success_handler@windmill.dev'\n        ORDER BY created_at DESC\n        LIMIT 1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "runnable_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "permissioned_as_email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "parent_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      true
-    ]
-  },
-  "hash": "71de038f332593e2177f33284854b6c0bfe9bb4999f2c4e9082a4c5f3b341496"
-}
diff --git a/backend/.sqlx/query-76440a1c5b40a897078817cc960247270c9044b363b71496ba36e1357c63a2a4.json b/backend/.sqlx/query-76440a1c5b40a897078817cc960247270c9044b363b71496ba36e1357c63a2a4.json
new file mode 100644
index 0000000000..8eecbfa7bc
--- /dev/null
+++ b/backend/.sqlx/query-76440a1c5b40a897078817cc960247270c9044b363b71496ba36e1357c63a2a4.json
@@ -0,0 +1,155 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE lineage AS (\n            SELECT id, parent_job, kind, runnable_path, runnable_id, trigger_kind, trigger,\n                tag, permissioned_as, args, 0 AS depth\n            FROM v2_job WHERE id = $1 AND workspace_id = $2\n          UNION ALL\n            SELECT p.id, p.parent_job, p.kind, p.runnable_path, p.runnable_id, p.trigger_kind,\n                p.trigger, p.tag, p.permissioned_as, p.args, l.depth + 1\n            FROM v2_job p JOIN lineage l ON p.id = l.parent_job\n            WHERE p.workspace_id = $2 AND l.depth < 100\n        )\n        SELECT id AS \"id!\", parent_job, kind AS \"kind!: JobKind\", runnable_path, runnable_id,\n            trigger_kind::text AS trigger_kind, trigger, tag AS \"tag!\",\n            permissioned_as AS \"permissioned_as!\",\n            -- A restart takes its flow version from the request, so a trusted flow path\n            -- can carry another flow's code: the version must belong to that path.\n            CASE kind\n                WHEN 'flow' THEN EXISTS (SELECT 1 FROM flow_version fv\n                    WHERE fv.id = runnable_id AND fv.path = runnable_path AND fv.workspace_id = $2)\n                WHEN 'script' THEN EXISTS (SELECT 1 FROM script s\n                    WHERE s.hash = runnable_id AND s.path = runnable_path AND s.workspace_id = $2\n                        AND NOT s.deleted)\n                ELSE true\n            END AS \"origin_verified!\",\n            -- What `run/f` and `run/p` resolve the path to now; for scripts the predicate of\n            -- `get_latest_deployed_script_hash`.\n            COALESCE(CASE kind\n                WHEN 'flow' THEN runnable_id = (SELECT f.versions[array_upper(f.versions, 1)]\n                    FROM flow f WHERE f.path = runnable_path AND f.workspace_id = $2)\n                WHEN 'script' THEN runnable_id = (SELECT s.hash FROM script s\n                    WHERE s.path = runnable_path AND s.workspace_id = $2 AND NOT s.deleted\n                        AND s.lock IS NOT NULL AND s.lock_error_logs IS NULL\n                    ORDER BY s.created_at DESC LIMIT 1)\n            END, false) AS \"current_version!\",\n            EXISTS (SELECT 1 FROM v2_job_status st WHERE st.id = lineage.id\n                    AND jsonb_typeof(st.flow_status->'restarted_from') = 'object')\n                OR EXISTS (SELECT 1 FROM v2_job_completed c WHERE c.id = lineage.id\n                    AND jsonb_typeof(c.flow_status->'restarted_from') = 'object')\n                AS \"restarted!\",\n            COALESCE(\n                (SELECT st.flow_status->'restarted_from'->>'flow_job_id' FROM v2_job_status st\n                    WHERE st.id = lineage.id),\n                (SELECT c.flow_status->'restarted_from'->>'flow_job_id' FROM v2_job_completed c\n                    WHERE c.id = lineage.id)\n            ) AS restarted_from,\n            -- Only deployed-app runs are stamped with their app; an app editor preview\n            -- runs app code at an app path it does not have to own.\n            COALESCE(trigger_kind = 'app' AND starts_with(runnable_path, trigger || '/'), false)\n                AS \"app_stamped!\",\n            -- A preview's modules come from its args, which its parent may have taken from\n            -- the caller.\n            COALESCE(jsonb_typeof(args->'_MODULES') = 'object', false) AS \"args_modules!\",\n            CASE WHEN depth = 0 THEN (SELECT wp.worker_group FROM v2_job_queue q\n                JOIN worker_ping wp ON wp.worker = q.worker WHERE q.id = lineage.id)\n            END AS worker_group,\n            CASE WHEN depth = 0 THEN CASE\n                WHEN starts_with(permissioned_as, 'g/') THEN 'group'\n                ELSE (SELECT CASE WHEN u.is_service_account THEN 'service_account' ELSE 'user' END\n                    FROM usr u WHERE starts_with(permissioned_as, 'u/')\n                        AND u.username = substr(permissioned_as, 3) AND u.workspace_id = $2)\n            END END AS run_as_type,\n            -- The canonical item `item_digest` hashes, null members included.\n            CASE WHEN depth = 0 OR depth = max(depth) OVER () THEN CASE kind\n                WHEN 'script' THEN (SELECT jsonb_build_object('content', s.content,\n                        'lock', s.lock, 'codebase', s.codebase,\n                        'modules', (SELECT jsonb_object_agg(m.key, m.value - 'language')\n                            FROM jsonb_each(s.modules) m))\n                    FROM script s WHERE s.hash = runnable_id AND s.workspace_id = $2\n                        AND NOT s.deleted)\n                WHEN 'flow' THEN (SELECT fv.value FROM flow_version fv\n                    WHERE fv.id = runnable_id AND fv.workspace_id = $2)\n                WHEN 'flowscript' THEN (SELECT jsonb_build_object('content', n.code,\n                        'lock', n.lock)\n                    FROM flow_node n WHERE n.id = runnable_id AND n.workspace_id = $2)\n            END END AS digest_source\n        FROM lineage ORDER BY depth",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 2,
+        "name": "kind!: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 3,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "runnable_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 5,
+        "name": "trigger_kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "trigger",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "tag!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "permissioned_as!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "origin_verified!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 10,
+        "name": "current_version!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 11,
+        "name": "restarted!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "restarted_from",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 13,
+        "name": "app_stamped!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 14,
+        "name": "args_modules!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 15,
+        "name": "worker_group",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "run_as_type",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 17,
+        "name": "digest_source",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "76440a1c5b40a897078817cc960247270c9044b363b71496ba36e1357c63a2a4"
+}
diff --git a/backend/.sqlx/query-77e9cb16c25defc2423621a64f020e1e07f7e50df82fb6c33f79e6faa5b77bab.json b/backend/.sqlx/query-77e9cb16c25defc2423621a64f020e1e07f7e50df82fb6c33f79e6faa5b77bab.json
new file mode 100644
index 0000000000..57822becd2
--- /dev/null
+++ b/backend/.sqlx/query-77e9cb16c25defc2423621a64f020e1e07f7e50df82fb6c33f79e6faa5b77bab.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT coalesce(flow_version_lite.value, flow_version.value) as \"value!: sqlx::types::Json<Box<RawValue>>\", flow.job_token_scopes FROM flow\n                        LEFT JOIN flow_version\n                            ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]\n                        LEFT JOIN flow_version_lite\n                            ON flow_version_lite.id = flow_version.id\n                        WHERE flow.path = $1 AND flow.workspace_id = $2 LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "value!: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      true
+    ]
+  },
+  "hash": "77e9cb16c25defc2423621a64f020e1e07f7e50df82fb6c33f79e6faa5b77bab"
+}
diff --git a/backend/.sqlx/query-7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13.json b/backend/.sqlx/query-7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13.json
new file mode 100644
index 0000000000..1c8dfcfa57
--- /dev/null
+++ b/backend/.sqlx/query-7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT wp.draining FROM v2_job j\n            JOIN v2_job_queue q ON q.id = j.id\n            JOIN worker_ping wp ON wp.worker = q.worker\n            WHERE j.id = $1 AND j.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL\n            AND ($3::text[] IS NULL OR j.tag = ANY($3))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "draining",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "7963eff5f7109874b94c0940eaef7d4b418a9e82be56dfe7dd65d160e0dcfd13"
+}
diff --git a/backend/.sqlx/query-1debd472c9ffd2fc78877484f93db51f9aabed54f9894eda8ad610053ad76ce6.json b/backend/.sqlx/query-83e9c830ee816d4e4e7193a67823cab7c9a4461d3bfbdc0fe7dbdd28ae2de924.json
similarity index 56%
rename from backend/.sqlx/query-1debd472c9ffd2fc78877484f93db51f9aabed54f9894eda8ad610053ad76ce6.json
rename to backend/.sqlx/query-83e9c830ee816d4e4e7193a67823cab7c9a4461d3bfbdc0fe7dbdd28ae2de924.json
index 96147d531e..b6a5d2a2d0 100644
--- a/backend/.sqlx/query-1debd472c9ffd2fc78877484f93db51f9aabed54f9894eda8ad610053ad76ce6.json
+++ b/backend/.sqlx/query-83e9c830ee816d4e4e7193a67823cab7c9a4461d3bfbdc0fe7dbdd28ae2de924.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT restart_unless_cancelled, timeout FROM script WHERE hash = $1 AND workspace_id = $2",
+  "query": "SELECT restart_unless_cancelled, timeout, job_token_scopes FROM script WHERE hash = $1 AND workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -12,6 +12,11 @@
         "ordinal": 1,
         "name": "timeout",
         "type_info": "Int4"
+      },
+      {
+        "ordinal": 2,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -21,9 +26,10 @@
       ]
     },
     "nullable": [
+      true,
       true,
       true
     ]
   },
-  "hash": "1debd472c9ffd2fc78877484f93db51f9aabed54f9894eda8ad610053ad76ce6"
+  "hash": "83e9c830ee816d4e4e7193a67823cab7c9a4461d3bfbdc0fe7dbdd28ae2de924"
 }
diff --git a/backend/.sqlx/query-51f18c817d4014e847486f5a8dbf205ffa0e53d5bd3fdb97777e988389b1d69e.json b/backend/.sqlx/query-8511e096394edb1433f6572d50b66d8558866af53d829d83fa634f12a90733c0.json
similarity index 61%
rename from backend/.sqlx/query-51f18c817d4014e847486f5a8dbf205ffa0e53d5bd3fdb97777e988389b1d69e.json
rename to backend/.sqlx/query-8511e096394edb1433f6572d50b66d8558866af53d829d83fa634f12a90733c0.json
index 6eceb86132..3420b8c337 100644
--- a/backend/.sqlx/query-51f18c817d4014e847486f5a8dbf205ffa0e53d5bd3fdb97777e988389b1d69e.json
+++ b/backend/.sqlx/query-8511e096394edb1433f6572d50b66d8558866af53d829d83fa634f12a90733c0.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/success_script', 'export function main() { return \"ok\"; }', 'deno', 'script', 'test-user', '{}', '', '', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/success_script', 'export function main() { return \"ok\"; }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,5 +10,5 @@
     },
     "nullable": []
   },
-  "hash": "51f18c817d4014e847486f5a8dbf205ffa0e53d5bd3fdb97777e988389b1d69e"
+  "hash": "8511e096394edb1433f6572d50b66d8558866af53d829d83fa634f12a90733c0"
 }
diff --git a/backend/.sqlx/query-8645e610aa35088376d0919132459bce3ad17df617855e5fcf838f6349e68c97.json b/backend/.sqlx/query-8645e610aa35088376d0919132459bce3ad17df617855e5fcf838f6349e68c97.json
new file mode 100644
index 0000000000..446e9da6df
--- /dev/null
+++ b/backend/.sqlx/query-8645e610aa35088376d0919132459bce3ad17df617855e5fcf838f6349e68c97.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO global_settings (name, value) VALUES ($1, 'true'::jsonb) ON CONFLICT (name) DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8645e610aa35088376d0919132459bce3ad17df617855e5fcf838f6349e68c97"
+}
diff --git a/backend/.sqlx/query-7904ac35748b1de2c7ff764f22787436d0fe74f99f298e5c399233f0d247f2ec.json b/backend/.sqlx/query-8aef4f9d27ec6df07cd671bcf90bf378e9fac4986cd29f69c1f2b8a83ba515c3.json
similarity index 54%
rename from backend/.sqlx/query-7904ac35748b1de2c7ff764f22787436d0fe74f99f298e5c399233f0d247f2ec.json
rename to backend/.sqlx/query-8aef4f9d27ec6df07cd671bcf90bf378e9fac4986cd29f69c1f2b8a83ba515c3.json
index e103a91c1e..53a9daaf9a 100644
--- a/backend/.sqlx/query-7904ac35748b1de2c7ff764f22787436d0fe74f99f298e5c399233f0d247f2ec.json
+++ b/backend/.sqlx/query-8aef4f9d27ec6df07cd671bcf90bf378e9fac4986cd29f69c1f2b8a83ba515c3.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "WITH RECURSIVE chain(id, parent_job) AS (\n                SELECT id, parent_job FROM v2_job WHERE id = $1 AND workspace_id = $2\n                UNION ALL\n                SELECT j.id, j.parent_job FROM v2_job j\n                    JOIN chain c ON j.id = c.parent_job AND j.workspace_id = $2\n            )\n            SELECT\n                CASE WHEN a.agent THEN regexp_replace(j.runnable_path, '\\.chat$', '')\n                    ELSE j.runnable_path END AS runnable_path,\n                CASE\n                    WHEN a.agent THEN 'agents'\n                    WHEN j.kind IN ('script', 'script_hub', 'unassigned_script') THEN 'scripts'\n                    WHEN j.kind IN ('flow', 'unassigned_flow') THEN 'flows'\n                    WHEN j.kind IN ('singlestepflow', 'unassigned_singlestepflow') THEN\n                        CASE WHEN COALESCE(\n                                (SELECT m->'value'->>'type'\n                                    FROM jsonb_array_elements(j.raw_flow->'modules') m\n                                    WHERE m->>'id' IN ('a', 'main')\n                                    LIMIT 1),\n                                'script'\n                            ) = 'flow' THEN 'flows' ELSE 'scripts' END\n                END AS scope_kind,\n                CASE WHEN j.trigger_kind = 'app' THEN j.trigger END AS launched_by_app\n            FROM v2_job j JOIN chain c ON c.id = j.id,\n            LATERAL (SELECT j.kind = 'flowpreview'\n                AND j.raw_flow->'modules'->1 IS NULL\n                AND j.raw_flow->'modules'->0->>'id' = '__wm_agent_root' AS agent) a\n            WHERE j.workspace_id = $2",
+  "query": "WITH RECURSIVE chain(id, parent_job) AS (\n                SELECT id, parent_job FROM v2_job WHERE id = $1 AND workspace_id = $2\n                UNION ALL\n                SELECT j.id, j.parent_job FROM v2_job j\n                    JOIN chain c ON j.id = c.parent_job AND j.workspace_id = $2\n            )\n            SELECT\n                CASE WHEN a.agent THEN regexp_replace(j.runnable_path, '\\.chat$', '')\n                    ELSE j.runnable_path END AS runnable_path,\n                CASE\n                    WHEN a.agent THEN 'agents'\n                    WHEN j.kind IN ('script', 'script_hub', 'unassigned_script') THEN 'scripts'\n                    WHEN j.kind IN ('flow', 'unassigned_flow') THEN 'flows'\n                    WHEN j.kind IN ('dependencies', 'flowdependencies') THEN 'dependencies'\n                    WHEN j.kind IN ('singlestepflow', 'unassigned_singlestepflow') THEN\n                        CASE WHEN COALESCE(\n                                (SELECT m->'value'->>'type'\n                                    FROM jsonb_array_elements(j.raw_flow->'modules') m\n                                    WHERE m->>'id' IN ('a', 'main')\n                                    LIMIT 1),\n                                'script'\n                            ) = 'flow' THEN 'flows' ELSE 'scripts' END\n                END AS scope_kind,\n                CASE WHEN j.trigger_kind = 'app' THEN j.trigger END AS launched_by_app\n            FROM v2_job j JOIN chain c ON c.id = j.id,\n            LATERAL (SELECT j.kind = 'flowpreview'\n                AND j.raw_flow->'modules'->1 IS NULL\n                AND j.raw_flow->'modules'->0->>'id' = '__wm_agent_root' AS agent) a\n            WHERE j.workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -31,5 +31,5 @@
       null
     ]
   },
-  "hash": "7904ac35748b1de2c7ff764f22787436d0fe74f99f298e5c399233f0d247f2ec"
+  "hash": "8aef4f9d27ec6df07cd671bcf90bf378e9fac4986cd29f69c1f2b8a83ba515c3"
 }
diff --git a/backend/.sqlx/query-1860c102a5309a8e1bb7288d0616f48e4330af7fbe61426e999c6073f630d88f.json b/backend/.sqlx/query-8f5091626054a43be07768f30cdc99bd68f1de8064ace4155f4da2cd45d1b403.json
similarity index 56%
rename from backend/.sqlx/query-1860c102a5309a8e1bb7288d0616f48e4330af7fbe61426e999c6073f630d88f.json
rename to backend/.sqlx/query-8f5091626054a43be07768f30cdc99bd68f1de8064ace4155f4da2cd45d1b403.json
index d67ddf711b..574156394d 100644
--- a/backend/.sqlx/query-1860c102a5309a8e1bb7288d0616f48e4330af7fbe61426e999c6073f630d88f.json
+++ b/backend/.sqlx/query-8f5091626054a43be07768f30cdc99bd68f1de8064ace4155f4da2cd45d1b403.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT DISTINCT ON (path)\n                      path,\n                      value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                      created_at,\n                      typ::text as \"typ!\"\n               FROM draft\n               WHERE workspace_id = $1\n                 AND typ IN ('app', 'raw_app')\n                 AND (email = $2 OR email IS NULL)\n                 AND NOT EXISTS (\n                     SELECT 1 FROM app a\n                     WHERE a.workspace_id = draft.workspace_id\n                       AND a.path = draft.path\n                 )\n               ORDER BY path, (email IS NULL), created_at DESC",
+  "query": "SELECT DISTINCT ON (path)\n                      path,\n                      value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                      created_at,\n                      email IS NULL as \"legacy!\"\n               FROM draft\n               WHERE workspace_id = $1\n                 AND typ = 'flow'\n                 AND (email = $2 OR email IS NULL)\n                 AND NOT EXISTS (\n                     SELECT 1 FROM flow f\n                     WHERE f.workspace_id = draft.workspace_id\n                       AND f.path = draft.path\n                 )\n               ORDER BY path, (email IS NULL)",
   "describe": {
     "columns": [
       {
@@ -20,8 +20,8 @@
       },
       {
         "ordinal": 3,
-        "name": "typ!",
-        "type_info": "Text"
+        "name": "legacy!",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -37,5 +37,5 @@
       null
     ]
   },
-  "hash": "1860c102a5309a8e1bb7288d0616f48e4330af7fbe61426e999c6073f630d88f"
+  "hash": "8f5091626054a43be07768f30cdc99bd68f1de8064ace4155f4da2cd45d1b403"
 }
diff --git a/backend/.sqlx/query-91fdd565bd210f8aa4c6d5f5e309573aefaeb5dbc6ac07f5e664bc8fe2cb2683.json b/backend/.sqlx/query-91fdd565bd210f8aa4c6d5f5e309573aefaeb5dbc6ac07f5e664bc8fe2cb2683.json
new file mode 100644
index 0000000000..ba917c82db
--- /dev/null
+++ b/backend/.sqlx/query-91fdd565bd210f8aa4c6d5f5e309573aefaeb5dbc6ac07f5e664bc8fe2cb2683.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(config->'paused' = 'true'::jsonb, false) FROM config WHERE name = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "coalesce",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "91fdd565bd210f8aa4c6d5f5e309573aefaeb5dbc6ac07f5e664bc8fe2cb2683"
+}
diff --git a/backend/.sqlx/query-9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d.json b/backend/.sqlx/query-9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d.json
deleted file mode 100644
index f105dd7825..0000000000
--- a/backend/.sqlx/query-9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH deleted AS (\n                    DELETE FROM v2_job_queue WHERE id = $1\n                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason\n                ), completed AS (\n                    INSERT INTO v2_job_completed AS cj\n                        ( workspace_id\n                        , id\n                        , started_at\n                        , duration_ms\n                        , result\n                        , result_columns\n                        , canceled_by\n                        , canceled_reason\n                        , flow_status\n                        , workflow_as_code_status\n                        , memory_peak\n                        , status\n                        , worker\n                        )\n                    SELECT d.workspace_id, d.id, d.started_at,\n                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),\n                        $3::text::jsonb, $10,\n                        CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                        CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                        s.flow_status, s.workflow_as_code_status, $8,\n                        CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                            WHEN $7::BOOL THEN 'skipped'::job_status\n                            WHEN $2::BOOL THEN 'success'::job_status\n                            ELSE 'failure'::job_status END,\n                        d.worker\n                    FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n                    ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                        canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                        canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n                    RETURNING duration_ms\n                )\n                SELECT duration_ms AS \"duration_ms!\" FROM completed",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "duration_ms!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Bool",
-        "Text",
-        "Bool",
-        "Varchar",
-        "Text",
-        "Bool",
-        "Int4",
-        "Int8",
-        "TextArray"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "9212902d4eb2834ab3b429968a7a85c53c49e4ef0f42c146324d5c71fbd1e21d"
-}
diff --git a/backend/.sqlx/query-ee769c78ec0a782de18911cdcb655aad93cf23321cd0f42f7ffa5348bfbea26e.json b/backend/.sqlx/query-966b065bd6bbbff9e0ca15bee504f9cfe5e3a75427767de41e5b85c797f7d58a.json
similarity index 57%
rename from backend/.sqlx/query-ee769c78ec0a782de18911cdcb655aad93cf23321cd0f42f7ffa5348bfbea26e.json
rename to backend/.sqlx/query-966b065bd6bbbff9e0ca15bee504f9cfe5e3a75427767de41e5b85c797f7d58a.json
index bb7e4fa36b..b3a2ea6a05 100644
--- a/backend/.sqlx/query-ee769c78ec0a782de18911cdcb655aad93cf23321cd0f42f7ffa5348bfbea26e.json
+++ b/backend/.sqlx/query-966b065bd6bbbff9e0ca15bee504f9cfe5e3a75427767de41e5b85c797f7d58a.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS (SELECT 1 FROM v2_job_queue WHERE id = $1 AND workspace_id = $2 AND running)",
+  "query": "SELECT EXISTS (SELECT 1 FROM global_settings WHERE name = $1)",
   "describe": {
     "columns": [
       {
@@ -11,7 +11,6 @@
     ],
     "parameters": {
       "Left": [
-        "Uuid",
         "Text"
       ]
     },
@@ -19,5 +18,5 @@
       null
     ]
   },
-  "hash": "ee769c78ec0a782de18911cdcb655aad93cf23321cd0f42f7ffa5348bfbea26e"
+  "hash": "966b065bd6bbbff9e0ca15bee504f9cfe5e3a75427767de41e5b85c797f7d58a"
 }
diff --git a/backend/.sqlx/query-975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5.json b/backend/.sqlx/query-975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5.json
deleted file mode 100644
index 0b166b32a4..0000000000
--- a/backend/.sqlx/query-975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH deleted AS (\n            DELETE FROM v2_job_queue WHERE id = $1\n            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason\n        ), completed AS (\n            INSERT INTO v2_job_completed AS cj\n                ( workspace_id\n                , id\n                , started_at\n                , duration_ms\n                , result\n                , result_columns\n                , canceled_by\n                , canceled_reason\n                , flow_status\n                , workflow_as_code_status\n                , memory_peak\n                , status\n                , worker\n                )\n            SELECT d.workspace_id, d.id, d.started_at,\n                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),\n                $3::text::jsonb, $10,\n                CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                s.flow_status, s.workflow_as_code_status, $8,\n                CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                    WHEN $7::BOOL THEN 'skipped'::job_status\n                    WHEN $2::BOOL THEN 'success'::job_status\n                    ELSE 'failure'::job_status END,\n                d.worker\n            FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n            ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                    THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n            RETURNING duration_ms\n        ), parent_ping AS (\n            UPDATE v2_job_runtime r SET ping = now()\n            FROM v2_job_queue q\n            WHERE r.id = $11 AND q.id = r.id AND q.workspace_id = $12\n                AND EXISTS (SELECT 1 FROM completed)\n        )\n        SELECT duration_ms AS \"duration_ms!\" FROM completed",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "duration_ms!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Bool",
-        "Text",
-        "Bool",
-        "Varchar",
-        "Text",
-        "Bool",
-        "Int4",
-        "Int8",
-        "TextArray",
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "975158ae72ec12f3f933fba1d9623bf1c925feebe746299cd1f0eda3f8b949d5"
-}
diff --git a/backend/.sqlx/query-97d8a9835344b8c72d59afc99d76b681c5120ef29eb09b8626a3fbc43a32cc0e.json b/backend/.sqlx/query-97d8a9835344b8c72d59afc99d76b681c5120ef29eb09b8626a3fbc43a32cc0e.json
new file mode 100644
index 0000000000..abf8b56d79
--- /dev/null
+++ b/backend/.sqlx/query-97d8a9835344b8c72d59afc99d76b681c5120ef29eb09b8626a3fbc43a32cc0e.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM runnable_job_stats WHERE hour < $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "97d8a9835344b8c72d59afc99d76b681c5120ef29eb09b8626a3fbc43a32cc0e"
+}
diff --git a/backend/.sqlx/query-5223412e366b22d953867425ed6156a66727e7a469abad1664ee03a3da31078a.json b/backend/.sqlx/query-9a29bd07a66f31f7414b79cafd8073194c6990eedad4b5b540134dd13d72abb1.json
similarity index 52%
rename from backend/.sqlx/query-5223412e366b22d953867425ed6156a66727e7a469abad1664ee03a3da31078a.json
rename to backend/.sqlx/query-9a29bd07a66f31f7414b79cafd8073194c6990eedad4b5b540134dd13d72abb1.json
index be5e26ef9b..e8f288f4a4 100644
--- a/backend/.sqlx/query-5223412e366b22d953867425ed6156a66727e7a469abad1664ee03a3da31078a.json
+++ b/backend/.sqlx/query-9a29bd07a66f31f7414b79cafd8073194c6990eedad4b5b540134dd13d72abb1.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT DISTINCT ON (path)\n                      path,\n                      value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                      created_at\n               FROM draft\n               WHERE workspace_id = $1\n                 AND typ = 'flow'\n                 AND (email = $2 OR email IS NULL)\n                 AND NOT EXISTS (\n                     SELECT 1 FROM flow f\n                     WHERE f.workspace_id = draft.workspace_id\n                       AND f.path = draft.path\n                 )\n               ORDER BY path, (email IS NULL)",
+  "query": "SELECT DISTINCT ON (path)\n                      path,\n                      value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                      created_at,\n                      email IS NULL as \"legacy!\"\n               FROM draft\n               WHERE workspace_id = $1\n                 AND typ = 'script'\n                 AND (email = $2 OR email IS NULL)\n                 AND NOT EXISTS (\n                     SELECT 1 FROM script s\n                     WHERE s.workspace_id = draft.workspace_id\n                       AND s.path = draft.path\n                 )\n               ORDER BY path, (email IS NULL)",
   "describe": {
     "columns": [
       {
@@ -17,6 +17,11 @@
         "ordinal": 2,
         "name": "created_at",
         "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "legacy!",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -28,8 +33,9 @@
     "nullable": [
       false,
       false,
-      false
+      false,
+      null
     ]
   },
-  "hash": "5223412e366b22d953867425ed6156a66727e7a469abad1664ee03a3da31078a"
+  "hash": "9a29bd07a66f31f7414b79cafd8073194c6990eedad4b5b540134dd13d72abb1"
 }
diff --git a/backend/.sqlx/query-9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d.json b/backend/.sqlx/query-9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d.json
new file mode 100644
index 0000000000..59ed0e1767
--- /dev/null
+++ b/backend/.sqlx/query-9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue\n         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null,\n             extras = CASE WHEN started_at IS NULL OR extras ? 'wac_first_started_at' THEN extras\n                 ELSE jsonb_set(COALESCE(extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(started_at))\n             END\n         WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "Int4",
+        "Float8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9e7a5e1ebba42217092971dd340cd9182a4812b14735e502958eaafeb4c6b33d"
+}
diff --git a/backend/.sqlx/query-a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665.json b/backend/.sqlx/query-a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665.json
deleted file mode 100644
index 2358af807f..0000000000
--- a/backend/.sqlx/query-a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n    SELECT usr.email, usage.executions\n        FROM usr, LATERAL (\n            SELECT COALESCE(SUM(c.duration_ms + 1000)/1000 , 0)::BIGINT executions\n                FROM v2_job_completed c JOIN v2_job j USING (id)\n                WHERE j.workspace_id = $1\n                AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')\n                AND j.permissioned_as_email = usr.email\n                AND now() - '1 week'::interval < j.created_at\n            ) usage\n        WHERE workspace_id = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "executions",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "a2f6ca89faaa8d8739f67cd1aae571de793b377dd6058065f51b12c974e5b665"
-}
diff --git a/backend/.sqlx/query-a6d355b3121f199f3827c05aaa7c8f780ab4c9d3d373d3cd0bb489e0d173040c.json b/backend/.sqlx/query-a6d355b3121f199f3827c05aaa7c8f780ab4c9d3d373d3cd0bb489e0d173040c.json
new file mode 100644
index 0000000000..e1657e156b
--- /dev/null
+++ b/backend/.sqlx/query-a6d355b3121f199f3827c05aaa7c8f780ab4c9d3d373d3cd0bb489e0d173040c.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(config->'paused' = 'true'::jsonb, false) FROM config WHERE name = $1 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "coalesce",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "a6d355b3121f199f3827c05aaa7c8f780ab4c9d3d373d3cd0bb489e0d173040c"
+}
diff --git a/backend/.sqlx/query-12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c.json b/backend/.sqlx/query-a6dafb34be6088886b078ed2b554de8c72e312ef8abd5ed29482a59c8ec51dd7.json
similarity index 68%
rename from backend/.sqlx/query-12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c.json
rename to backend/.sqlx/query-a6dafb34be6088886b078ed2b554de8c72e312ef8abd5ed29482a59c8ec51dd7.json
index 4c120699aa..bde8b28723 100644
--- a/backend/.sqlx/query-12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c.json
+++ b/backend/.sqlx/query-a6dafb34be6088886b078ed2b554de8c72e312ef8abd5ed29482a59c8ec51dd7.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)\n         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+  "query": "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, turn_job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)\n         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -20,6 +20,7 @@
         },
         "Text",
         "Uuid",
+        "Uuid",
         "Varchar",
         "Bool",
         "Text",
@@ -30,5 +31,5 @@
     },
     "nullable": []
   },
-  "hash": "12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c"
+  "hash": "a6dafb34be6088886b078ed2b554de8c72e312ef8abd5ed29482a59c8ec51dd7"
 }
diff --git a/backend/.sqlx/query-df8586283178b0e684b9a0e359efb16e38fd68a5fe2b01cd77f74a725bbf37a3.json b/backend/.sqlx/query-aed606f8c8d91a924ac457b4eabdf391947d5fc3da90ef98a7b793c2430eb7bc.json
similarity index 76%
rename from backend/.sqlx/query-df8586283178b0e684b9a0e359efb16e38fd68a5fe2b01cd77f74a725bbf37a3.json
rename to backend/.sqlx/query-aed606f8c8d91a924ac457b4eabdf391947d5fc3da90ef98a7b793c2430eb7bc.json
index 3383951c13..0bd5d0eca5 100644
--- a/backend/.sqlx/query-df8586283178b0e684b9a0e359efb16e38fd68a5fe2b01cd77f74a725bbf37a3.json
+++ b/backend/.sqlx/query-aed606f8c8d91a924ac457b4eabdf391947d5fc3da90ef98a7b793c2430eb7bc.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT q.id AS \"id!\", j.created_by, j.permissioned_as, j.permissioned_as_email, j.trigger, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.preprocessed, j.args AS \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\" FROM v2_job_queue q JOIN v2_job j USING (id) JOIN script s ON s.workspace_id = j.workspace_id AND s.hash = j.runnable_id WHERE j.workspace_id = $1 AND j.runnable_path = $2 AND j.kind = 'script' AND j.flow_step_id IS NULL AND j.runnable_id != $3 AND q.canceled_by IS NULL AND s.restart_unless_cancelled",
+  "query": "SELECT q.id AS \"id!\", j.created_by, j.permissioned_as, j.permissioned_as_email, j.trigger, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.preprocessed, j.args AS \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\", p.job_token_scopes AS \"job_token_scopes?\" FROM v2_job_queue q JOIN v2_job j USING (id) JOIN script s ON s.workspace_id = j.workspace_id AND s.hash = j.runnable_id LEFT JOIN job_perms p ON p.job_id = q.id WHERE j.workspace_id = $1 AND j.runnable_path = $2 AND j.kind = 'script' AND j.flow_step_id IS NULL AND j.runnable_id != $3 AND q.canceled_by IS NULL AND s.restart_unless_cancelled",
   "describe": {
     "columns": [
       {
@@ -71,6 +71,11 @@
         "ordinal": 7,
         "name": "args: sqlx::types::Json<HashMap<String, Box<RawValue>>>",
         "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 8,
+        "name": "job_token_scopes?",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -88,8 +93,9 @@
       true,
       true,
       true,
+      true,
       true
     ]
   },
-  "hash": "df8586283178b0e684b9a0e359efb16e38fd68a5fe2b01cd77f74a725bbf37a3"
+  "hash": "aed606f8c8d91a924ac457b4eabdf391947d5fc3da90ef98a7b793c2430eb7bc"
 }
diff --git a/backend/.sqlx/query-d2a9a9af4d00c1c05276c14e6f32044437800a4b0c60aa364ab2f362a4fd9a2c.json b/backend/.sqlx/query-b0c10d17ed684af4dc79db7a199d4438ea003b5762178f25ff12ef23c1a8f46a.json
similarity index 61%
rename from backend/.sqlx/query-d2a9a9af4d00c1c05276c14e6f32044437800a4b0c60aa364ab2f362a4fd9a2c.json
rename to backend/.sqlx/query-b0c10d17ed684af4dc79db7a199d4438ea003b5762178f25ff12ef23c1a8f46a.json
index ec3ae54f17..a5a8c00494 100644
--- a/backend/.sqlx/query-d2a9a9af4d00c1c05276c14e6f32044437800a4b0c60aa364ab2f362a4fd9a2c.json
+++ b/backend/.sqlx/query-b0c10d17ed684af4dc79db7a199d4438ea003b5762178f25ff12ef23c1a8f46a.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/failing_script', $2, 'deno', 'script', 'test-user', '{}', 'Failing test script', 'A script that always fails', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/failing_script', $2, 'bun', 'script', 'test-user', '{}', 'Failing test script', 'A script that always fails', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "d2a9a9af4d00c1c05276c14e6f32044437800a4b0c60aa364ab2f362a4fd9a2c"
+  "hash": "b0c10d17ed684af4dc79db7a199d4438ea003b5762178f25ff12ef23c1a8f46a"
 }
diff --git a/backend/.sqlx/query-b159cc3ab6fddcfb561c90d20bee2ff605a1c3721a4cbcc080f98fbb87277c37.json b/backend/.sqlx/query-b159cc3ab6fddcfb561c90d20bee2ff605a1c3721a4cbcc080f98fbb87277c37.json
new file mode 100644
index 0000000000..d65f75636d
--- /dev/null
+++ b/backend/.sqlx/query-b159cc3ab6fddcfb561c90d20bee2ff605a1c3721a4cbcc080f98fbb87277c37.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM script WHERE workspace_id = $1 AND hash = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b159cc3ab6fddcfb561c90d20bee2ff605a1c3721a4cbcc080f98fbb87277c37"
+}
diff --git a/backend/.sqlx/query-b40c9e2d637cf0f2f49fd4c720b64eb6af24e8d8aa99b846f21f2ed49c320bdc.json b/backend/.sqlx/query-b40c9e2d637cf0f2f49fd4c720b64eb6af24e8d8aa99b846f21f2ed49c320bdc.json
new file mode 100644
index 0000000000..db729b97b1
--- /dev/null
+++ b/backend/.sqlx/query-b40c9e2d637cf0f2f49fd4c720b64eb6af24e8d8aa99b846f21f2ed49c320bdc.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, job_token_scopes)\n        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, job_token_scopes\n            FROM flow\n            WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b40c9e2d637cf0f2f49fd4c720b64eb6af24e8d8aa99b846f21f2ed49c320bdc"
+}
diff --git a/backend/.sqlx/query-b48afe9913423a90955011fc6368b8517561f5b55a30e44801d6a9123a762584.json b/backend/.sqlx/query-b48afe9913423a90955011fc6368b8517561f5b55a30e44801d6a9123a762584.json
new file mode 100644
index 0000000000..47dcca381c
--- /dev/null
+++ b/backend/.sqlx/query-b48afe9913423a90955011fc6368b8517561f5b55a30e44801d6a9123a762584.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_token_scopes FROM script WHERE path = $1 AND workspace_id = $2 AND deleted = false ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "b48afe9913423a90955011fc6368b8517561f5b55a30e44801d6a9123a762584"
+}
diff --git a/backend/.sqlx/query-bfd01122256e922b00acf0e86593007c6aeccf76bfd07384ffaccf50a24d13d4.json b/backend/.sqlx/query-bfd01122256e922b00acf0e86593007c6aeccf76bfd07384ffaccf50a24d13d4.json
new file mode 100644
index 0000000000..b1f969f343
--- /dev/null
+++ b/backend/.sqlx/query-bfd01122256e922b00acf0e86593007c6aeccf76bfd07384ffaccf50a24d13d4.json
@@ -0,0 +1,102 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels, on_behalf_of, on_behalf_of_email, job_token_scopes) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40, $41, $42)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int8",
+        "Varchar",
+        "Int8Array",
+        "Text",
+        "Text",
+        "Text",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Jsonb",
+        "Text",
+        {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        },
+        {
+          "Custom": {
+            "name": "script_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "trigger",
+                "failure",
+                "command",
+                "approval",
+                "preprocessor"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        "VarcharArray",
+        "Int4",
+        "Int4",
+        "Int4",
+        "Bool",
+        "Bool",
+        "Int2",
+        "Bool",
+        "Bool",
+        "Int4",
+        "Int4",
+        "Varchar",
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Varchar",
+        "Int4",
+        "Bool",
+        "Int8",
+        "Jsonb",
+        "TextArray",
+        "Varchar",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bfd01122256e922b00acf0e86593007c6aeccf76bfd07384ffaccf50a24d13d4"
+}
diff --git a/backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json b/backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json
new file mode 100644
index 0000000000..be4fbb73c9
--- /dev/null
+++ b/backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE email = $1 AND label = 'session' AND token_hash != $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877"
+}
diff --git a/backend/.sqlx/query-c4eaa6e3b1d30a72ef1b54b2b7f28d84f1ca3c91de86d520dce06ac12d557bd5.json b/backend/.sqlx/query-c4eaa6e3b1d30a72ef1b54b2b7f28d84f1ca3c91de86d520dce06ac12d557bd5.json
new file mode 100644
index 0000000000..151296d652
--- /dev/null
+++ b/backend/.sqlx/query-c4eaa6e3b1d30a72ef1b54b2b7f28d84f1ca3c91de86d520dce06ac12d557bd5.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH inserted AS (\n            INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs, job_token_scopes)\n            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs, job_token_scopes\n                FROM flow\n                WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3\n            RETURNING 1\n        ) SELECT COUNT(*) FROM inserted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "c4eaa6e3b1d30a72ef1b54b2b7f28d84f1ca3c91de86d520dce06ac12d557bd5"
+}
diff --git a/backend/.sqlx/query-c5971326bdbfaa7dff74689d1365db4f26c41fa56b326dbd02e604c793a13477.json b/backend/.sqlx/query-c5971326bdbfaa7dff74689d1365db4f26c41fa56b326dbd02e604c793a13477.json
new file mode 100644
index 0000000000..d84578d37c
--- /dev/null
+++ b/backend/.sqlx/query-c5971326bdbfaa7dff74689d1365db4f26c41fa56b326dbd02e604c793a13477.json
@@ -0,0 +1,74 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT workspace_id, runnable_path, worker_group,\n            SUM(job_count)::bigint AS \"job_count!\",\n            SUM(total_duration_ms)::bigint AS \"total_duration_ms!\",\n            MAX(max_memory_peak) AS \"max_memory_peak!\",\n            SUM(sum_memory_peak)::bigint AS \"sum_memory_peak!\",\n            SUM(memory_sample_count)::bigint AS \"memory_sample_count!\",\n            SUM(total_cpu_ms)::bigint AS \"total_cpu_ms!\"\n        FROM runnable_job_stats\n        WHERE hour >= $1\n            AND ($2::text IS NULL OR worker_group = $2)\n            AND ($3::text IS NULL OR workspace_id = $3)\n        GROUP BY workspace_id, runnable_path, worker_group\n        ORDER BY CASE $4::text\n            WHEN 'max_memory' THEN MAX(max_memory_peak)::numeric\n            WHEN 'cpu' THEN SUM(total_cpu_ms)\n            ELSE SUM(total_duration_ms)\n        END DESC, workspace_id, runnable_path, worker_group\n        LIMIT $5\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "worker_group",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "job_count!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 4,
+        "name": "total_duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 5,
+        "name": "max_memory_peak!",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 6,
+        "name": "sum_memory_peak!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 7,
+        "name": "memory_sample_count!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 8,
+        "name": "total_cpu_ms!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "c5971326bdbfaa7dff74689d1365db4f26c41fa56b326dbd02e604c793a13477"
+}
diff --git a/backend/.sqlx/query-c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc.json b/backend/.sqlx/query-c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc.json
deleted file mode 100644
index 7f6fe7a81c..0000000000
--- a/backend/.sqlx/query-c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12) ON CONFLICT (worker)\n        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL\n        RETURNING jobs_executed",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "jobs_executed",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Text",
-        "TextArray",
-        "Varchar",
-        "Varchar",
-        "TextArray",
-        "Varchar",
-        "Int8",
-        "Int8",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "c748617e060bc41b5922df4b433f20b6971b993e0671b6ccb45db5ef028550bc"
-}
diff --git a/backend/.sqlx/query-c921b1a03e3181bbac351545941affc87853ff2d97f567a8817260cfef43e00e.json b/backend/.sqlx/query-c921b1a03e3181bbac351545941affc87853ff2d97f567a8817260cfef43e00e.json
new file mode 100644
index 0000000000..393c88720d
--- /dev/null
+++ b/backend/.sqlx/query-c921b1a03e3181bbac351545941affc87853ff2d97f567a8817260cfef43e00e.json
@@ -0,0 +1,65 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, username, is_admin, is_operator, groups, folders, end_user_email,\n            job_token_scopes\n        FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "username",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_admin",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_operator",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "groups",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 5,
+        "name": "folders",
+        "type_info": "JsonbArray"
+      },
+      {
+        "ordinal": 6,
+        "name": "end_user_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "c921b1a03e3181bbac351545941affc87853ff2d97f567a8817260cfef43e00e"
+}
diff --git a/backend/.sqlx/query-cdc594b30855e9384481f561b2c16200d4e6dacb1eb274513c8f1795235dfe20.json b/backend/.sqlx/query-cc719da4da98b6fe9612a4cc2f42dd19834a3e0d0be593ea6bc1239fe5453a74.json
similarity index 69%
rename from backend/.sqlx/query-cdc594b30855e9384481f561b2c16200d4e6dacb1eb274513c8f1795235dfe20.json
rename to backend/.sqlx/query-cc719da4da98b6fe9612a4cc2f42dd19834a3e0d0be593ea6bc1239fe5453a74.json
index a68e5f1253..91cacf4123 100644
--- a/backend/.sqlx/query-cdc594b30855e9384481f561b2c16200d4e6dacb1eb274513c8f1795235dfe20.json
+++ b/backend/.sqlx/query-cc719da4da98b6fe9612a4cc2f42dd19834a3e0d0be593ea6bc1239fe5453a74.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 5555555555, 'f/test/error_handler', 'export function main() { return \"handled\"; }', 'deno', 'script', 'test-user', '{}', '', '', '')\n        ",
+  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 5555555555, 'f/test/error_handler', 'export function main() { return \"handled\"; }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\\n//bun.lock\\n<empty>')\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "cdc594b30855e9384481f561b2c16200d4e6dacb1eb274513c8f1795235dfe20"
+  "hash": "cc719da4da98b6fe9612a4cc2f42dd19834a3e0d0be593ea6bc1239fe5453a74"
 }
diff --git a/backend/.sqlx/query-ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8.json b/backend/.sqlx/query-ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8.json
new file mode 100644
index 0000000000..ba7a89ef73
--- /dev/null
+++ b/backend/.sqlx/query-ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8.json
@@ -0,0 +1,43 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH deleted AS (\n                    DELETE FROM v2_job_queue WHERE id = $1\n                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,\n                        (extras->>'wac_first_started_at')::timestamptz AS first_started_at,\n                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms\n                ), completed AS (\n                    INSERT INTO v2_job_completed AS cj\n                        ( workspace_id\n                        , id\n                        , started_at\n                        , duration_ms\n                        , extras\n                        , result\n                        , result_columns\n                        , canceled_by\n                        , canceled_reason\n                        , flow_status\n                        , workflow_as_code_status\n                        , memory_peak\n                        , status\n                        , worker\n                        )\n                    SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),\n                        CASE WHEN d.first_started_at IS NULL THEN d.run_ms\n                            ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,\n                        CASE WHEN d.first_started_at IS NOT NULL\n                            THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,\n                        $3::text::jsonb, $10,\n                        CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,\n                        CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,\n                        s.flow_status, s.workflow_as_code_status, $8,\n                        CASE WHEN $4::BOOL OR d.canceled_by IS NOT NULL THEN 'canceled'::job_status\n                            WHEN $7::BOOL THEN 'skipped'::job_status\n                            WHEN $2::BOOL THEN 'success'::job_status\n                            ELSE 'failure'::job_status END,\n                        d.worker\n                    FROM deleted d LEFT JOIN v2_job_status s ON s.id = d.id\n                    ON CONFLICT (id) DO UPDATE SET status = EXCLUDED.status, result = $3::text::jsonb,\n                        canceled_by = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,\n                        canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL\n                            THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END\n                    RETURNING cj.started_at, cj.duration_ms,\n                        COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms\n                )\n                SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",\n                    last_run_ms AS \"last_run_ms!\" FROM completed",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "started_at?",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "last_run_ms!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Bool",
+        "Text",
+        "Bool",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Int4",
+        "Int8",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      null
+    ]
+  },
+  "hash": "ce39fd9650500b16f7247c8173a40c7e5d2d8a51aea2d36f2bc8c6f86d53a9b8"
+}
diff --git a/backend/.sqlx/query-ce3bccee14cd107631c4ddb4a467099be925f1058c76c6af31e8a620607cf6a1.json b/backend/.sqlx/query-ce3bccee14cd107631c4ddb4a467099be925f1058c76c6af31e8a620607cf6a1.json
new file mode 100644
index 0000000000..4ae34431dc
--- /dev/null
+++ b/backend/.sqlx/query-ce3bccee14cd107631c4ddb4a467099be925f1058c76c6af31e8a620607cf6a1.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE\n            flow\n        SET\n            path = $1,\n            summary = $2,\n            description = $3,\n            dependency_job = NULL,\n            lock_error_logs = '',\n            tag = $4,\n            dedicated_worker = $5,\n            visible_to_runner_only = $6,\n            ws_error_handler_muted = $7,\n            value = $8,\n            schema = $9::text::json,\n            edited_by = $10,\n            edited_at = now(),\n            labels = COALESCE($13, labels),\n            on_behalf_of = $14,\n            on_behalf_of_email = $15,\n            job_token_scopes = CASE WHEN $16 THEN $17 ELSE job_token_scopes END\n        WHERE\n            path = $11 AND workspace_id = $12",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "Text",
+        "Text",
+        "TextArray",
+        "Varchar",
+        "Text",
+        "Bool",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ce3bccee14cd107631c4ddb4a467099be925f1058c76c6af31e8a620607cf6a1"
+}
diff --git a/backend/.sqlx/query-d2fbaaaea6c542342862d8b535673d19dc4ca721ab656a39330bad5ea48999d8.json b/backend/.sqlx/query-d2fbaaaea6c542342862d8b535673d19dc4ca721ab656a39330bad5ea48999d8.json
new file mode 100644
index 0000000000..55b335fba0
--- /dev/null
+++ b/backend/.sqlx/query-d2fbaaaea6c542342862d8b535673d19dc4ca721ab656a39330bad5ea48999d8.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM runnable_job_stats WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d2fbaaaea6c542342862d8b535673d19dc4ca721ab656a39330bad5ea48999d8"
+}
diff --git a/backend/.sqlx/query-d51f555e80b27549b884f334087878286dcc2f23101c2e1c8c1d07b6f0deaecd.json b/backend/.sqlx/query-d51f555e80b27549b884f334087878286dcc2f23101c2e1c8c1d07b6f0deaecd.json
new file mode 100644
index 0000000000..ae90b163ff
--- /dev/null
+++ b/backend/.sqlx/query-d51f555e80b27549b884f334087878286dcc2f23101c2e1c8c1d07b6f0deaecd.json
@@ -0,0 +1,159 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of, created_by, labels, job_token_scopes FROM script\n             WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)\n             ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "hash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "concurrency_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 4,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "debounce_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "debounce_delay_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 8,
+        "name": "cache_ignore_s3_path",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "runnable_settings_handle",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 10,
+        "name": "language: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 11,
+        "name": "dedicated_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 13,
+        "name": "timeout",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 14,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 15,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "labels",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 17,
+        "name": "job_token_scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "d51f555e80b27549b884f334087878286dcc2f23101c2e1c8c1d07b6f0deaecd"
+}
diff --git a/backend/.sqlx/query-967f52005f4a044b3a2e9f02ceadf90dad5246681bde6caaa633b85a5e8b2352.json b/backend/.sqlx/query-d5f1e272af4a428daedafa3453124b1973a48d47c1c563b2213055bfcf688230.json
similarity index 57%
rename from backend/.sqlx/query-967f52005f4a044b3a2e9f02ceadf90dad5246681bde6caaa633b85a5e8b2352.json
rename to backend/.sqlx/query-d5f1e272af4a428daedafa3453124b1973a48d47c1c563b2213055bfcf688230.json
index 5161f716ff..190c14788f 100644
--- a/backend/.sqlx/query-967f52005f4a044b3a2e9f02ceadf90dad5246681bde6caaa633b85a5e8b2352.json
+++ b/backend/.sqlx/query-d5f1e272af4a428daedafa3453124b1973a48d47c1c563b2213055bfcf688230.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM flow_conversation_message WHERE job_id = ANY($1) RETURNING conversation_id",
+  "query": "DELETE FROM flow_conversation_message WHERE COALESCE(turn_job_id, job_id) = ANY($1)\n         RETURNING conversation_id",
   "describe": {
     "columns": [
       {
@@ -18,5 +18,5 @@
       false
     ]
   },
-  "hash": "967f52005f4a044b3a2e9f02ceadf90dad5246681bde6caaa633b85a5e8b2352"
+  "hash": "d5f1e272af4a428daedafa3453124b1973a48d47c1c563b2213055bfcf688230"
 }
diff --git a/backend/.sqlx/query-ebce1633afe3d3f8a1a68bc8d26adcdd88b137bb892437a3ca67fd716772512b.json b/backend/.sqlx/query-d61e8523269a26051079b0ee837bf33c1ce2e063aaf80fd155dbbbf99eb2fab3.json
similarity index 59%
rename from backend/.sqlx/query-ebce1633afe3d3f8a1a68bc8d26adcdd88b137bb892437a3ca67fd716772512b.json
rename to backend/.sqlx/query-d61e8523269a26051079b0ee837bf33c1ce2e063aaf80fd155dbbbf99eb2fab3.json
index 1930427b94..7b1e8d29cc 100644
--- a/backend/.sqlx/query-ebce1633afe3d3f8a1a68bc8d26adcdd88b137bb892437a3ca67fd716772512b.json
+++ b/backend/.sqlx/query-d61e8523269a26051079b0ee837bf33c1ce2e063aaf80fd155dbbbf99eb2fab3.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT\n            COUNT(*) FILTER (WHERE NOT operator AND NOT disabled AND NOT is_service_account) AS \"developers!\",\n            COUNT(*) FILTER (WHERE operator AND NOT disabled AND NOT is_service_account) AS \"operators!\"\n        FROM usr WHERE workspace_id = $1",
+  "query": "SELECT\n            COUNT(*) FILTER (WHERE NOT operator AND NOT disabled AND NOT is_service_account) AS \"developers!\",\n            COUNT(*) FILTER (WHERE operator AND NOT disabled AND NOT is_service_account) AS \"operators!\",\n            COUNT(*) FILTER (WHERE is_service_account AND NOT disabled) AS \"service_accounts!\"\n        FROM usr WHERE workspace_id = $1",
   "describe": {
     "columns": [
       {
@@ -12,6 +12,11 @@
         "ordinal": 1,
         "name": "operators!",
         "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "service_accounts!",
+        "type_info": "Int8"
       }
     ],
     "parameters": {
@@ -20,9 +25,10 @@
       ]
     },
     "nullable": [
+      null,
       null,
       null
     ]
   },
-  "hash": "ebce1633afe3d3f8a1a68bc8d26adcdd88b137bb892437a3ca67fd716772512b"
+  "hash": "d61e8523269a26051079b0ee837bf33c1ce2e063aaf80fd155dbbbf99eb2fab3"
 }
diff --git a/backend/.sqlx/query-de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429.json b/backend/.sqlx/query-de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429.json
new file mode 100644
index 0000000000..48963d9ef7
--- /dev/null
+++ b/backend/.sqlx/query-de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT q.id FROM v2_job_queue q\n            JOIN native_retry_attempt n ON n.job_id = q.id\n            JOIN v2_job r ON r.id = q.id\n            JOIN v2_job a ON a.id = r.parent_job\n            WHERE q.workspace_id = $2 AND a.parent_job = ANY($1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "de1adae1306fb9d877ec6f2d52235b3f57d4fa4c27861b51da6bfe8c74abd429"
+}
diff --git a/backend/.sqlx/query-df1fe2e7ef004b8de0e626f40fd737b3b4b662a89148cf6ac70eb3563ad7f0c5.json b/backend/.sqlx/query-df1fe2e7ef004b8de0e626f40fd737b3b4b662a89148cf6ac70eb3563ad7f0c5.json
new file mode 100644
index 0000000000..7f160dc856
--- /dev/null
+++ b/backend/.sqlx/query-df1fe2e7ef004b8de0e626f40fd737b3b4b662a89148cf6ac70eb3563ad7f0c5.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (\n            workspace_id, path, summary, description, value, edited_by, edited_at,\n            archived, schema, extra_perms, dependency_job, tag,\n            ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,\n            concurrency_key, versions, on_behalf_of, on_behalf_of_email, lock_error_logs,\n            job_token_scopes\n        )\n        SELECT $2, path, summary, description, value, edited_by, edited_at,\n               archived, schema, extra_perms, NULL, tag,\n               ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,\n               concurrency_key, ARRAY[]::bigint[],\n               -- Same predicate as clone_scripts.\n               CASE WHEN on_behalf_of LIKE 'u/%' THEN\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar\n                             AND u.username = substring(on_behalf_of from 3)\n                           UNION ALL\n                           SELECT 1 FROM password p WHERE p.super_admin\n                             AND (p.username = substring(on_behalf_of from 3)\n                                  OR p.email = substring(on_behalf_of from 3))))\n                    WHEN on_behalf_of LIKE 'g/%' THEN\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM group_ g WHERE g.workspace_id = $2::varchar\n                             AND g.name = substring(on_behalf_of from 3)))\n                    ELSE\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar\n                             AND u.username = on_behalf_of\n                           UNION ALL\n                           SELECT 1 FROM password p WHERE p.email = on_behalf_of\n                             AND p.super_admin))\n               END, on_behalf_of_email, lock_error_logs, job_token_scopes\n        FROM flow\n        WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "df1fe2e7ef004b8de0e626f40fd737b3b4b662a89148cf6ac70eb3563ad7f0c5"
+}
diff --git a/backend/.sqlx/query-e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd.json b/backend/.sqlx/query-e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd.json
deleted file mode 100644
index ae893b6791..0000000000
--- a/backend/.sqlx/query-e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH prev AS (SELECT started_at FROM v2_job_queue WHERE id = $1)\n                 UPDATE v2_job_queue q SET running = false, started_at = null\n                 FROM prev WHERE q.id = $1\n                 RETURNING (extract(epoch FROM now() - prev.started_at) * 1000)::bigint",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "int8",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "e12f852fa196d16862151ab490b05e6f5c25e23b7c41ce1c0e5a83bf7b118bfd"
-}
diff --git a/backend/.sqlx/query-e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919.json b/backend/.sqlx/query-e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919.json
new file mode 100644
index 0000000000..9ebf9289c2
--- /dev/null
+++ b/backend/.sqlx/query-e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE worker_ping SET draining = true WHERE worker = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e4b9c0e8a46dbfe29bace8d8b12123a98ec175f9d3dc72e40a1cb40e14dec919"
+}
diff --git a/backend/.sqlx/query-e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b.json b/backend/.sqlx/query-e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b.json
new file mode 100644
index 0000000000..9f51c69616
--- /dev/null
+++ b/backend/.sqlx/query-e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode, draining) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12, COALESCE($13, false)) ON CONFLICT (worker)\n        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL, draining = COALESCE($13, worker_ping.draining)\n        RETURNING jobs_executed",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "jobs_executed",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        "TextArray",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Int8",
+        "Int8",
+        "Text",
+        "Bool",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "e7a8c0ee68b8626eb45a7eacdd364360a5d5c783d6ca0a3c4123ea126ed0e60b"
+}
diff --git a/backend/.sqlx/query-e81eaa501b4af1269a4929ec660d10fc10d9ec4dc2359f43d79fe255d101cad8.json b/backend/.sqlx/query-e81eaa501b4af1269a4929ec660d10fc10d9ec4dc2359f43d79fe255d101cad8.json
new file mode 100644
index 0000000000..909565b8c6
--- /dev/null
+++ b/backend/.sqlx/query-e81eaa501b4af1269a4929ec660d10fc10d9ec4dc2359f43d79fe255d101cad8.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs, job_token_scopes)\n        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs, job_token_scopes\n            FROM flow WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e81eaa501b4af1269a4929ec660d10fc10d9ec4dc2359f43d79fe255d101cad8"
+}
diff --git a/backend/.sqlx/query-e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323.json b/backend/.sqlx/query-e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323.json
new file mode 100644
index 0000000000..e22953610d
--- /dev/null
+++ b/backend/.sqlx/query-e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    SELECT usr.email, usage.executions\n        FROM usr, LATERAL (\n            SELECT COALESCE(SUM(COALESCE((c.extras->>'wac_last_segment_ms')::bigint, c.duration_ms) + 1000)/1000 , 0)::BIGINT executions\n                FROM v2_job_completed c JOIN v2_job j USING (id)\n                WHERE j.workspace_id = $1\n                AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')\n                AND j.permissioned_as_email = usr.email\n                AND now() - '1 week'::interval < j.created_at\n            ) usage\n        WHERE workspace_id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "executions",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "e8779f1cddc475554dbbd2e3122db8a21a2eaacf971bf046cef1ee14cf04e323"
+}
diff --git a/backend/.sqlx/query-ee92100fcd681515ba81f23970e64af7f33464879bef4d1eff682126dffeef64.json b/backend/.sqlx/query-ee92100fcd681515ba81f23970e64af7f33464879bef4d1eff682126dffeef64.json
deleted file mode 100644
index 3c52f8ba96..0000000000
--- a/backend/.sqlx/query-ee92100fcd681515ba81f23970e64af7f33464879bef4d1eff682126dffeef64.json
+++ /dev/null
@@ -1,125 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH RECURSIVE lineage AS (\n            SELECT id, parent_job, kind, runnable_path, runnable_id, trigger_kind, trigger,\n                permissioned_as, args, 0 AS depth\n            FROM v2_job WHERE id = $1 AND workspace_id = $2\n          UNION ALL\n            SELECT p.id, p.parent_job, p.kind, p.runnable_path, p.runnable_id, p.trigger_kind,\n                p.trigger, p.permissioned_as, p.args, l.depth + 1\n            FROM v2_job p JOIN lineage l ON p.id = l.parent_job\n            WHERE p.workspace_id = $2 AND l.depth < 100\n        )\n        SELECT id AS \"id!\", parent_job, kind AS \"kind!: JobKind\", runnable_path, runnable_id,\n            trigger_kind::text AS trigger_kind, permissioned_as AS \"permissioned_as!\",\n            -- A restart takes its flow version from the request, so a trusted flow path\n            -- can carry another flow's code: the version must belong to that path.\n            CASE kind\n                WHEN 'flow' THEN EXISTS (SELECT 1 FROM flow_version fv\n                    WHERE fv.id = runnable_id AND fv.path = runnable_path AND fv.workspace_id = $2)\n                WHEN 'script' THEN EXISTS (SELECT 1 FROM script s\n                    WHERE s.hash = runnable_id AND s.path = runnable_path AND s.workspace_id = $2\n                        AND NOT s.deleted)\n                ELSE true\n            END AS \"origin_verified!\",\n            -- What `run/f` and `run/p` resolve the path to now; for scripts the predicate of\n            -- `get_latest_deployed_script_hash`.\n            COALESCE(CASE kind\n                WHEN 'flow' THEN runnable_id = (SELECT f.versions[array_upper(f.versions, 1)]\n                    FROM flow f WHERE f.path = runnable_path AND f.workspace_id = $2)\n                WHEN 'script' THEN runnable_id = (SELECT s.hash FROM script s\n                    WHERE s.path = runnable_path AND s.workspace_id = $2 AND NOT s.deleted\n                        AND s.lock IS NOT NULL AND s.lock_error_logs IS NULL\n                    ORDER BY s.created_at DESC LIMIT 1)\n            END, false) AS \"current_version!\",\n            EXISTS (SELECT 1 FROM v2_job_status st WHERE st.id = lineage.id\n                    AND jsonb_typeof(st.flow_status->'restarted_from') = 'object')\n                OR EXISTS (SELECT 1 FROM v2_job_completed c WHERE c.id = lineage.id\n                    AND jsonb_typeof(c.flow_status->'restarted_from') = 'object')\n                AS \"restarted!\",\n            COALESCE(\n                (SELECT st.flow_status->'restarted_from'->>'flow_job_id' FROM v2_job_status st\n                    WHERE st.id = lineage.id),\n                (SELECT c.flow_status->'restarted_from'->>'flow_job_id' FROM v2_job_completed c\n                    WHERE c.id = lineage.id)\n            ) AS restarted_from,\n            -- Only deployed-app runs are stamped with their app; an app editor preview\n            -- runs app code at an app path it does not have to own.\n            COALESCE(trigger_kind = 'app' AND starts_with(runnable_path, trigger || '/'), false)\n                AS \"app_stamped!\",\n            -- A preview's modules come from its args, which its parent may have taken from\n            -- the caller.\n            COALESCE(jsonb_typeof(args->'_MODULES') = 'object', false) AS \"args_modules!\"\n        FROM lineage ORDER BY depth",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id!",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "parent_job",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 2,
-        "name": "kind!: JobKind",
-        "type_info": {
-          "Custom": {
-            "name": "job_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "preview",
-                "flow",
-                "dependencies",
-                "flowpreview",
-                "script_hub",
-                "identity",
-                "flowdependencies",
-                "http",
-                "graphql",
-                "postgresql",
-                "noop",
-                "appdependencies",
-                "deploymentcallback",
-                "singlestepflow",
-                "flowscript",
-                "flownode",
-                "appscript",
-                "aiagent",
-                "unassigned_script",
-                "unassigned_flow",
-                "unassigned_singlestepflow"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 3,
-        "name": "runnable_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "runnable_id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 5,
-        "name": "trigger_kind",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 6,
-        "name": "permissioned_as!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 7,
-        "name": "origin_verified!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 8,
-        "name": "current_version!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
-        "name": "restarted!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 10,
-        "name": "restarted_from",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 11,
-        "name": "app_stamped!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 12,
-        "name": "args_modules!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "ee92100fcd681515ba81f23970e64af7f33464879bef4d1eff682126dffeef64"
-}
diff --git a/backend/.sqlx/query-e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258.json b/backend/.sqlx/query-eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9.json
similarity index 80%
rename from backend/.sqlx/query-e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258.json
rename to backend/.sqlx/query-eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9.json
index 4ebad828df..1670a5009e 100644
--- a/backend/.sqlx/query-e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258.json
+++ b/backend/.sqlx/query-eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO job_resolution (job_id, workspace_id, resolved_by, note, automatic)\n            SELECT c.id, c.workspace_id, NULL, NULL, true\n                FROM v2_job_completed c\n                JOIN v2_job j ON j.id = c.id\n                WHERE c.status = 'failure'\n                    AND c.workspace_id = $2\n                    AND j.flow_step_id IS NULL\n                    AND j.runnable_id IS NOT DISTINCT FROM $3\n                    AND EXISTS (\n                        SELECT 1 FROM v2_job_completed sc\n                        JOIN v2_job sj ON sj.id = sc.id\n                        JOIN native_retry_attempt nra ON nra.job_id = sc.id\n                        WHERE sc.status = 'success'\n                            AND sc.workspace_id = $2\n                            AND sj.parent_job = $1\n                            AND sj.runnable_id IS NOT DISTINCT FROM $3\n                    )\n                    AND (\n                        (j.parent_job = $1\n                            AND EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                        OR (c.id = $1 AND j.parent_job IS NULL\n                            AND NOT EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                    )\n            ON CONFLICT (job_id) DO NOTHING",
+  "query": "INSERT INTO job_resolution (job_id, workspace_id, resolved_by, note, automatic)\n            SELECT c.id, c.workspace_id, NULL, NULL, true\n                FROM v2_job_completed c\n                JOIN v2_job j ON j.id = c.id\n                WHERE c.status = 'failure'\n                    AND c.workspace_id = $2\n                    AND j.flow_step_id IS NULL\n                    AND j.runnable_id IS NOT DISTINCT FROM $3\n                    AND EXISTS (\n                        SELECT 1 FROM v2_job_completed sc\n                        JOIN v2_job sj ON sj.id = sc.id\n                        JOIN native_retry_attempt nra ON nra.job_id = sc.id\n                        WHERE sc.status = 'success'\n                            AND sc.workspace_id = $2\n                            AND sj.parent_job = $1\n                            AND sj.runnable_id IS NOT DISTINCT FROM $3\n                    )\n                    AND (\n                        (j.parent_job = $1\n                            AND EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                        OR (c.id = $1\n                            AND NOT EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))\n                    )\n            ON CONFLICT (job_id) DO NOTHING",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,5 +12,5 @@
     },
     "nullable": []
   },
-  "hash": "e34cb7cd6ff9d80e77a51ae47c3cfb9b0772d5d3d239273fc5cea322cae4e258"
+  "hash": "eecea4a5ba0de73129bde6ed0c229690c322bc376b1bfc13ed719126f72cabb9"
 }
diff --git a/backend/.sqlx/query-eefb19c05e6d9650b4dd1e50e10c26f01e117b75ab48e197c7d91d388865da74.json b/backend/.sqlx/query-eefb19c05e6d9650b4dd1e50e10c26f01e117b75ab48e197c7d91d388865da74.json
new file mode 100644
index 0000000000..24c87414b1
--- /dev/null
+++ b/backend/.sqlx/query-eefb19c05e6d9650b4dd1e50e10c26f01e117b75ab48e197c7d91d388865da74.json
@@ -0,0 +1,398 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            v2_job.id,\n            v2_job.raw_code,\n            v2_job.raw_lock,\n            v2_job.raw_flow as \"raw_flow: _\",\n            v2_job.tag,\n            v2_job.created_at,\n            v2_job.created_by,\n            v2_job.permissioned_as,\n            v2_job.permissioned_as_email,\n            v2_job.kind as \"kind: _\",\n            v2_job.runnable_id,\n            v2_job.runnable_path,\n            v2_job.parent_job,\n            v2_job.root_job,\n            v2_job.script_lang as \"script_lang: _\",\n            v2_job.script_entrypoint_override,\n            v2_job.flow_step,\n            v2_job.flow_step_id,\n            v2_job.flow_innermost_root_job,\n            v2_job.\"trigger\",\n            v2_job.trigger_kind as \"trigger_kind: _\",\n            v2_job.same_worker,\n            v2_job.visible_to_owner,\n            v2_job.concurrent_limit,\n            v2_job.concurrency_time_window_s,\n            v2_job.cache_ttl,\n            v2_job.timeout,\n            v2_job.priority,\n            v2_job.preprocessed,\n            v2_job.args as \"args: _\",\n            v2_job.labels,\n            job_perms.job_token_scopes as \"job_token_scopes?\",\n            v2_job.pre_run_error,\n\n            v2_job_queue.started_at,\n            v2_job_queue.scheduled_for,\n            v2_job_queue.running,\n            v2_job_queue.canceled_by,\n            v2_job_queue.canceled_reason,\n            v2_job_queue.suspend,\n            v2_job_queue.suspend_until,\n            v2_job_queue.worker,\n            v2_job_queue.extras as \"extras: _\",\n\n            v2_job_runtime.ping,\n            v2_job_runtime.memory_peak,\n\n            v2_job_status.flow_status as \"flow_status: _\",\n            v2_job_status.flow_leaf_jobs as \"flow_leaf_jobs: _\",\n            v2_job_status.workflow_as_code_status as \"workflow_as_code_status: _\",\n\n            concurrency_key.key as \"concurrency_key?\"\n        FROM v2_job_queue\n        INNER JOIN v2_job ON v2_job.id = v2_job_queue.id\n        LEFT JOIN job_perms ON job_perms.job_id = v2_job_queue.id\n        LEFT JOIN v2_job_runtime ON v2_job_runtime.id = v2_job_queue.id\n        LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id\n        LEFT JOIN concurrency_key ON concurrency_key.job_id = v2_job_queue.id\n        WHERE v2_job_queue.workspace_id = $1\n            AND v2_job_queue.running = false\n            AND v2_job.parent_job IS NULL\n            AND v2_job.trigger_kind IS DISTINCT FROM 'schedule'\n        ORDER BY v2_job.created_at DESC\n        LIMIT $2\n        OFFSET $3\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "raw_code",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "raw_lock",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "raw_flow: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 4,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "permissioned_as_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "kind: _",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlestepflow",
+                "flowscript",
+                "flownode",
+                "appscript",
+                "aiagent",
+                "unassigned_script",
+                "unassigned_flow",
+                "unassigned_singlestepflow"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 10,
+        "name": "runnable_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 11,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 12,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 13,
+        "name": "root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 14,
+        "name": "script_lang: _",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 15,
+        "name": "script_entrypoint_override",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "flow_step",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 17,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 18,
+        "name": "flow_innermost_root_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 19,
+        "name": "trigger",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 20,
+        "name": "trigger_kind: _",
+        "type_info": {
+          "Custom": {
+            "name": "job_trigger_kind",
+            "kind": {
+              "Enum": [
+                "webhook",
+                "http",
+                "websocket",
+                "kafka",
+                "email",
+                "nats",
+                "schedule",
+                "app",
+                "ui",
+                "postgres",
+                "sqs",
+                "gcp",
+                "mqtt",
+                "nextcloud",
+                "google",
+                "ci_test",
+                "github",
+                "azure",
+                "asset",
+                "freshness",
+                "amqp"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 21,
+        "name": "same_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 22,
+        "name": "visible_to_owner",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 23,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 24,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 25,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 26,
+        "name": "timeout",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 27,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 28,
+        "name": "preprocessed",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 29,
+        "name": "args: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 30,
+        "name": "labels",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 31,
+        "name": "job_token_scopes?",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 32,
+        "name": "pre_run_error",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 33,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 34,
+        "name": "scheduled_for",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 35,
+        "name": "running",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 36,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 37,
+        "name": "canceled_reason",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 38,
+        "name": "suspend",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 39,
+        "name": "suspend_until",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 40,
+        "name": "worker",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 41,
+        "name": "extras: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 42,
+        "name": "ping",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 43,
+        "name": "memory_peak",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 44,
+        "name": "flow_status: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 45,
+        "name": "flow_leaf_jobs: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 46,
+        "name": "workflow_as_code_status: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 47,
+        "name": "concurrency_key?",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false
+    ]
+  },
+  "hash": "eefb19c05e6d9650b4dd1e50e10c26f01e117b75ab48e197c7d91d388865da74"
+}
diff --git a/backend/.sqlx/query-cbc521b505c3953dc624ae6cefe6999e6d0c732da83ebc74ef7678cacd22ad6b.json b/backend/.sqlx/query-efc7aab19d729ea419c1fcaef47122096921dce2dac3979a8b788bf76f32646b.json
similarity index 58%
rename from backend/.sqlx/query-cbc521b505c3953dc624ae6cefe6999e6d0c732da83ebc74ef7678cacd22ad6b.json
rename to backend/.sqlx/query-efc7aab19d729ea419c1fcaef47122096921dce2dac3979a8b788bf76f32646b.json
index a2a87b680d..81505d64a3 100644
--- a/backend/.sqlx/query-cbc521b505c3953dc624ae6cefe6999e6d0c732da83ebc74ef7678cacd22ad6b.json
+++ b/backend/.sqlx/query-efc7aab19d729ea419c1fcaef47122096921dce2dac3979a8b788bf76f32646b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "WITH active_users as (SELECT distinct username as email FROM audit_partitioned WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh') AND username NOT IN (SELECT email FROM usr WHERE is_service_account)),\n        active_authors as (SELECT distinct t.email FROM usr t LEFT JOIN workspace_settings ws ON ws.workspace_id = t.workspace_id WHERE NOT (t.operator AND NOT COALESCE((ws.operator_settings->>'builder_flows')::boolean, false)) AND t.email IN (SELECT email FROM active_users)),\n        active_authors_agg as (SELECT array_agg(email) as authors FROM active_authors),\n        active_ops_agg as (SELECT array_agg(email) as operators from active_users WHERE email NOT IN (SELECT email FROM active_authors))\n        SELECT active_authors_agg.authors, active_ops_agg.operators, array_length(active_authors_agg.authors, 1) as author_count, array_length(active_ops_agg.operators, 1) as operator_count FROM active_authors_agg, active_ops_agg",
+  "query": "WITH active_users as (SELECT distinct username as email FROM audit_partitioned WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh') AND username NOT IN (SELECT email FROM usr WHERE is_service_account)),\n        active_authors as (SELECT distinct t.email FROM usr t LEFT JOIN workspace_settings ws ON ws.workspace_id = t.workspace_id WHERE NOT (t.operator AND NOT (COALESCE((ws.operator_settings->>'builder_flows')::boolean, false) OR COALESCE((ws.operator_settings->>'builder_apps')::boolean, false))) AND t.email IN (SELECT email FROM active_users)),\n        active_authors_agg as (SELECT array_agg(email) as authors FROM active_authors),\n        active_ops_agg as (SELECT array_agg(email) as operators from active_users WHERE email NOT IN (SELECT email FROM active_authors))\n        SELECT active_authors_agg.authors, active_ops_agg.operators, array_length(active_authors_agg.authors, 1) as author_count, array_length(active_ops_agg.operators, 1) as operator_count FROM active_authors_agg, active_ops_agg",
   "describe": {
     "columns": [
       {
@@ -34,5 +34,5 @@
       null
     ]
   },
-  "hash": "cbc521b505c3953dc624ae6cefe6999e6d0c732da83ebc74ef7678cacd22ad6b"
+  "hash": "efc7aab19d729ea419c1fcaef47122096921dce2dac3979a8b788bf76f32646b"
 }
diff --git a/backend/.sqlx/query-f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed.json b/backend/.sqlx/query-f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed.json
deleted file mode 100644
index 5f86fb97d8..0000000000
--- a/backend/.sqlx/query-f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue\n         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null\n         WHERE id = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text",
-        "Int4",
-        "Float8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f0498c9bddc0d4d8948167f3ed849bf8b3523d8dde1ef6b8f1950423830cc6ed"
-}
diff --git a/backend/.sqlx/query-f2146082f64fcdb4acdfe92e42f084f90b3ac06139ffca98670215956150563a.json b/backend/.sqlx/query-f2146082f64fcdb4acdfe92e42f084f90b3ac06139ffca98670215956150563a.json
new file mode 100644
index 0000000000..ad4991a7cf
--- /dev/null
+++ b/backend/.sqlx/query-f2146082f64fcdb4acdfe92e42f084f90b3ac06139ffca98670215956150563a.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (\n        workspace_id, path, summary, description,\n        dependency_job, lock_error_logs, tag,\n        dedicated_worker, visible_to_runner_only,\n        ws_error_handler_muted,\n        value, schema, edited_by, edited_at, labels,\n        on_behalf_of, on_behalf_of_email, job_token_scopes\n    ) VALUES (\n        $1, $2, $3, $4,\n        NULL, '', $5,\n        $6, $7,\n        $8,\n        $9, $10::text::json, $11, now(), $12,\n        $13, $14, $15\n    )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f2146082f64fcdb4acdfe92e42f084f90b3ac06139ffca98670215956150563a"
+}
diff --git a/backend/.sqlx/query-f338741f0866dc717ccfcf6b7d46b4e55ca07e472610b29fad24b64f45f98e18.json b/backend/.sqlx/query-f338741f0866dc717ccfcf6b7d46b4e55ca07e472610b29fad24b64f45f98e18.json
new file mode 100644
index 0000000000..0f57f5d951
--- /dev/null
+++ b/backend/.sqlx/query-f338741f0866dc717ccfcf6b7d46b4e55ca07e472610b29fad24b64f45f98e18.json
@@ -0,0 +1,59 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft\n           WHERE workspace_id = $1 AND path = $2 AND typ = $3\n             AND ($4::text IS NULL OR email = $4)\n           RETURNING 1 as \"one!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "one!",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        },
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "f338741f0866dc717ccfcf6b7d46b4e55ca07e472610b29fad24b64f45f98e18"
+}
diff --git a/backend/.sqlx/query-f633095ebe2fdabd116d687c7f8cfb8cb76159d8db20a42e0fce71146f9b8aaa.json b/backend/.sqlx/query-f633095ebe2fdabd116d687c7f8cfb8cb76159d8db20a42e0fce71146f9b8aaa.json
new file mode 100644
index 0000000000..c8134447e6
--- /dev/null
+++ b/backend/.sqlx/query-f633095ebe2fdabd116d687c7f8cfb8cb76159d8db20a42e0fce71146f9b8aaa.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO global_settings (name, value) VALUES ($1, $2) ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value, updated_at = now() WHERE global_settings.value IS DISTINCT FROM EXCLUDED.value",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f633095ebe2fdabd116d687c7f8cfb8cb76159d8db20a42e0fce71146f9b8aaa"
+}
diff --git a/backend/.sqlx/query-69bfbe9b39414b724488532cc3b3659915d9fcb3d58f16532aaffe06c44ec976.json b/backend/.sqlx/query-fa81e10f725586e12c77d4f6387cc76d5569621612ade0270261c172102015b4.json
similarity index 67%
rename from backend/.sqlx/query-69bfbe9b39414b724488532cc3b3659915d9fcb3d58f16532aaffe06c44ec976.json
rename to backend/.sqlx/query-fa81e10f725586e12c77d4f6387cc76d5569621612ade0270261c172102015b4.json
index 52105ca605..6fbc58c626 100644
--- a/backend/.sqlx/query-69bfbe9b39414b724488532cc3b3659915d9fcb3d58f16532aaffe06c44ec976.json
+++ b/backend/.sqlx/query-fa81e10f725586e12c77d4f6387cc76d5569621612ade0270261c172102015b4.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM flow_conversation_message m\n         USING flow_conversation c\n         WHERE m.conversation_id = c.id AND c.workspace_id = $1 AND m.job_id = ANY($2)\n         RETURNING m.conversation_id",
+  "query": "DELETE FROM flow_conversation_message m\n         USING flow_conversation c\n         WHERE m.conversation_id = c.id AND c.workspace_id = $1\n           AND COALESCE(m.turn_job_id, m.job_id) = ANY($2)\n         RETURNING m.conversation_id",
   "describe": {
     "columns": [
       {
@@ -19,5 +19,5 @@
       false
     ]
   },
-  "hash": "69bfbe9b39414b724488532cc3b3659915d9fcb3d58f16532aaffe06c44ec976"
+  "hash": "fa81e10f725586e12c77d4f6387cc76d5569621612ade0270261c172102015b4"
 }
diff --git a/backend/.sqlx/query-fac99e27c8396185dd21c33baf649dd75b5f8ed859e410d2322ec3f565382fa8.json b/backend/.sqlx/query-fac99e27c8396185dd21c33baf649dd75b5f8ed859e410d2322ec3f565382fa8.json
deleted file mode 100644
index c624143ea4..0000000000
--- a/backend/.sqlx/query-fac99e27c8396185dd21c33baf649dd75b5f8ed859e410d2322ec3f565382fa8.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT DISTINCT ON (path)\n                      path,\n                      value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                      created_at\n               FROM draft\n               WHERE workspace_id = $1\n                 AND typ = 'script'\n                 AND (email = $2 OR email IS NULL)\n                 AND NOT EXISTS (\n                     SELECT 1 FROM script s\n                     WHERE s.workspace_id = draft.workspace_id\n                       AND s.path = draft.path\n                 )\n               ORDER BY path, (email IS NULL)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-        "type_info": "Json"
-      },
-      {
-        "ordinal": 2,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "fac99e27c8396185dd21c33baf649dd75b5f8ed859e410d2322ec3f565382fa8"
-}
diff --git a/backend/.sqlx/query-68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca.json b/backend/.sqlx/query-fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c.json
similarity index 86%
rename from backend/.sqlx/query-68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca.json
rename to backend/.sqlx/query-fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c.json
index 583d2bcc6b..5ee5c7571d 100644
--- a/backend/.sqlx/query-68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca.json
+++ b/backend/.sqlx/query-fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,\n        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,\n        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode\n        FROM worker_ping\n        WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)\n        ORDER BY ping_at desc LIMIT $2 OFFSET $3",
+  "query": "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,\n        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,\n        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode, draining\n        FROM worker_ping\n        WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)\n        ORDER BY ping_at desc LIMIT $2 OFFSET $3",
   "describe": {
     "columns": [
       {
@@ -107,6 +107,11 @@
         "ordinal": 20,
         "name": "native_mode",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 21,
+        "name": "draining",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -138,8 +143,9 @@
       true,
       true,
       true,
+      false,
       false
     ]
   },
-  "hash": "68bca8f839e47705b11d312ee874eceaa3d1d24d9053ad4aea94b9f8465585ca"
+  "hash": "fe22c4609d8b2472c0f83fedb92eceec2b6f1ae1a32fcf375161d04419404d9c"
 }
diff --git a/backend/AGENTS.md b/backend/AGENTS.md
index 750e0594e1..fbacb857ee 100644
--- a/backend/AGENTS.md
+++ b/backend/AGENTS.md
@@ -214,7 +214,7 @@ Whole classes of defect compile and unit-test clean:
 - **Stack overflow from a large buffer in an async block.** An array declared across an
   `.await` is baked into the future's state; once that future is boxed a few layers deep
   by the job poller, two 16 KB arrays abort the worker *process* (`thread
-  'tokio-runtime-worker' has overflowed its stack`). Heap-allocate read buffers
+  'tokio-rt-worker' has overflowed its stack`). Heap-allocate read buffers
   (`vec![0u8; N]`, not `[0u8; N]`).
 - Deadlocks from draining only one of a child's pipes, missed cancellation or timeout
   propagation, and anything depending on the real engine's output format.
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index abc735f0c7..1bd38513a7 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2,15 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "addr2line"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
-dependencies = [
- "gimli",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -247,7 +238,7 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
 dependencies = [
- "object 0.39.1",
+ "object",
 ]
 
 [[package]]
@@ -508,6 +499,22 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
 
+[[package]]
+name = "asn1-rs"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f6fd5ddaf0351dff5b8da21b2fb4ff8e08ddd02857f0bf69c47639106c0fff0"
+dependencies = [
+ "asn1-rs-derive 0.4.0",
+ "asn1-rs-impl 0.1.0",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
 [[package]]
 name = "asn1-rs"
 version = "0.6.2"
@@ -515,7 +522,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
  "asn1-rs-derive 0.5.1",
- "asn1-rs-impl",
+ "asn1-rs-impl 0.2.0",
  "displaydoc",
  "nom",
  "num-traits",
@@ -531,7 +538,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
 dependencies = [
  "asn1-rs-derive 0.6.0",
- "asn1-rs-impl",
+ "asn1-rs-impl 0.2.0",
  "displaydoc",
  "nom",
  "num-traits",
@@ -540,6 +547,18 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "asn1-rs-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "synstructure 0.12.6",
+]
+
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -564,6 +583,17 @@ dependencies = [
  "synstructure 0.13.2",
 ]
 
+[[package]]
+name = "asn1-rs-impl"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "asn1-rs-impl"
 version = "0.2.0"
@@ -828,13 +858,13 @@ dependencies = [
 
 [[package]]
 name = "async-recursion"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+checksum = "4f8abc12baad266b1c8cec146854c195b5864b4221d4b2ca7296a7ae82d9e451"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -920,6 +950,35 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "attribute-derive"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f9ef7a68684657ce9da341c934c73b63df7a3585a61e366d84c84ed5d3d167"
+dependencies = [
+ "attribute-derive-macro",
+ "manyhow 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "attribute-derive-macro"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300d426e5e73549125bb8e4649bdd5508f82c94ddf898fb0517246e71dfb8e98"
+dependencies = [
+ "collection_literals",
+ "interpolator",
+ "manyhow 0.14.0",
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+ "quote-use",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "autocfg"
 version = "1.5.1"
@@ -974,11 +1033,23 @@ version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
- "aws-lc-sys",
+ "aws-lc-sys 0.45.0",
  "untrusted 0.7.1",
  "zeroize",
 ]
 
+[[package]]
+name = "aws-lc-sys"
+version = "0.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
 [[package]]
 name = "aws-lc-sys"
 version = "0.45.0"
@@ -1254,7 +1325,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "http 0.2.12",
  "http 1.5.0",
  "percent-encoding",
@@ -1338,18 +1409,18 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "h2 0.3.27",
- "h2 0.4.19",
+ "h2 0.4.20",
  "http 0.2.12",
  "http 1.5.0",
  "http-body 0.4.6",
  "hyper 0.14.32",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.24.2",
  "hyper-rustls 0.27.10",
  "hyper-util",
  "pin-project-lite",
  "rustls 0.21.12",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "tokio",
@@ -1492,44 +1563,17 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "rustc_version 0.4.1",
+ "rustc_version",
  "tracing",
 ]
 
-[[package]]
-name = "axum"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
-dependencies = [
- "async-trait",
- "axum-core 0.4.5",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "itoa",
- "matchit 0.7.3",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "sync_wrapper",
- "tower 0.5.3",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "axum"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
- "axum-core 0.5.6",
+ "axum-core",
  "axum-macros",
  "bytes",
  "form_urlencoded",
@@ -1537,7 +1581,7 @@ dependencies = [
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "itoa",
  "matchit 0.8.4",
@@ -1558,26 +1602,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "axum-core"
 version = "0.5.6"
@@ -1608,12 +1632,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "az"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be5eb007b7cacc6c660343e96f650fedf4b5a77512399eb952ca6642cf8d13f7"
-
 [[package]]
 name = "backon"
 version = "1.6.0"
@@ -1625,27 +1643,18 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "backtrace"
-version = "0.3.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide 0.8.9",
- "object 0.37.3",
- "rustc-demangle",
- "windows-link 0.2.1",
-]
-
 [[package]]
 name = "base16ct"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base32"
 version = "0.5.1"
@@ -1723,6 +1732,26 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bindgen"
+version = "0.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
+dependencies = [
+ "bitflags 2.13.2",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.13.0",
+ "log",
+ "prettyplease 0.2.37",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash 1.1.0",
+ "shlex 1.3.0",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.71.1"
@@ -1931,7 +1960,7 @@ dependencies = [
  "hex",
  "http 1.5.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-named-pipe",
  "hyper-util",
  "hyperlocal",
@@ -1963,18 +1992,18 @@ dependencies = [
 
 [[package]]
 name = "bon"
-version = "3.10.1"
+version = "3.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60eafe0d77c3a2fc292c1d1346c3041b33c0a108085a2afabf672b70f69dbbc9"
+checksum = "214f5df094ce551a10a30ffb9c70243d61f121a3d985a6495933e181dee6a7d2"
 dependencies = [
  "bon-macros",
 ]
 
 [[package]]
 name = "bon-macros"
-version = "3.10.1"
+version = "3.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd0f9631d8aaaee112c41985d675ef269e02acbd4f33122836af4f0c5f699ff6"
+checksum = "2706da6c749998cc555d04184909608956a69ad3f8ab1a076fbc867b4a3c3ce5"
 dependencies = [
  "darling 0.24.1",
  "ident_case",
@@ -2018,6 +2047,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "brotli"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor 4.0.3",
+]
+
 [[package]]
 name = "brotli"
 version = "7.0.0"
@@ -2212,6 +2252,16 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "calendrical_calculations"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5abbd6eeda6885048d357edc66748eea6e0268e3dd11f326fff5bd248d779c26"
+dependencies = [
+ "core_maths",
+ "displaydoc",
+]
+
 [[package]]
 name = "candle-core"
 version = "0.9.2"
@@ -2316,9 +2366,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.5.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f360145194ee8e21db5ee7f3fcd4fe52210864c75c985dae33218202c8bbe040"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2364,6 +2414,18 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "char_str"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9cba78a5abb515610e10af297615434b019755b5d7be14e559ff5340dff50c4"
+dependencies = [
+ "castaway",
+ "get-size2",
+ "itoa",
+ "ryu",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -2489,12 +2551,18 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b77c319abfd5219629c45c34c89ba945ed3c5e49fcde9d16b6c3885f118a730"
 dependencies = [
- "const-oid",
- "der",
- "spki",
+ "const-oid 0.9.6",
+ "der 0.7.10",
+ "spki 0.7.3",
  "x509-cert",
 ]
 
+[[package]]
+name = "collection_literals"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2550f75b8cfac212855f6b1885455df8eaee8fe8e246b647d69146142e016084"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -2534,6 +2602,19 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79fcda08c33bb58b97008b2cdada6622500e949e060f5913361763121abd2416"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "static_assertions",
+ "zmij",
+]
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -2562,12 +2643,30 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "const-hex"
+version = "1.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e59eef12462b0f9b0a3620219be5d639afd79fe39dff0a42c3997061f9298b4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "proptest",
+ "serde_core",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -2694,6 +2793,21 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "core_maths"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -2745,6 +2859,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
 [[package]]
 name = "cron"
 version = "0.17.0"
@@ -2836,6 +2956,22 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "crypto-bigint"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -2853,7 +2989,32 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "cssparser"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf 0.13.1",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2888,18 +3049,19 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
 dependencies = [
  "cmov",
+ "subtle",
 ]
 
 [[package]]
 name = "curl-sys"
-version = "0.4.90+curl-8.21.0"
+version = "0.4.91+curl-8.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97799a0d220bfb3361e0fe4936966ff8c4b24d65c3f06dfc70d7b680b44e7897"
+checksum = "cd39579123e45bf762716bb893d43886ed1cabe6289455be29a4f1d4e37afb06"
 dependencies = [
  "cc",
  "libc",
@@ -2920,8 +3082,8 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto 0.2.9",
- "rustc_version 0.4.1",
+ "fiat-crypto",
+ "rustc_version",
  "subtle",
  "zeroize",
 ]
@@ -3795,7 +3957,7 @@ checksum = "c72e0409b3dbd60a5bf296cbc273a8e36bb3a3aab6abac389f1891e187d5ce14"
 dependencies = [
  "base64 0.22.1",
  "capacity_builder",
- "deno_error 0.7.3",
+ "deno_error",
  "deno_media_type",
  "deno_terminal",
  "dprint-swc-ext",
@@ -3829,37 +3991,29 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "deno_console"
-version = "0.209.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66c0b8a65dcb7b38c22e5969c6454b3cb0839b7dcfb7a4f0d904de871a4c4416"
-dependencies = [
- "deno_core",
-]
-
 [[package]]
 name = "deno_core"
-version = "0.352.1"
+version = "0.412.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf78f3f72ac8e09b18a588bc26a1b3c5ab853e7fb489889b2f5000654d34db5d"
+checksum = "580cb2e0d797d75ff3dfc4a8f2b14aa7470f0fa31654a09a83d4cbb42b5eb9b4"
 dependencies = [
  "anyhow",
- "az",
- "bincode",
+ "base64 0.22.1",
  "bit-set",
  "bit-vec 0.8.0",
+ "boxed_error",
  "bytes",
- "capacity_builder",
  "cooked-waker",
- "deno_core_icudata",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_ops",
  "deno_path_util",
  "deno_unsync",
+ "deno_v8",
  "futures",
  "indexmap 2.14.2",
+ "inventory",
  "libc",
+ "num-bigint",
  "parking_lot",
  "percent-encoding",
  "pin-project",
@@ -3869,41 +4023,41 @@ dependencies = [
  "smallvec",
  "sourcemap",
  "static_assertions",
+ "sys_traits",
  "thiserror 2.0.21",
  "tokio",
  "url",
- "v8",
+ "uuid",
  "wasm_dep_analyzer",
+ "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_core_icudata"
-version = "0.74.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe4dccb6147bb3f3ba0c7a48e993bfeb999d2c2e47a81badee80e2b370c8d695"
-
 [[package]]
 name = "deno_crypto"
-version = "0.223.0"
+version = "0.273.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "beb2568806b930b96fb6440ff16463befa73a36de3378986644e7134c9d52e8f"
+checksum = "d9931d22328961b9a9c8d3b666a27312c1f3ddcc7ea78d8610ddfbc934ac61a0"
 dependencies = [
  "aes 0.8.3",
  "aes-gcm",
  "aes-kw",
+ "argon2",
  "aws-lc-rs",
  "base64 0.22.1",
  "cbc",
- "const-oid",
+ "const-oid 0.9.6",
  "ctr",
  "curve25519-dalek",
  "deno_core",
- "deno_error 0.6.1",
- "deno_web",
+ "deno_crypto_provider",
+ "deno_error",
  "ecdsa",
- "ed448-goldilocks",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
+ "fips203",
+ "fips205",
+ "hmac 0.12.1",
  "num-traits",
+ "ocb3",
  "once_cell",
  "p256",
  "p384",
@@ -3914,21 +4068,34 @@ dependencies = [
  "serde_bytes",
  "sha1",
  "sha2 0.10.9",
- "signature",
- "spki",
+ "sha3",
+ "signature 2.2.0",
+ "spki 0.7.3",
+ "subtle",
  "thiserror 2.0.21",
+ "tiny-keccak",
  "tokio",
  "uuid",
  "x25519-dalek",
 ]
 
 [[package]]
-name = "deno_error"
-version = "0.6.1"
+name = "deno_crypto_provider"
+version = "0.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612ec3fc481fea759141b0c57810889b0a4fb6fee8f10748677bfe492fd30486"
+checksum = "fafd673e5a4eefd6d65db358b00ff60488cfa1be6515406b4371935c2e2e6baa"
 dependencies = [
- "deno_error_macro 0.6.1",
+ "aws-lc-sys 0.40.0",
+ "ed448-goldilocks",
+]
+
+[[package]]
+name = "deno_error"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfafd2219b29886a71aecbb3449e462deed1b2c474dc5b12f855f0e58c478931"
+dependencies = [
+ "deno_error_macro",
  "libc",
  "serde",
  "serde_json",
@@ -3936,32 +4103,11 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "deno_error"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3007d3f1ea92ea503324ae15883aac0c2de2b8cf6fead62203ff6a67161007ab"
-dependencies = [
- "deno_error_macro 0.7.3",
- "libc",
-]
-
 [[package]]
 name = "deno_error_macro"
-version = "0.6.1"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8380a4224d5d2c3f84da4d764c4326cac62e9a1e3d4960442d29136fc07be863"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "deno_error_macro"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b565e60a9685cdf312c888665b5f8647ac692a7da7e058a5e2268a466da8eaf"
+checksum = "1c28ede88783f14cd8aae46ca89f230c226b40e4a81ab06fa52ed72af84beb2f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3970,43 +4116,41 @@ dependencies = [
 
 [[package]]
 name = "deno_features"
-version = "0.6.0"
+version = "0.56.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "487773bb24b92f3b88d1c9ef0d4d15888641a2e2ea4d4cdfd6fda12cae26317c"
+checksum = "2fef16a40daeb19acfc5345aa5bb367a36ecffef18b7ad1a594f0f01fe7c20c5"
 dependencies = [
  "deno_core",
- "serde",
- "serde_json",
 ]
 
 [[package]]
 name = "deno_fetch"
-version = "0.233.0"
+version = "0.283.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cbe158bec955790105ded69978b1245b97c65092f7bf184add344c0e78efffa"
+checksum = "20e792f76d45e20cf6f1ad46157bbe1a0a895a6f09ec4d99b0911112be8e05e3"
 dependencies = [
+ "async-compression",
  "base64 0.22.1",
  "bytes",
  "data-url",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_fs",
+ "deno_io",
  "deno_path_util",
  "deno_permissions",
  "deno_tls",
- "dyn-clone",
  "error_reporter",
- "h2 0.4.19",
+ "h2 0.4.20",
  "hickory-resolver",
  "http 1.5.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.27.10",
  "hyper-util",
  "ipnet",
  "percent-encoding",
- "rustls-webpki 0.102.8",
- "serde",
+ "rustls-webpki 0.103.15",
  "serde_json",
  "thiserror 2.0.21",
  "tokio",
@@ -4015,62 +4159,69 @@ dependencies = [
  "tokio-util",
  "tokio-vsock",
  "tower 0.5.3",
- "tower-http",
  "tower-service",
 ]
 
 [[package]]
 name = "deno_fs"
-version = "0.119.0"
+version = "0.169.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca83a95cea7bcdf19dac1888ef6f04aff69d251640a4d085bc6089c06b4b181"
+checksum = "a0b0ae3c55f4af9d33113ba4935828a2e9a7bfcbf4d3058533403b9ef332a966"
 dependencies = [
  "async-trait",
- "base32",
  "boxed_error",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_io",
+ "deno_maybe_sync",
  "deno_path_util",
  "deno_permissions",
  "filetime",
  "junction",
  "libc",
- "nix 0.27.1",
+ "nix 0.30.1",
  "rand 0.8.5",
  "rayon",
+ "same-file",
  "serde",
  "thiserror 2.0.21",
- "winapi",
+ "tokio",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_io"
-version = "0.119.0"
+version = "0.169.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597aac25be261a1bd545d6f47a80439c60e600c076f9847b3718a592883b2a73"
+checksum = "ba495b6c141d34e49fb2dbe7ca746d7ac068b1962470776eb341c59059b758f6"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
+ "deno_permissions",
  "deno_subprocess_windows",
  "filetime",
- "fs3",
  "libc",
  "log",
- "nix 0.27.1",
- "once_cell",
+ "nix 0.30.1",
  "os_pipe",
  "parking_lot",
  "pin-project",
  "rand 0.8.5",
  "tokio",
  "uuid",
- "winapi",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "deno_maybe_sync"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57e5e72b38015b5e478b8d739dfa818d563329e03a72d6ce5cfb2ecbcd7f8d41"
+dependencies = [
+ "rustc-hash 2.1.3",
+]
+
 [[package]]
 name = "deno_media_type"
 version = "0.3.3"
@@ -4097,17 +4248,21 @@ dependencies = [
 
 [[package]]
 name = "deno_net"
-version = "0.201.0"
+version = "0.251.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb88f1ea2762065d6cc0316372acc22696ab6004943aa029f80546f9faf1b491"
+checksum = "19ba02152d978f30e2eb5f8d074b343363f53cb1364b5c304b3176da916a06c0"
 dependencies = [
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_features",
  "deno_permissions",
+ "deno_signals",
  "deno_tls",
+ "deno_tunnel",
  "hickory-proto",
  "hickory-resolver",
+ "libc",
+ "log",
  "pin-project",
  "quinn",
  "rustls-tokio-stream",
@@ -4119,32 +4274,33 @@ dependencies = [
  "tokio-vsock",
  "url",
  "web-transport-proto",
+ "x509-parser 0.15.1",
 ]
 
 [[package]]
 name = "deno_ops"
-version = "0.228.1"
+version = "0.288.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf8dbe5abf37d270bb853c5dfe45fbe3b1b6c453877cc11d7fe84e9862a6dbc"
+checksum = "977748624aad80164dbe385c8c907bc0041c2e6849f92528e362e03132c64c52"
 dependencies = [
  "indexmap 2.14.2",
- "proc-macro-rules",
  "proc-macro2",
  "quote",
  "stringcase",
  "strum",
  "strum_macros",
  "syn 2.0.119",
+ "syn-match",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "deno_path_util"
-version = "0.4.0"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "516f813389095889776b81cc9108ff6f336fd9409b4b12fc0138aea23d2708e1"
+checksum = "78c7e98943f0d068928906db0c7bde89de684fa32c6a8018caacc4cee2cdd72b"
 dependencies = [
- "deno_error 0.6.1",
+ "deno_error",
  "percent-encoding",
  "sys_traits",
  "thiserror 2.0.21",
@@ -4153,77 +4309,100 @@ dependencies = [
 
 [[package]]
 name = "deno_permissions"
-version = "0.68.0"
+version = "0.118.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa14d9c3fbba59836ffbaac7f736a2f48d4a5fc209a2103d1e1b898915232a5"
+checksum = "f8e9d37215f52e29b5ad9d9065c476168ffb888cd2ad93b0ae153f22304851a0"
 dependencies = [
  "capacity_builder",
- "deno_error 0.6.1",
+ "chrono",
+ "deno_error",
  "deno_path_util",
  "deno_terminal",
  "deno_unsync",
+ "dunce",
  "fqdn",
- "ipnetwork",
+ "ipnet",
  "libc",
  "log",
- "nix 0.27.1",
+ "nix 0.30.1",
  "once_cell",
  "parking_lot",
- "percent-encoding",
  "serde",
  "serde_json",
  "sys_traits",
- "temp_deno_which",
  "thiserror 2.0.21",
+ "unicode-normalization",
  "url",
- "winapi",
+ "which 8.0.6",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "deno_signals"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "038ed4b09a6d36c81ac436c4d10076e9e01cc67faf93d701c541887f8eeddf36"
+dependencies = [
+ "libc",
+ "signal-hook",
+ "thiserror 2.0.21",
+ "tokio",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_subprocess_windows"
-version = "0.4.0"
+version = "0.54.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bc6b10059f0ccb14c6e0319c5275f0407fb2f9ffe405cd555700561999ea4bf"
+checksum = "04d4f451b2f94d2847de4895d39ca5aa264b90af34e72fd79ddc1d0da05a5ea0"
 dependencies = [
- "fastrand 2.5.0",
  "futures-channel",
  "libc",
+ "rand 0.8.5",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_telemetry"
-version = "0.31.0"
+version = "0.81.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "377581966bd34e85ce230f7f4b1dee7e16c6bf7f845b4690648507ce7ba105d9"
+checksum = "8831dc236ed1c66a90c8dfddab93ad44fbb28950fc476c78306b9100233ff694"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
+ "deno_net",
+ "deno_signals",
+ "deno_terminal",
  "deno_tls",
+ "flate2",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.27.10",
  "hyper-util",
  "log",
  "once_cell",
- "opentelemetry 0.27.1",
- "opentelemetry-http 0.27.0",
- "opentelemetry-otlp 0.27.0",
- "opentelemetry-semantic-conventions 0.27.0",
- "opentelemetry_sdk 0.27.1",
+ "opentelemetry 0.32.0",
+ "opentelemetry-http 0.32.0",
+ "opentelemetry-otlp 0.32.0",
+ "opentelemetry-proto 0.32.0",
+ "opentelemetry-semantic-conventions 0.32.1",
+ "opentelemetry_sdk 0.32.1",
  "pin-project",
+ "prost 0.14.4",
  "serde",
+ "sys_traits",
  "thiserror 2.0.21",
  "tokio",
+ "tokio-vsock",
+ "tower-service",
 ]
 
 [[package]]
 name = "deno_terminal"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f71c27009e0141dedd315f1dfa3ebb0a6ca4acce7c080fac576ea415a465f6"
+checksum = "f3ba8041ae7319b3ca6a64c399df4112badcbbe0868b4517637647614bede4be"
 dependencies = [
  "once_cell",
  "termcolor",
@@ -4231,23 +4410,40 @@ dependencies = [
 
 [[package]]
 name = "deno_tls"
-version = "0.196.0"
+version = "0.246.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7835eb6a8d114703b0293573fbb8885bc2c81e8c35363b9e89391dd3c541fa6"
+checksum = "6229f7a00441b2acbf7fae58dd14bded0e835f212653402083430826e640f99d"
 dependencies = [
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_native_certs",
- "rustls 0.23.35",
+ "log",
+ "rustls 0.23.40",
  "rustls-pemfile 2.2.0",
  "rustls-tokio-stream",
- "rustls-webpki 0.102.8",
+ "rustls-webpki 0.103.15",
  "serde",
  "thiserror 2.0.21",
  "tokio",
  "webpki-roots 0.26.11",
 ]
 
+[[package]]
+name = "deno_tunnel"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e432929e0c167f2a003b963ee406c714fcd947a87d4f9edc7b3255e87be9881d"
+dependencies = [
+ "pin-project",
+ "quinn",
+ "serde",
+ "serde_json",
+ "socket2 0.6.5",
+ "thiserror 2.0.21",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "deno_unsync"
 version = "0.4.4"
@@ -4260,42 +4456,43 @@ dependencies = [
 ]
 
 [[package]]
-name = "deno_url"
-version = "0.209.0"
+name = "deno_v8"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cccbb10fb59f29b04161055a65f7fe83364f9e8317d4d2ce3bd7979faf63a87"
+checksum = "85cdff08dedf79da6a40f97554f47d59d419ba3df8061b8b31789cd2cbe00433"
 dependencies = [
- "deno_core",
- "deno_error 0.6.1",
- "urlpattern",
+ "v8",
+ "v8x",
 ]
 
 [[package]]
 name = "deno_web"
-version = "0.240.0"
+version = "0.290.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d6b8a97cc90b6aaea20fe200cfa7e5b6953dd33ecda0af50d6d360387c33df4"
+checksum = "7510967ba4ec695959c1a518748c3b564fd9ca7a8f3eb13bd397707a3ca232da"
 dependencies = [
  "async-trait",
- "base64-simd",
+ "brotli 6.0.0",
  "bytes",
+ "cssparser",
  "deno_core",
- "deno_error 0.6.1",
- "deno_permissions",
+ "deno_error",
  "encoding_rs",
  "flate2",
  "futures",
  "serde",
  "thiserror 2.0.21",
  "tokio",
+ "unicode-normalization",
+ "urlpattern",
  "uuid",
 ]
 
 [[package]]
 name = "deno_webidl"
-version = "0.209.0"
+version = "0.259.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20bbfac0cf15918f7cbd0b55c366ac20ad65c825f362fa684c3104984254d3b"
+checksum = "40af42313723a8d3114c4e5b007abd1cab4400a0b68929794c556b2e792409c7"
 dependencies = [
  "deno_core",
 ]
@@ -4306,13 +4503,37 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "der_derive",
  "flagset",
  "pem-rfc7468",
  "zeroize",
 ]
 
+[[package]]
+name = "der"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
+dependencies = [
+ "const-oid 0.10.2",
+ "zeroize",
+]
+
+[[package]]
+name = "der-parser"
+version = "8.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbd676fbbab537128ef0278adb5576cf363cff6aa22a7b24effe97347cfab61e"
+dependencies = [
+ "asn1-rs 0.5.2",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "der-parser"
 version = "9.0.0"
@@ -4361,6 +4582,25 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "derive-io"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58cc7f4740088458993d183a200fe56e62378736f94bf0e2dd45807407e7bb94"
+dependencies = [
+ "derive-io-macros",
+ "tokio",
+]
+
+[[package]]
+name = "derive-io-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d0a1bd7eeab72097740967d03d53db5fbaf8e3c0dd471ebdefa43ce445a20a6"
+dependencies = [
+ "proc-macro2",
+]
+
 [[package]]
 name = "derive_builder"
 version = "0.12.0"
@@ -4450,7 +4690,6 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
- "unicode-xid",
 ]
 
 [[package]]
@@ -4461,7 +4700,7 @@ checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
  "proc-macro2",
  "quote",
- "rustc_version 0.4.1",
+ "rustc_version",
  "syn 2.0.119",
 ]
 
@@ -4501,7 +4740,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid",
+ "const-oid 0.9.6",
  "crypto-common 0.1.7",
  "subtle",
 ]
@@ -4513,10 +4752,43 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
+ "const-oid 0.10.2",
  "crypto-common 0.2.2",
  "ctutils",
 ]
 
+[[package]]
+name = "diplomat"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8b37a6cea72eb6df5143d3e091d4c34cb0cf4046dd1ddcc082988886fe1f809"
+dependencies = [
+ "diplomat_core",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "diplomat-runtime"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae517853d9f82b2d144393b1c32c34c46c2e361de2b6c44a8fdfce23beb211cd"
+
+[[package]]
+name = "diplomat_core"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b18e806f9ecb92df828d080efe47984ae1193958295d4a84fb8b32c9a1aa1b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "smallvec",
+ "strck",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "dirs"
 version = "4.0.0"
@@ -4674,6 +4946,27 @@ dependencies = [
  "text_lines",
 ]
 
+[[package]]
+name = "drop_bomb"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bda8e21c04aca2ae33ffc2fd8c23134f3cac46db123ba97bd9d3f3b8a4a85e1"
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
 [[package]]
 name = "duct"
 version = "0.13.7"
@@ -4720,12 +5013,12 @@ version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "rfc6979",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -4734,8 +5027,8 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
- "signature",
+ "pkcs8 0.10.2",
+ "signature 2.2.0",
 ]
 
 [[package]]
@@ -4749,21 +5042,35 @@ dependencies = [
  "rand_core 0.6.4",
  "serde",
  "sha2 0.10.9",
- "signature",
+ "signature 2.2.0",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
-name = "ed448-goldilocks"
-version = "0.8.3"
+name = "ed448"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06924531e9e90130842b012e447f85bdaf9161bc8a0f8092be8cb70b01ebe092"
+checksum = "ae112a25f86ae3598d4e8533ed1e65149cec6eb21918e7a6f4c06dddec370263"
 dependencies = [
- "fiat-crypto 0.1.20",
- "hex",
+ "pkcs8 0.11.0",
+ "signature 3.0.0",
+]
+
+[[package]]
+name = "ed448-goldilocks"
+version = "0.14.0-pre.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b805154de2e68f59874ec217ca36790dcffe500cd872c60fe509d28d0814a74d"
+dependencies = [
+ "ed448",
+ "elliptic-curve 0.14.1",
+ "hash2curve",
+ "rand_core 0.10.1",
+ "serdect 0.4.3",
+ "shake",
+ "signature 3.0.0",
  "subtle",
- "zeroize",
 ]
 
 [[package]]
@@ -4780,9 +5087,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 dependencies = [
  "serde",
 ]
@@ -4793,20 +5100,39 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "base64ct",
- "crypto-bigint",
+ "crypto-bigint 0.5.5",
  "digest 0.10.7",
- "ff",
+ "ff 0.13.1",
  "generic-array",
- "group",
+ "group 0.13.0",
  "hkdf",
  "pem-rfc7468",
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "sec1",
+ "sec1 0.7.3",
  "serde_json",
- "serdect",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
+dependencies = [
+ "base16ct 1.0.0",
+ "crypto-bigint 0.7.5",
+ "crypto-common 0.2.2",
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hybrid-array",
+ "pkcs8 0.11.0",
+ "rand_core 0.10.1",
+ "sec1 0.8.1",
  "subtle",
  "zeroize",
 ]
@@ -5005,6 +5331,18 @@ dependencies = [
  "regex-syntax 0.8.11",
 ]
 
+[[package]]
+name = "fastbloom"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef975e30683b2d965054bb0a836f8973857c4ebf6acf274fe46617cd285060d8"
+dependencies = [
+ "foldhash 0.2.0",
+ "libm",
+ "portable-atomic",
+ "siphasher 1.0.4",
+]
+
 [[package]]
 name = "fastdivide"
 version = "0.4.2"
@@ -5037,10 +5375,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "fiat-crypto"
-version = "0.1.20"
+name = "ff"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e825f6987101665dea6ec934c09ec6d721de7bc1bf92248e1d5810c8cd636b77"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+dependencies = [
+ "rand_core 0.10.1",
+ "subtle",
+]
 
 [[package]]
 name = "fiat-crypto"
@@ -5064,6 +5406,30 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fips203"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8bdb6454f692ca2a2b45cd554c6828c639d7f9c968cf83a678899ec4443a280"
+dependencies = [
+ "rand_core 0.6.4",
+ "sha3",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "fips205"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f5626bf5534df4ebdbd2536465d7eaa8a9dc2cdeb7e036e0ecf291dcc80ffb6"
+dependencies = [
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+ "sha3",
+ "zeroize",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -5083,7 +5449,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
  "bitflags 2.13.2",
- "rustc_version 0.4.1",
+ "rustc_version",
 ]
 
 [[package]]
@@ -5166,9 +5532,9 @@ dependencies = [
 
 [[package]]
 name = "fqdn"
-version = "0.3.12"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb540cf7bc4fe6df9d8f7f0c974cfd0dce8ed4e9e8884e73433b503ee78b4e7d"
+checksum = "886ac788f62d16d6b0f26b2fa762b34ef16ebfb4b624c2c15fbcadc9173c0f72"
 
 [[package]]
 name = "from_variant"
@@ -5186,17 +5552,6 @@ version = "1.20260821.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c70238056ad1dbfdf035222a571d2e9baf5b6a4c308cfa87bc8cbe7f2f3840"
 
-[[package]]
-name = "fs3"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb17cf6ed704f72485332f6ab65257460c4f9f3083934cf402bf9f5b3b600a90"
-dependencies = [
- "libc",
- "rustc_version 0.2.3",
- "winapi",
-]
-
 [[package]]
 name = "fs4"
 version = "0.13.1"
@@ -5526,6 +5881,31 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "get-size-derive2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28f0daa179069133df60523e0f59d0a6bd2d3db9ccae01b630896d269c4a802e"
+dependencies = [
+ "attribute-derive",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "get-size2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "050a5d07359ebfac7f0b74916d94cfa30575e45fdc7e9bfbb0f76d5d4203325a"
+dependencies = [
+ "compact_str 0.10.0",
+ "get-size-derive2",
+ "hashbrown 0.17.1",
+ "ordermap",
+ "smallvec",
+ "thin-vec",
+]
+
 [[package]]
 name = "gethostname"
 version = "0.4.3"
@@ -5607,12 +5987,6 @@ dependencies = [
  "polyval",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.32.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
-
 [[package]]
 name = "git-version"
 version = "0.3.9"
@@ -5675,7 +6049,7 @@ dependencies = [
  "google-cloud-metadata",
  "google-cloud-token",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "home",
  "jsonwebtoken 9.3.1",
  "path-clean",
@@ -5714,7 +6088,7 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "886aa8ec755382a1fdf4651f6e6ec01f2f3bf49f2cb0f068b9a74cafd574a715"
 dependencies = [
- "prost",
+ "prost 0.13.5",
  "prost-types",
  "tonic 0.12.3",
 ]
@@ -5776,11 +6150,22 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff",
+ "ff 0.13.1",
  "rand_core 0.6.4",
  "subtle",
 ]
 
+[[package]]
+name = "group"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
+dependencies = [
+ "ff 0.14.0",
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "gzip-header"
 version = "1.1.0"
@@ -5811,9 +6196,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -5843,6 +6228,16 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "hash2curve"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1eaf40612d7d854743e7189228a6d528f0f6e8502cf6a0cb831d28a218b7f3f6"
+dependencies = [
+ "digest 0.11.3",
+ "elliptic-curve 0.14.1",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -5990,11 +6385,10 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.25.0-alpha.5"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d00147af6310f4392a31680db52a3ed45a2e0f68eb18e8c3fe5537ecc96d9e2"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
 dependencies = [
- "async-recursion",
  "async-trait",
  "cfg-if",
  "data-encoding",
@@ -6006,6 +6400,7 @@ dependencies = [
  "ipnet",
  "once_cell",
  "rand 0.9.5",
+ "ring 0.17.14",
  "serde",
  "thiserror 2.0.21",
  "tinyvec",
@@ -6016,9 +6411,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.25.0-alpha.5"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5762f69ebdbd4ddb2e975cd24690bf21fe6b2604039189c26acddbc427f12887"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -6042,7 +6437,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
 ]
 
 [[package]]
@@ -6054,6 +6449,15 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -6171,7 +6575,7 @@ dependencies = [
  "futures",
  "http 1.5.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.26.0",
  "hyper-tls",
  "hyper-tungstenite",
@@ -6201,7 +6605,9 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
+ "subtle",
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -6230,15 +6636,15 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
- "h2 0.4.19",
+ "h2 0.4.20",
  "http 1.5.0",
  "http-body 1.1.0",
  "httparse",
@@ -6260,7 +6666,7 @@ dependencies = [
  "futures-util",
  "headers",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.27.10",
  "hyper-util",
  "pin-project-lite",
@@ -6276,7 +6682,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
 dependencies = [
  "hex",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6307,7 +6713,7 @@ checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "log",
  "rustls 0.22.4",
@@ -6325,10 +6731,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "log",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "tokio",
  "tokio-rustls 0.26.6",
@@ -6342,7 +6748,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6357,7 +6763,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -6372,7 +6778,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a343d17fe7885302ed7252767dc7bb83609a874b6ff581142241ec4b73957ad"
 dependencies = [
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6393,7 +6799,7 @@ dependencies = [
  "http 1.5.0",
  "http-body 1.1.0",
  "httparse",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -6414,7 +6820,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6445,6 +6851,28 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_calendar"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58655df2f728e46e4eee80bddebefacf52ec3e77cdb925014b47c5a5905eb55c"
+dependencies = [
+ "calendrical_calculations",
+ "displaydoc",
+ "icu_calendar_data",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_calendar_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc00caaa3fb3201ff7a18aa458e8c3ab042b9da154cfdf948bdde3936c31c36e"
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -6668,10 +7096,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
 
 [[package]]
-name = "inventory"
-version = "0.3.24"
+name = "interpolator"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+checksum = "71dd52191aae121e8611f1e8dc3e324dd0dd1dee1e6dd91d10ee07a3cfb4d9d8"
+
+[[package]]
+name = "inventory"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6928282826c822ad91bf1c9a1cb90a30ba1c26770749929b4656cd6be829cd7c"
 dependencies = [
  "rustversion",
 ]
@@ -6687,17 +7121,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "io-uring"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed3bd0ecfbb87805f538bb7b32e5239ca0763890c623e349860ecba69469f2bb"
-dependencies = [
- "bitflags 2.13.2",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "ipconfig"
 version = "0.3.4"
@@ -6717,15 +7140,6 @@ version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
-[[package]]
-name = "ipnetwork"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "is-macro"
 version = "0.3.8"
@@ -6786,6 +7200,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -6793,10 +7216,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
-name = "jiff"
-version = "0.2.37"
+name = "ixdtf"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
+checksum = "4d3667095d64c3ecffc96463a21157b04bf3e252f6e8d5750b20c02e33c194e3"
+
+[[package]]
+name = "jiff"
+version = "0.2.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
 dependencies = [
  "defmt",
  "jiff-core",
@@ -6821,9 +7250,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.37"
+version = "0.2.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
+checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
 dependencies = [
  "jiff-core",
  "proc-macro2",
@@ -6833,9 +7262,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-tzdb"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
 
 [[package]]
 name = "jiff-tzdb-platform"
@@ -6871,7 +7300,7 @@ checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
 dependencies = [
  "proc-macro2",
  "quote",
- "rustc_version 0.4.1",
+ "rustc_version",
  "simd_cesu8",
  "syn 2.0.119",
 ]
@@ -6979,7 +7408,7 @@ dependencies = [
  "pem",
  "serde",
  "serde_json",
- "signature",
+ "signature 2.2.0",
  "simple_asn1",
  "zeroize",
 ]
@@ -7006,6 +7435,25 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "keccak"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+]
+
 [[package]]
 name = "keyed_priority_queue"
 version = "0.4.2"
@@ -7068,7 +7516,7 @@ dependencies = [
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-http-proxy",
  "hyper-rustls 0.27.10",
  "hyper-timeout",
@@ -7077,7 +7525,7 @@ dependencies = [
  "k8s-openapi",
  "kube-core",
  "pem",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "secrecy",
  "serde",
  "serde_json",
@@ -7150,12 +7598,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "lalrpop-util"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "507460a910eb7b32ee961886ff48539633b788a36b65692b95f225b844c82553"
-
 [[package]]
 name = "lapin"
 version = "2.5.5"
@@ -7252,9 +7694,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "libffi-sys"
@@ -7566,7 +8008,7 @@ dependencies = [
  "base64 0.22.1",
  "gethostname",
  "mail-builder",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "smtp-proto",
  "tokio",
@@ -7574,76 +8016,30 @@ dependencies = [
  "webpki-roots 0.26.11",
 ]
 
-[[package]]
-name = "malachite"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fbdf9cb251732db30a7200ebb6ae5d22fe8e11397364416617d2c2cf0c51cb5"
-dependencies = [
- "malachite-base",
- "malachite-nz",
- "malachite-q",
-]
-
-[[package]]
-name = "malachite-base"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ea0ed76adf7defc1a92240b5c36d5368cfe9251640dcce5bd2d0b7c1fd87aeb"
-dependencies = [
- "hashbrown 0.14.5",
- "itertools 0.11.0",
- "libm",
- "ryu",
-]
-
-[[package]]
-name = "malachite-bigint"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d149aaa2965d70381709d9df4c7ee1fc0de1c614a4efc2ee356f5e43d68749f8"
-dependencies = [
- "derive_more 1.0.0",
- "malachite",
- "num-integer",
- "num-traits",
- "paste",
-]
-
-[[package]]
-name = "malachite-nz"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34a79feebb2bc9aa7762047c8e5495269a367da6b5a90a99882a0aeeac1841f7"
-dependencies = [
- "itertools 0.11.0",
- "libm",
- "malachite-base",
-]
-
-[[package]]
-name = "malachite-q"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50f235d5747b1256b47620f5640c2a17a88c7569eebdf27cd9cb130e1a619191"
-dependencies = [
- "itertools 0.11.0",
- "malachite-base",
- "malachite-nz",
-]
-
 [[package]]
 name = "manyhow"
 version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b33efb3ca6d3b07393750d4030418d594ab1139cee518f0dc88db70fec873587"
 dependencies = [
- "manyhow-macros",
+ "manyhow-macros 0.11.4",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "manyhow"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c69ea6e469ca785c846b25dd69eac9e9c916b51d8ada1f212866787ee1da12d"
+dependencies = [
+ "manyhow-macros 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "manyhow-macros"
 version = "0.11.4"
@@ -7655,6 +8051,17 @@ dependencies = [
  "quote",
 ]
 
+[[package]]
+name = "manyhow-macros"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22fc5c1b2c4000056dae3619fea36e79ce79dabfee4907d2dcad6612b189e370"
+dependencies = [
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "mappable-rc"
 version = "0.1.1"
@@ -7709,6 +8116,16 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "md-5"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
+dependencies = [
+ "cfg-if",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "md5"
 version = "0.6.1"
@@ -7830,9 +8247,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.3"
+version = "1.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
 dependencies = [
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
@@ -7912,7 +8329,7 @@ checksum = "a4db8a44120571277accfaa3f3d91e7d3989d601d817c2fc01a9391b86135666"
 dependencies = [
  "darling 0.23.0",
  "heck",
- "manyhow",
+ "manyhow 0.11.4",
  "num-bigint",
  "proc-macro-crate",
  "proc-macro2",
@@ -8046,6 +8463,7 @@ dependencies = [
  "cfg-if",
  "cfg_aliases",
  "libc",
+ "memoffset",
 ]
 
 [[package]]
@@ -8265,7 +8683,6 @@ checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
 dependencies = [
  "num-integer",
  "num-traits",
- "rand 0.8.5",
  "serde",
 ]
 
@@ -8409,15 +8826,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "object"
-version = "0.37.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "object"
 version = "0.39.1"
@@ -8442,7 +8850,7 @@ dependencies = [
  "http-body-util",
  "httparse",
  "humantime",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "itertools 0.14.0",
  "md-5 0.10.6",
  "parking_lot",
@@ -8464,6 +8872,18 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "ocb3"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c196e0276c471c843dd5777e7543a36a298a4be942a2a688d8111cd43390dedb"
+dependencies = [
+ "aead",
+ "cipher 0.4.4",
+ "ctr",
+ "subtle",
+]
+
 [[package]]
 name = "odpic-sys"
 version = "0.1.1"
@@ -8473,6 +8893,15 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "oid-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bedf36ffb6ba96c2eb7144ef6270557b52e54b20c0a8e1eb2ff99a6c6959bff"
+dependencies = [
+ "asn1-rs 0.5.2",
+]
+
 [[package]]
 name = "oid-registry"
 version = "0.7.1"
@@ -8502,6 +8931,10 @@ name = "once_cell"
 version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "once_cell_polyfill"
@@ -8559,7 +8992,7 @@ dependencies = [
  "chrono",
  "dyn-clone",
  "ed25519-dalek",
- "hmac",
+ "hmac 0.12.1",
  "http 1.5.0",
  "itertools 0.10.5",
  "log",
@@ -8641,23 +9074,23 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry"
-version = "0.27.1"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab70038c28ed37b97d8ed414b6429d343a8bbf44c9f79ec854f3a643029ba6d7"
+checksum = "aaf416e4cb72756655126f7dd7bb0af49c674f4c1b9903e80c009e0c37e552e6"
 dependencies = [
  "futures-core",
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 1.0.69",
+ "thiserror 2.0.21",
  "tracing",
 ]
 
 [[package]]
 name = "opentelemetry"
-version = "0.30.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaf416e4cb72756655126f7dd7bb0af49c674f4c1b9903e80c009e0c37e552e6"
+checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -8679,18 +9112,6 @@ dependencies = [
  "tracing-subscriber",
 ]
 
-[[package]]
-name = "opentelemetry-http"
-version = "0.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a8a7f5f6ba7c1b286c2fbca0454eaba116f63bbe69ed250b642d36fbb04d80"
-dependencies = [
- "async-trait",
- "bytes",
- "http 1.5.0",
- "opentelemetry 0.27.1",
-]
-
 [[package]]
 name = "opentelemetry-http"
 version = "0.30.0"
@@ -8705,24 +9126,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "opentelemetry-otlp"
-version = "0.27.0"
+name = "opentelemetry-http"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91cf61a1868dacc576bf2b2a1c3e9ab150af7272909e80085c3173384fe11f76"
+checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
 dependencies = [
  "async-trait",
- "futures-core",
+ "bytes",
  "http 1.5.0",
- "opentelemetry 0.27.1",
- "opentelemetry-http 0.27.0",
- "opentelemetry-proto 0.27.0",
- "opentelemetry_sdk 0.27.1",
- "prost",
- "serde_json",
- "thiserror 1.0.69",
- "tokio",
- "tonic 0.12.3",
- "tracing",
+ "opentelemetry 0.32.0",
 ]
 
 [[package]]
@@ -8736,7 +9148,7 @@ dependencies = [
  "opentelemetry-http 0.30.0",
  "opentelemetry-proto 0.30.0",
  "opentelemetry_sdk 0.30.0",
- "prost",
+ "prost 0.13.5",
  "reqwest 0.12.28",
  "thiserror 2.0.21",
  "tokio",
@@ -8745,17 +9157,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "opentelemetry-proto"
-version = "0.27.0"
+name = "opentelemetry-otlp"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6e05acbfada5ec79023c85368af14abd0b307c015e9064d249b2a950ef459a6"
+checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
 dependencies = [
- "hex",
- "opentelemetry 0.27.1",
- "opentelemetry_sdk 0.27.1",
- "prost",
- "serde",
- "tonic 0.12.3",
+ "http 1.5.0",
+ "opentelemetry 0.32.0",
+ "opentelemetry-http 0.32.0",
+ "opentelemetry-proto 0.32.0",
+ "opentelemetry_sdk 0.32.1",
+ "prost 0.14.4",
+ "serde_json",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -8768,16 +9182,24 @@ dependencies = [
  "hex",
  "opentelemetry 0.30.0",
  "opentelemetry_sdk 0.30.0",
- "prost",
+ "prost 0.13.5",
  "serde",
  "tonic 0.13.1",
 ]
 
 [[package]]
-name = "opentelemetry-semantic-conventions"
-version = "0.27.0"
+name = "opentelemetry-proto"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc1b6902ff63b32ef6c489e8048c5e253e2e4a803ea3ea7e783914536eb15c52"
+checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638"
+dependencies = [
+ "base64 0.22.1",
+ "const-hex",
+ "opentelemetry 0.32.0",
+ "opentelemetry_sdk 0.32.1",
+ "prost 0.14.4",
+ "serde",
+]
 
 [[package]]
 name = "opentelemetry-semantic-conventions"
@@ -8786,25 +9208,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "83d059a296a47436748557a353c5e6c5705b9470ef6c95cfc52c21a8814ddac2"
 
 [[package]]
-name = "opentelemetry_sdk"
-version = "0.27.1"
+name = "opentelemetry-semantic-conventions"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "231e9d6ceef9b0b2546ddf52335785ce41252bc7474ee8ba05bfad277be13ab8"
-dependencies = [
- "async-trait",
- "futures-channel",
- "futures-executor",
- "futures-util",
- "glob",
- "opentelemetry 0.27.1",
- "percent-encoding",
- "rand 0.8.5",
- "serde_json",
- "thiserror 1.0.69",
- "tokio",
- "tokio-stream",
- "tracing",
-]
+checksum = "c913ac17a6c451661ee255f4625d143e51647ae78ebd969b75e41c4442f4fe47"
 
 [[package]]
 name = "opentelemetry_sdk"
@@ -8824,6 +9231,24 @@ dependencies = [
  "tokio-stream",
 ]
 
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry 0.32.0",
+ "percent-encoding",
+ "portable-atomic",
+ "rand 0.9.5",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-stream",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -8875,6 +9300,15 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "ordermap"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a756ddcdeb6c0efc8927bdf0ed112885815a35ba350472a467be5104f01ca1"
+dependencies = [
+ "indexmap 2.14.2",
+]
+
 [[package]]
 name = "os_pipe"
 version = "1.2.1"
@@ -8913,10 +9347,10 @@ checksum = "3cae83056e7cb770211494a0ecf66d9fa7eba7d00977e5bb91f0e925b40b937f"
 dependencies = [
  "cbc",
  "cms",
- "der",
+ "der 0.7.10",
  "des 0.8.1",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "pkcs12",
  "pkcs5",
  "rand 0.9.5",
@@ -8934,7 +9368,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
  "ecdsa",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "primeorder",
  "sha2 0.10.9",
 ]
@@ -8946,7 +9380,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
  "ecdsa",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "primeorder",
  "sha2 0.10.9",
 ]
@@ -8957,9 +9391,9 @@ version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "ecdsa",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "primeorder",
  "rand_core 0.6.4",
  "sha2 0.10.9",
@@ -9080,7 +9514,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
  "digest 0.10.7",
- "hmac",
+ "hmac 0.12.1",
 ]
 
 [[package]]
@@ -9198,7 +9632,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
 dependencies = [
- "phf_macros",
+ "phf_macros 0.11.3",
  "phf_shared 0.11.3",
 ]
 
@@ -9217,6 +9651,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
+ "phf_macros 0.13.1",
  "phf_shared 0.13.1",
  "serde",
 ]
@@ -9227,7 +9662,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
 dependencies = [
- "phf_generator",
+ "phf_generator 0.11.3",
  "phf_shared 0.11.3",
 ]
 
@@ -9241,19 +9676,42 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand 2.5.0",
+ "phf_shared 0.13.1",
+]
+
 [[package]]
 name = "phf_macros"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
 dependencies = [
- "phf_generator",
+ "phf_generator 0.11.3",
  "phf_shared 0.11.3",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.11.3"
@@ -9354,9 +9812,9 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
- "der",
- "pkcs8",
- "spki",
+ "der 0.7.10",
+ "pkcs8 0.10.2",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -9366,10 +9824,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "695b3df3d3cc1015f12d70235e35b6b79befc5fa7a9b95b951eab1dd07c9efc2"
 dependencies = [
  "cms",
- "const-oid",
- "der",
+ "const-oid 0.9.6",
+ "der 0.7.10",
  "digest 0.10.7",
- "spki",
+ "spki 0.7.3",
  "x509-cert",
  "zeroize",
 ]
@@ -9382,11 +9840,11 @@ checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
 dependencies = [
  "aes 0.8.3",
  "cbc",
- "der",
+ "der 0.7.10",
  "pbkdf2",
  "scrypt",
  "sha2 0.10.9",
- "spki",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -9395,8 +9853,18 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der 0.8.2",
+ "spki 0.8.1",
 ]
 
 [[package]]
@@ -9471,7 +9939,7 @@ dependencies = [
 [[package]]
 name = "postgres-native-tls"
 version = "0.5.2"
-source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/windmill-labs/rust-postgres?rev=b3a6443aa1ae90a4f6c4b742103ba80584598f2e#b3a6443aa1ae90a4f6c4b742103ba80584598f2e"
 dependencies = [
  "native-tls",
  "tokio",
@@ -9493,25 +9961,25 @@ dependencies = [
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.9"
-source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+version = "0.6.12"
+source = "git+https://github.com/windmill-labs/rust-postgres?rev=b3a6443aa1ae90a4f6c4b742103ba80584598f2e#b3a6443aa1ae90a4f6c4b742103ba80584598f2e"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
  "fallible-iterator",
- "hmac",
- "md-5 0.10.6",
+ "hmac 0.13.0",
+ "md-5 0.11.0",
  "memchr",
- "rand 0.9.5",
- "sha2 0.10.9",
+ "rand 0.10.3",
+ "sha2 0.11.0",
  "stringprep",
 ]
 
 [[package]]
 name = "postgres-types"
 version = "0.2.11"
-source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/windmill-labs/rust-postgres?rev=b3a6443aa1ae90a4f6c4b742103ba80584598f2e#b3a6443aa1ae90a4f6c4b742103ba80584598f2e"
 dependencies = [
  "array-init",
  "bit-vec 0.6.3",
@@ -9537,9 +10005,9 @@ dependencies = [
 
 [[package]]
 name = "powerfmt"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
 
 [[package]]
 name = "ppv-lite86"
@@ -9582,7 +10050,7 @@ version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
 ]
 
 [[package]]
@@ -9591,7 +10059,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.15+spec-1.1.0",
+ "toml_edit 0.25.17+spec-1.1.0",
 ]
 
 [[package]]
@@ -9617,29 +10085,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "proc-macro-rules"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07c277e4e643ef00c1233393c673f655e3672cf7eb3ba08a00bdd0ea59139b5f"
-dependencies = [
- "proc-macro-rules-macros",
- "proc-macro2",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "proc-macro-rules-macros"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "207fffb0fe655d1d47f6af98cc2793405e85929bdbc420d685554ff07be27ac7"
-dependencies = [
- "once_cell",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "proc-macro-utils"
 version = "0.10.0"
@@ -9713,6 +10158,21 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "proptest"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+dependencies = [
+ "bitflags 2.13.2",
+ "num-traits",
+ "rand 0.9.5",
+ "rand_chacha 0.9.0",
+ "rand_xorshift",
+ "regex-syntax 0.8.11",
+ "unarray",
+]
+
 [[package]]
 name = "prost"
 version = "0.13.5"
@@ -9720,7 +10180,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
 dependencies = [
  "bytes",
- "prost-derive",
+ "prost-derive 0.13.5",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive 0.14.4",
 ]
 
 [[package]]
@@ -9736,13 +10206,26 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "prost-types"
 version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
 dependencies = [
- "prost",
+ "prost 0.13.5",
 ]
 
 [[package]]
@@ -9860,7 +10343,7 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.3",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "socket2 0.6.5",
  "thiserror 2.0.21",
  "tokio",
@@ -9876,13 +10359,14 @@ checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "aws-lc-rs",
  "bytes",
+ "fastbloom",
  "getrandom 0.4.3",
  "lru-slab",
  "rand 0.10.3",
  "rand_pcg",
  "ring 0.17.14",
  "rustc-hash 2.1.3",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.21",
@@ -9914,6 +10398,28 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "quote-use"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48356e493823dc3c1d7e9fc7b3ff204ecec48afbdd718fc4134091b88eb63f3d"
+dependencies = [
+ "quote",
+ "quote-use-macros",
+]
+
+[[package]]
+name = "quote-use-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf1c5de6a7cc231c71e03c77aa4c7019097859ea7029156b54d2894a8430704"
+dependencies = [
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "r-efi"
 version = "5.3.0"
@@ -10068,6 +10574,15 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "raw-cpuid"
 version = "11.6.0"
@@ -10304,9 +10819,9 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "relative-path"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bca40a312222d8ba74837cb474edef44b37f561da5f773981007a10bbaa992b0"
+checksum = "f2a073568cd8b9c4825429d3e9fc5f52851b4f97cc1348800689408921e6b8f8"
 dependencies = [
  "serde",
 ]
@@ -10332,11 +10847,11 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.19",
+ "h2 0.4.20",
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.27.10",
  "hyper-tls",
  "hyper-util",
@@ -10347,7 +10862,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "serde",
@@ -10380,11 +10895,11 @@ dependencies = [
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.4.19",
+ "h2 0.4.20",
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-rustls 0.27.10",
  "hyper-util",
  "js-sys",
@@ -10394,7 +10909,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
@@ -10440,7 +10955,7 @@ dependencies = [
  "futures",
  "getrandom 0.2.17",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "reqwest 0.13.5",
  "reqwest-middleware",
  "retry-policies",
@@ -10450,6 +10965,16 @@ dependencies = [
  "wasmtimer",
 ]
 
+[[package]]
+name = "resb"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22d392791f3c6802a1905a509e9d1a6039cbbcb5e9e00e5a6d3661f7c874f390"
+dependencies = [
+ "potential_utf",
+ "serde_core",
+]
+
 [[package]]
 name = "resolv-conf"
 version = "0.7.6"
@@ -10471,7 +10996,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
  "subtle",
 ]
 
@@ -10569,9 +11094,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "3.5.0"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e66877136e969d5a2d561ee5841b17717a0619aebd64abb47a2a2f46e34683"
+checksum = "a1da498700030856ba63114bceefa30ba21f5e278cb975e5b9de3529fe842b40"
 dependencies = [
  "darling 0.24.1",
  "proc-macro2",
@@ -10634,20 +11159,120 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
  "num-traits",
  "pkcs1",
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "ruff_python_ast"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15434b06df7d930fad2818639a4e0fec4af9c770121c45a96b72da7feaae9ead"
+dependencies = [
+ "aho-corasick",
+ "arrayvec",
+ "bitflags 2.13.2",
+ "char_str",
+ "compact_str 0.10.0",
+ "get-size2",
+ "is-macro",
+ "memchr",
+ "ruff_python_trivia",
+ "ruff_source_file",
+ "ruff_text_size",
+ "rustc-hash 2.1.3",
+ "thin-vec",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "ruff_python_parser"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37a22811d752aa9e255d7dd72524d14352cf9bc654ef79b399bf1eeeb6640fbb"
+dependencies = [
+ "bitflags 2.13.2",
+ "bstr",
+ "drop_bomb",
+ "get-size2",
+ "hashbrown 0.17.1",
+ "memchr",
+ "ruff_python_ast",
+ "ruff_python_trivia",
+ "ruff_text_size",
+ "ruff_unicode_names2",
+ "rustc-hash 2.1.3",
+ "stacker",
+ "static_assertions",
+ "thin-vec",
+ "unicode-ident",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "ruff_python_trivia"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0322a5059fe0feb2e010ca6f31c24ac289f6b7e9e38359539491b10c57f1c5bc"
+dependencies = [
+ "itertools 0.15.0",
+ "memchr",
+ "ruff_source_file",
+ "ruff_text_size",
+ "rustc-hash 2.1.3",
+ "unicode-ident",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "ruff_source_file"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6ae809a289b5c791f82aa45df33f2a92323e7a1c1d265c10e9ac884027a2e43"
+dependencies = [
+ "memchr",
+ "ruff_text_size",
+]
+
+[[package]]
+name = "ruff_text_size"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf6344d6915ced9316312c1ee3f24c4300c54295bc4c3b8f4e95b633ae5443b"
+dependencies = [
+ "get-size2",
+]
+
+[[package]]
+name = "ruff_unicode_names2"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13418b8fd029d597e35dedc36e91f47122d26075e4c86557574d9441753fb375"
+dependencies = [
+ "phf 0.11.3",
+ "ruff_unicode_names2_generator",
+]
+
+[[package]]
+name = "ruff_unicode_names2_generator"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37fd82af49d5685d9054e68185987acaaf62542f671b6df8935155664876bc39"
+dependencies = [
+ "phf_codegen",
+ "rand 0.8.5",
+]
+
 [[package]]
 name = "rumqttc"
 version = "0.24.0"
@@ -10721,12 +11346,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -10739,22 +11358,13 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
-[[package]]
-name = "rustc_version"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
-dependencies = [
- "semver 0.9.0",
-]
-
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.28",
+ "semver",
 ]
 
 [[package]]
@@ -10834,9 +11444,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.35"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -10855,7 +11465,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70cc376c6ba1823ae229bacf8ad93c136d93524eab0e4e5e0e4f96b9c4e5b212"
 dependencies = [
  "log",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.7.3",
  "rustls-pki-types",
  "rustls-webpki 0.103.15",
@@ -10937,7 +11547,7 @@ dependencies = [
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.15",
@@ -10955,12 +11565,13 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-tokio-stream"
-version = "0.5.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faa7dc7c991d9164e55bbf1558029eb5b84d32cc4d61a7df5b8641b2deedc4b3"
+checksum = "0560d12c0d8c672f849197de91b9ee61f5bf9aa024c97aaeeb112ec2f6c347fd"
 dependencies = [
+ "derive-io",
  "futures",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "socket2 0.5.10",
  "tokio",
 ]
@@ -10998,63 +11609,6 @@ dependencies = [
  "untrusted 0.9.0",
 ]
 
-[[package]]
-name = "rustpython-ast"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cdaf8ee5c1473b993b398c174641d3aa9da847af36e8d5eb8291930b72f31a5"
-dependencies = [
- "is-macro",
- "malachite-bigint",
- "rustpython-parser-core",
- "static_assertions",
-]
-
-[[package]]
-name = "rustpython-parser"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "868f724daac0caf9bd36d38caf45819905193a901e8f1c983345a68e18fb2abb"
-dependencies = [
- "anyhow",
- "is-macro",
- "itertools 0.11.0",
- "lalrpop-util",
- "log",
- "malachite-bigint",
- "num-traits",
- "phf 0.11.3",
- "phf_codegen",
- "rustc-hash 1.1.0",
- "rustpython-ast",
- "rustpython-parser-core",
- "tiny-keccak",
- "unic-emoji-char",
- "unic-ucd-ident",
- "unicode_names2",
-]
-
-[[package]]
-name = "rustpython-parser-core"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4b6c12fa273825edc7bccd9a734f0ad5ba4b8a2f4da5ff7efe946f066d0f4ad"
-dependencies = [
- "is-macro",
- "memchr",
- "rustpython-parser-vendored",
-]
-
-[[package]]
-name = "rustpython-parser-vendored"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04fcea49a4630a3a5d940f4d514dc4f575ed63c14c3e3ed07146634aed7f67a6"
-dependencies = [
- "memchr",
- "once_cell",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -11262,11 +11816,25 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
- "der",
+ "base16ct 0.2.0",
+ "der 0.7.10",
  "generic-array",
- "pkcs8",
- "serdect",
+ "pkcs8 0.10.2",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "sec1"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+dependencies = [
+ "base16ct 1.0.0",
+ "ctutils",
+ "der 0.8.2",
+ "hybrid-array",
  "subtle",
  "zeroize",
 ]
@@ -11316,27 +11884,12 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "semver"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d7eb9ef2c18661902cc47e535f9bc51b78acd254da71d375c2f6720d9a40403"
-dependencies = [
- "semver-parser",
-]
-
 [[package]]
 name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
-[[package]]
-name = "semver-parser"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
-
 [[package]]
 name = "seq-macro"
 version = "0.3.6"
@@ -11515,16 +12068,16 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.261.1"
+version = "0.321.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3495190857461e87a2716141043218aad5281f219f54a03b7ebbe605b3b931df"
+checksum = "fd3b6f6140192f569b88997e2ea7afeef6aa38b64374e84784ea1d1ea35679d3"
 dependencies = [
- "deno_error 0.6.1",
+ "deno_error",
+ "deno_v8",
  "num-bigint",
  "serde",
  "smallvec",
  "thiserror 2.0.21",
- "v8",
 ]
 
 [[package]]
@@ -11594,7 +12147,17 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct 1.0.0",
  "serde",
 ]
 
@@ -11658,6 +12221,38 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak 0.1.6",
+]
+
+[[package]]
+name = "shake"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
+dependencies = [
+ "digest 0.11.3",
+ "keccak 0.2.2",
+ "sponge-cursor",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -11698,6 +12293,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -11714,9 +12319,9 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1e303f8205714074f6068773f0e29527e0453937fe837c9717d066635b65f31"
 dependencies = [
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "signature",
+ "signature 2.2.0",
  "zeroize",
 ]
 
@@ -11730,6 +12335,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
@@ -11742,7 +12357,7 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
 dependencies = [
- "rustc_version 0.4.1",
+ "rustc_version",
  "simdutf8",
 ]
 
@@ -11910,7 +12525,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.7.10",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+dependencies = [
+ "base64ct",
+ "der 0.8.2",
 ]
 
 [[package]]
@@ -11925,6 +12550,12 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
 [[package]]
 name = "sql-builder"
 version = "3.1.1"
@@ -12004,7 +12635,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -12077,7 +12708,7 @@ dependencies = [
  "generic-array",
  "hex",
  "hkdf",
- "hmac",
+ "hmac 0.12.1",
  "itoa",
  "log",
  "md-5 0.10.6",
@@ -12117,7 +12748,7 @@ dependencies = [
  "futures-util",
  "hex",
  "hkdf",
- "hmac",
+ "hmac 0.12.1",
  "home",
  "itoa",
  "log",
@@ -12201,6 +12832,15 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "strck"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42316e70da376f3d113a68d138a60d8a9883c604fe97942721ec2068dab13a9f"
+dependencies = [
+ "unicode-ident",
+]
+
 [[package]]
 name = "string_enum"
 version = "1.0.2"
@@ -12401,7 +13041,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bcf55c2d7555c93f4945e29f93b7529562be97ba16e60dd94c25724d746174ac"
 dependencies = [
  "ascii",
- "compact_str",
+ "compact_str 0.7.1",
  "memchr",
  "num-bigint",
  "once_cell",
@@ -12714,6 +13354,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn-match"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54b8f0a9004d6aafa6a588602a1119e6cdaacec9921aa1605383e6e7d6258fd6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -12723,6 +13374,18 @@ dependencies = [
  "futures-core",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "unicode-xid",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -12756,11 +13419,14 @@ dependencies = [
 
 [[package]]
 name = "sys_traits"
-version = "0.1.16"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4707edf3196e8037ee45018d1bb1bfb233b0e4fc440fa3d3f25bc69bfdaf26"
+checksum = "c7a35f11f9773f11930a7d1e6276766f1577400ee2530b7f0cf3844c2dcbf12b"
 dependencies = [
+ "junction",
+ "libc",
  "sys_traits_macros",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -13015,15 +13681,6 @@ dependencies = [
  "rustls-pemfile 2.2.0",
 ]
 
-[[package]]
-name = "temp_deno_which"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "366c5ccd670145885feb6efd6bbf2478ed236c4c3839046fcc8e2a1a84c51091"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -13037,6 +13694,40 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "temporal_capi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f48eb9ca4ca22caaa48d1e7a534ad3fd598a23d1a71945e8ad5ac0be501fa5f2"
+dependencies = [
+ "diplomat",
+ "diplomat-runtime",
+ "icu_calendar",
+ "icu_locale_core",
+ "num-traits",
+ "temporal_rs",
+ "timezone_provider",
+ "writeable",
+ "zoneinfo64",
+]
+
+[[package]]
+name = "temporal_rs"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a978fef907a27736827d336c0bfaab14fb8a7509dd6dc2b43c44e51d59aca5b"
+dependencies = [
+ "calendrical_calculations",
+ "core_maths",
+ "icu_calendar",
+ "icu_locale_core",
+ "ixdtf",
+ "num-traits",
+ "timezone_provider",
+ "tinystr",
+ "writeable",
+]
+
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -13075,6 +13766,12 @@ dependencies = [
  "unicode-width 0.2.2",
 ]
 
+[[package]]
+name = "thin-vec"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6a4b9ba8738cb4a4f399d37e266becfd475e75eb73425b87a05a2f2039ba63e"
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -13237,6 +13934,18 @@ dependencies = [
  "time-core",
 ]
 
+[[package]]
+name = "timezone_provider"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ec4f4eebb4817fde02a411aedc7ac5f66c89c68c49e5d4b17a8139f077af52"
+dependencies = [
+ "tinystr",
+ "zerotrie",
+ "zerovec",
+ "zoneinfo64",
+]
+
 [[package]]
 name = "tiny-keccak"
 version = "2.0.2"
@@ -13313,23 +14022,20 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.46.1"
+version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
- "backtrace",
  "bytes",
- "io-uring",
  "libc",
  "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "slab",
- "socket2 0.5.10",
+ "socket2 0.6.5",
  "tokio-macros",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -13358,13 +14064,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -13380,7 +14086,7 @@ dependencies = [
 [[package]]
 name = "tokio-postgres"
 version = "0.7.15"
-source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
+source = "git+https://github.com/windmill-labs/rust-postgres?rev=b3a6443aa1ae90a4f6c4b742103ba80584598f2e#b3a6443aa1ae90a4f6c4b742103ba80584598f2e"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -13453,7 +14159,7 @@ version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "tokio",
 ]
 
@@ -13585,9 +14291,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
@@ -13607,21 +14313,21 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.15+spec-1.1.0"
+version = "0.25.17+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
+checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
 dependencies = [
  "indexmap 2.14.2",
- "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_datetime 1.1.2+spec-1.1.0",
  "toml_parser",
  "winnow 1.0.4",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
  "winnow 1.0.4",
 ]
@@ -13632,24 +14338,20 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
 dependencies = [
- "async-stream",
  "async-trait",
- "axum 0.7.9",
  "base64 0.22.1",
  "bytes",
  "flate2",
- "h2 0.4.19",
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost",
+ "prost 0.13.5",
  "rustls-pemfile 2.2.0",
- "socket2 0.5.10",
  "tokio",
  "tokio-rustls 0.26.6",
  "tokio-stream",
@@ -13667,20 +14369,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
 dependencies = [
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "flate2",
- "h2 0.4.19",
+ "h2 0.4.20",
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost",
+ "prost 0.13.5",
  "rustls-native-certs 0.8.4",
  "socket2 0.5.10",
  "tokio",
@@ -13738,7 +14440,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "151b5a3e3c45df17466454bb74e9ecedecc955269bdedbf4d150dfa393b55a36"
 dependencies = [
- "axum-core 0.5.6",
+ "axum-core",
  "cookie",
  "futures-util",
  "http 1.5.0",
@@ -13936,9 +14638,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter-language"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca0d1bf6fdd806e43ae5198f82f527056d359def39e54e67a0f478ac09dac081"
+checksum = "d0af592be68c579aa78a16846bd19422978c3c52e438523d45ff5d1bff1f9d4a"
 
 [[package]]
 name = "tree-sitter-r"
@@ -14029,9 +14731,9 @@ dependencies = [
 
 [[package]]
 name = "twox-hash"
-version = "2.1.4"
+version = "2.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
 
 [[package]]
 name = "typed-path"
@@ -14092,6 +14794,12 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
 [[package]]
 name = "unic-char-property"
 version = "0.9.0"
@@ -14113,17 +14821,6 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
 
-[[package]]
-name = "unic-emoji-char"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b07221e68897210270a38bde4babb655869637af0f69407f96053a34f76494d"
-dependencies = [
- "unic-char-property",
- "unic-char-range",
- "unic-ucd-version",
-]
-
 [[package]]
 name = "unic-ucd-category"
 version = "0.9.0"
@@ -14136,17 +14833,6 @@ dependencies = [
  "unic-ucd-version",
 ]
 
-[[package]]
-name = "unic-ucd-ident"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987"
-dependencies = [
- "unic-char-property",
- "unic-char-range",
- "unic-ucd-version",
-]
-
 [[package]]
 name = "unic-ucd-version"
 version = "0.9.0"
@@ -14158,9 +14844,9 @@ dependencies = [
 
 [[package]]
 name = "unicase"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"
 
 [[package]]
 name = "unicode-bidi"
@@ -14234,28 +14920,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
 
-[[package]]
-name = "unicode_names2"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1673eca9782c84de5f81b82e4109dcfb3611c8ba0d52930ec4a9478f547b2dd"
-dependencies = [
- "phf 0.11.3",
- "unicode_names2_generator",
-]
-
-[[package]]
-name = "unicode_names2_generator"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91e5b84611016120197efd7dc93ef76774f4e084cd73c9fb3ea4a86c570c56e"
-dependencies = [
- "getopts",
- "log",
- "phf_codegen",
- "rand 0.8.5",
-]
-
 [[package]]
 name = "universal-hash"
 version = "0.5.1"
@@ -14307,7 +14971,7 @@ dependencies = [
  "log",
  "native-tls",
  "once_cell",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -14337,13 +15001,13 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
 name = "urlpattern"
-version = "0.3.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d"
+checksum = "0f805818f843b548bacc19609eb3619dd2850e54746f5cada37927393c2ef4ec"
 dependencies = [
+ "icu_properties",
  "regex",
  "serde",
- "unic-ucd-ident",
  "url",
 ]
 
@@ -14379,9 +15043,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.26.1"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -14391,20 +15055,36 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "137.3.0"
+version = "150.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33995a1fee055ff743281cde33a41f0d618ee0bdbe8bdf6859e11864499c2595"
+checksum = "42a978ff11f15b24e5c05a7123cf2b68f41e763546699781a924ef4e2cf43a49"
 dependencies = [
- "bindgen 0.71.1",
+ "bindgen 0.72.1",
  "bitflags 2.13.2",
  "fslock",
  "gzip-header",
  "home",
  "miniz_oxide 0.8.9",
  "paste",
+ "temporal_capi",
  "which 6.0.3",
 ]
 
+[[package]]
+name = "v8x"
+version = "149.4.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3701ffb3692a24808503d17f758b0a3f688d2c451779247982566b5941033e63"
+dependencies = [
+ "bindgen 0.70.1",
+ "bitflags 2.13.2",
+ "cc",
+ "paste",
+ "temporal_capi",
+ "temporal_rs",
+ "timezone_provider",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -14466,9 +15146,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -14624,11 +15304,11 @@ dependencies = [
 
 [[package]]
 name = "wasm_dep_analyzer"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51cf5f08b357e64cd7642ab4bbeb11aecab9e15520692129624fb9908b8df2c"
+checksum = "a10e6b67c951a84de7029487e0e0a496860dae49f6699edd279d5ff35b8fbf54"
 dependencies = [
- "deno_error 0.6.1",
+ "deno_error",
  "thiserror 2.0.21",
 ]
 
@@ -14729,6 +15409,12 @@ dependencies = [
  "winsafe",
 ]
 
+[[package]]
+name = "which"
+version = "8.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bae2f2b2b816647a1cab1acc91f5bd20812d53cb344382635ec2181940c8034f"
+
 [[package]]
 name = "whoami"
 version = "1.6.1"
@@ -14792,14 +15478,14 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-nats",
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
@@ -14808,7 +15494,7 @@ dependencies = [
  "gethostname",
  "git-version",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "jsonwebtoken 10.4.0",
  "lazy_static",
  "once_cell",
@@ -14819,7 +15505,7 @@ dependencies = [
  "rdkafka",
  "reqwest 0.13.5",
  "rumqttc",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "serde",
  "serde_derive",
  "serde_json",
@@ -14850,6 +15536,7 @@ dependencies = [
  "windmill-api-scripts",
  "windmill-api-settings",
  "windmill-api-users",
+ "windmill-audit",
  "windmill-autoscaling",
  "windmill-common",
  "windmill-dep-map",
@@ -14881,7 +15568,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14898,6 +15585,7 @@ dependencies = [
  "indexmap 2.14.2",
  "lazy_static",
  "mime_guess",
+ "rand 0.9.5",
  "reqwest 0.13.5",
  "serde",
  "serde_json",
@@ -14915,9 +15603,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -14928,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14939,7 +15627,7 @@ dependencies = [
  "async_zip",
  "aws-sdk-config",
  "aws-sigv4",
- "axum 0.8.9",
+ "axum",
  "base32",
  "base64 0.22.1",
  "bytes",
@@ -14956,9 +15644,9 @@ dependencies = [
  "futures",
  "git-version",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "indexmap 2.14.2",
  "itertools 0.14.0",
  "jsonwebtoken 10.4.0",
@@ -14971,17 +15659,19 @@ dependencies = [
  "native-tls",
  "openidconnect",
  "openssl",
+ "p256",
  "pin-project",
  "postgres-native-tls 0.5.3",
  "prometheus",
  "quick-xml",
  "quick_cache",
  "rand 0.9.5",
+ "rcgen",
  "regex",
  "reqwest 0.13.5",
  "rsa",
  "rust-embed",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "samael",
  "serde",
  "serde_json",
@@ -14997,6 +15687,7 @@ dependencies = [
  "tokio",
  "tokio-native-tls",
  "tokio-postgres",
+ "tokio-rustls 0.26.6",
  "tokio-stream",
  "tokio-util",
  "tower 0.5.3",
@@ -15068,12 +15759,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "lazy_static",
  "quick_cache",
  "serde",
@@ -15091,9 +15782,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -15108,10 +15799,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
  "itertools 0.14.0",
@@ -15134,7 +15825,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15144,9 +15835,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "itertools 0.14.0",
  "serde",
@@ -15161,9 +15852,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "ed25519-dalek",
@@ -15183,10 +15874,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "candle-core",
  "candle-nn",
  "candle-transformers",
@@ -15206,9 +15897,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "sql-builder",
@@ -15222,11 +15913,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "serde",
  "serde_json",
  "sql-builder",
@@ -15244,9 +15935,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "globset",
  "lazy_static",
@@ -15266,9 +15957,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -15280,18 +15971,18 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-nats",
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "futures",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "rand 0.9.5",
  "rdkafka",
  "reqwest 0.13.5",
@@ -15316,14 +16007,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "lazy_static",
  "serde",
  "serde_json",
@@ -15335,15 +16026,16 @@ dependencies = [
  "uuid",
  "windmill-api-auth",
  "windmill-api-sse",
+ "windmill-audit",
  "windmill-common",
  "windmill-queue",
 ]
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "flate2",
  "futures",
@@ -15351,7 +16043,7 @@ dependencies = [
  "lazy_static",
  "quick_cache",
  "reqwest 0.13.5",
- "semver 1.0.28",
+ "semver",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -15369,10 +16061,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "http 1.5.0",
  "indexmap 2.14.2",
  "itertools 0.14.0",
@@ -15391,9 +16083,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "chrono-tz",
  "serde",
@@ -15411,14 +16103,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "futures",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "itertools 0.14.0",
  "lazy_static",
  "prometheus",
@@ -15453,10 +16145,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -15482,7 +16174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15494,13 +16186,13 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "argon2",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "lazy_static",
  "serde",
  "serde_json",
@@ -15518,9 +16210,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -15532,15 +16224,15 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "constant_time_eq 0.3.1",
  "futures",
  "hex",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "lazy_static",
  "magic-crypt",
  "regex",
@@ -15571,7 +16263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15580,15 +16272,16 @@ dependencies = [
  "sql-builder",
  "sqlx",
  "tracing",
+ "tracing-subscriber",
  "windmill-common",
 ]
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "k8s-openapi",
  "kube",
  "serde",
@@ -15604,7 +16297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15618,7 +16311,7 @@ dependencies = [
  "aws-sdk-secretsmanager",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.9",
+ "axum",
  "backon",
  "base64 0.22.1",
  "bitflags 2.13.2",
@@ -15640,8 +16333,9 @@ dependencies = [
  "git-version",
  "globset",
  "hex",
- "hmac",
- "hyper 1.11.1",
+ "hkdf",
+ "hmac 0.12.1",
+ "hyper 1.12.0",
  "indexmap 2.14.2",
  "itertools 0.14.0",
  "jsonwebtoken 10.4.0",
@@ -15657,6 +16351,7 @@ dependencies = [
  "opentelemetry-otlp 0.30.0",
  "opentelemetry-semantic-conventions 0.30.0",
  "opentelemetry_sdk 0.30.0",
+ "p256",
  "pep440_rs",
  "phf 0.11.3",
  "pin-project-lite",
@@ -15672,17 +16367,18 @@ dependencies = [
  "reqwest-middleware",
  "reqwest-retry",
  "rsa",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
+ "ryu-js",
  "schemars 0.8.22",
- "semver 1.0.28",
+ "semver",
  "serde",
  "serde_json",
  "serde_yml",
  "sha1",
  "sha2 0.10.9",
  "size",
- "spki",
+ "spki 0.7.3",
  "sqlx",
  "strum",
  "strum_macros",
@@ -15717,7 +16413,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "chrono",
  "futures",
@@ -15737,7 +16433,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "regex",
  "serde",
@@ -15754,7 +16450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15781,7 +16477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15798,7 +16494,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15814,7 +16510,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15835,15 +16531,15 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "backon",
  "base64 0.22.1",
  "chrono",
- "hmac",
+ "hmac 0.12.1",
  "http 1.5.0",
  "itertools 0.14.0",
  "lazy_static",
@@ -15866,16 +16562,16 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "arc-swap",
  "async-oauth2",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "itertools 0.14.0",
  "lazy_static",
  "reqwest 0.12.28",
@@ -15891,7 +16587,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15900,7 +16596,7 @@ dependencies = [
  "aws-credential-types",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.9",
+ "axum",
  "bytes",
  "chrono",
  "datafusion",
@@ -15927,7 +16623,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15940,12 +16636,13 @@ dependencies = [
  "thiserror 2.0.21",
  "tokio",
  "tracing",
+ "windmill-audit",
  "windmill-common",
 ]
 
 [[package]]
 name = "windmill-parser"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15954,7 +16651,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15966,7 +16663,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15978,7 +16675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15990,7 +16687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16002,7 +16699,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16014,7 +16711,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -16025,7 +16722,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16036,30 +16733,30 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
- "rustpython-ast",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
  "serde_json",
  "windmill-parser",
 ]
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "rustpython-ast",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
  "windmill-parser",
  "windmill-parser-sql-asset",
 ]
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16069,7 +16766,8 @@ dependencies = [
  "phf 0.11.3",
  "regex",
  "regex-lite",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
  "serde",
  "serde_json",
  "sqlx",
@@ -16081,7 +16779,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16093,7 +16791,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16107,7 +16805,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16124,7 +16822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16137,7 +16835,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16149,7 +16847,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16167,7 +16865,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16183,11 +16881,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "rustpython-ast",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
+ "ruff_text_size",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -16199,7 +16898,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16213,11 +16912,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.9",
+ "axum",
  "backon",
  "chrono",
  "chrono-tz",
@@ -16226,7 +16925,7 @@ dependencies = [
  "futures",
  "futures-core",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "itertools 0.14.0",
  "lazy_static",
  "once_cell",
@@ -16252,23 +16951,19 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "const_format",
  "deno_ast",
- "deno_console",
  "deno_core",
  "deno_crypto",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_fetch",
- "deno_fs",
- "deno_io",
  "deno_net",
  "deno_permissions",
  "deno_telemetry",
  "deno_tls",
- "deno_url",
  "deno_web",
  "deno_webidl",
  "futures",
@@ -16277,13 +16972,15 @@ dependencies = [
  "rcgen",
  "regex",
  "reqwest 0.13.5",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
  "sqlx",
+ "sys_traits",
  "tokio",
  "tracing",
  "uuid",
+ "v8",
  "winapi",
  "windmill-common",
  "windmill-parser-ts",
@@ -16292,7 +16989,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16303,18 +17000,18 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "dashmap",
  "futures",
  "hex",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "lazy_static",
  "magic-crypt",
  "quick_cache",
@@ -16338,11 +17035,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "futures",
  "serde",
@@ -16362,14 +17059,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "itertools 0.14.0",
  "lazy_static",
  "rand 0.9.5",
@@ -16395,11 +17092,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "futures",
  "itertools 0.14.0",
@@ -16422,11 +17119,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -16455,11 +17152,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "lazy_static",
  "regex",
@@ -16475,11 +17172,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -16509,19 +17206,19 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
  "futures",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "http 1.5.0",
- "hyper 1.11.1",
+ "hyper 1.12.0",
  "itertools 0.14.0",
  "lazy_static",
  "matchit 0.7.3",
@@ -16546,11 +17243,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "itertools 0.14.0",
  "rdkafka",
@@ -16569,11 +17266,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "itertools 0.14.0",
@@ -16593,12 +17290,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-nats",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "itertools 0.14.0",
  "nkeys",
@@ -16617,11 +17314,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "byteorder",
  "bytes",
  "chrono",
@@ -16652,7 +17349,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16661,7 +17358,7 @@ dependencies = [
  "aws-sdk-sqs",
  "aws-sdk-sts",
  "aws-smithy-types",
- "axum 0.8.9",
+ "axum",
  "backon",
  "chrono",
  "itertools 0.14.0",
@@ -16680,11 +17377,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "futures",
  "http 1.5.0",
@@ -16705,7 +17402,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
@@ -16724,14 +17421,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
  "async-recursion",
  "async-stream",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "backon",
  "base64 0.22.1",
  "bit-vec 0.6.3",
@@ -16750,7 +17447,7 @@ dependencies = [
  "gcp_auth",
  "git-version",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "hudsucker",
  "hyper-http-proxy",
  "hyper-rustls 0.27.10",
@@ -16773,9 +17470,10 @@ dependencies = [
  "pem",
  "pep440_rs",
  "postgres-native-tls 0.5.3",
+ "postgres-protocol",
  "process-wrap",
  "prometheus",
- "prost",
+ "prost 0.13.5",
  "quick_cache",
  "rand 0.9.5",
  "rcgen",
@@ -16784,7 +17482,7 @@ dependencies = [
  "reqwest-middleware",
  "rsa",
  "rust_decimal",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-pemfile 2.2.0",
  "serde",
@@ -16842,7 +17540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "bytes",
  "futures",
@@ -17437,9 +18135,26 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
- "const-oid",
- "der",
- "spki",
+ "const-oid 0.9.6",
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7069fba5b66b9193bd2c5d3d4ff12b839118f6bcbef5328efafafb5395cf63da"
+dependencies = [
+ "asn1-rs 0.5.2",
+ "data-encoding",
+ "der-parser 8.2.0",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.6.1",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
 ]
 
 [[package]]
@@ -17551,18 +18266,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.59"
+version = "0.8.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
+checksum = "86502bf56ac7c77571a32e2647bb2a15894565e981fb2a48d7bde2d91c965a9d"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.59"
+version = "0.8.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
+checksum = "5457206954b06561e2608c7e19cf58b1926586d999c246eebe4502f7e2039d1a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -17592,9 +18307,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 dependencies = [
  "zeroize_derive",
 ]
@@ -17669,6 +18384,19 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zoneinfo64"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed6eb2607e906160c457fd573e9297e65029669906b9ac8fb1b5cd5e055f0705"
+dependencies = [
+ "calendrical_calculations",
+ "icu_locale_core",
+ "potential_utf",
+ "resb",
+ "serde",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.3"
@@ -17689,9 +18417,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.1.0+zstd.1.5.7"
+version = "2.1.1+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
+checksum = "aeec9eaf2dffbbd09201e23bd0ffcbaa33bb8e9266a10734fd7ed90a85eca078"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index d2bec22817..aaf5a2e8df 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.821.0"
+version = "1.830.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.821.0"
+version = "1.830.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -156,7 +156,7 @@ bedrock = ["windmill-ai/bedrock", "windmill-api/bedrock", "windmill-worker/bedro
 mqtt_trigger = ["windmill-api/mqtt_trigger"]
 amqp_trigger = ["windmill-api/amqp_trigger"]
 native_trigger = ["windmill-api/native_trigger"]
-sqs_trigger = ["windmill-api/sqs_trigger", "windmill-common/aws_auth", "windmill-api/openidconnect"]
+sqs_trigger = ["windmill-api/sqs_trigger", "windmill-common/aws_auth", "openidconnect"]
 gcp_trigger = ["windmill-api/gcp_trigger"]
 azure_trigger = ["windmill-api/azure_trigger"]
 smtp = ["windmill-api/smtp", "windmill-common/smtp", "windmill-queue/smtp"]
@@ -249,36 +249,22 @@ sqlx-sqlite = { git = "https://github.com/windmill-labs/sqlx", rev = "6bdaee94fa
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7" }
 # Use tiberius main branch for libgssapi 0.8.1 fix (https://github.com/prisma/tiberius/issues/343)
 tiberius = { git = "https://github.com/prisma/tiberius", rev = "59db57960a14b422fb3a1309aa4aa47880896ff8" }
-# Pin tokio-postgres / postgres-types / postgres-protocol to the
-# MaterializeInc fork. windmill-trigger-postgres already pulled this
-# fork in transitively for the postgres-replication crate
-# (CopyBothDuplex, LogicalReplicationStream, TupleData with binary
-# tuple support) which upstream rust-postgres has declined to merge
-# since 2021 (PR #752 → #778, both still unmerged).
+# Pin tokio-postgres / postgres-types / postgres-protocol to
+# windmill-labs/rust-postgres, branch `windmill-describe-first`: the
+# MaterializeInc fork (postgres-replication, which upstream has not merged)
+# plus `Client::describe_typed`, which pg_executor needs before
+# query_typed_raw so result columns of types the client has not seen yet
+# (custom enums / domains, citext, postgis) don't deadlock a large result,
+# and `Client::transaction_status`, which keeps a connection left inside a
+# transaction out of the executor's cache. Each pinned commit carries a `windmill-*` tag so it stays reachable when the
+# branch is rebased onto MaterializeInc master.
 #
-# MI also carries a mitigation for the
-# Client::query_typed_raw / Client::prepare deadlock on result columns
-# whose Oid the client doesn't know about yet (citext, custom enums /
-# domains, postgis): MI's 2025-12-11 PR #33 resized the per-request
-# response channel from mpsc::channel(1) → mpsc::channel(1024).
-# bounded(1024) is sufficient for any realistic typeinfo deferral
-# (need ~2-3 batches) but leaves a theoretical failure mode at
-# >~64 MB results with a custom-Oid column. The strict-correct fix is
-# mpsc::unbounded(); a follow-up PR to MI is open proposing that.
-#
-# The [patch.crates-io] entries below force windmill-worker's
-# pg_executor (which imports `tokio_postgres::` directly from
-# crates.io) onto the same fork as windmill-trigger-postgres, so the
-# deadlock mitigation reaches both consumers.
-#
-# Upstream deadlock PRs (open, not on the critical path now that MI
-# is mitigated):
-#   https://github.com/rust-postgres/rust-postgres/pull/1348
-#   https://github.com/rust-postgres/rust-postgres/pull/1349
-# Reproducer: https://github.com/rubenfiszel/tokio-postgres-deadlock-repro
-tokio-postgres = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
-postgres-types = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
-postgres-protocol = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
+# The [patch.crates-io] entries force windmill-worker's pg_executor (which
+# imports `tokio_postgres::` from crates.io) onto the same fork as
+# windmill-trigger-postgres.
+tokio-postgres = { git = "https://github.com/windmill-labs/rust-postgres", rev = "b3a6443aa1ae90a4f6c4b742103ba80584598f2e" }
+postgres-types = { git = "https://github.com/windmill-labs/rust-postgres", rev = "b3a6443aa1ae90a4f6c4b742103ba80584598f2e" }
+postgres-protocol = { git = "https://github.com/windmill-labs/rust-postgres", rev = "b3a6443aa1ae90a4f6c4b742103ba80584598f2e" }
 
 [dependencies]
 anyhow.workspace = true
@@ -295,6 +281,7 @@ windmill-api = { workspace = true, default-features = false }
 windmill-api-agent-workers = { workspace = true, optional = true }
 windmill-api-scripts.workspace = true
 windmill-api-settings.workspace = true
+windmill-audit.workspace = true
 windmill-worker.workspace = true
 windmill-indexer = { workspace = true, optional = true }
 windmill-autoscaling = { workspace = true, optional = true }
@@ -465,7 +452,7 @@ headers = "^0"
 hyper = { version = "^1", features = ["full"] }
 hyper-tls = "^0.6"
 hyper-util = { version = "^0.1", features = ["client-legacy", "http1", "tokio"] }
-tokio = { version = "=1.46.1", features = ["full", "tracing", "time"] }
+tokio = { version = "=1.53.2", features = ["full", "tracing", "time"] }
 tokio-stream = { version = "0.1.17" }
 tower = "^0"
 tower-http = { version = "^0.6", features = ["trace", "cors", "catch-panic"] }
@@ -473,7 +460,7 @@ tower-cookies = "^0.11"
 serde = "^1"
 # 1.0.151 introduced RawValue::from_string_unchecked, which the SQL executors use
 # to avoid re-parsing every collected row.
-serde_json = { version = "^1.0.151", features = ["preserve_order", "raw_value"] }
+serde_json = { version = "^1.0.151", features = ["preserve_order", "raw_value", "float_roundtrip"] }
 serde_yml = "0.0.12"
 uuid = { version = "^1", features = ["serde", "v4", "js"] }
 thiserror = "^2"
@@ -502,9 +489,11 @@ arc-swap = "1"
 ed25519-dalek = { version = "2", features = ["rand_core"] }
 magic-crypt = "^3"
 git-version = "^0"
-malachite = "=0.4.18"
-malachite-bigint = "=0.2.0"
-rustpython-parser = "^0"
+# Ruff's parser crates are internal to ruff and carry no semver guarantee: pin them exactly,
+# and to the same release.
+ruff_python_parser = "=0.0.17"
+ruff_python_ast = "=0.0.17"
+ruff_text_size = "=0.0.17"
 pep440_rs = "0.7.3"
 php-parser-rs = { git = "https://github.com/php-rust-tools/parser", rev = "ec4cb411dec09450946ef57920b7ffced7f6495d" }
 cron = "^0"
@@ -533,33 +522,29 @@ aws-sdk-rds = "^1"
 async-trait = "0.1.88"
 
 
-v8 = "=137.1.0"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
-# deno_* pin set: deno v2.4.0 base, with deno_ast force-overridden to =0.51.0.
-# Rationale: deno_ast 0.51.0 is the first version pulling swc_common =14.0.4,
-# the first swc_common patch that dropped `pub use serde::__private as serde;`
-# (the line that capped our workspace serde pin at =1.0.220). v2.4.0's other
-# pins keep deno_tls at 0.196.0 which uses permissive `rustls ^0.23.11`,
-# compatible with aws-sdk-bedrockruntime's `^0.23.31` requirement. deno_tls
-# 0.198+ tightened that to exact `=0.23.28`, which would have made any
-# meaningful deno bump resolver-impossible against aws-sdk.
-deno_fetch = "0.233.0"
-deno_tls = "0.196.0"
-deno_console = "0.209.0"
-deno_url = "0.209.0"
-deno_webidl = "0.209.0"
-deno_web = "0.240.0"
-# Sibling release of the pinned deno_core 0.352 / deno_web 0.240 stack
-# (its deps are deno_core ^0.352, deno_web ^0.240, deno_error =0.6.1). A newer
-# deno_crypto would force bumping the whole deno stack.
-deno_crypto = "0.223.0"
-deno_io = "0.119.0"
-deno_fs = "0.119.0"
-deno_net = "0.201.0"
-deno_core = "0.352.0"
+# deno_* pin set: the crates deno published together on 2026-09-16 (deno_core
+# 0.412).
+# V8 is pinned exactly because flake.nix fetches the prebuilt archive of that
+# version: update its version and hash there with any bump. No default features,
+# so the pin leaves the feature set deno_core picks untouched.
+v8 = { version = "=150.4.0", default-features = false }
+# These release as a matched set: each pins its siblings, deno_error exactly,
+# and deno_tls pins rustls exactly (=0.23.40, the workspace `rustls` pin below
+# must equal it). A bump moves all of them at once.
+# deno_ast is independent of that set and stays at 0.51.0: a newer one pulls
+# swc_common 17, which would force bumping every swc_* pin the parsers use.
+deno_fetch = "0.283.0"
+deno_tls = "0.246.0"
+deno_webidl = "0.259.0"
+deno_web = "0.290.0"
+deno_crypto = "0.273.0"
+deno_net = "0.251.0"
+deno_core = "0.412.0"
 deno_ast = { version = "=0.51.0", features = ["transpiling"] }
-deno_permissions = "0.68.0"
-deno_telemetry = "0.31.0"
-deno_error = "=0.6.1"
+deno_permissions = "0.118.0"
+deno_telemetry = "0.81.0"
+deno_error = "=0.7.1"
+sys_traits = { version = "0.1.28", features = ["real", "libc", "winapi"] }
 rustls-pemfile = "2.2.0"
 
 # only used with special deno_core_mac feature to prevent ffi issue on macos, requires libffi to be installed
@@ -586,6 +571,7 @@ base64 = "^0.22.1"
 base32 = "^0"
 hmac = "0.12.1"
 sha2 = "0.10.6"
+ryu-js = "1.0.3"
 md-5 = "0.10.6"
 sha1 = "0.10.6"
 sqlx = { version = "0.8.0", features = [
@@ -609,9 +595,11 @@ const_format = { version = "0.2.35", features = ["rust_1_64", "rust_1_51"] }
 const-str = "0.5"
 constant_time_eq = "0.3.1"
 rsa = "^0"
+p256 = "0.13"
 spki = { version = "0.7", features = ["pem"] }
 pkcs1 = "0.7"
 aes-gcm = "0.10.3"
+hkdf = "0.12.4"
 async_zip = { version = "0.0.17", features = ["tokio", "tokio-fs", "deflate", "chrono"] }
 once_cell = "1.17.1"
 dashmap = "6.1.0"
@@ -630,8 +618,8 @@ convert_case = "0.6.0"
 getrandom = "0.2"
 tokio-postgres = {version = "^0.7", features = ["array-impls", "with-serde_json-1", "with-chrono-0_4", "with-uuid-1", "with-bit-vec-0_6"]}
 postgres-protocol = "0.6"
-rust-postgres = { package = "tokio-postgres", git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe"}
-rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/MaterializeInc/rust-postgres", features = ["runtime"], rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
+rust-postgres = { package = "tokio-postgres", git = "https://github.com/windmill-labs/rust-postgres", rev = "b3a6443aa1ae90a4f6c4b742103ba80584598f2e"}
+rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/windmill-labs/rust-postgres", features = ["runtime"], rev = "b3a6443aa1ae90a4f6c4b742103ba80584598f2e" }
 bit-vec = "=0.6.3"
 mappable-rc = "^0"
 mysql_async = { version = "*", default-features = false, features = ["minimal", "default", "native-tls-tls", "rust_decimal"]}
@@ -695,7 +683,7 @@ aws-sdk-sqs = "^1.89.0"
 aws-sdk-sts = "^1.91.0"
 aws-sdk-sso = "=1.77.0"
 aws-sdk-ssooidc = "=1.78.0"
-rustls = "=0.23.35"
+rustls = "=0.23.40"
 async-once-cell = "0.5.4"
 size = "0.5.0"
 
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index c2c253e8f0..695f6d248b 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-ff4d04f17721d84fb9a1f655af50ff7e4e7dcbc7
+40ab35596e6fcb82a4dfc56e186befb807f8e2af
diff --git a/backend/migrations/20260929064555_flow_conversation_message_turn_job_id.down.sql b/backend/migrations/20260929064555_flow_conversation_message_turn_job_id.down.sql
new file mode 100644
index 0000000000..5906eda25d
--- /dev/null
+++ b/backend/migrations/20260929064555_flow_conversation_message_turn_job_id.down.sql
@@ -0,0 +1 @@
+ALTER TABLE flow_conversation_message DROP COLUMN turn_job_id;
diff --git a/backend/migrations/20260929064555_flow_conversation_message_turn_job_id.up.sql b/backend/migrations/20260929064555_flow_conversation_message_turn_job_id.up.sql
new file mode 100644
index 0000000000..db9427692b
--- /dev/null
+++ b/backend/migrations/20260929064555_flow_conversation_message_turn_job_id.up.sql
@@ -0,0 +1,23 @@
+-- The flow run a row's turn belongs to: the job the user message started. Retention collects
+-- rows by it, so a turn goes as one unit. `job_id` names the step or tool job that wrote the
+-- row, which completes, and so expires, before the run does.
+ALTER TABLE flow_conversation_message ADD COLUMN turn_job_id UUID;
+
+-- Turns can overlap in one conversation, so a row's turn is the user row its job descends
+-- from. Transcript order only decides for rows whose job is already gone or that have none.
+UPDATE flow_conversation_message m
+   SET turn_job_id = COALESCE(
+       (SELECT u.job_id FROM v2_job j
+          JOIN flow_conversation_message u
+            ON u.conversation_id = m.conversation_id
+           AND u.message_type = 'user'
+           AND u.job_id IN (j.id, j.parent_job, j.root_job, j.flow_innermost_root_job)
+         WHERE j.id = m.job_id
+         LIMIT 1),
+       (SELECT u.job_id FROM flow_conversation_message u
+         WHERE u.conversation_id = m.conversation_id
+           AND u.message_type = 'user'
+           AND u.created_seq <= m.created_seq
+         ORDER BY u.created_seq DESC
+         LIMIT 1)
+   );
diff --git a/backend/migrations/20261002124918_job_token_scopes.down.sql b/backend/migrations/20261002124918_job_token_scopes.down.sql
new file mode 100644
index 0000000000..be2c13b3ff
--- /dev/null
+++ b/backend/migrations/20261002124918_job_token_scopes.down.sql
@@ -0,0 +1,3 @@
+ALTER TABLE job_perms DROP COLUMN IF EXISTS job_token_scopes;
+ALTER TABLE flow DROP COLUMN IF EXISTS job_token_scopes;
+ALTER TABLE script DROP COLUMN IF EXISTS job_token_scopes;
diff --git a/backend/migrations/20261002124918_job_token_scopes.up.sql b/backend/migrations/20261002124918_job_token_scopes.up.sql
new file mode 100644
index 0000000000..6b24325378
--- /dev/null
+++ b/backend/migrations/20261002124918_job_token_scopes.up.sql
@@ -0,0 +1,3 @@
+ALTER TABLE script ADD COLUMN IF NOT EXISTS job_token_scopes text[];
+ALTER TABLE flow ADD COLUMN IF NOT EXISTS job_token_scopes text[];
+ALTER TABLE job_perms ADD COLUMN IF NOT EXISTS job_token_scopes text[];
diff --git a/backend/migrations/20261008070335_worker_ping_draining.down.sql b/backend/migrations/20261008070335_worker_ping_draining.down.sql
new file mode 100644
index 0000000000..64a5f2949d
--- /dev/null
+++ b/backend/migrations/20261008070335_worker_ping_draining.down.sql
@@ -0,0 +1 @@
+ALTER TABLE worker_ping DROP COLUMN IF EXISTS draining;
diff --git a/backend/migrations/20261008070335_worker_ping_draining.up.sql b/backend/migrations/20261008070335_worker_ping_draining.up.sql
new file mode 100644
index 0000000000..33b5ad5e3e
--- /dev/null
+++ b/backend/migrations/20261008070335_worker_ping_draining.up.sql
@@ -0,0 +1 @@
+ALTER TABLE worker_ping ADD COLUMN IF NOT EXISTS draining BOOLEAN NOT NULL DEFAULT FALSE;
diff --git a/backend/migrations/20261008165042_runnable_job_stats.down.sql b/backend/migrations/20261008165042_runnable_job_stats.down.sql
new file mode 100644
index 0000000000..21208736b4
--- /dev/null
+++ b/backend/migrations/20261008165042_runnable_job_stats.down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS runnable_job_stats;
diff --git a/backend/migrations/20261008165042_runnable_job_stats.up.sql b/backend/migrations/20261008165042_runnable_job_stats.up.sql
new file mode 100644
index 0000000000..cf676a037e
--- /dev/null
+++ b/backend/migrations/20261008165042_runnable_job_stats.up.sql
@@ -0,0 +1,17 @@
+-- Hourly resource rollup per runnable and worker group, fed by the workers.
+-- Memory figures are in kB, like v2_job_completed.memory_peak.
+-- No foreign key to workspace: every worker upserts here, and the key would cost each row
+-- a lookup and a lock on its workspace. Workspace deletion removes the rows itself.
+CREATE TABLE IF NOT EXISTS runnable_job_stats (
+    hour BIGINT NOT NULL,
+    workspace_id VARCHAR(50) NOT NULL,
+    runnable_path VARCHAR(255) NOT NULL,
+    worker_group TEXT NOT NULL,
+    job_count INTEGER NOT NULL DEFAULT 0,
+    total_duration_ms BIGINT NOT NULL DEFAULT 0,
+    max_memory_peak INTEGER NOT NULL DEFAULT 0,
+    sum_memory_peak BIGINT NOT NULL DEFAULT 0,
+    memory_sample_count INTEGER NOT NULL DEFAULT 0,
+    total_cpu_ms BIGINT NOT NULL DEFAULT 0,
+    PRIMARY KEY (hour, workspace_id, runnable_path, worker_group)
+);
diff --git a/backend/migrations/20261012180101_datatable_role_set.down.sql b/backend/migrations/20261012180101_datatable_role_set.down.sql
new file mode 100644
index 0000000000..15384edae8
--- /dev/null
+++ b/backend/migrations/20261012180101_datatable_role_set.down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS datatable_role_set;
diff --git a/backend/migrations/20261012180101_datatable_role_set.up.sql b/backend/migrations/20261012180101_datatable_role_set.up.sql
new file mode 100644
index 0000000000..0093837d3b
--- /dev/null
+++ b/backend/migrations/20261012180101_datatable_role_set.up.sql
@@ -0,0 +1,21 @@
+-- The logins behind a data table connection made as several roles at once: one Postgres login per
+-- distinct set of data table roles, a member of each. Which roles a login holds is its
+-- memberships on the cluster, and its name is derived from their catalog ids, so a row only has to
+-- carry the credential.
+--
+-- A row is written after its login exists and removed before the login is dropped, so a row always
+-- names a login that can authenticate with `pwd`.
+CREATE TABLE datatable_role_set (
+    cluster VARCHAR(20) NOT NULL CHECK (cluster IN ('instance', 'external_instance')),
+    name VARCHAR(63) NOT NULL,
+    -- Generated by Windmill, never entered by anyone, and never leaves the server.
+    pwd TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    -- Recorded at most once a day. A login unused for long enough is dropped, and made again if
+    -- its set of roles is asked for later.
+    last_used_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (cluster, name)
+);
+
+GRANT ALL ON datatable_role_set TO windmill_user;
+GRANT ALL ON datatable_role_set TO windmill_admin;
diff --git a/backend/migrations/20261012213357_widen_variable_value.down.sql b/backend/migrations/20261012213357_widen_variable_value.down.sql
new file mode 100644
index 0000000000..48b61c3f65
--- /dev/null
+++ b/backend/migrations/20261012213357_widen_variable_value.down.sql
@@ -0,0 +1,12 @@
+DO $$
+DECLARE
+    too_long BIGINT;
+BEGIN
+    SELECT count(*) INTO too_long FROM variable WHERE length(value) > 15000;
+    IF too_long > 0 THEN
+        RAISE EXCEPTION 'cannot narrow variable.value to VARCHAR(15000): % row(s) are longer than 15000 characters', too_long;
+    END IF;
+END $$;
+
+ALTER TABLE variable DROP CONSTRAINT IF EXISTS variable_value_length;
+ALTER TABLE variable ALTER COLUMN value TYPE VARCHAR(15000);
diff --git a/backend/migrations/20261012213357_widen_variable_value.up.sql b/backend/migrations/20261012213357_widen_variable_value.up.sql
new file mode 100644
index 0000000000..06dc8a191a
--- /dev/null
+++ b/backend/migrations/20261012213357_widen_variable_value.up.sql
@@ -0,0 +1,8 @@
+-- AES-256-GCM ciphertext is 32 bytes (magic, nonce, tag) longer than legacy CBC before base64,
+-- so the longest CBC value that fits 15000 chars is exactly 15040 chars once re-encrypted.
+ALTER TABLE variable ALTER COLUMN value TYPE VARCHAR(15040);
+
+-- Only GCM secrets (base64 of the `wmA2` magic starts `d21BM`) may use the extra room: a longer
+-- CBC value could never be re-encrypted to fit, and would fail every rotation of its workspace key.
+ALTER TABLE variable ADD CONSTRAINT variable_value_length
+    CHECK (length(value) <= 15000 OR (is_secret AND value LIKE 'd21BM%'));
diff --git a/backend/oauth_connect.json b/backend/oauth_connect.json
index 2f889336f9..f7c7ef9698 100644
--- a/backend/oauth_connect.json
+++ b/backend/oauth_connect.json
@@ -45,12 +45,39 @@
       "files:read"
     ],
     "scope_options": [
+      { "value": "chat:write", "label": "Send messages as the app" },
+      { "value": "chat:write.public", "label": "Send messages to public channels the app is not in" },
+      { "value": "channels:join", "label": "Join public channels" },
+      { "value": "files:write", "label": "Upload, edit and delete files" },
+      { "value": "users:read", "label": "View people in the workspace" },
+      { "value": "users:read.email", "label": "View people's email addresses" },
+      { "value": "channels:read", "label": "View basic information about public channels" },
+      { "value": "channels:history", "label": "Read messages in public channels the app is in" },
       { "value": "reactions:write", "label": "Add emoji reactions" },
       { "value": "channels:manage", "label": "Create, archive and manage public channels, invite members, set topics" },
       { "value": "groups:write", "label": "Create and manage private channels the app is in" },
-      { "value": "usergroups:write", "label": "Edit user groups (workspace settings often block bots)" }
+      { "value": "usergroups:write", "label": "Edit user groups (workspace settings often block bots)" },
+      { "value": "files:read", "label": "Read and download files shared where the app is a member" },
+      { "value": "groups:read", "label": "List private channels the app is in" },
+      { "value": "im:read", "label": "List the app's direct messages" },
+      { "value": "mpim:read", "label": "List the app's group direct messages" },
+      { "value": "usergroups:read", "label": "List user groups" },
+      { "value": "emoji:read", "label": "List custom emojis" }
     ],
     "user_scope_options": [
+      { "value": "channels:history", "label": "Read messages in public channels" },
+      { "value": "groups:history", "label": "Read messages in your private channels" },
+      { "value": "im:history", "label": "Read your direct messages" },
+      { "value": "mpim:history", "label": "Read your group direct messages" },
+      { "value": "search:read", "label": "Search messages and files" },
+      { "value": "users:read", "label": "View people in the workspace" },
+      { "value": "chat:write", "label": "Send messages as you" },
+      { "value": "users:read.email", "label": "View people's email addresses" },
+      { "value": "channels:read", "label": "View basic information about public channels" },
+      { "value": "groups:read", "label": "View basic information about your private channels" },
+      { "value": "im:read", "label": "View basic information about your direct messages" },
+      { "value": "mpim:read", "label": "View basic information about your group direct messages" },
+      { "value": "files:read", "label": "View files shared in your conversations" },
       { "value": "reactions:write", "label": "Add emoji reactions" },
       { "value": "channels:write", "label": "Create, archive and manage public channels" },
       { "value": "channels:write.invites", "label": "Invite members to public channels" },
@@ -58,7 +85,10 @@
       { "value": "groups:write", "label": "Create and manage private channels" },
       { "value": "users.profile:write", "label": "Set your status and edit your profile" },
       { "value": "reminders:write", "label": "Create reminders for yourself" },
-      { "value": "usergroups:write", "label": "Edit user groups" }
+      { "value": "usergroups:write", "label": "Edit user groups" },
+      { "value": "files:write", "label": "Upload and delete files as yourself" },
+      { "value": "usergroups:read", "label": "List user groups" },
+      { "value": "emoji:read", "label": "List custom emojis" }
     ],
     "token_response_path": "authed_user"
   },
@@ -73,7 +103,8 @@
     "scopes": ["https://www.googleapis.com/auth/spreadsheets"],
     "scope_options": [
       { "value": "https://www.googleapis.com/auth/spreadsheets", "label": "Read, edit, create and delete spreadsheets" },
-      { "value": "https://www.googleapis.com/auth/spreadsheets.readonly", "label": "Read spreadsheets" }
+      { "value": "https://www.googleapis.com/auth/spreadsheets.readonly", "label": "Read spreadsheets" },
+      { "value": "https://www.googleapis.com/auth/drive.metadata.readonly", "label": "List and search your spreadsheets in Drive" }
     ],
     "extra_params": {
       "access_type": "offline",
@@ -150,7 +181,9 @@
     "scope_options": [
       { "value": "https://www.googleapis.com/auth/documents", "label": "Read, edit, create and delete documents" },
       { "value": "https://www.googleapis.com/auth/documents.readonly", "label": "Read documents" },
-      { "value": "https://www.googleapis.com/auth/drive.file", "label": "Only files created or opened with this connection" }
+      { "value": "https://www.googleapis.com/auth/drive.file", "label": "Only files created or opened with this connection" },
+      { "value": "https://www.googleapis.com/auth/drive.readonly", "label": "Read, export and search all Drive files and comments" },
+      { "value": "https://www.googleapis.com/auth/drive", "label": "Read, edit, create and delete all Drive files" }
     ],
     "extra_params": {
       "access_type": "offline",
@@ -205,7 +238,8 @@
       { "value": "https://www.googleapis.com/auth/admin.directory.group.readonly", "label": "Read groups" },
       { "value": "https://www.googleapis.com/auth/admin.directory.orgunit", "label": "Read and manage organizational units" },
       { "value": "https://www.googleapis.com/auth/admin.directory.orgunit.readonly", "label": "Read organizational units" },
-      { "value": "https://www.googleapis.com/auth/admin.directory.user.security", "label": "Manage user security settings" }
+      { "value": "https://www.googleapis.com/auth/admin.directory.user.security", "label": "Manage user security settings" },
+      { "value": "https://www.googleapis.com/auth/admin.reports.audit.readonly", "label": "Read audit logs (login, admin, Drive, token activity)" }
     ],
     "extra_params": {
       "access_type": "offline",
@@ -220,6 +254,14 @@
       "type": "web_server"
     }
   },
+  "notion": {
+    "auth_url": "https://api.notion.com/v1/oauth/authorize",
+    "token_url": "https://api.notion.com/v1/oauth/token",
+    "scopes": [],
+    "extra_params": {
+      "owner": "user"
+    }
+  },
   "linkedin": {
     "auth_url": "https://www.linkedin.com/oauth/v2/authorization",
     "token_url": "https://www.linkedin.com/oauth/v2/accessToken",
diff --git a/backend/parsers/windmill-parser-py-asset/Cargo.toml b/backend/parsers/windmill-parser-py-asset/Cargo.toml
index ddd6446079..84562dcf0e 100644
--- a/backend/parsers/windmill-parser-py-asset/Cargo.toml
+++ b/backend/parsers/windmill-parser-py-asset/Cargo.toml
@@ -11,6 +11,6 @@ path = "./src/lib.rs"
 [dependencies]
 windmill-parser.workspace = true
 windmill-parser-sql-asset.workspace = true
-rustpython-parser.workspace = true
-rustpython-ast = { version = "0.4.0", features = ["visitor"] }
+ruff_python_parser.workspace = true
+ruff_python_ast.workspace = true
 anyhow.workspace = true
diff --git a/backend/parsers/windmill-parser-py-asset/src/lib.rs b/backend/parsers/windmill-parser-py-asset/src/lib.rs
index 9c70b93d64..2919b74607 100644
--- a/backend/parsers/windmill-parser-py-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-py-asset/src/lib.rs
@@ -1,5 +1,8 @@
-use rustpython_ast::{Constant, Expr, ExprConstant, Visitor};
-use rustpython_parser::{ast::Suite, Parse};
+use ruff_python_ast::{
+    visitor::{walk_expr, walk_stmt, Visitor},
+    Expr, ExprCall, ExprDict, FStringPartRef, InterpolatedStringElement, Keyword, Stmt, StmtAssign,
+};
+use ruff_python_parser::parse_module;
 use std::collections::HashMap;
 use windmill_parser::asset_parser::{
     asset_was_used, merge_assets, parse_asset_syntax, parse_pipeline_annotations, AssetKind,
@@ -8,12 +11,12 @@ use windmill_parser::asset_parser::{
 use AssetUsageAccessType::*;
 
 pub fn parse_assets(input: &str) -> anyhow::Result<ParseAssetsOutput> {
-    let ast = Suite::parse(input, "main.py")
-        .map_err(|e| anyhow::anyhow!("Error parsing code: {}", e.to_string()))?;
+    let ast = parse_module(input)
+        .map_err(|e| anyhow::anyhow!("Error parsing code: {}", e.to_string()))?
+        .into_suite();
 
     let mut assets_finder = AssetsFinder { assets: vec![], var_identifiers: HashMap::new() };
-    ast.into_iter()
-        .for_each(|stmt| assets_finder.visit_stmt(stmt));
+    assets_finder.visit_body(&ast);
 
     for (kind, path, _) in assets_finder.var_identifiers.into_values() {
         // if a db = wmill.datatable() was never used (e.g db.query(...)),
@@ -43,13 +46,72 @@ struct AssetsFinder {
     var_identifiers: HashMap<String, (AssetKind, VarAssetName, VarAssetSchema)>,
 }
 
-impl Visitor for AssetsFinder {
+impl<'a> Visitor<'a> for AssetsFinder {
+    fn visit_stmt(&mut self, stmt: &'a Stmt) {
+        if let Stmt::Assign(node) = stmt {
+            self.track_assignment(node);
+        }
+        // Continue with generic visit to catch any other assets in the statement
+        walk_stmt(self, stmt);
+    }
+
+    fn visit_expr(&mut self, expr: &'a Expr) {
+        match expr {
+            // A detected asset call does not recurse,
+            // so this is only reached when no further context was found
+            Expr::StringLiteral(s) => self.visit_str(s.value.to_str()),
+            Expr::FString(f) => {
+                // Literal text between two interpolations reads as one string, across the
+                // pieces of an implicitly concatenated f-string too.
+                let mut literal = String::new();
+                for part in &f.value {
+                    match part {
+                        FStringPartRef::Literal(s) => literal.push_str(&s.value),
+                        FStringPartRef::FString(f) => {
+                            for element in &f.elements {
+                                match element {
+                                    InterpolatedStringElement::Literal(l) => {
+                                        literal.push_str(&l.value)
+                                    }
+                                    InterpolatedStringElement::Interpolation(_) => {
+                                        self.visit_str(&std::mem::take(&mut literal))
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                self.visit_str(&literal);
+                walk_expr(self, expr);
+            }
+            Expr::Call(node) => {
+                if self.visit_expr_call_inner(node).is_err() {
+                    walk_expr(self, expr);
+                }
+            }
+            _ => walk_expr(self, expr),
+        }
+    }
+}
+
+impl AssetsFinder {
+    fn visit_str(&mut self, s: &str) {
+        if let Some((kind, path)) = parse_asset_syntax(s, false) {
+            self.assets.push(ParseAssetsResult {
+                kind,
+                path: path.to_string(),
+                access_type: None,
+                columns: None,
+            });
+        }
+    }
+
     // Handle assignment statements like: x = wmill.datatable('name')
-    fn visit_stmt_assign(&mut self, node: rustpython_ast::StmtAssign) {
+    fn track_assignment(&mut self, node: &StmtAssign) {
         // Check if the value is a call to a tracked function
         if let Some(Expr::Name(expr_name)) = node.targets.first() {
             // Remove any tracked variables with that name in case of reassignment
-            let Ok(var_name) = expr_name.id.parse::<String>();
+            let var_name = expr_name.id.to_string();
             let removed = self.var_identifiers.remove(&var_name);
             // if a db = wmill.datatable() or similar was removed, but never used (e.g db.query(...)),
             // we still want to register the asset as unknown access type
@@ -69,59 +131,12 @@ impl Visitor for AssetsFinder {
 
             if let Some((kind, name, schema)) = self.extract_asset_from_call(&node.value) {
                 // Track target variable
-                let Ok(var_name) = expr_name.id.parse::<String>();
                 self.var_identifiers
                     .insert(var_name, (kind.clone(), name.clone(), schema.clone()));
             }
         }
-        // Continue with generic visit to catch any other assets in the expression
-        self.generic_visit_stmt_assign(node);
     }
 
-    // visit_call_expr will not recurse if it detects an asset,
-    // so this will only be called when no further context was found
-    fn visit_expr_constant(&mut self, node: ExprConstant) {
-        match node.value {
-            Constant::Str(s) => {
-                if let Some((kind, path)) = parse_asset_syntax(&s, false) {
-                    self.assets.push(ParseAssetsResult {
-                        kind,
-                        path: path.to_string(),
-                        access_type: None,
-                        columns: None,
-                    });
-                }
-            }
-            _ => self.generic_visit_expr_constant(node),
-        }
-    }
-
-    fn visit_expr_call(&mut self, node: rustpython_ast::ExprCall) {
-        match self.visit_expr_call_inner(&node) {
-            Ok(_) => {}
-            Err(_) => {
-                // Check keyword arguments for assets before falling back to generic visit
-                for keyword in &node.keywords {
-                    if let Expr::Constant(ExprConstant { value: Constant::Str(s), .. }) =
-                        &keyword.value
-                    {
-                        if let Some((kind, path)) = parse_asset_syntax(s, false) {
-                            self.assets.push(ParseAssetsResult {
-                                kind,
-                                path: path.to_string(),
-                                access_type: None,
-                                columns: None,
-                            });
-                        }
-                    }
-                }
-                self.generic_visit_expr_call(node);
-            }
-        }
-    }
-}
-
-impl AssetsFinder {
     /// Extract asset info from calls like wmill.datatable('name'), wmill.ducklake('name'), etc.
     fn extract_asset_from_call(
         &self,
@@ -147,18 +162,20 @@ impl AssetsFinder {
 
         // Get the first argument (the asset name)
         let name = call
+            .arguments
             .args
             .first()
             .or_else(|| {
                 // Try keyword argument 'name' or 'path'
-                call.keywords
+                call.arguments
+                    .keywords
                     .iter()
                     .find(|kw| matches!(kw.arg.as_deref(), Some("name") | Some("path")))
                     .map(|kw| &kw.value)
             })
             .and_then(|first_arg| {
-                if let Expr::Constant(ExprConstant { value: Constant::Str(name), .. }) = first_arg {
-                    Some(name.clone())
+                if let Expr::StringLiteral(name) = first_arg {
+                    Some(name.value.to_str().to_string())
                 } else {
                     None
                 }
@@ -179,44 +196,39 @@ impl AssetsFinder {
         Some((kind, name, schema))
     }
 
-    fn visit_expr_call_inner(&mut self, node: &rustpython_ast::ExprCall) -> Result<(), ()> {
+    fn visit_expr_call_inner(&mut self, node: &ExprCall) -> Result<(), ()> {
         let ident: String = node
             .func
             .as_name_expr()
-            .and_then(|o| o.id.parse().ok())
+            .map(|o| o.id.to_string())
             .or_else(|| {
                 node.func
                     .as_attribute_expr()
-                    .and_then(|attr| attr.attr.parse().ok())
+                    .map(|attr| attr.attr.to_string())
             })
             .ok_or(())?;
 
         // `obj_name` is the object (receiver) - i.e., `obj` in `obj.method()`
-        let obj_name: String = if let Expr::Attribute(rustpython_ast::ExprAttribute {
-            value, ..
-        }) = node.func.as_ref()
-        {
-            if let Expr::Name(expr_name) = value.as_ref() {
-                expr_name.id.parse().map_err(|_| ())?
-            } else {
-                return Err(());
-            }
-        } else {
-            return Err(());
-        };
+        let obj_name: String = node
+            .func
+            .as_attribute_expr()
+            .and_then(|attr| attr.value.as_name_expr())
+            .map(|name| name.id.to_string())
+            .ok_or(())?;
 
         if obj_name == "wmill" {
             // Continue
         } else if let Some((kind, ref path, ref schema)) = self.var_identifiers.get(&obj_name) {
             if ident == "query" {
-                let expr_name = node.args.get(0).or_else(|| {
-                    node.keywords
+                let expr_name = node.arguments.args.get(0).or_else(|| {
+                    node.arguments
+                        .keywords
                         .iter()
                         .find(|kw| kw.arg.as_deref() == Some("name"))
                         .map(|kw| &kw.value)
                 });
                 let sql = match expr_name {
-                    Some(Expr::Constant(ExprConstant { value: Constant::Str(sql), .. })) => sql,
+                    Some(Expr::StringLiteral(sql)) => sql.value.to_str(),
                     _ => return Err(()),
                 };
                 // We use the SQL parser to detect RW, specific tables, etc.
@@ -224,7 +236,7 @@ impl AssetsFinder {
                     *kind,
                     path,
                     schema.as_deref(),
-                    &sql,
+                    sql,
                 );
                 match sql_assets {
                     Ok(Some(sql_assets)) => self.assets.extend(sql_assets),
@@ -252,9 +264,10 @@ impl AssetsFinder {
         };
 
         let arg_val = match arg {
-            Arg(i, name) => node.args.get(i).or_else(|| {
+            Arg(i, name) => node.arguments.args.get(i).or_else(|| {
                 // Get arg by name
-                node.keywords
+                node.arguments
+                    .keywords
                     .iter()
                     .find(|kw| kw.arg.as_deref() == Some(name))
                     .map(|kw| &kw.value)
@@ -270,8 +283,9 @@ impl AssetsFinder {
                 self.assets
                     .push(ParseAssetsResult { kind, path, access_type, columns: None });
             }
-            Some(Expr::Constant(ExprConstant { value: Constant::Str(value), .. })) => {
-                let path = parse_asset_syntax(&value, false)
+            Some(Expr::StringLiteral(value)) => {
+                let value = value.value.to_str();
+                let path = parse_asset_syntax(value, false)
                     .map(|(_, p)| p)
                     .unwrap_or(std::borrow::Cow::Borrowed(value));
                 self.assets.push(ParseAssetsResult {
@@ -291,26 +305,24 @@ impl AssetsFinder {
 struct Arg(usize, &'static str);
 
 /// Extract a string-literal keyword argument, e.g. `s3="value"` in a call.
-fn keyword_str_value(keywords: &[rustpython_ast::Keyword], name: &str) -> Option<String> {
+fn keyword_str_value(keywords: &[Keyword], name: &str) -> Option<String> {
     keywords
         .iter()
         .find(|kw| kw.arg.as_deref() == Some(name))
         .and_then(|kw| match &kw.value {
-            Expr::Constant(ExprConstant { value: Constant::Str(s), .. }) => Some(s.clone()),
+            Expr::StringLiteral(s) => Some(s.value.to_str().to_string()),
             _ => None,
         })
 }
 
 /// Extract a string-literal value from a dict literal, e.g. `{"s3": "value"}`.
-fn dict_str_value(dict: &rustpython_ast::ExprDict, name: &str) -> Option<String> {
-    dict.keys
+fn dict_str_value(dict: &ExprDict, name: &str) -> Option<String> {
+    dict.items
         .iter()
-        .zip(dict.values.iter())
-        .find_map(|(key, value)| match (key.as_ref()?, value) {
-            (
-                Expr::Constant(ExprConstant { value: Constant::Str(k), .. }),
-                Expr::Constant(ExprConstant { value: Constant::Str(v), .. }),
-            ) if k.as_str() == name => Some(v.clone()),
+        .find_map(|item| match (item.key.as_ref()?, &item.value) {
+            (Expr::StringLiteral(k), Expr::StringLiteral(v)) if k.value.to_str() == name => {
+                Some(v.value.to_str().to_string())
+            }
             _ => None,
         })
 }
@@ -328,12 +340,13 @@ fn dict_str_value(dict: &rustpython_ast::ExprDict, name: &str) -> Option<String>
 /// matches the TS object form and the `# on s3:///…` trigger form exactly.
 fn s3_object_arg_path(expr: &Expr) -> Option<String> {
     let uri = match expr {
-        Expr::Constant(ExprConstant { value: Constant::Str(s), .. }) => {
+        Expr::StringLiteral(s) => {
+            let s = s.value.to_str();
             match s
                 .strip_prefix("s3://")
                 .and_then(|rest| rest.split_once('/'))
             {
-                Some((_, key)) if !key.is_empty() => s.clone(),
+                Some((_, key)) if !key.is_empty() => s.to_string(),
                 _ => return None,
             }
         }
@@ -347,8 +360,9 @@ fn s3_object_arg_path(expr: &Expr) -> Option<String> {
             if func_name != "S3Object" {
                 return None;
             }
-            let key = keyword_str_value(&call.keywords, "s3")?;
-            let storage = keyword_str_value(&call.keywords, "storage").unwrap_or_default();
+            let key = keyword_str_value(&call.arguments.keywords, "s3")?;
+            let storage =
+                keyword_str_value(&call.arguments.keywords, "storage").unwrap_or_default();
             format!("s3://{storage}/{key}")
         }
         Expr::Dict(dict) => {
@@ -822,4 +836,62 @@ def main():
             },])
         );
     }
+
+    #[test]
+    fn test_py_asset_parser_recent_syntax() {
+        let input = r#"
+import wmill
+lazy import polars
+
+type Rows = list[dict]
+
+def main[T](name: str):
+    try:
+        with wmill.load_s3_file_reader('s3:///in.csv') as f:
+            f.read()
+    except ValueError, TypeError:
+        pass
+    greeting = t"hello {name}"
+    return f"{wmill.get_resource("u/user/pg")["host"]}"
+"#;
+        let s = parse_assets(input).map(|o| o.assets);
+        assert_eq!(
+            s.map_err(|e| e.to_string()),
+            Ok(vec![
+                ParseAssetsResult {
+                    kind: AssetKind::S3Object,
+                    path: "/in.csv".to_string(),
+                    access_type: Some(R),
+                    columns: None,
+                },
+                ParseAssetsResult {
+                    kind: AssetKind::Resource,
+                    path: "u/user/pg".to_string(),
+                    access_type: None,
+                    columns: None,
+                },
+            ])
+        );
+    }
+
+    #[test]
+    fn test_py_asset_parser_schema_qualified_db_without_table() {
+        let input = r#"
+import wmill
+def main():
+    db = wmill.datatable('dt:sch')
+    db.query("ATTACH 'ducklake://other' AS o")
+    db.query("SELECT * FROM t")
+"#;
+        let s = parse_assets(input).map(|o| o.assets);
+        assert_eq!(
+            s.map_err(|e| e.to_string())
+                .map(|a| a.into_iter().map(|a| (a.kind, a.path)).collect::<Vec<_>>()),
+            Ok(vec![
+                (AssetKind::DataTable, "dt".to_string()),
+                (AssetKind::DataTable, "dt/sch.t".to_string()),
+                (AssetKind::Ducklake, "other".to_string()),
+            ])
+        );
+    }
 }
diff --git a/backend/parsers/windmill-parser-py-imports/Cargo.toml b/backend/parsers/windmill-parser-py-imports/Cargo.toml
index 565e1422bb..2ef83f5ac9 100644
--- a/backend/parsers/windmill-parser-py-imports/Cargo.toml
+++ b/backend/parsers/windmill-parser-py-imports/Cargo.toml
@@ -23,7 +23,8 @@ tracing.workspace = true
 
 [dependencies]
 windmill-parser.workspace = true
-rustpython-parser.workspace = true
+ruff_python_parser.workspace = true
+ruff_python_ast.workspace = true
 phf.workspace = true
 itertools.workspace = true
 serde_json.workspace = true
diff --git a/backend/parsers/windmill-parser-py-imports/src/lib.rs b/backend/parsers/windmill-parser-py-imports/src/lib.rs
index de7f51bc79..5c8de9790f 100644
--- a/backend/parsers/windmill-parser-py-imports/src/lib.rs
+++ b/backend/parsers/windmill-parser-py-imports/src/lib.rs
@@ -13,9 +13,9 @@ use async_recursion::async_recursion;
 use itertools::Itertools;
 use lazy_static::lazy_static;
 #[cfg(not(target_arch = "wasm32"))]
-use std::str::FromStr;
-#[cfg(not(target_arch = "wasm32"))]
 use std::collections::HashMap;
+#[cfg(not(target_arch = "wasm32"))]
+use std::str::FromStr;
 
 use mapping::{FULL_IMPORTS_MAP, SHORT_IMPORTS_MAP};
 #[cfg(not(target_arch = "wasm32"))]
@@ -23,11 +23,8 @@ use regex::Regex;
 #[cfg(target_arch = "wasm32")]
 use regex_lite::Regex;
 
-use rustpython_parser::{
-    ast::{Stmt, StmtImport, StmtImportFrom, Suite},
-    text_size::TextRange,
-    Parse,
-};
+use ruff_python_ast::{Stmt, StmtImport, StmtImportFrom};
+use ruff_python_parser::parse_module;
 #[cfg(not(target_arch = "wasm32"))]
 use sqlx::{Pool, Postgres};
 #[cfg(not(target_arch = "wasm32"))]
@@ -160,6 +157,7 @@ pub struct ImportPin {
 }
 
 pub fn parse_code_for_imports(code: &str, path: &str) -> anyhow::Result<Vec<NImport>> {
+    let full_code = code;
     // Use regex to safely find the main function definition
     let mut code = DEF_MAIN_RE
         .split(code)
@@ -186,16 +184,22 @@ pub fn parse_code_for_imports(code: &str, path: &str) -> anyhow::Result<Vec<NImp
     // This is needed because we've split off the real main function above
     let code_with_fake_main = format!("{}\n\ndef main(): pass", code);
 
-    let ast = Suite::parse(&code_with_fake_main, "main.py").map_err(|e| {
-        anyhow::anyhow!("Error parsing code for imports: {}", e.to_string())
-    })?;
+    let (code, ast) = match parse_module(&code_with_fake_main) {
+        Ok(parsed) => (code, parsed.into_suite()),
+        // The split lands on any line reading like the definition of `main`, one inside a
+        // string included: what precedes it is then not a module, while the whole file is.
+        Err(e) => match parse_module(full_code) {
+            Ok(parsed) => (full_code.to_string(), parsed.into_suite()),
+            Err(_) => anyhow::bail!("Error parsing code for imports: {}", e.to_string()),
+        },
+    };
     // Note: We're still using the original code for finding pins,
     // as the TextRange values from the parsed AST would be based on code_with_fake_main
     // but we want to match against the original code
-    let find_pin = |range: TextRange, key: String| {
+    let find_pin = |stmt_end: usize, key: String| {
         let hs = code
             .chars()
-            .skip(range.end().to_usize())
+            .skip(stmt_end)
             .take_while(|e| *e != '\n')
             .collect::<String>();
 
@@ -226,9 +230,9 @@ pub fn parse_code_for_imports(code: &str, path: &str) -> anyhow::Result<Vec<NImp
     let mut nimports: Vec<NImport> = ast
         .into_iter()
         .filter_map(|x| match x {
-            Stmt::Import(StmtImport { names, range }) => names
+            Stmt::Import(StmtImport { names, range, .. }) => names
                 .get(0)
-                .and_then(|al| find_pin(range, al.name.to_string()))
+                .and_then(|al| find_pin(range.end().to_usize(), al.name.to_string()))
                 .or(Some(
                     names
                         .into_iter()
@@ -239,15 +243,11 @@ pub fn parse_code_for_imports(code: &str, path: &str) -> anyhow::Result<Vec<NImp
                         .flatten()
                         .collect::<Vec<NImport>>(),
                 )),
-            Stmt::ImportFrom(StmtImportFrom { level: Some(i), module, .. }) if i.to_u32() > 0 => {
-                Some(process_import(
-                    module.map(|x| x.to_string()),
-                    path,
-                    i.to_usize(),
-                ))
-            }
+            Stmt::ImportFrom(StmtImportFrom { level, module, .. }) if level > 0 => Some(
+                process_import(module.map(|x| x.to_string()), path, level as usize),
+            ),
             Stmt::ImportFrom(StmtImportFrom { level: _, module, range, .. }) => find_pin(
-                range,
+                range.end().to_usize(),
                 module.clone().map(|x| x.to_string()).unwrap_or_default(),
             )
             .or(Some(process_import(module.map(|x| x.to_string()), path, 0))),
@@ -351,13 +351,16 @@ async fn parse_python_imports_inner(
     temp_script_refs: &Option<HashMap<String, String>>,
 ) -> error::Result<HashMap<String, NImportResolved>> {
     tracing::debug!("Parsing python imports for path: {}", path);
-    let PythonAnnotations { py310, py311, py312, py313, .. } = PythonAnnotations::parse(&code);
+    let PythonAnnotations { py310, py311, py312, py313, py314, py315, .. } =
+        PythonAnnotations::parse(&code);
     tracing::debug!(
-        "Found python annotations - py310: {}, py311: {}, py312: {}, py313: {}",
+        "Found python annotations - py310: {}, py311: {}, py312: {}, py313: {}, py314: {}, py315: {}",
         py310,
         py311,
         py312,
-        py313
+        py313,
+        py314,
+        py315
     );
 
     let mut push_version_specifiers = |perform, unparsed: String| -> error::Result<()> {
@@ -373,6 +376,8 @@ async fn parse_python_imports_inner(
     push_version_specifiers(py311, "==3.11.*".to_owned())?;
     push_version_specifiers(py312, "==3.12.*".to_owned())?;
     push_version_specifiers(py313, "==3.13.*".to_owned())?;
+    push_version_specifiers(py314, "==3.14.*".to_owned())?;
+    push_version_specifiers(py315, "==3.15.*".to_owned())?;
 
     for x in code.lines() {
         if x.starts_with("# py:") || x.starts_with("#py:") {
@@ -513,8 +518,14 @@ async fn parse_python_imports_inner(
         let mut nested = match n {
             NImport::Relative(rpath) => {
                 // First try to get content from temp_script_refs cache if available
-                let code_from_cache = if let Some(hash) = temp_script_refs.as_ref().and_then(|dt| dt.get(&rpath)) {
-                    tracing::debug!("Found relative import '{}' in temp_script_refs with hash '{}'", rpath, hash);
+                let code_from_cache = if let Some(hash) =
+                    temp_script_refs.as_ref().and_then(|dt| dt.get(&rpath))
+                {
+                    tracing::debug!(
+                        "Found relative import '{}' in temp_script_refs with hash '{}'",
+                        rpath,
+                        hash
+                    );
                     match windmill_common::cache::raw_script_temp::load(hash.clone(), db).await {
                         Ok(content) => Some(content),
                         Err(e) => {
@@ -529,19 +540,17 @@ async fn parse_python_imports_inner(
                 // Use cached content if available, otherwise fall back to deployed script
                 let code = match code_from_cache {
                     Some(content) => content,
-                    None => {
-                        sqlx::query_scalar!(
-                            r#"
+                    None => sqlx::query_scalar!(
+                        r#"
                         SELECT content FROM script WHERE path = $1 AND workspace_id = $2
                         AND archived = false ORDER BY created_at DESC LIMIT 1
                         "#,
-                            &rpath,
-                            w_id
-                        )
-                        .fetch_optional(db)
-                        .await?
-                        .unwrap_or_else(|| "".to_string())
-                    }
+                        &rpath,
+                        w_id
+                    )
+                    .fetch_optional(db)
+                    .await?
+                    .unwrap_or_else(|| "".to_string()),
                 };
 
                 if already_visited.contains(&rpath) {
diff --git a/backend/parsers/windmill-parser-py-imports/src/mapping.rs b/backend/parsers/windmill-parser-py-imports/src/mapping.rs
index 6246a1f156..90f3fab99c 100644
--- a/backend/parsers/windmill-parser-py-imports/src/mapping.rs
+++ b/backend/parsers/windmill-parser-py-imports/src/mapping.rs
@@ -383,5 +383,10 @@ pub static SHORT_IMPORTS_MAP: PyMap = phf_map! {
     "vt" => "vt-py",
     "grpc" => "grpcio",
     "serpapi" => "google-search-results",
+    "pptx" => "python-pptx",
+    "OpenSSL" => "pyOpenSSL",
+    "win32api" => "pywin32",
+    "ruamel" => "ruamel.yaml",
+    "speech-recognition" => "SpeechRecognition",
     // Add new entry here ^
 };
diff --git a/backend/parsers/windmill-parser-py-imports/tests/tests.rs b/backend/parsers/windmill-parser-py-imports/tests/tests.rs
index c853c8e5b4..9086b29d47 100644
--- a/backend/parsers/windmill-parser-py-imports/tests/tests.rs
+++ b/backend/parsers/windmill-parser-py-imports/tests/tests.rs
@@ -1,7 +1,9 @@
 mod tests {
 
     use sqlx::{Pool, Postgres};
-    use windmill_parser_py_imports::parse_python_imports;
+    use windmill_parser_py_imports::{
+        parse_code_for_imports, parse_python_imports, ImportPin, NImport,
+    };
 
     #[sqlx::test(fixtures("base"))]
     async fn test_parse_python_imports(db: Pool<Postgres>) -> anyhow::Result<()> {
@@ -117,4 +119,87 @@ def main():
 
         Ok(())
     }
+
+    fn auto(pkg: &str) -> NImport {
+        NImport::Auto { pkg: pkg.to_string(), key: None }
+    }
+
+    #[test]
+    fn test_parse_lazy_imports() -> anyhow::Result<()> {
+        let code = "
+lazy import requests
+lazy import numpy # pin: numpy==2.1.0
+lazy from pandas import DataFrame
+lazy from f.shared import helper
+lazy = 1
+
+def main():
+    pass
+";
+        assert_eq!(
+            parse_code_for_imports(code, "f/foo/bar")?,
+            vec![
+                NImport::Pin {
+                    pins: vec![ImportPin {
+                        pkg: "numpy==2.1.0".to_string(),
+                        path: "f/foo/bar".to_string()
+                    }],
+                    key: "numpy".to_string()
+                },
+                auto("pandas"),
+                auto("requests"),
+                NImport::Relative("f/shared".to_string()),
+            ]
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn test_parse_imports_recent_syntax_before_main() -> anyhow::Result<()> {
+        let code = r#"
+import requests
+
+type Alias = list[int]
+NAME = "x"
+D = {"a": 1}
+L = [[1], [2]]
+TEMPLATE = t"hello {NAME}"
+PEP701 = f"{D["a"]} {'\n'.join(["x"])}"
+PEP798 = [*a for a in L]
+
+try:
+    import ujson
+except ImportError, ValueError:
+    pass
+
+def main():
+    pass
+"#;
+        assert_eq!(
+            parse_code_for_imports(code, "f/foo/bar")?,
+            vec![auto("requests")]
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn test_parse_imports_main_lookalike_in_docstring() -> anyhow::Result<()> {
+        for example in ["def main[T](x: T):", "def main(x):"] {
+            let code = format!(
+                "\"\"\"Usage example:\n{example}\n    return x\n\"\"\"\nimport requests # pin: requests==2.32.0\n\ndef main(value: str):\n    return value\n"
+            );
+            assert_eq!(
+                parse_code_for_imports(&code, "f/foo/bar")?,
+                vec![NImport::Pin {
+                    pins: vec![ImportPin {
+                        pkg: "requests==2.32.0".to_string(),
+                        path: "f/foo/bar".to_string()
+                    }],
+                    key: "requests".to_string()
+                }],
+                "{code}"
+            );
+        }
+        Ok(())
+    }
 }
diff --git a/backend/parsers/windmill-parser-py/Cargo.toml b/backend/parsers/windmill-parser-py/Cargo.toml
index 0c50e0f8d8..6971fe8fcd 100644
--- a/backend/parsers/windmill-parser-py/Cargo.toml
+++ b/backend/parsers/windmill-parser-py/Cargo.toml
@@ -10,8 +10,8 @@ path = "./src/lib.rs"
 
 [dependencies]
 windmill-parser.workspace = true
-rustpython-parser.workspace = true
+ruff_python_parser.workspace = true
+ruff_python_ast.workspace = true
 itertools.workspace = true
 serde_json.workspace = true
 anyhow.workspace = true
-rustpython-ast = { version = "0.4.0", features = ["visitor"] }
diff --git a/backend/parsers/windmill-parser-py/src/lib.rs b/backend/parsers/windmill-parser-py/src/lib.rs
index 086a354d02..5a9eabc33e 100644
--- a/backend/parsers/windmill-parser-py/src/lib.rs
+++ b/backend/parsers/windmill-parser-py/src/lib.rs
@@ -13,13 +13,11 @@ use itertools::Itertools;
 use serde_json::json;
 use windmill_parser::{json_to_typ, Arg, MainArgSignature, ObjectType, Typ};
 
-use rustpython_parser::{
-    ast::{
-        Constant, Expr, ExprAttribute, ExprConstant, ExprDict, ExprList, ExprName, Stmt,
-        StmtAssign, StmtAsyncFunctionDef, StmtClassDef, StmtFunctionDef, Suite,
-    },
-    Parse,
+use ruff_python_ast::{
+    Expr, ExprAttribute, ExprDict, ExprList, ExprName, Number, Parameters, Stmt, StmtAssign,
+    StmtClassDef, StmtFunctionDef,
 };
+use ruff_python_parser::parse_module;
 
 pub mod pydantic_parser;
 
@@ -81,22 +79,24 @@ fn should_parse_for_models(code: &str) -> bool {
         || code.contains("import dataclasses")
 }
 
+/// What follows `def <name>` or `async def <name>` on a line opening that function's
+/// parameters or type parameters.
+fn strip_def<'a>(line: &'a str, name: &str) -> Option<&'a str> {
+    let rest = line
+        .strip_prefix("async def ")
+        .or_else(|| line.strip_prefix("def "))?
+        .strip_prefix(name)?;
+    (rest.starts_with('(') || rest.starts_with('[')).then_some(rest)
+}
+
 fn filter_non_main(code: &str, main_name: &str) -> String {
-    let def_main = format!("def {}(", main_name);
-    let async_def_main = format!("async def {}(", main_name);
     let mut filtered_code = String::new();
     let mut code_iter = code.split("\n");
     let mut remaining: String = String::new();
     while let Some(line) = code_iter.next() {
-        if line.starts_with(&async_def_main) {
-            filtered_code += &async_def_main;
-            remaining += line.strip_prefix(&async_def_main).unwrap();
-            remaining += "\n";
-            remaining += &code_iter.join("\n");
-            break;
-        } else if line.starts_with(&def_main) {
-            filtered_code += &def_main;
-            remaining += line.strip_prefix(&def_main).unwrap();
+        if let Some(rest) = strip_def(line, main_name) {
+            filtered_code += &line[..line.len() - rest.len()];
+            remaining += rest;
             remaining += "\n";
             remaining += &code_iter.join("\n");
             break;
@@ -106,6 +106,26 @@ fn filter_non_main(code: &str, main_name: &str) -> String {
         return String::new();
     }
     let mut chars = remaining.chars();
+
+    // PEP 695 type parameters, `def main[T](x: T)`, sit between the name and the parameters.
+    if remaining.starts_with('[') {
+        let mut open_brackets = 0;
+        for c in chars.by_ref() {
+            if c == '[' {
+                open_brackets += 1;
+            } else if c == ']' {
+                open_brackets -= 1;
+            }
+            filtered_code.push(c);
+            if open_brackets == 0 {
+                break;
+            }
+        }
+    }
+    if chars.next() != Some('(') {
+        return String::new();
+    }
+    filtered_code.push('(');
     let mut open_parens = 1;
 
     while let Some(c) = chars.next() {
@@ -183,15 +203,15 @@ fn extract_code_metadata(code: &str, main_name: &str) -> CodeMetadata {
 
     let filtered_code = filter_relevant_statements(code);
 
-    let ast = match Suite::parse(&filtered_code, "main.py") {
-        Ok(ast) => ast,
+    let ast = match parse_module(&filtered_code) {
+        Ok(parsed) => parsed.into_suite(),
         Err(_) => return CodeMetadata { enums, descriptions },
     };
 
     for stmt in ast {
         match stmt {
-            Stmt::ClassDef(StmtClassDef { name, body, bases, .. }) if has_enum => {
-                let is_enum = bases.iter().any(|base| {
+            Stmt::ClassDef(class_def) if has_enum => {
+                let is_enum = class_def.bases().iter().any(|base| {
                     matches!(base, Expr::Name(ExprName { id, .. })
                         if id == "Enum" || id == "IntEnum" || id == "StrEnum"
                         || id == "Flag" || id == "IntFlag")
@@ -201,17 +221,15 @@ fn extract_code_metadata(code: &str, main_name: &str) -> CodeMetadata {
                     let mut values = Vec::new();
                     let mut members = HashMap::new();
 
+                    let StmtClassDef { name, body, .. } = class_def;
                     for item in body {
                         if let Stmt::Assign(StmtAssign { targets, value, .. }) = item {
                             if let Some(Expr::Name(ExprName { id: target_name, .. })) =
                                 targets.first()
                             {
                                 if !target_name.starts_with('_') {
-                                    if let Expr::Constant(ExprConstant {
-                                        value: Constant::Str(val),
-                                        ..
-                                    }) = value.as_ref()
-                                    {
+                                    if let Expr::StringLiteral(val) = value.as_ref() {
+                                        let val = val.value.to_str();
                                         values.push(val.to_string());
                                         members.insert(target_name.to_string(), val.to_string());
                                     }
@@ -225,15 +243,13 @@ fn extract_code_metadata(code: &str, main_name: &str) -> CodeMetadata {
                     }
                 }
             }
-            Stmt::FunctionDef(StmtFunctionDef { name: func_name, body, .. }) if has_docstring => {
-                if &func_name == main_name {
+            Stmt::FunctionDef(StmtFunctionDef {
+                name: func_name, body, is_async: false, ..
+            }) if has_docstring => {
+                if func_name.as_str() == main_name {
                     if let Some(Stmt::Expr(expr_stmt)) = body.first() {
-                        if let Expr::Constant(ExprConstant {
-                            value: Constant::Str(docstring),
-                            ..
-                        }) = expr_stmt.value.as_ref()
-                        {
-                            descriptions = parse_docstring_args(docstring);
+                        if let Expr::StringLiteral(docstring) = expr_stmt.value.as_ref() {
+                            descriptions = parse_docstring_args(docstring.value.to_str());
                         }
                     }
                 }
@@ -294,6 +310,27 @@ fn parse_docstring_args(docstring: &str) -> HashMap<String, String> {
     descriptions
 }
 
+/// A line that reads as the definition of `main_name` can also sit inside a string, a docstring
+/// showing an example for instance. When several lines do, only the parsed module tells which
+/// one is the function.
+fn main_params_among_lookalikes(code: &str, main_name: &str) -> Option<Parameters> {
+    code.split('\n')
+        .filter(|line| strip_def(line, main_name).is_some())
+        .nth(1)?;
+    parse_module(code)
+        .ok()?
+        .into_suite()
+        .into_iter()
+        .find_map(|x| match x {
+            Stmt::FunctionDef(StmtFunctionDef { name, parameters, .. })
+                if name.as_str() == main_name =>
+            {
+                Some(*parameters)
+            }
+            _ => None,
+        })
+}
+
 /// skip_params is a micro optimization for when we just want to find the main
 /// function without parsing all the params.
 pub fn parse_python_signature(
@@ -310,41 +347,39 @@ pub fn parse_python_signature(
     // - If no models: parse only the filtered main function
     let (params, module) = if should_parse_for_models(code) {
         // Parse full code once for both Pydantic detection and signature extraction
-        let ast = Suite::parse(code, "main.py")
-            .map_err(|e| anyhow::anyhow!("Error parsing code: {}", e.to_string()))?;
+        let ast = parse_module(code)
+            .map_err(|e| anyhow::anyhow!("Error parsing code: {}", e.to_string()))?
+            .into_suite();
 
         // Extract main function from full AST
         let params = ast.iter().find_map(|x| match x {
-            Stmt::FunctionDef(StmtFunctionDef { name, args, .. }) if name == &main_name => {
-                Some(args.as_ref().clone())
-            }
-            Stmt::AsyncFunctionDef(StmtAsyncFunctionDef { name, args, .. })
-                if name == &main_name =>
+            Stmt::FunctionDef(StmtFunctionDef { name, parameters, .. })
+                if name.as_str() == main_name =>
             {
-                Some(args.as_ref().clone())
+                Some(parameters.as_ref().clone())
             }
             _ => None,
         });
 
         // Keep AST for Pydantic/dataclass detection
         (params, Some(ast))
+    } else if let Some(params) = main_params_among_lookalikes(code, &main_name) {
+        (Some(params), None)
     } else {
         // No models detected - parse only the filtered main function
         let filtered_code = filter_non_main(code, &main_name);
         if filtered_code.is_empty() {
             (None, None)
         } else {
-            let ast = Suite::parse(&filtered_code, "main.py")
-                .map_err(|e| anyhow::anyhow!("Error parsing code: {}", e.to_string()))?;
+            let ast = parse_module(&filtered_code)
+                .map_err(|e| anyhow::anyhow!("Error parsing code: {}", e.to_string()))?
+                .into_suite();
 
             let params = ast.into_iter().find_map(|x| match x {
-                Stmt::FunctionDef(StmtFunctionDef { name, args, .. }) if &name == &main_name => {
-                    Some(*args)
-                }
-                Stmt::AsyncFunctionDef(StmtAsyncFunctionDef { name, args, .. })
-                    if &name == &main_name =>
+                Stmt::FunctionDef(StmtFunctionDef { name, parameters, .. })
+                    if name.as_str() == main_name =>
                 {
-                    Some(*args)
+                    Some(*parameters)
                 }
                 _ => None,
             });
@@ -378,8 +413,6 @@ pub fn parse_python_signature(
 
     if !skip_params && params.is_some() {
         let params = params.unwrap();
-        let def_arg_start = params.args.len() - params.defaults().count();
-
         // Two-pass approach for lazy metadata extraction:
         // Pass 1: Parse types without enum info to determine if metadata is needed
         // Pass 2: Re-parse unknown types with metadata only if necessary
@@ -392,11 +425,11 @@ pub fn parse_python_signature(
             .iter()
             .enumerate()
             .map(|(i, x)| {
-                let arg_name = x.as_arg().arg.to_string();
+                let arg_name = x.parameter.name.to_string();
                 let (typ, has_default) = x
-                    .as_arg()
+                    .parameter
                     .annotation
-                    .as_ref()
+                    .as_deref()
                     .map_or((Typ::Unknown, false), |e| {
                         parse_expr(e, &empty_enums, module_ref)
                     });
@@ -423,21 +456,16 @@ pub fn parse_python_signature(
                 .into_iter()
                 .map(|(i, arg_name, mut typ, mut has_default)| {
                     if matches!(typ, Typ::Resource(_)) && !metadata.enums.is_empty() {
-                        if let Some(annotation) = params.args[i].as_arg().annotation.as_ref() {
+                        if let Some(annotation) = params.args[i].parameter.annotation.as_deref() {
                             (typ, has_default) =
                                 parse_expr(annotation, &metadata.enums, module_ref);
                         }
                     }
 
-                    let default = if i >= def_arg_start {
-                        params
-                            .defaults()
-                            .nth(i - def_arg_start)
-                            .map(|expr| to_value(expr, &metadata.enums))
-                            .flatten()
-                    } else {
-                        None
-                    };
+                    let default = params.args[i]
+                        .default
+                        .as_deref()
+                        .and_then(|expr| to_value(expr, &metadata.enums));
 
                     let should_get_type_from_default = match &typ {
                         Typ::Unknown => true,
@@ -465,10 +493,10 @@ pub fn parse_python_signature(
                     // debounce accumulation support. Falls back to docstring
                     // description if no union array pattern is found.
                     let union_otyp = params.args[i]
-                        .as_arg()
+                        .parameter
                         .annotation
-                        .as_ref()
-                        .and_then(|ann| detect_py_union_array_otyp(ann.as_ref()));
+                        .as_deref()
+                        .and_then(detect_py_union_array_otyp);
 
                     Arg {
                         otyp: union_otyp.or_else(|| {
@@ -509,12 +537,8 @@ pub fn parse_python_signature(
     }
 }
 
-fn parse_expr(
-    e: &Box<Expr>,
-    enums: &HashMap<String, EnumInfo>,
-    module: Option<&[Stmt]>,
-) -> (Typ, bool) {
-    match e.as_ref() {
+fn parse_expr(e: &Expr, enums: &HashMap<String, EnumInfo>, module: Option<&[Stmt]>) -> (Typ, bool) {
+    match e {
         Expr::Name(ExprName { id, .. }) => (parse_typ(id.as_ref(), enums, module), false),
         Expr::Attribute(x) => {
             if let Some(name) = x.value.as_name_expr() {
@@ -531,12 +555,9 @@ fn parse_expr(
             }
         }
         Expr::BinOp(x) => {
-            if matches!(
-                x.right.as_ref(),
-                Expr::Constant(ExprConstant { value: Constant::None, .. })
-            ) {
+            if x.right.is_none_literal_expr() {
                 (parse_expr(&x.left, enums, module).0, true)
-            } else if detect_py_union_array_otyp(e.as_ref()).is_some() {
+            } else if detect_py_union_array_otyp(e).is_some() {
                 // T | list[T] — parsed type is Unknown; otyp is set separately
                 (Typ::Unknown, false)
             } else {
@@ -552,7 +573,7 @@ fn parse_expr(
                                 .elts
                                 .iter()
                                 .map(|x| match x {
-                                    Expr::Constant(c) => c.value.as_str().map(|x| x.to_string()),
+                                    Expr::StringLiteral(s) => Some(s.value.to_str().to_string()),
                                     _ => None,
                                 })
                                 .filter_map(|x| x)
@@ -625,15 +646,26 @@ fn map_resource_name(x: &str) -> String {
     }
 }
 
-fn to_value<R>(et: &Expr<R>, enums: &HashMap<String, EnumInfo>) -> Option<serde_json::Value> {
+fn to_value(et: &Expr, enums: &HashMap<String, EnumInfo>) -> Option<serde_json::Value> {
     match et {
-        Expr::Constant(ExprConstant { value, .. }) => Some(constant_to_value(value)),
-        Expr::Dict(ExprDict { keys, values, .. }) => {
-            let v = keys
-                .into_iter()
-                .zip(values)
-                .map(|(k, v)| {
-                    let key = k
+        Expr::NoneLiteral(_) => Some(json!(null)),
+        Expr::BooleanLiteral(b) => Some(json!(b.value)),
+        Expr::StringLiteral(s) => Some(json!(s.value.to_str())),
+        Expr::BytesLiteral(b) => Some(json!(b.value.bytes().collect::<Vec<u8>>())),
+        Expr::NumberLiteral(n) => Some(match &n.value {
+            Number::Int(i) => {
+                serde_json::from_str(&i.to_string()).unwrap_or(json!("invalid number"))
+            }
+            Number::Float(f) => json!(f),
+            Number::Complex { real, imag } => json!([real, imag]),
+        }),
+        Expr::EllipsisLiteral(_) => Some(json!("...")),
+        Expr::Dict(ExprDict { items, .. }) => {
+            let v = items
+                .iter()
+                .map(|item| {
+                    let key = item
+                        .key
                         .as_ref()
                         .map(|e| to_value(e, enums))
                         .flatten()
@@ -642,7 +674,7 @@ fn to_value<R>(et: &Expr<R>, enums: &HashMap<String, EnumInfo>) -> Option<serde_
                             _ => None,
                         })
                         .unwrap_or_else(|| "no_key".to_string());
-                    (key, to_value(&v, enums))
+                    (key, to_value(&item.value, enums))
                 })
                 .collect::<HashMap<String, _>>();
             Some(json!(v))
@@ -672,20 +704,6 @@ fn to_value<R>(et: &Expr<R>, enums: &HashMap<String, EnumInfo>) -> Option<serde_
     }
 }
 
-fn constant_to_value(c: &Constant) -> serde_json::Value {
-    match c {
-        Constant::None => json!(null),
-        Constant::Bool(b) => json!(b),
-        Constant::Str(s) => json!(s),
-        Constant::Bytes(b) => json!(b),
-        Constant::Int(i) => serde_json::from_str(&i.to_string()).unwrap_or(json!("invalid number")),
-        Constant::Tuple(t) => json!(t.iter().map(constant_to_value).collect::<Vec<_>>()),
-        Constant::Float(f) => json!(f),
-        Constant::Complex { real, imag } => json!([real, imag]),
-        Constant::Ellipsis => json!("..."),
-    }
-}
-
 #[cfg(test)]
 mod tests {
 
@@ -1323,4 +1341,89 @@ def main(color: Color = Color.RED):
         );
         Ok(())
     }
+
+    #[test]
+    fn test_parse_python_sig_type_params() -> anyhow::Result<()> {
+        for code in [
+            "def main[T](x: str, y: int = 3):\n    return x\n",
+            "async def main[T: (int, str), *Ts](x: str, y: int = 3):\n    return x\n",
+            // parsed whole rather than pre-filtered down to `main`
+            "from dataclasses import dataclass\n\ndef main[T](x: str, y: int = 3):\n    return x\n",
+        ] {
+            let result = parse_python_signature(code, None, false)?;
+            assert_eq!(result.auto_kind, None, "{code}");
+            assert_eq!(
+                result
+                    .args
+                    .iter()
+                    .map(|a| (a.name.as_str(), &a.typ, &a.default))
+                    .collect::<Vec<_>>(),
+                vec![
+                    ("x", &Typ::Str(None), &None),
+                    ("y", &Typ::Int, &Some(json!(3)))
+                ],
+                "{code}"
+            );
+        }
+        Ok(())
+    }
+
+    // A script with a model class is parsed whole, so syntax anywhere in it reaches the parser.
+    #[test]
+    fn test_parse_python_sig_recent_syntax() -> anyhow::Result<()> {
+        let code = r#"
+from dataclasses import dataclass
+lazy import requests
+lazy from pandas import DataFrame
+
+type Alias = list[int]
+
+@dataclass
+class Point:
+    x: int
+
+try:
+    import a
+except ImportError, ValueError:
+    pass
+
+D = {"a": 1}
+L = [[1], [2]]
+PEP701 = f"{D["a"]} {'\n'.join(["x"])}"
+PEP798 = [*a for a in L]
+
+def main(p: Point, name: str = "world"):
+    return t"hello {name}"
+"#;
+        let result = parse_python_signature(code, None, false)?;
+        assert_eq!(result.args.len(), 2);
+        assert_eq!(
+            result.args[0].typ,
+            Typ::Object(ObjectType::new(
+                Some("Point".to_string()),
+                Some(vec![windmill_parser::ObjectProperty {
+                    key: "x".to_string(),
+                    typ: Box::new(Typ::Int)
+                }])
+            ))
+        );
+        assert_eq!(result.args[1].default, Some(json!("world")));
+        Ok(())
+    }
+
+    #[test]
+    fn test_parse_python_sig_main_lookalike_in_docstring() -> anyhow::Result<()> {
+        for example in ["def main[T](x: T):", "def main(x: int, y: int):"] {
+            let code = format!(
+                "\"\"\"Usage example:\n{example}\n    return x\n\"\"\"\n\ndef main(value: str):\n    return value\n"
+            );
+            let result = parse_python_signature(&code, None, false)?;
+            assert_eq!(
+                result.args.iter().map(|a| &a.name).collect::<Vec<_>>(),
+                vec!["value"],
+                "{code}"
+            );
+        }
+        Ok(())
+    }
 }
diff --git a/backend/parsers/windmill-parser-py/src/pydantic_parser.rs b/backend/parsers/windmill-parser-py/src/pydantic_parser.rs
index e229d97a8a..78a0a3c354 100644
--- a/backend/parsers/windmill-parser-py/src/pydantic_parser.rs
+++ b/backend/parsers/windmill-parser-py/src/pydantic_parser.rs
@@ -11,8 +11,8 @@
 //! This module provides functionality to detect and parse Pydantic models and Python
 //! dataclasses from Python AST, enabling automatic UI generation for complex data structures.
 
-use rustpython_parser::ast::{
-    Constant, Expr, ExprAttribute, ExprCall, ExprConstant, ExprName, ExprTuple, Stmt, StmtAnnAssign,
+use ruff_python_ast::{
+    Decorator, Expr, ExprAttribute, ExprCall, ExprName, ExprTuple, Stmt, StmtAnnAssign,
 };
 use std::collections::HashSet;
 use windmill_parser::{ObjectProperty, ObjectType, Typ};
@@ -64,7 +64,7 @@ fn detect_model_type_impl(
                 // Mark as being visited
                 visited.insert(class_name.to_string());
 
-                let result = if is_pydantic_base(&class_def.bases) {
+                let result = if is_pydantic_base(class_def.bases()) {
                     // Pydantic BaseModel
                     parse_model_fields(&class_def.body, class_def.name.as_str(), module, visited)
                 } else if has_dataclass_decorator(&class_def.decorator_list)
@@ -115,9 +115,9 @@ fn is_pydantic_base(bases: &[Expr]) -> bool {
 }
 
 /// Checks if a class has @dataclass decorator (standard library)
-fn has_dataclass_decorator(decorators: &[Expr]) -> bool {
+fn has_dataclass_decorator(decorators: &[Decorator]) -> bool {
     for decorator in decorators {
-        match decorator {
+        match &decorator.expression {
             // Match: @dataclass
             Expr::Name(ExprName { id, .. }) if id.as_str() == "dataclass" => {
                 return true;
@@ -160,9 +160,9 @@ fn has_dataclass_decorator(decorators: &[Expr]) -> bool {
 }
 
 /// Checks if a class has @pydantic.dataclasses.dataclass decorator (Pydantic v2)
-fn has_pydantic_dataclass_decorator(decorators: &[Expr]) -> bool {
+fn has_pydantic_dataclass_decorator(decorators: &[Decorator]) -> bool {
     for decorator in decorators {
-        match decorator {
+        match &decorator.expression {
             // Match: @pydantic.dataclasses.dataclass
             Expr::Attribute(ExprAttribute { attr, value, .. }) if attr.as_str() == "dataclass" => {
                 if let Expr::Attribute(ExprAttribute {
@@ -350,10 +350,10 @@ fn extract_field_type(
 
         // String annotations: "ForwardRef" (forward references)
         // Not fully supported - return Unknown with warning
-        Expr::Constant(ExprConstant { value: Constant::Str(s), .. }) => {
+        Expr::StringLiteral(s) => {
             eprintln!(
                 "Forward references like \"{forward_ref}\" are not yet supported, treating as Unknown",
-                forward_ref = s,
+                forward_ref = s.value.to_str(),
             );
             Typ::Unknown
         }
diff --git a/backend/parsers/windmill-parser-sql-asset/src/asset_parser_utils.rs b/backend/parsers/windmill-parser-sql-asset/src/asset_parser_utils.rs
index b29c6c99ac..4d77da15bb 100644
--- a/backend/parsers/windmill-parser-sql-asset/src/asset_parser_utils.rs
+++ b/backend/parsers/windmill-parser-sql-asset/src/asset_parser_utils.rs
@@ -20,13 +20,16 @@ pub fn parse_wmill_sdk_sql_assets(
         Ok(mut sql_assets) => {
             if let Some(schema) = schema {
                 for asset in &mut sql_assets.assets {
-                    if asset.kind == kind && asset.path.starts_with(asset_name) {
-                        asset.path = format!(
-                            "{}/{}.{}",
-                            asset_name,
-                            schema,
-                            &asset.path[asset_name.len() + 1..]
-                        );
+                    if asset.kind != kind {
+                        continue;
+                    }
+                    // A statement can name the database alone, with no table to qualify.
+                    let table = asset
+                        .path
+                        .strip_prefix(asset_name)
+                        .and_then(|rest| rest.strip_prefix('/'));
+                    if let Some(table) = table {
+                        asset.path = format!("{asset_name}/{schema}.{table}");
                     }
                 }
             }
diff --git a/backend/parsers/windmill-parser-sql/src/lib.rs b/backend/parsers/windmill-parser-sql/src/lib.rs
index 38f4b7a33e..341906a3e3 100644
--- a/backend/parsers/windmill-parser-sql/src/lib.rs
+++ b/backend/parsers/windmill-parser-sql/src/lib.rs
@@ -235,7 +235,7 @@ lazy_static::lazy_static! {
     // -- $name (type) = default
     static ref RE_ARG_DUCKDB: Regex = Regex::new(r#"(?m)^-- \$(\w+) \(([A-Za-z0-9_\[\]]+)\)(?: ?\= ?(.+))? *(?:\r|\n|$)"#).unwrap();
 
-    static ref RE_ARG_SNOWFLAKE: Regex = Regex::new(r#"(?m)^-- \? (\w+) \((\w+)\)(?: ?\= ?(.+))? *(?:\r|\n|$)"#).unwrap();
+    static ref RE_ARG_SNOWFLAKE: Regex = Regex::new(r#"(?m)^-- \? (\w+) \((\w+(?:\[\])?)\)(?: ?\= ?(.+))? *(?:\r|\n|$)"#).unwrap();
 
 
     static ref RE_ARG_MSSQL: Regex = Regex::new(r#"(?m)^-- @(?:P|p)\d+ (\w+) \((\w+)\)(?: ?\= ?(.+))? *(?:\r|\n|$)"#).unwrap();
@@ -254,6 +254,12 @@ fn parsed_default(parsed_typ: &Typ, default: String) -> Option<serde_json::Value
         Typ::Str(_) if default.len() >= 2 && default.starts_with("'") && default.ends_with("'") => {
             Some(json!(&default[1..default.len() - 1]))
         }
+        Typ::List(_) => Some(
+            serde_json::from_str::<serde_json::Value>(&default)
+                .ok()
+                .filter(|v| v.is_array())
+                .unwrap_or_else(|| json!(default)),
+        ),
         _ => Some(json!(default)),
     }
 }
@@ -1039,12 +1045,18 @@ pub fn parse_duckdb_typ(typ: &str) -> Typ {
 }
 
 pub fn parse_snowflake_typ(typ: &str) -> Typ {
+    if let Some(base_typ) = typ.strip_suffix("[]") {
+        return Typ::List(Box::new(parse_snowflake_typ(base_typ)));
+    }
     match typ {
-        "varchar" => Typ::Str(None),
-        "binary" => Typ::Bytes,
-        "date" | "time" | "timestamp" => Typ::Datetime,
-        "int" => Typ::Int,
-        "float" => Typ::Float,
+        "array" => Typ::List(Box::new(Typ::Unknown)),
+        "varchar" | "text" | "string" | "char" | "character" => Typ::Str(None),
+        "binary" | "varbinary" => Typ::Bytes,
+        "date" | "time" | "datetime" | "timestamp" | "timestamp_ntz" | "timestamp_ltz"
+        | "timestamp_tz" => Typ::Datetime,
+        "int" | "integer" | "bigint" | "smallint" | "tinyint" | "byteint" => Typ::Int,
+        "float" | "float4" | "float8" | "double" | "double precision" | "real" | "number"
+        | "decimal" | "numeric" => Typ::Float,
         "boolean" => Typ::Bool,
         "s3object" => Typ::Resource("S3Object".to_string()),
         _ => Typ::Str(None),
@@ -1589,6 +1601,39 @@ SELECT ?;
         Ok(())
     }
 
+    #[test]
+    fn test_parse_snowflake_array_types() -> anyhow::Result<()> {
+        let code = r#"
+-- ? groups (varchar[])
+-- ? ids (int[]) = [1, 2]
+-- ? anything (ARRAY)
+SELECT 1;
+"#;
+        let args = parse_snowflake_sig(code)?.args;
+        assert_eq!(args[1].default, Some(json!([1, 2])));
+        let got = args
+            .iter()
+            .map(|a| (a.name.as_str(), a.otyp.as_deref(), &a.typ))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            got,
+            vec![
+                (
+                    "groups",
+                    Some("varchar[]"),
+                    &Typ::List(Box::new(Typ::Str(None)))
+                ),
+                ("ids", Some("int[]"), &Typ::List(Box::new(Typ::Int))),
+                (
+                    "anything",
+                    Some("array"),
+                    &Typ::List(Box::new(Typ::Unknown))
+                ),
+            ]
+        );
+        Ok(())
+    }
+
     #[test]
     fn test_parse_mssql_sig() -> anyhow::Result<()> {
         let code = r#"
diff --git a/backend/parsers/windmill-parser-wac/Cargo.toml b/backend/parsers/windmill-parser-wac/Cargo.toml
index d354b1c653..21ee286db9 100644
--- a/backend/parsers/windmill-parser-wac/Cargo.toml
+++ b/backend/parsers/windmill-parser-wac/Cargo.toml
@@ -9,8 +9,9 @@ name = "windmill_parser_wac"
 path = "./src/lib.rs"
 
 [dependencies]
-rustpython-parser.workspace = true
-rustpython-ast = { version = "0.4.0", features = ["visitor"] }
+ruff_python_parser.workspace = true
+ruff_python_ast.workspace = true
+ruff_text_size.workspace = true
 swc_common.workspace = true
 swc_ecma_parser.workspace = true
 swc_ecma_ast.workspace = true
diff --git a/backend/parsers/windmill-parser-wac/src/python.rs b/backend/parsers/windmill-parser-wac/src/python.rs
index f91067b711..e8fb72ff2f 100644
--- a/backend/parsers/windmill-parser-wac/src/python.rs
+++ b/backend/parsers/windmill-parser-wac/src/python.rs
@@ -1,12 +1,12 @@
 use std::collections::HashMap;
 
-use rustpython_parser::{
-    ast::{
-        Expr, ExprAwait, ExprCall, ExprName, Stmt, StmtExpr, StmtFor, StmtIf, StmtReturn, StmtTry,
-        StmtTryStar, StmtWhile,
-    },
-    Parse,
+use ruff_python_ast::{
+    CmpOp, ElifElseClause, ExceptHandler, Expr, ExprAttribute, ExprAwait, ExprCall, ExprName,
+    Number, Parameters, Stmt, StmtExpr, StmtFor, StmtFunctionDef, StmtIf, StmtReturn, StmtTry,
+    StmtWhile,
 };
+use ruff_python_parser::parse_module;
+use ruff_text_size::{Ranged, TextSize};
 
 use crate::dag::{DagEdge, DagNode, DagNodeType, Param, WorkflowDag};
 use crate::validation::{self, CompileError};
@@ -42,9 +42,9 @@ type TaskFunctions = HashMap<String, Option<String>>;
 fn collect_task_functions(stmts: &[Stmt]) -> TaskFunctions {
     let mut tasks = HashMap::new();
     for stmt in stmts {
-        if let Stmt::AsyncFunctionDef(func) = stmt {
+        if let Stmt::FunctionDef(func @ StmtFunctionDef { is_async: true, .. }) = stmt {
             for dec in &func.decorator_list {
-                match dec {
+                match &dec.expression {
                     // @task  (bare decorator)
                     Expr::Name(ExprName { id, .. }) if id.as_str() == "task" => {
                         tasks.insert(func.name.to_string(), None);
@@ -68,13 +68,9 @@ fn collect_task_functions(stmts: &[Stmt]) -> TaskFunctions {
                 if let Expr::Name(ExprName { id, .. }) = call.func.as_ref() {
                     if id.as_str() == "task_script" || id.as_str() == "task_flow" {
                         // Extract the path from the first positional argument
-                        let path = call.args.first().and_then(|arg| {
-                            if let Expr::Constant(c) = arg {
-                                if let rustpython_parser::ast::Constant::Str(s) = &c.value {
-                                    return Some(s.to_string());
-                                }
-                            }
-                            None
+                        let path = call.arguments.args.first().and_then(|arg| match arg {
+                            Expr::StringLiteral(s) => Some(s.value.to_str().to_string()),
+                            _ => None,
                         });
                         // Extract variable name from target
                         if let Some(Expr::Name(ExprName { id: var_name, .. })) =
@@ -92,13 +88,11 @@ fn collect_task_functions(stmts: &[Stmt]) -> TaskFunctions {
 
 /// Extract the `path=` keyword argument from a `@task(path="...")` call.
 fn extract_task_path_kwarg(call: &ExprCall) -> Option<String> {
-    for kw in &call.keywords {
+    for kw in &call.arguments.keywords {
         if let Some(ref arg) = kw.arg {
             if arg.as_str() == "path" {
-                if let Expr::Constant(c) = &kw.value {
-                    if let rustpython_parser::ast::Constant::Str(s) = &c.value {
-                        return Some(s.to_string());
-                    }
+                if let Expr::StringLiteral(s) = &kw.value {
+                    return Some(s.value.to_str().to_string());
                 }
             }
         }
@@ -150,10 +144,9 @@ impl WacWalker {
 
     fn line_of_expr(&self, expr: &Expr) -> usize {
         let offset = match expr {
-            Expr::Call(c) => c.range.start().to_usize(),
-            Expr::Await(a) => a.range.start().to_usize(),
-            Expr::Attribute(a) => a.range.start().to_usize(),
-            Expr::Name(n) => n.range.start().to_usize(),
+            Expr::Call(_) | Expr::Await(_) | Expr::Attribute(_) | Expr::Name(_) => {
+                expr.start().to_usize()
+            }
             _ => 0,
         };
         self.line_index.line_of(offset)
@@ -161,17 +154,15 @@ impl WacWalker {
 
     fn line_of_stmt(&self, stmt: &Stmt) -> usize {
         let offset = match stmt {
-            Stmt::If(s) => s.range.start().to_usize(),
-            Stmt::For(s) => s.range.start().to_usize(),
-            Stmt::While(s) => s.range.start().to_usize(),
-            Stmt::Return(s) => s.range.start().to_usize(),
-            Stmt::Expr(s) => s.range.start().to_usize(),
-            Stmt::Try(s) => s.range.start().to_usize(),
-            Stmt::TryStar(s) => s.range.start().to_usize(),
-            Stmt::Assign(s) => s.range.start().to_usize(),
-            Stmt::AnnAssign(s) => s.range.start().to_usize(),
-            Stmt::FunctionDef(s) => s.range.start().to_usize(),
-            Stmt::AsyncFunctionDef(s) => s.range.start().to_usize(),
+            Stmt::If(_)
+            | Stmt::For(_)
+            | Stmt::While(_)
+            | Stmt::Return(_)
+            | Stmt::Expr(_)
+            | Stmt::Try(_)
+            | Stmt::Assign(_)
+            | Stmt::AnnAssign(_)
+            | Stmt::FunctionDef(_) => stmt.start().to_usize(),
             _ => 0,
         };
         self.line_index.line_of(offset)
@@ -190,9 +181,7 @@ impl WacWalker {
     /// Check if an expression is `asyncio.gather(...)` call
     fn is_asyncio_gather_call(expr: &Expr) -> bool {
         if let Expr::Call(call) = expr {
-            if let Expr::Attribute(rustpython_parser::ast::ExprAttribute { value, attr, .. }) =
-                call.func.as_ref()
-            {
+            if let Expr::Attribute(ExprAttribute { value, attr, .. }) = call.func.as_ref() {
                 if attr.as_str() == "gather" {
                     if let Expr::Name(ExprName { id, .. }) = value.as_ref() {
                         return id.as_str() == "asyncio";
@@ -222,20 +211,20 @@ impl WacWalker {
     fn expr_to_source(expr: &Expr) -> String {
         match expr {
             Expr::Compare(c) => {
-                let left = Self::expr_to_source(&c.left);
-                if let Some(comparator) = c.comparators.first() {
+                let left = Self::expr_to_source(&c.operands[0]);
+                if let Some(comparator) = c.comparators().first() {
                     let right = Self::expr_to_source(comparator);
                     let op = match c.ops.first() {
-                        Some(rustpython_parser::ast::CmpOp::Gt) => ">",
-                        Some(rustpython_parser::ast::CmpOp::Lt) => "<",
-                        Some(rustpython_parser::ast::CmpOp::GtE) => ">=",
-                        Some(rustpython_parser::ast::CmpOp::LtE) => "<=",
-                        Some(rustpython_parser::ast::CmpOp::Eq) => "==",
-                        Some(rustpython_parser::ast::CmpOp::NotEq) => "!=",
-                        Some(rustpython_parser::ast::CmpOp::In) => "in",
-                        Some(rustpython_parser::ast::CmpOp::NotIn) => "not in",
-                        Some(rustpython_parser::ast::CmpOp::Is) => "is",
-                        Some(rustpython_parser::ast::CmpOp::IsNot) => "is not",
+                        Some(CmpOp::Gt) => ">",
+                        Some(CmpOp::Lt) => "<",
+                        Some(CmpOp::GtE) => ">=",
+                        Some(CmpOp::LtE) => "<=",
+                        Some(CmpOp::Eq) => "==",
+                        Some(CmpOp::NotEq) => "!=",
+                        Some(CmpOp::In) => "in",
+                        Some(CmpOp::NotIn) => "not in",
+                        Some(CmpOp::Is) => "is",
+                        Some(CmpOp::IsNot) => "is not",
                         None => "?",
                     };
                     format!("{left} {op} {right}")
@@ -253,14 +242,14 @@ impl WacWalker {
                 format!("{value}.{}", a.attr)
             }
             Expr::Name(n) => n.id.to_string(),
-            Expr::Constant(c) => match &c.value {
-                rustpython_parser::ast::Constant::Str(s) => format!("\"{s}\""),
-                rustpython_parser::ast::Constant::Int(i) => i.to_string(),
-                rustpython_parser::ast::Constant::Float(f) => f.to_string(),
-                rustpython_parser::ast::Constant::Bool(b) => b.to_string(),
-                rustpython_parser::ast::Constant::None => "None".to_string(),
-                _ => "...".to_string(),
+            Expr::StringLiteral(s) => format!("\"{}\"", s.value.to_str()),
+            Expr::NumberLiteral(n) => match &n.value {
+                Number::Int(i) => i.to_string(),
+                Number::Float(f) => f.to_string(),
+                Number::Complex { .. } => "...".to_string(),
             },
+            Expr::BooleanLiteral(b) => b.value.to_string(),
+            Expr::NoneLiteral(_) => "None".to_string(),
             _ => "...".to_string(),
         }
     }
@@ -279,8 +268,16 @@ impl WacWalker {
         match stmt {
             Stmt::Expr(StmtExpr { value, .. }) => self.expr_contains_step(value),
             Stmt::Assign(a) => self.expr_contains_step(&a.value),
-            Stmt::If(s) => self.body_contains_step(&s.body) || self.body_contains_step(&s.orelse),
-            Stmt::For(s) => self.body_contains_step(&s.body) || self.body_contains_step(&s.orelse),
+            Stmt::If(s) => {
+                self.body_contains_step(&s.body)
+                    || s.elif_else_clauses
+                        .iter()
+                        .any(|clause| self.body_contains_step(&clause.body))
+            }
+            // `async for` is not modelled: its body is skipped like any unsupported statement
+            Stmt::For(s) if !s.is_async => {
+                self.body_contains_step(&s.body) || self.body_contains_step(&s.orelse)
+            }
             Stmt::While(s) => {
                 self.body_contains_step(&s.body) || self.body_contains_step(&s.orelse)
             }
@@ -289,19 +286,7 @@ impl WacWalker {
                     || self.body_contains_step(&s.orelse)
                     || self.body_contains_step(&s.finalbody)
                     || s.handlers.iter().any(|h| match h {
-                        rustpython_parser::ast::ExceptHandler::ExceptHandler(eh) => {
-                            self.body_contains_step(&eh.body)
-                        }
-                    })
-            }
-            Stmt::TryStar(s) => {
-                self.body_contains_step(&s.body)
-                    || self.body_contains_step(&s.orelse)
-                    || self.body_contains_step(&s.finalbody)
-                    || s.handlers.iter().any(|h| match h {
-                        rustpython_parser::ast::ExceptHandler::ExceptHandler(eh) => {
-                            self.body_contains_step(&eh.body)
-                        }
+                        ExceptHandler::ExceptHandler(eh) => self.body_contains_step(&eh.body),
                     })
             }
             Stmt::Return(_) => false,
@@ -319,11 +304,12 @@ impl WacWalker {
         match expr {
             Expr::Await(ExprAwait { value, .. }) => self.expr_contains_step(value),
             Expr::Call(call) => {
-                if self.is_task_fn_call(&Expr::Call(call.clone())) {
-                    return true;
-                }
-                if Self::is_asyncio_gather_call(&Expr::Call(call.clone())) {
-                    return call.args.iter().any(|a| self.expr_contains_step(a));
+                if Self::is_asyncio_gather_call(expr) {
+                    return call
+                        .arguments
+                        .args
+                        .iter()
+                        .any(|a| self.expr_contains_step(a));
                 }
                 false
             }
@@ -370,12 +356,11 @@ impl WacWalker {
             Stmt::Expr(StmtExpr { value, .. }) => self.walk_expr_stmt(value),
             Stmt::Assign(a) => self.walk_expr_stmt(&a.value),
             Stmt::If(if_stmt) => self.walk_if(if_stmt),
-            Stmt::For(for_stmt) => self.walk_for(for_stmt),
+            Stmt::For(for_stmt) if !for_stmt.is_async => self.walk_for(for_stmt),
             Stmt::While(while_stmt) => self.walk_while(while_stmt),
             Stmt::Try(try_stmt) => self.walk_try(try_stmt),
-            Stmt::TryStar(try_stmt) => self.walk_try_star(try_stmt),
             Stmt::Return(ret) => self.walk_return(ret),
-            Stmt::FunctionDef(_) | Stmt::AsyncFunctionDef(_) => {
+            Stmt::FunctionDef(_) => {
                 if self.stmt_contains_step(stmt) {
                     self.errors.push(validation::error_step_in_nested_function(
                         self.line_of_stmt(stmt),
@@ -392,7 +377,7 @@ impl WacWalker {
         if let Expr::Await(ExprAwait { value, .. }) = expr {
             // await task_fn(...)
             if let Expr::Call(call) = value.as_ref() {
-                if self.is_task_fn_call(&Expr::Call(call.clone())) {
+                if self.is_task_fn_call(value) {
                     return self.emit_step(call, expr);
                 }
                 // Check for SDK-level calls: step(), sleep(), wait_for_approval()
@@ -430,15 +415,12 @@ impl WacWalker {
             "step" => {
                 // step("name", fn) — extract the name from the first string argument
                 let name = call
+                    .arguments
                     .args
                     .first()
-                    .and_then(|arg| {
-                        if let Expr::Constant(c) = arg {
-                            if let rustpython_parser::ast::Constant::Str(s) = &c.value {
-                                return Some(s.to_string());
-                            }
-                        }
-                        None
+                    .and_then(|arg| match arg {
+                        Expr::StringLiteral(s) => Some(s.value.to_str().to_string()),
+                        _ => None,
                     })
                     .unwrap_or_else(|| "step".to_string());
                 let id = self.next_id();
@@ -452,6 +434,7 @@ impl WacWalker {
             }
             "sleep" => {
                 let seconds = call
+                    .arguments
                     .args
                     .first()
                     .map(|arg| Self::expr_to_source(arg))
@@ -517,10 +500,10 @@ impl WacWalker {
         });
 
         let mut step_ids = Vec::new();
-        for arg in &gather_call.args {
+        for arg in &gather_call.arguments.args {
             // Each arg should be task_fn(...)
             if let Expr::Call(call) = arg {
-                if self.is_task_fn_call(&Expr::Call(call.clone())) {
+                if self.is_task_fn_call(arg) {
                     let (name, script) = self
                         .extract_step_info_from_task_call(call)
                         .unwrap_or(("unknown".into(), "unknown".into()));
@@ -553,15 +536,33 @@ impl WacWalker {
     }
 
     fn walk_if(&mut self, if_stmt: &StmtIf) -> Option<(String, String)> {
-        let has_steps_in_body = self.body_contains_step(&if_stmt.body);
-        let has_steps_in_else = self.body_contains_step(&if_stmt.orelse);
+        self.walk_if_chain(
+            if_stmt.start(),
+            &if_stmt.test,
+            &if_stmt.body,
+            &if_stmt.elif_else_clauses,
+        )
+    }
+
+    /// An `elif` is laid out as an `if` nested alone in the `else` of the clause before it.
+    fn walk_if_chain(
+        &mut self,
+        start: TextSize,
+        test: &Expr,
+        body: &[Stmt],
+        clauses: &[ElifElseClause],
+    ) -> Option<(String, String)> {
+        let has_steps_in_body = self.body_contains_step(body);
+        let has_steps_in_else = clauses
+            .iter()
+            .any(|clause| self.body_contains_step(&clause.body));
 
         if !has_steps_in_body && !has_steps_in_else {
             return None;
         }
 
-        let line = self.line_index.line_of(if_stmt.range.start().to_usize());
-        let condition_source = Self::expr_to_source(&if_stmt.test);
+        let line = self.line_index.line_of(start.to_usize());
+        let condition_source = Self::expr_to_source(test);
 
         let branch_id = self.next_id();
         let branch_node_id = self.add_node(DagNode {
@@ -573,15 +574,19 @@ impl WacWalker {
 
         let mut last_ids = Vec::new();
 
-        if let Some((true_first, true_last)) = self.walk_body(&if_stmt.body) {
+        if let Some((true_first, true_last)) = self.walk_body(body) {
             self.add_edge(&branch_node_id, &true_first, Some("true".to_string()));
             last_ids.push(true_last);
         } else {
             last_ids.push(branch_node_id.clone());
         }
 
-        if !if_stmt.orelse.is_empty() {
-            if let Some((else_first, else_last)) = self.walk_body(&if_stmt.orelse) {
+        if let Some((clause, clauses)) = clauses.split_first() {
+            let orelse = match &clause.test {
+                Some(test) => self.walk_if_chain(clause.start(), test, &clause.body, clauses),
+                None => self.walk_body(&clause.body),
+            };
+            if let Some((else_first, else_last)) = orelse {
                 self.add_edge(&branch_node_id, &else_first, Some("false".to_string()));
                 last_ids.push(else_last);
             } else {
@@ -611,7 +616,7 @@ impl WacWalker {
             return None;
         }
 
-        let line = self.line_index.line_of(for_stmt.range.start().to_usize());
+        let line = self.line_index.line_of(for_stmt.start().to_usize());
         let iter_source = Self::expr_to_source(&for_stmt.iter);
 
         let start_id = self.next_id();
@@ -644,7 +649,7 @@ impl WacWalker {
             return None;
         }
 
-        let line = self.line_index.line_of(while_stmt.range.start().to_usize());
+        let line = self.line_index.line_of(while_stmt.start().to_usize());
         let condition = Self::expr_to_source(&while_stmt.test);
 
         let start_id = self.next_id();
@@ -677,39 +682,14 @@ impl WacWalker {
             || self.body_contains_step(&try_stmt.orelse)
             || self.body_contains_step(&try_stmt.finalbody)
             || try_stmt.handlers.iter().any(|h| match h {
-                rustpython_parser::ast::ExceptHandler::ExceptHandler(eh) => {
-                    self.body_contains_step(&eh.body)
-                }
+                ExceptHandler::ExceptHandler(eh) => self.body_contains_step(&eh.body),
             });
 
         if !has_steps {
             return None;
         }
 
-        let line = self.line_index.line_of(try_stmt.range.start().to_usize());
-        self.emit_try_catch_branch(
-            &try_stmt.body,
-            &try_stmt.handlers,
-            &try_stmt.finalbody,
-            line,
-        )
-    }
-
-    fn walk_try_star(&mut self, try_stmt: &StmtTryStar) -> Option<(String, String)> {
-        let has_steps = self.body_contains_step(&try_stmt.body)
-            || self.body_contains_step(&try_stmt.orelse)
-            || self.body_contains_step(&try_stmt.finalbody)
-            || try_stmt.handlers.iter().any(|h| match h {
-                rustpython_parser::ast::ExceptHandler::ExceptHandler(eh) => {
-                    self.body_contains_step(&eh.body)
-                }
-            });
-
-        if !has_steps {
-            return None;
-        }
-
-        let line = self.line_index.line_of(try_stmt.range.start().to_usize());
+        let line = self.line_index.line_of(try_stmt.start().to_usize());
         self.emit_try_catch_branch(
             &try_stmt.body,
             &try_stmt.handlers,
@@ -721,7 +701,7 @@ impl WacWalker {
     fn emit_try_catch_branch(
         &mut self,
         try_body: &[Stmt],
-        handlers: &[rustpython_parser::ast::ExceptHandler],
+        handlers: &[ExceptHandler],
         finally_body: &[Stmt],
         line: usize,
     ) -> Option<(String, String)> {
@@ -746,7 +726,7 @@ impl WacWalker {
         // Except handlers
         for handler in handlers {
             match handler {
-                rustpython_parser::ast::ExceptHandler::ExceptHandler(eh) => {
+                ExceptHandler::ExceptHandler(eh) => {
                     if let Some((catch_first, catch_last)) = self.walk_body(&eh.body) {
                         self.add_edge(&branch_node_id, &catch_first, Some("except".to_string()));
                         last_ids.push(catch_last);
@@ -783,7 +763,7 @@ impl WacWalker {
     }
 
     fn walk_return(&mut self, ret: &StmtReturn) -> Option<(String, String)> {
-        let line = self.line_index.line_of(ret.range.start().to_usize());
+        let line = self.line_index.line_of(ret.start().to_usize());
         let id = self.next_id();
         let node_id = self.add_node(DagNode {
             id: id.clone(),
@@ -796,12 +776,12 @@ impl WacWalker {
 }
 
 /// Extract workflow function parameters (no longer skips ctx)
-fn extract_params(args: &rustpython_parser::ast::Arguments) -> Vec<Param> {
+fn extract_params(args: &Parameters) -> Vec<Param> {
     let mut params = Vec::new();
     for arg_with_default in args.args.iter().chain(args.posonlyargs.iter()) {
-        let name = arg_with_default.def.arg.to_string();
+        let name = arg_with_default.parameter.name.to_string();
         let typ = arg_with_default
-            .def
+            .parameter
             .annotation
             .as_ref()
             .map(|ann| WacWalker::expr_to_source(ann));
@@ -811,59 +791,34 @@ fn extract_params(args: &rustpython_parser::ast::Arguments) -> Vec<Param> {
 }
 
 pub fn parse_python_workflow(code: &str) -> Result<WorkflowDag, Vec<CompileError>> {
-    let ast = rustpython_parser::ast::Suite::parse(code, "<workflow>")
-        .map_err(|e| vec![CompileError { message: format!("Parse error: {e}"), line: 0 }])?;
+    let ast = parse_module(code)
+        .map_err(|e| vec![CompileError { message: format!("Parse error: {e}"), line: 0 }])?
+        .into_suite();
 
     // First pass: collect @task functions
     let task_functions = collect_task_functions(&ast);
 
-    // Find the @workflow async def
-    let workflow_fn = ast.iter().find_map(|stmt| {
-        if let Stmt::AsyncFunctionDef(func) = stmt {
-            let has_workflow_decorator = func.decorator_list.iter().any(|dec| {
-                if let Expr::Name(ExprName { id, .. }) = dec {
-                    id.as_str() == "workflow"
-                } else {
-                    false
-                }
-            });
-            if has_workflow_decorator {
-                return Some(func);
+    let workflow_fns = || {
+        ast.iter().filter_map(|stmt| match stmt {
+            Stmt::FunctionDef(func)
+                if func.decorator_list.iter().any(|dec| {
+                    matches!(&dec.expression, Expr::Name(ExprName { id, .. }) if id.as_str() == "workflow")
+                }) =>
+            {
+                Some(func)
             }
-        }
-        // Also check non-async for error reporting
-        if let Stmt::FunctionDef(func) = stmt {
-            let has_workflow_decorator = func.decorator_list.iter().any(|dec| {
-                if let Expr::Name(ExprName { id, .. }) = dec {
-                    id.as_str() == "workflow"
-                } else {
-                    false
-                }
-            });
-            if has_workflow_decorator {
-                return None; // Will be reported as not-async below
-            }
-        }
-        None
-    });
+            _ => None,
+        })
+    };
 
-    // Check for non-async workflow function
-    let non_async_workflow = ast.iter().find_map(|stmt| {
-        if let Stmt::FunctionDef(func) = stmt {
-            let has_workflow_decorator = func.decorator_list.iter().any(|dec| {
-                if let Expr::Name(ExprName { id, .. }) = dec {
-                    id.as_str() == "workflow"
-                } else {
-                    false
-                }
-            });
-            if has_workflow_decorator {
-                let line_index = LineIndex::new(code);
-                return Some(line_index.line_of(func.range.start().to_usize()));
-            }
-        }
-        None
-    });
+    // Find the @workflow async def
+    let workflow_fn = workflow_fns().find(|func| func.is_async);
+
+    // Check for non-async workflow function. The statement starts at its first decorator,
+    // the name sits on the `def` line the error points at.
+    let non_async_workflow = workflow_fns()
+        .find(|func| !func.is_async)
+        .map(|func| LineIndex::new(code).line_of(func.name.start().to_usize()));
 
     if let Some(line) = non_async_workflow {
         if workflow_fn.is_none() {
@@ -875,7 +830,7 @@ pub fn parse_python_workflow(code: &str) -> Result<WorkflowDag, Vec<CompileError
         vec![CompileError { message: "No @workflow async function found.".to_string(), line: 0 }]
     })?;
 
-    let params = extract_params(&workflow_fn.args);
+    let params = extract_params(&workflow_fn.parameters);
     let source_hash = compute_source_hash(code);
 
     let mut walker = WacWalker::new(code, task_functions);
@@ -894,13 +849,3 @@ fn compute_source_hash(code: &str) -> String {
     hasher.update(code.as_bytes());
     format!("{:x}", hasher.finalize())
 }
-
-trait ToUsize {
-    fn to_usize(self) -> usize;
-}
-
-impl ToUsize for rustpython_parser::text_size::TextSize {
-    fn to_usize(self) -> usize {
-        u32::from(self) as usize
-    }
-}
diff --git a/backend/parsers/windmill-parser-wac/tests/python_tests.rs b/backend/parsers/windmill-parser-wac/tests/python_tests.rs
index cf117da9e7..c0de489153 100644
--- a/backend/parsers/windmill-parser-wac/tests/python_tests.rs
+++ b/backend/parsers/windmill-parser-wac/tests/python_tests.rs
@@ -363,3 +363,77 @@ async def main(x: str):
     ));
     assert!(matches!(dag.nodes[5].node_type, DagNodeType::Return));
 }
+
+#[test]
+fn test_elif_chain_nests_branches() {
+    let code = r#"
+from wmill import workflow, task
+
+@task
+async def a(): ...
+@task
+async def b(): ...
+@task
+async def c(): ...
+
+@workflow
+async def main(x: int):
+    if x > 2:
+        await a()
+    elif x == 2:
+        await b()
+    else:
+        await c()
+"#;
+
+    let dag = parse_python_workflow(code).expect("should parse");
+    let branches: Vec<(&str, usize)> = dag
+        .nodes
+        .iter()
+        .filter_map(|n| match &n.node_type {
+            DagNodeType::Branch { condition_source } => Some((condition_source.as_str(), n.line)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(branches, vec![("x > 2", 13), ("x == 2", 15)]);
+
+    // The `elif` branch hangs off the `false` edge of the `if` before it
+    let (outer, inner) = (&dag.nodes[0].id, &dag.nodes[2].id);
+    assert!(dag
+        .edges
+        .iter()
+        .any(|e| &e.from == outer && &e.to == inner && e.label.as_deref() == Some("false")));
+    assert_eq!(
+        dag.nodes
+            .iter()
+            .filter(|n| matches!(n.node_type, DagNodeType::Merge))
+            .count(),
+        2
+    );
+}
+
+#[test]
+fn test_workflow_with_recent_syntax() {
+    let code = r#"
+from wmill import workflow, task
+lazy import polars
+
+type Rows = list[dict]
+
+@task
+async def load[T](rows: T): ...
+
+@workflow
+async def main(name: str):
+    try:
+        await load(t"hello {name}")
+    except ValueError, TypeError:
+        pass
+"#;
+
+    let dag = parse_python_workflow(code).expect("should parse");
+    assert!(dag
+        .nodes
+        .iter()
+        .any(|n| matches!(&n.node_type, DagNodeType::Step { name, .. } if name == "load")));
+}
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 62c0cc5a8d..75c10528df 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -254,6 +254,35 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "attribute-derive"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f9ef7a68684657ce9da341c934c73b63df7a3585a61e366d84c84ed5d3d167"
+dependencies = [
+ "attribute-derive-macro",
+ "manyhow",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.7",
+]
+
+[[package]]
+name = "attribute-derive-macro"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300d426e5e73549125bb8e4649bdd5508f82c94ddf898fb0517246e71dfb8e98"
+dependencies = [
+ "collection_literals",
+ "interpolator",
+ "manyhow",
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+ "quote-use",
+ "syn 3.0.7",
+]
+
 [[package]]
 name = "autocfg"
 version = "1.5.0"
@@ -428,7 +457,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "shlex",
  "syn 2.0.117",
 ]
@@ -620,6 +649,15 @@ version = "1.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2e93abca9e28e0a1b9877922aacb20576e05d4679ffa78c3d6dc22a26a216659"
 
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.56"
@@ -670,6 +708,18 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "char_str"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9cba78a5abb515610e10af297615434b019755b5d7be14e559ff5340dff50c4"
+dependencies = [
+ "castaway",
+ "get-size2",
+ "itoa",
+ "ryu",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -779,6 +829,12 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
+[[package]]
+name = "collection_literals"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2550f75b8cfac212855f6b1885455df8eaee8fe8e246b647d69146142e016084"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.4"
@@ -795,6 +851,19 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79fcda08c33bb58b97008b2cdada6622500e949e060f5913361763121abd2416"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "static_assertions",
+ "zmij",
+]
+
 [[package]]
 name = "compression-codecs"
 version = "0.4.37"
@@ -1019,12 +1088,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -1093,27 +1156,6 @@ dependencies = [
  "powerfmt",
 ]
 
-[[package]]
-name = "derive_more"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
-dependencies = [
- "derive_more-impl",
-]
-
-[[package]]
-name = "derive_more-impl"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "unicode-xid",
-]
-
 [[package]]
 name = "des"
 version = "0.7.0"
@@ -1196,6 +1238,12 @@ version = "0.15.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
 
+[[package]]
+name = "drop_bomb"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bda8e21c04aca2ae33ffc2fd8c23134f3cac46db123ba97bd9d3f3b8a4a85e1"
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -1502,6 +1550,31 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "get-size-derive2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28f0daa179069133df60523e0f59d0a6bd2d3db9ccae01b630896d269c4a802e"
+dependencies = [
+ "attribute-derive",
+ "quote",
+ "syn 3.0.7",
+]
+
+[[package]]
+name = "get-size2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "050a5d07359ebfac7f0b74916d94cfa30575e45fdc7e9bfbb0f76d5d4203325a"
+dependencies = [
+ "compact_str",
+ "get-size-derive2",
+ "hashbrown 0.17.1",
+ "ordermap",
+ "smallvec",
+ "thin-vec",
+]
+
 [[package]]
 name = "gethostname"
 version = "0.4.3"
@@ -1686,6 +1759,12 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
 [[package]]
 name = "hashlink"
 version = "0.10.0"
@@ -1758,7 +1837,7 @@ dependencies = [
  "hashbrown 0.14.5",
  "new_debug_unreachable",
  "once_cell",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "triomphe",
 ]
 
@@ -1870,7 +1949,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -2012,16 +2091,22 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
 
+[[package]]
+name = "interpolator"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71dd52191aae121e8611f1e8dc3e324dd0dd1dee1e6dd91d10ee07a3cfb4d9d8"
+
 [[package]]
 name = "inventory"
 version = "0.3.22"
@@ -2082,15 +2167,6 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
-[[package]]
-name = "itertools"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -2109,6 +2185,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.17"
@@ -2212,12 +2297,6 @@ version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
 
-[[package]]
-name = "lalrpop-util"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "507460a910eb7b32ee961886ff48539633b788a36b65692b95f225b844c82553"
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -2388,61 +2467,26 @@ dependencies = [
 ]
 
 [[package]]
-name = "malachite"
-version = "0.4.22"
+name = "manyhow"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fbdf9cb251732db30a7200ebb6ae5d22fe8e11397364416617d2c2cf0c51cb5"
+checksum = "8c69ea6e469ca785c846b25dd69eac9e9c916b51d8ada1f212866787ee1da12d"
 dependencies = [
- "malachite-base",
- "malachite-nz",
- "malachite-q",
+ "manyhow-macros",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.7",
 ]
 
 [[package]]
-name = "malachite-base"
-version = "0.4.22"
+name = "manyhow-macros"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ea0ed76adf7defc1a92240b5c36d5368cfe9251640dcce5bd2d0b7c1fd87aeb"
+checksum = "22fc5c1b2c4000056dae3619fea36e79ce79dabfee4907d2dcad6612b189e370"
 dependencies = [
- "hashbrown 0.14.5",
- "itertools 0.11.0",
- "libm",
- "ryu",
-]
-
-[[package]]
-name = "malachite-bigint"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d149aaa2965d70381709d9df4c7ee1fc0de1c614a4efc2ee356f5e43d68749f8"
-dependencies = [
- "derive_more",
- "malachite",
- "num-integer",
- "num-traits",
- "paste",
-]
-
-[[package]]
-name = "malachite-nz"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34a79feebb2bc9aa7762047c8e5495269a367da6b5a90a99882a0aeeac1841f7"
-dependencies = [
- "itertools 0.11.0",
- "libm",
- "malachite-base",
-]
-
-[[package]]
-name = "malachite-q"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50f235d5747b1256b47620f5640c2a17a88c7569eebdf27cd9cb130e1a619191"
-dependencies = [
- "itertools 0.11.0",
- "malachite-base",
- "malachite-nz",
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
 ]
 
 [[package]]
@@ -2949,6 +2993,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
+[[package]]
+name = "ordermap"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a756ddcdeb6c0efc8927bdf0ed112885815a35ba350472a467be5104f01ca1"
+dependencies = [
+ "indexmap",
+]
+
 [[package]]
 name = "owo-colors"
 version = "4.3.0"
@@ -2984,12 +3037,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "paste"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-
 [[package]]
 name = "pem"
 version = "3.0.6"
@@ -3286,6 +3333,17 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "proc-macro-utils"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeaf08a13de400bc215877b5bdc088f241b12eb42f0a548d3390dc1c56bb7071"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "smallvec",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -3401,9 +3459,9 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "rustls",
- "socket2 0.6.3",
+ "socket2",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -3422,7 +3480,7 @@ dependencies = [
  "lru-slab",
  "rand 0.9.5",
  "ring",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
@@ -3441,7 +3499,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -3455,6 +3513,28 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "quote-use"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48356e493823dc3c1d7e9fc7b3ff204ecec48afbdd718fc4134091b88eb63f3d"
+dependencies = [
+ "quote",
+ "quote-use-macros",
+]
+
+[[package]]
+name = "quote-use-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf1c5de6a7cc231c71e03c77aa4c7019097859ea7029156b54d2894a8430704"
+dependencies = [
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.7",
+]
+
 [[package]]
 name = "r-efi"
 version = "5.3.0"
@@ -3835,6 +3915,106 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "ruff_python_ast"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15434b06df7d930fad2818639a4e0fec4af9c770121c45a96b72da7feaae9ead"
+dependencies = [
+ "aho-corasick",
+ "arrayvec",
+ "bitflags",
+ "char_str",
+ "compact_str",
+ "get-size2",
+ "is-macro",
+ "memchr",
+ "ruff_python_trivia",
+ "ruff_source_file",
+ "ruff_text_size",
+ "rustc-hash",
+ "thin-vec",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "ruff_python_parser"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37a22811d752aa9e255d7dd72524d14352cf9bc654ef79b399bf1eeeb6640fbb"
+dependencies = [
+ "bitflags",
+ "bstr",
+ "drop_bomb",
+ "get-size2",
+ "hashbrown 0.17.1",
+ "memchr",
+ "ruff_python_ast",
+ "ruff_python_trivia",
+ "ruff_text_size",
+ "ruff_unicode_names2",
+ "rustc-hash",
+ "stacker",
+ "static_assertions",
+ "thin-vec",
+ "unicode-ident",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "ruff_python_trivia"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0322a5059fe0feb2e010ca6f31c24ac289f6b7e9e38359539491b10c57f1c5bc"
+dependencies = [
+ "itertools 0.15.0",
+ "memchr",
+ "ruff_source_file",
+ "ruff_text_size",
+ "rustc-hash",
+ "unicode-ident",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "ruff_source_file"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6ae809a289b5c791f82aa45df33f2a92323e7a1c1d265c10e9ac884027a2e43"
+dependencies = [
+ "memchr",
+ "ruff_text_size",
+]
+
+[[package]]
+name = "ruff_text_size"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf6344d6915ced9316312c1ee3f24c4300c54295bc4c3b8f4e95b633ae5443b"
+dependencies = [
+ "get-size2",
+]
+
+[[package]]
+name = "ruff_unicode_names2"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13418b8fd029d597e35dedc36e91f47122d26075e4c86557574d9441753fb375"
+dependencies = [
+ "phf 0.11.3",
+ "ruff_unicode_names2_generator",
+]
+
+[[package]]
+name = "ruff_unicode_names2_generator"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37fd82af49d5685d9054e68185987acaaf62542f671b6df8935155664876bc39"
+dependencies = [
+ "phf_codegen",
+ "rand 0.8.6",
+]
+
 [[package]]
 name = "rust_decimal"
 version = "1.40.0"
@@ -3857,12 +4037,6 @@ version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
@@ -3971,63 +4145,6 @@ dependencies = [
  "untrusted 0.9.0",
 ]
 
-[[package]]
-name = "rustpython-ast"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cdaf8ee5c1473b993b398c174641d3aa9da847af36e8d5eb8291930b72f31a5"
-dependencies = [
- "is-macro",
- "malachite-bigint",
- "rustpython-parser-core",
- "static_assertions",
-]
-
-[[package]]
-name = "rustpython-parser"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "868f724daac0caf9bd36d38caf45819905193a901e8f1c983345a68e18fb2abb"
-dependencies = [
- "anyhow",
- "is-macro",
- "itertools 0.11.0",
- "lalrpop-util",
- "log",
- "malachite-bigint",
- "num-traits",
- "phf 0.11.3",
- "phf_codegen",
- "rustc-hash 1.1.0",
- "rustpython-ast",
- "rustpython-parser-core",
- "tiny-keccak",
- "unic-emoji-char",
- "unic-ucd-ident",
- "unicode_names2",
-]
-
-[[package]]
-name = "rustpython-parser-core"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4b6c12fa273825edc7bccd9a734f0ad5ba4b8a2f4da5ff7efe946f066d0f4ad"
-dependencies = [
- "is-macro",
- "memchr",
- "rustpython-parser-vendored",
-]
-
-[[package]]
-name = "rustpython-parser-vendored"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04fcea49a4630a3a5d940f4d514dc4f575ed63c14c3e3ed07146634aed7f67a6"
-dependencies = [
- "memchr",
- "once_cell",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -4040,6 +4157,12 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "ryu-js"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04d056b875a9d2e6cb9a61d127afee9ac5999b9f87bcb32079d1318e505be714"
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -4409,16 +4532,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -4680,15 +4793,15 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stacker"
-version = "0.1.23"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d74a23609d509411d10e2176dc2a4346e3b4aea2e7b1869f19fdedbc71c013"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
 dependencies = [
  "cc",
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4830,7 +4943,7 @@ dependencies = [
  "new_debug_unreachable",
  "num-bigint",
  "once_cell",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "serde",
  "siphasher 0.3.11",
  "swc_atoms",
@@ -4852,7 +4965,7 @@ dependencies = [
  "num-bigint",
  "once_cell",
  "phf 0.11.3",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "string_enum",
  "swc_atoms",
  "swc_common",
@@ -4871,7 +4984,7 @@ dependencies = [
  "either",
  "num-bigint",
  "phf 0.11.3",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "seq-macro",
  "serde",
  "smallvec",
@@ -4974,6 +5087,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d62a2e0561533f2ca2561d0cf27fd9fedb640a1bf2616ff5d5c80d99017faadc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -5102,6 +5226,12 @@ dependencies = [
  "unicode-width 0.2.2",
 ]
 
+[[package]]
+name = "thin-vec"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6a4b9ba8738cb4a4f399d37e266becfd475e75eb73425b87a05a2f2039ba63e"
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -5193,15 +5323,6 @@ dependencies = [
  "time-core",
 ]
 
-[[package]]
-name = "tiny-keccak"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
-dependencies = [
- "crunchy",
-]
-
 [[package]]
 name = "tinystr"
 version = "0.8.2"
@@ -5229,9 +5350,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.46.1"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
  "backtrace",
  "bytes",
@@ -5242,10 +5363,10 @@ dependencies = [
  "pin-project-lite",
  "signal-hook-registry",
  "slab",
- "socket2 0.5.10",
+ "socket2",
  "tokio-macros",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5289,7 +5410,7 @@ dependencies = [
  "postgres-protocol",
  "postgres-types",
  "rand 0.10.1",
- "socket2 0.6.3",
+ "socket2",
  "tokio",
  "tokio-util",
  "whoami 2.1.0",
@@ -5325,6 +5446,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
+ "futures-util",
  "pin-project-lite",
  "tokio",
 ]
@@ -5663,17 +5785,6 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
 
-[[package]]
-name = "unic-emoji-char"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b07221e68897210270a38bde4babb655869637af0f69407f96053a34f76494d"
-dependencies = [
- "unic-char-property",
- "unic-char-range",
- "unic-ucd-version",
-]
-
 [[package]]
 name = "unic-ucd-category"
 version = "0.9.0"
@@ -5686,17 +5797,6 @@ dependencies = [
  "unic-ucd-version",
 ]
 
-[[package]]
-name = "unic-ucd-ident"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987"
-dependencies = [
- "unic-char-property",
- "unic-char-range",
- "unic-ucd-version",
-]
-
 [[package]]
 name = "unic-ucd-version"
 version = "0.9.0"
@@ -5775,28 +5875,6 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
-[[package]]
-name = "unicode_names2"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1673eca9782c84de5f81b82e4109dcfb3611c8ba0d52930ec4a9478f547b2dd"
-dependencies = [
- "phf 0.11.3",
- "unicode_names2_generator",
-]
-
-[[package]]
-name = "unicode_names2_generator"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91e5b84611016120197efd7dc93ef76774f4e084cd73c9fb3ea4a86c570c56e"
-dependencies = [
- "getopts",
- "log",
- "phf_codegen",
- "rand 0.8.6",
-]
-
 [[package]]
 name = "unscanny"
 version = "0.1.0"
@@ -6216,7 +6294,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6260,12 +6338,14 @@ dependencies = [
  "pin-project-lite",
  "pkcs1",
  "postgres-native-tls",
+ "postgres-protocol",
  "quick_cache",
  "rand 0.9.5",
  "regex",
  "reqwest",
  "reqwest-middleware",
  "reqwest-retry",
+ "ryu-js",
  "semver",
  "serde",
  "serde_json",
@@ -6302,7 +6382,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6314,7 +6394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6323,7 +6403,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6335,7 +6415,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6347,7 +6427,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6359,7 +6439,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6371,7 +6451,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6383,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6394,7 +6474,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6405,30 +6485,30 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
- "rustpython-ast",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
  "serde_json",
  "windmill-parser",
 ]
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "rustpython-ast",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
  "windmill-parser",
  "windmill-parser-sql-asset",
 ]
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6438,7 +6518,8 @@ dependencies = [
  "phf 0.11.3",
  "regex",
  "regex-lite",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
  "serde",
  "serde_json",
  "sqlx",
@@ -6450,7 +6531,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6462,7 +6543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6557,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6493,7 +6574,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6587,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6518,7 +6599,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6536,7 +6617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6552,11 +6633,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
- "rustpython-ast",
- "rustpython-parser",
+ "ruff_python_ast",
+ "ruff_python_parser",
+ "ruff_text_size",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -6568,7 +6650,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6600,7 +6682,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6614,7 +6696,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.821.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 387a98aa1f..8aebf20597 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.821.0"
+version = "1.830.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 23978d7e62..fd953213a4 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -44,32 +44,33 @@ use windmill_common::{
         CRITICAL_ALERTS_ON_TOKEN_EXPIRY_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING,
         CRITICAL_ALERT_MUTE_ZOMBIE_JOB_RESTART_SETTING, CRITICAL_ERROR_CHANNELS_SETTING,
         CUSTOM_TAGS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        DISABLE_PASSWORD_LOGIN_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
-        EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
-        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING,
+        DEPENDENCY_JOB_TAG_SETTING, DISABLE_PASSWORD_LOGIN_SETTING, EMAIL_DOMAIN_SETTING,
+        ENV_SETTINGS, EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING,
+        EXTRA_PIP_INDEX_URL_SETTING, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING,
         HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING, HTTP_ROUTE_WORKSPACED_ROUTE_SETTING,
         HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INDEXER_SETTING,
         INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
         JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
         KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
         MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING,
-        NO_DEFAULT_MAVEN_SETTING,
-        NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
-        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
-        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
-        POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
-        REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RESTART_COORDINATION_SETTING,
-        RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RETENTION_PERIOD_SECS_SETTING, RUBY_REPOS_SETTING,
-        SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
-        SANDBOX_IMAGE_DEFAULT_REGISTRY_SETTING, SANDBOX_IMAGE_MAX_SIZE_MB_SETTING,
-        SANDBOX_IMAGE_PULL_POLICY_SETTING, SANDBOX_REGISTRY_AUTH_SETTING, SCIM_TOKEN_SETTING,
-        SERVICE_LOG_RETENTION_SECS_SETTING, SMTP_SETTING, STORE_AUDIT_LOGS_S3_SETTING,
+        NO_DEFAULT_MAVEN_SETTING, NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING,
+        NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING,
+        OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING,
+        POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING,
+        REQUEST_SIZE_LIMIT_SETTING, REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING,
+        RESTART_COORDINATION_SETTING, RETENTION_PERIOD_SECS_OVERRIDES_SETTING,
+        RETENTION_PERIOD_SECS_SETTING, RUBY_REPOS_SETTING, SAML_METADATA_SETTING,
+        SANDBOX_IMAGE_CACHE_MAX_MB_SETTING, SANDBOX_IMAGE_DEFAULT_REGISTRY_SETTING,
+        SANDBOX_IMAGE_MAX_SIZE_MB_SETTING, SANDBOX_IMAGE_PULL_POLICY_SETTING,
+        SANDBOX_REGISTRY_AUTH_SETTING, SCIM_TOKEN_SETTING, SERVICE_LOG_RETENTION_SECS_SETTING,
+        SMTP_SETTING, STORE_AUDIT_LOGS_S3_SETTING, SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING,
         TEAMS_SETTING, TIMEOUT_WAIT_RESULT_SETTING, UV_EXCLUDE_NEWER_SETTING,
         UV_INDEX_STRATEGY_SETTING, UV_PYTHON_INSTALL_MIRROR_SETTING,
         WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
         WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
         WORKSPACE_MAX_QUEUED_JOBS_SETTING, WORKSPACE_REGISTRIES_SETTING,
     },
+    hub_resource_types,
     scripts::ScriptLang,
     stats_oss::schedule_stats,
     triggers::TriggerKind,
@@ -122,28 +123,28 @@ use windmill_worker::{
     BUN_BUNDLE_CACHE_DIR, BUN_CACHE_DIR, CSHARP_CACHE_DIR, DENO_CACHE_DIR, DENO_CACHE_DIR_DEPS,
     DENO_CACHE_DIR_NPM, GO_BIN_CACHE_DIR, GO_CACHE_DIR, JAVA_CACHE_DIR, NU_CACHE_DIR,
     POWERSHELL_CACHE_DIR, PY310_CACHE_DIR, PY311_CACHE_DIR, PY312_CACHE_DIR, PY313_CACHE_DIR,
-    RUBY_CACHE_DIR, RUST_CACHE_DIR, R_CACHE_DIR, TAR_JAVA_CACHE_DIR, UV_CACHE_DIR,
+    PY314_CACHE_DIR, PY315_CACHE_DIR, RUBY_CACHE_DIR, RUST_CACHE_DIR, R_CACHE_DIR,
+    TAR_JAVA_CACHE_DIR, UV_CACHE_DIR,
 };
 
 use crate::monitor::{
-    initial_load, load_concurrency_key_max_queued, load_disable_password_login,
-    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
-    load_mcp_disable_token_query_param, load_metrics_debug_enabled,
-    load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
-    load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
-    load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
-    load_workspace_fairness_max_percent, load_workspace_fairness_min_total,
-    load_workspace_max_queued_jobs, monitor_db, reload_app_workspaced_route_setting,
-    reload_audit_log_retention_days_setting, reload_base_url_setting,
-    reload_bun_install_min_release_age_setting, reload_bunfig_install_scopes_setting,
-    reload_critical_alert_mute_ui_setting, reload_critical_alert_mute_zombie_job_restart_setting,
+    initial_load, load_concurrency_key_max_queued, load_dependency_job_tag,
+    load_disable_password_login, load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
+    load_mcp_disable_token_query_param, load_metrics_debug_enabled, load_preview_tags_override,
+    load_require_preexisting_user, load_retention_period_overrides, load_tag_per_workspace_enabled,
+    load_tag_per_workspace_workspaces, load_workspace_fairness_duration_secs,
+    load_workspace_fairness_enabled, load_workspace_fairness_max_percent,
+    load_workspace_fairness_min_total, load_workspace_max_queued_jobs, monitor_db,
+    reload_app_workspaced_route_setting, reload_audit_log_retention_days_setting,
+    reload_base_url_setting, reload_bun_install_min_release_age_setting,
+    reload_bunfig_install_scopes_setting, reload_critical_alert_mute_ui_setting,
+    reload_critical_alert_mute_zombie_job_restart_setting,
     reload_critical_alerts_on_token_expiry_setting, reload_critical_error_channels_setting,
     reload_extra_pip_index_url_setting, reload_http_route_default_allowed_origins_setting,
-    reload_http_route_workspaced_route_setting,
-    reload_hub_api_secret_setting, reload_hub_base_url_setting,
-    reload_instance_events_webhook_setting, reload_job_default_timeout_setting,
-    reload_job_isolation_setting, reload_jwt_secret_setting, reload_license_key,
-    reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
+    reload_http_route_workspaced_route_setting, reload_hub_api_secret_setting,
+    reload_hub_base_url_setting, reload_instance_events_webhook_setting,
+    reload_job_default_timeout_setting, reload_job_isolation_setting, reload_jwt_secret_setting,
+    reload_license_key, reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
     reload_nsjail_tmpfs_size_setting, reload_otel_traces_retention_secs_setting,
     reload_otel_tracing_proxy_setting, reload_pip_index_url_setting,
     reload_retention_period_setting, reload_sandbox_image_cache_max_setting,
@@ -403,112 +404,16 @@ async fn cache_hub_scripts(file_path: Option<String>) -> anyhow::Result<()> {
     Ok(())
 }
 
-/// Raw resource type from hub API (schema is a JSON string)
-#[derive(serde::Deserialize)]
-struct HubResourceTypeRaw {
-    pub id: i64,
-    pub name: String,
-    pub schema: Option<String>,
-    pub app: String,
-    pub description: Option<String>,
-    /// Absent from hubs predating the column, and from caches written before it.
-    #[serde(default)]
-    pub format_extension: Option<String>,
-    /// Doubly optional, so a hub predating the field (no key) is told apart from a type the
-    /// hub leaves unnamed (null).
-    #[serde(
-        default,
-        deserialize_with = "windmill_common::more_serde::double_option"
-    )]
-    pub display_name: Option<Option<String>>,
-}
-
-
-/// Processed resource type with parsed schema
-#[derive(serde::Deserialize, serde::Serialize, Clone)]
-pub struct HubResourceType {
-    pub id: i64,
-    pub name: String,
-    pub schema: Option<serde_json::Value>,
-    pub app: String,
-    pub description: Option<String>,
-    /// Doubly optional on purpose. A cache written before this column has no key at
-    /// all (`None`) and must leave the stored extension alone; one written since
-    /// always writes the key, so an explicit null (`Some(None)`) is the hub genuinely
-    /// dropping it and must clear. A single `Option` conflates the two, and picking
-    /// either meaning breaks the other — as does plain serde, which folds `null`
-    /// into the outer `None`, hence the wrapping deserializer.
-    #[serde(
-        default,
-        deserialize_with = "windmill_common::more_serde::double_option",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub format_extension: Option<Option<String>>,
-    /// Doubly optional like `format_extension`: a cache written before the field leaves the
-    /// stored name alone, while a null from the hub clears it.
-    #[serde(
-        default,
-        deserialize_with = "windmill_common::more_serde::double_option",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub display_name: Option<Option<String>>,
-}
-
-const HUB_RT_CACHE_FILE: &str = "resource_types.json";
-
 async fn cache_hub_resource_types() -> anyhow::Result<()> {
     println!("Caching resource types from hub...");
 
-    let response = HTTP_CLIENT
-        .get(format!("{}/resource_types/list", DEFAULT_HUB_BASE_URL))
-        .header("Accept", "application/json")
-        .send()
-        .await
-        .with_context(|| "Failed to fetch resource types from hub")?;
-
-    if !response.status().is_success() {
-        anyhow::bail!(
-            "Failed to fetch resource types from hub: {}",
-            response.status()
-        );
-    }
-
-    let raw_types: Vec<HubResourceTypeRaw> = response
-        .json::<Vec<HubResourceTypeRaw>>()
-        .await
-        .with_context(|| "Failed to parse resource types from hub")?;
-
-    // Parse schema strings into JSON values
-    let resource_types: Vec<HubResourceType> = raw_types
-        .into_iter()
-        .filter_map(|rt| {
-            let schema = match rt.schema {
-                Some(s) => match serde_json::from_str(&s) {
-                    Ok(v) => Some(v),
-                    Err(e) => {
-                        println!("Warning: failed to parse schema for {}: {}", rt.name, e);
-                        return None;
-                    }
-                },
-                None => None,
-            };
-            Some(HubResourceType {
-                id: rt.id,
-                name: rt.name,
-                schema,
-                app: rt.app,
-                description: rt.description,
-                format_extension: Some(rt.format_extension),
-                display_name: rt.display_name,
-            })
-        })
-        .collect();
+    let resource_types = hub_resource_types::fetch(DEFAULT_HUB_BASE_URL, None, None).await?;
 
     println!("Fetched {} resource types from hub", resource_types.len());
 
     create_dir_all(&*HUB_RT_CACHE_DIR)?;
 
-    let cache_path = format!("{}/{}", *HUB_RT_CACHE_DIR, HUB_RT_CACHE_FILE);
+    let cache_path = hub_resource_types::cache_path();
     let content = serde_json::to_string_pretty(&resource_types)
         .with_context(|| "Failed to serialize resource types")?;
 
@@ -519,147 +424,6 @@ async fn cache_hub_resource_types() -> anyhow::Result<()> {
     Ok(())
 }
 
-pub async fn sync_cached_resource_types(db: &sqlx::Pool<sqlx::Postgres>) -> anyhow::Result<()> {
-    let cache_path = format!("{}/{}", *HUB_RT_CACHE_DIR, HUB_RT_CACHE_FILE);
-
-    if tokio::fs::metadata(&cache_path).await.is_err() {
-        tracing::info!(
-            "No cached resource types found at {}, skipping sync",
-            cache_path
-        );
-        return Ok(());
-    }
-
-    tracing::info!("Syncing cached resource types to admins workspace...");
-
-    let content = tokio::fs::read_to_string(&cache_path)
-        .await
-        .with_context(|| format!("Failed to read cache file from {}", cache_path))?;
-
-    let cached_types: Vec<HubResourceType> =
-        serde_json::from_str(&content).with_context(|| "Failed to parse cached resource types")?;
-
-    tracing::info!("Found {} cached resource types", cached_types.len());
-
-    // Get existing resource types in admins workspace. `format_extension` is part of
-    // the comparison below, so a type whose only change is gaining or losing it is
-    // not mistaken for unchanged; `is_fileset` decides whether it may take one.
-    let existing_types: Vec<(
-        String,
-        Option<serde_json::Value>,
-        Option<String>,
-        Option<String>,
-        bool,
-        Option<String>,
-    )> = sqlx::query_as(
-        "SELECT name, schema, description, format_extension, is_fileset, display_name FROM resource_type WHERE workspace_id = 'admins'",
-    )
-    .fetch_all(db)
-    .await
-    .with_context(|| "Failed to fetch existing resource types")?;
-
-    let existing_map: std::collections::HashMap<
-        String,
-        (
-            Option<serde_json::Value>,
-            Option<String>,
-            Option<String>,
-            bool,
-            Option<String>,
-        ),
-    > = existing_types
-        .into_iter()
-        .map(
-            |(name, schema, desc, format_extension, is_fileset, display_name)| {
-                (
-                    name,
-                    (schema, desc, format_extension, is_fileset, display_name),
-                )
-            },
-        )
-        .collect();
-
-    let mut synced_count = 0;
-    let mut skipped_count = 0;
-
-    for rt in cached_types {
-        let existing = existing_map.get(&rt.name);
-        let is_fileset = existing.map(|(_, _, _, f, _)| *f).unwrap_or(false);
-        let stored_extension = existing.and_then(|(_, _, e, _, _)| e.clone());
-        let stored_display_name = existing.and_then(|(_, _, _, _, n)| n.clone());
-        // A fileset is a set of files, so it cannot also be one file. Create, update
-        // and the manual sync all reject the pair; this writer would otherwise
-        // persist it onto a same-named local fileset.
-        //
-        // A cache with no key at all leaves the stored value alone, so the target is
-        // what is already there — which is also what makes the comparison below
-        // agree with the write instead of re-upserting the row on every boot.
-        let format_extension = if is_fileset {
-            None
-        } else {
-            match &rt.format_extension {
-                Some(from_cache) => from_cache.clone(),
-                None => stored_extension.clone(),
-            }
-        };
-        // No key in the cache leaves the stored name alone, as for the extension. So does a name
-        // too long for the column: one bad entry must not fail the upsert and end the sync.
-        let display_name = match &rt.display_name {
-            Some(Some(name)) if name.chars().count() > 100 => {
-                tracing::warn!(
-                    "Ignoring the display_name of resource type {}: longer than 100 characters",
-                    rt.name
-                );
-                stored_display_name.clone()
-            }
-            Some(from_cache) => from_cache.clone(),
-            None => stored_display_name.clone(),
-        };
-
-        if let Some((existing_schema, existing_desc, _, _, _)) = existing {
-            if existing_schema == &rt.schema
-                && existing_desc == &rt.description
-                && stored_extension == format_extension
-                && stored_display_name == display_name
-            {
-                skipped_count += 1;
-                continue;
-            }
-        }
-
-        // Insert or update resource type
-        sqlx::query(
-            // `format_extension` is resolved above rather than coalesced here: a
-            // COALESCE could never clear one, so a hub that dropped an extension
-            // would leave the stale value behind forever.
-            "INSERT INTO resource_type (workspace_id, name, schema, description, format_extension, display_name, edited_at)
-             VALUES ('admins', $1, $2, $3, $4, $5, now())
-             ON CONFLICT (workspace_id, name) DO UPDATE
-             SET schema = EXCLUDED.schema, description = EXCLUDED.description,
-                 format_extension = EXCLUDED.format_extension,
-                 display_name = EXCLUDED.display_name, edited_at = now()",
-        )
-        .bind(&rt.name)
-        .bind(&rt.schema)
-        .bind(&rt.description)
-        .bind(&format_extension)
-        .bind(&display_name)
-        .execute(db)
-        .await
-        .with_context(|| format!("Failed to upsert resource type {}", rt.name))?;
-
-        synced_count += 1;
-    }
-
-    tracing::info!(
-        "Synced {} resource types to admins workspace ({} skipped as unchanged)",
-        synced_count,
-        skipped_count
-    );
-
-    Ok(())
-}
-
 fn print_help() {
     println!("Windmill - a fast, open-source workflow engine and job runner.");
     println!();
@@ -673,6 +437,8 @@ fn print_help() {
     println!("  cache-rt             Pre-cache hub resource types");
     println!("  sync-config <file>   Sync instance config from a YAML file to the database");
     println!("  operator             Run the Kubernetes operator (watches a ConfigMap)");
+    #[cfg(all(feature = "enterprise", feature = "openidconnect", feature = "private"))]
+    println!("  oidc-signer <conformance|test-signer>  (ee) Check an external OIDC signer, or run a file-backed one for tests");
     println!();
     println!("Environment variables (name = default):");
     println!("  DATABASE_URL = <required>              The Postgres database url.");
@@ -699,7 +465,7 @@ fn print_help() {
     println!("  LICENSE_KEY = None                     (EE only) Enterprise license key (workers require valid key)");
     println!("  RUN_UPDATE_CA_CERTIFICATE_AT_START = false  Run system CA update at startup");
     println!("  RUN_UPDATE_CA_CERTIFICATE_PATH = /usr/sbin/update-ca-certificates  Path to CA update tool");
-    println!("  SYNC_CACHED_RT = false                 Sync cached resource types to admins workspace on server start");
+    println!("  SYNC_CACHED_RT = false                 Sync the image's cached resource types to the admins workspace on server start");
     println!("  HUB_BASE_URL = https://hub.windmill.dev  Hub to fetch scripts from in `cache` mode (server/worker use the DB setting instead)");
     println!();
     println!("Notes:");
@@ -707,6 +473,38 @@ fn print_help() {
     println!("- At startup, Windmill logs currently set configuration keys for visibility.");
 }
 
+async fn otel_environment(conn: &Connection) -> String {
+    if let Ok(environment) = std::env::var("OTEL_ENVIRONMENT") {
+        environment
+    } else {
+        load_base_url(conn)
+            .await
+            .unwrap_or_else(|_| "local".to_string())
+            .trim_start_matches("https://")
+            .trim_start_matches("http://")
+            .split(".")
+            .next()
+            .unwrap_or_else(|| "local")
+            .to_string()
+    }
+}
+
+/// Tracing for a subcommand that writes instance config. It never runs the server startup
+/// that loads the OTel settings, and its audit events are exported under them.
+///
+/// The subscriber it installs depends on those settings, so `early_logs` is what prints
+/// the events of connecting and loading them; it gives way once the real one is in.
+async fn init_declarative_writer_tracing(
+    db: &windmill_common::DB,
+    service: &str,
+    early_logs: tracing::subscriber::DefaultGuard,
+) {
+    load_otel(db).await;
+    let environment = otel_environment(&Connection::Sql(db.clone())).await;
+    drop(early_logs);
+    windmill_common::tracing_init::initialize_subcommand_tracing(service, &HOSTNAME, &environment);
+}
+
 async fn windmill_main() -> anyhow::Result<()> {
     let (killpill_tx, mut killpill_rx) = KillpillSender::new(2);
     let mut monitor_killpill_rx = killpill_tx.subscribe();
@@ -810,7 +608,6 @@ async fn windmill_main() -> anyhow::Result<()> {
             return Ok(());
         }
         "sync-config" => {
-            tracing_subscriber::fmt::init();
             let path = std::env::args().nth(2).unwrap_or_else(|| {
                 eprintln!("Usage: windmill sync-config <file>");
                 std::process::exit(1);
@@ -824,15 +621,40 @@ async fn windmill_main() -> anyhow::Result<()> {
             windmill_common::instance_config::resolve_env_refs(&mut config.global_settings)
                 .map_err(|var| anyhow::anyhow!("environment variable '{var}' not found"))?;
 
+            let early_logs = tracing::subscriber::set_default(tracing_subscriber::fmt().finish());
             tracing::info!("Connecting to database...");
             let db = crate::db_connect::initial_connection().await?;
-            config.sync_to_db(&db).await?;
+            init_declarative_writer_tracing(&db, "windmill-sync-config", early_logs).await;
+
+            let author = windmill_audit::instance_config::declarative_sync_author();
+            let synced = config
+                .sync_to_db(
+                    &db,
+                    &windmill_audit::instance_config::InstanceConfigAuditor {
+                        db: &db,
+                        author: &author,
+                        source: Some(
+                            windmill_audit::instance_config::DeclarativeSource::SyncConfig,
+                        ),
+                    },
+                )
+                .await;
+            // Also on failure: the settings written before it are already audited, and the
+            // process exits before the exporter's next scheduled batch.
+            windmill_common::otel_oss::flush_otel_logs().await;
+            synced?;
             tracing::info!("Synced instance config from {path}");
             return Ok(());
         }
+        #[cfg(all(feature = "enterprise", feature = "openidconnect", feature = "private"))]
+        "oidc-signer" => {
+            tracing_subscriber::fmt::init();
+            windmill_api::oidc_signer_tools_ee::run_cli(std::env::args().skip(2).collect()).await?;
+            return Ok(());
+        }
         #[cfg(feature = "operator")]
         "operator" => {
-            tracing_subscriber::fmt::init();
+            let early_logs = tracing::subscriber::set_default(tracing_subscriber::fmt().finish());
             tracing::info!("Starting Windmill Kubernetes operator...");
             tracing::info!("Connecting to database...");
 
@@ -845,6 +667,7 @@ async fn windmill_main() -> anyhow::Result<()> {
                 operator_killpill_rx,
             )
             .await?;
+            init_declarative_writer_tracing(&db, "windmill-operator", early_logs).await;
 
             #[cfg(all(feature = "enterprise", feature = "private"))]
             tokio::spawn(async move {
@@ -971,19 +794,7 @@ async fn windmill_main() -> anyhow::Result<()> {
         (Connection::Sql(db), None, None)
     };
 
-    let environment = if let Ok(environment) = std::env::var("OTEL_ENVIRONMENT") {
-        environment
-    } else {
-        load_base_url(&conn)
-            .await
-            .unwrap_or_else(|_| "local".to_string())
-            .trim_start_matches("https://")
-            .trim_start_matches("http://")
-            .split(".")
-            .next()
-            .unwrap_or_else(|| "local")
-            .to_string()
-    };
+    let environment = otel_environment(&conn).await;
 
     let _guard = windmill_common::tracing_init::initialize_tracing(&hostname, &mode, &environment);
 
@@ -1018,8 +829,10 @@ async fn windmill_main() -> anyhow::Result<()> {
                 .map(|v| v.to_lowercase() == "true" || v == "1")
                 .unwrap_or(false)
             {
-                if let Err(e) = sync_cached_resource_types(db).await {
-                    tracing::warn!("Failed to sync cached resource types: {:#}", e);
+                match hub_resource_types::sync_from_image_cache(db).await {
+                    Ok(Some(outcome)) => tracing::info!("{}", outcome.summary()),
+                    Ok(None) => {}
+                    Err(e) => tracing::warn!("Failed to sync cached resource types: {:#}", e),
                 }
             }
         }
@@ -1237,6 +1050,15 @@ Windmill Community Edition {GIT_VERSION}
         // empty script cache, refilled from the database.
         windmill_common::cache::script::clear();
 
+        // Before the first load: it can sign a token for instance object storage.
+        #[cfg(all(feature = "enterprise", feature = "openidconnect", feature = "private"))]
+        windmill_common::oidc_ee::init_oidc_signing(
+            &conn,
+            server_mode,
+            killpill_rx.resubscribe(),
+        )
+        .await?;
+
         initial_load(
             &conn,
             killpill_tx.clone(),
@@ -1751,6 +1573,7 @@ Windmill Community Edition {GIT_VERSION}
         if server_mode {
             if let Some(db) = conn.as_sql() {
                 schedule_stats(&db, &HTTP_CLIENT).await;
+                hub_resource_types::spawn_daily_sync(db.clone(), killpill_tx.subscribe());
             }
         }
 
@@ -1889,12 +1712,10 @@ async fn process_notify_event(
             );
             windmill_common::workspaces::PUBLIC_APP_RATE_LIMIT_CACHE.remove(payload);
         }
-        windmill_common::SCRIPT_VERSION_DELETED_CHANNEL => {
-            match serde_json::from_str(payload) {
-                Ok(deleted) => windmill_api_scripts::scripts::evict_deleted_script_versions(deleted),
-                Err(e) => tracing::error!("Invalid script version deletion payload {payload}: {e}"),
-            }
-        }
+        windmill_common::SCRIPT_VERSION_DELETED_CHANNEL => match serde_json::from_str(payload) {
+            Ok(deleted) => windmill_api_scripts::scripts::evict_deleted_script_versions(deleted),
+            Err(e) => tracing::error!("Invalid script version deletion payload {payload}: {e}"),
+        },
         "notify_runnable_version_change" => {
             tracing::info!("Runnable version change detected: {}", payload);
             match payload.split(':').collect::<Vec<&str>>().as_slice() {
@@ -2055,6 +1876,11 @@ async fn process_notify_event(
                         tracing::error!("Error loading preview tags override: {e:#}");
                     }
                 }
+                DEPENDENCY_JOB_TAG_SETTING => {
+                    if let Err(e) = load_dependency_job_tag(db).await {
+                        tracing::error!("Error loading dependency job tag: {e:#}");
+                    }
+                }
                 WORKSPACE_FAIRNESS_ENABLED_SETTING => {
                     if let Err(e) = load_workspace_fairness_enabled(db).await {
                         tracing::error!("Error loading workspace fairness enabled: {e:#}");
@@ -2322,6 +2148,12 @@ async fn process_notify_event(
                 RESTART_COORDINATION_SETTING => {
                     // Internal coordination key for staggered restarts, no action needed
                 }
+                SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING => {
+                    // Read by the daily resource type sync each time it runs
+                }
+                "oidc_external_signer" => {
+                    // Written by servers that sign with an external signer, read when signing
+                }
                 "plain_emails_telemetry" => {
                     let enabled = sqlx::query_scalar!(
                         "SELECT value FROM global_settings WHERE name = 'plain_emails_telemetry'"
@@ -2407,6 +2239,8 @@ pub async fn run_workers(
         &*PY311_CACHE_DIR,
         &*PY312_CACHE_DIR,
         &*PY313_CACHE_DIR,
+        &*PY314_CACHE_DIR,
+        &*PY315_CACHE_DIR,
         &*BUN_BUNDLE_CACHE_DIR,
         &*GO_CACHE_DIR,
         &*GO_BIN_CACHE_DIR,
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 751d19fecc..23ab2eaed1 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -40,7 +40,7 @@ use windmill_common::ee_oss::{jobs_waiting_alerts, worker_groups_alerts};
 use windmill_common::global_settings::OAUTH_SETTING;
 use windmill_common::otel_oss::{
     otel_incr_zombie_delete_count, otel_incr_zombie_restart_count, otel_set_db_pool,
-    otel_set_queue_count, otel_set_queue_running_count,
+    otel_set_queue_count, otel_set_queue_delay, otel_set_queue_running_count,
 };
 use windmill_common::{
     agent_workers::DECODED_AGENT_TOKEN,
@@ -60,17 +60,17 @@ use windmill_common::{
         CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING, CRITICAL_ALERTS_ON_TOKEN_EXPIRY_SETTING,
         CRITICAL_ALERT_MUTE_UI_SETTING, CRITICAL_ALERT_MUTE_ZOMBIE_JOB_RESTART_SETTING,
         CRITICAL_ERROR_CHANNELS_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING,
-        DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_PASSWORD_LOGIN, DISABLE_PASSWORD_LOGIN_SETTING,
-        EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
-        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
-        HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
-        JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
-        MCP_DISABLE_TOKEN_QUERY_PARAM, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
-        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
-        NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
-        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
-        PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING,
-        PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        DEFAULT_TAGS_WORKSPACES_SETTING, DEPENDENCY_JOB_TAG_SETTING, DISABLE_PASSWORD_LOGIN,
+        DISABLE_PASSWORD_LOGIN_SETTING, EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING,
+        EXTRA_PIP_INDEX_URL_SETTING, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING,
+        HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
+        JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
+        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MCP_DISABLE_TOKEN_QUERY_PARAM,
+        MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING,
+        NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
+        NUGET_CONFIG_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
+        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
+        POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
         SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
         SANDBOX_IMAGE_DEFAULT_REGISTRY_SETTING, SANDBOX_IMAGE_MAX_SIZE_MB_SETTING,
@@ -93,11 +93,11 @@ use windmill_common::{
         load_periodic_bash_script_interval_from_env, load_whitelist_env_vars_from_env,
         load_worker_config, store_pull_query, store_suspended_pull_query, Connection, WorkerConfig,
         CLOUD_HOSTED, CONCURRENCY_KEY_MAX_QUEUED, CONCURRENCY_KEY_MAX_QUEUED_DEFAULT,
-        DEFAULT_TAGS_PER_WORKSPACE, DEFAULT_TAGS_WORKSPACES, FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX,
-        INDEXER_CONFIG, PREVIEW_TAGS_OVERRIDE, SMTP_CONFIG, WINDMILL_DIR, WORKER_CONFIG,
-        WORKER_GROUP, WORKSPACE_FAIRNESS_DURATION_SECS, WORKSPACE_FAIRNESS_ENABLED,
-        WORKSPACE_FAIRNESS_MAX_PERCENT, WORKSPACE_FAIRNESS_MIN_TOTAL, WORKSPACE_MAX_QUEUED_JOBS,
-        WORKSPACE_MAX_QUEUED_JOBS_DEFAULT,
+        DEFAULT_TAGS_PER_WORKSPACE, DEFAULT_TAGS_WORKSPACES, DEPENDENCY_JOB_TAG,
+        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX, INDEXER_CONFIG, PREVIEW_TAGS_OVERRIDE, SMTP_CONFIG,
+        WINDMILL_DIR, WORKER_CONFIG, WORKER_GROUP, WORKSPACE_FAIRNESS_DURATION_SECS,
+        WORKSPACE_FAIRNESS_ENABLED, WORKSPACE_FAIRNESS_MAX_PERCENT, WORKSPACE_FAIRNESS_MIN_TOTAL,
+        WORKSPACE_MAX_QUEUED_JOBS, WORKSPACE_MAX_QUEUED_JOBS_DEFAULT,
     },
     KillpillSender, AUDIT_LOG_RETENTION_DAYS, BASE_URL, CRITICAL_ALERTS_ON_DB_OVERSIZE,
     CRITICAL_ALERTS_ON_TOKEN_EXPIRY, CRITICAL_ALERT_MUTE_UI_ENABLED,
@@ -168,6 +168,12 @@ lazy_static::lazy_static! {
         &["tag"]
     ).unwrap();
 
+    static ref QUEUE_DELAY_SECONDS: prometheus::GaugeVec = prometheus::register_gauge_vec!(
+        "queue_delay_seconds",
+        "How long the next job to be picked up has been waiting, in seconds",
+        &["tag"]
+    ).unwrap();
+
     static ref QUEUE_RUNNING_COUNT: prometheus::IntGaugeVec = prometheus::register_int_gauge_vec!(
         "queue_running_count",
         "Number of running jobs in the queue",
@@ -312,6 +318,9 @@ pub async fn initial_load(
         pass.setting(PREVIEW_TAGS_OVERRIDE_SETTING, false, |v| async move {
             apply_preview_tags_override(v)
         });
+        pass.setting(DEPENDENCY_JOB_TAG_SETTING, false, |v| async move {
+            apply_dependency_job_tag(v)
+        });
 
         // Load per-workspace retention overrides before the first cleanup tick so a fresh server
         // never sweeps globally without honoring configured longer-retention workspaces.
@@ -418,6 +427,8 @@ pub async fn initial_load(
                     native_mode,
                     // an agent worker never reads its group's config, only its token
                     object_store_cache_config: None,
+                    // nor whether it is paused: the server refuses it jobs instead
+                    paused: false,
                 }));
             }
         }
@@ -876,6 +887,24 @@ pub fn apply_preview_tags_override(value: Option<serde_json::Value>) {
     }
 }
 
+pub async fn load_dependency_job_tag(db: &DB) -> error::Result<()> {
+    let v = load_value_from_global_settings(db, DEPENDENCY_JOB_TAG_SETTING).await?;
+    apply_dependency_job_tag(v);
+    Ok(())
+}
+
+pub fn apply_dependency_job_tag(value: Option<serde_json::Value>) {
+    let tag = match value {
+        Some(serde_json::Value::String(t)) if !t.trim().is_empty() => Some(t.trim().to_string()),
+        None | Some(serde_json::Value::Null) | Some(serde_json::Value::String(_)) => None,
+        Some(other) => {
+            tracing::error!("{DEPENDENCY_JOB_TAG_SETTING} is not a string: {other}, ignoring");
+            return;
+        }
+    };
+    DEPENDENCY_JOB_TAG.store(std::sync::Arc::new(tag));
+}
+
 // Upper bound on the duration window. Postgres `make_interval(secs => $1::int4)` is the consumer
 // downstream, so this stays comfortably below `i32::MAX` and the subsequent `u32 -> i32` cast in
 // `workspace_fairness::refresh_overloaded` cannot wrap into a negative interval (which would
@@ -4107,6 +4136,20 @@ pub async fn monitor_db(
                     }
                     _ => {}
                 }
+                match windmill_common::runnable_job_stats::cleanup_old_runnable_job_stats(
+                    db,
+                    windmill_common::runnable_job_stats::RETENTION_DAYS,
+                )
+                .await
+                {
+                    Ok(count) if count > 0 => {
+                        tracing::info!("Deleted {} old runnable job stats rows", count);
+                    }
+                    Err(e) => {
+                        tracing::error!("Error cleaning up runnable job stats: {:?}", e);
+                    }
+                    _ => {}
+                }
             }
         }
     };
@@ -4406,6 +4449,42 @@ pub async fn monitor_db(
         }
     };
 
+    // Drop the data table role set logins nobody has connected with for a month. Every ~40 min,
+    // spawned for the same reason as the credential maintenance above: it opens a connection per
+    // managed database for each login it drops.
+    let datatable_role_set_sweep_f = async {
+        if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(240) {
+            if let Some(db) = conn.as_sql() {
+                let db = db.clone();
+                tokio::spawn(async move {
+                    if let Err(e) =
+                        windmill_common::datatable_roles::sweep_unused_role_set_logins(&db).await
+                    {
+                        tracing::error!("Error sweeping unused data table role set logins: {e}");
+                    }
+                });
+            }
+        }
+    };
+
+    // Re-encrypt the legacy-format secret variables once new values are written in AES-256-GCM.
+    // Every ~5 min until one pass has gone through every workspace; spawned so a large instance
+    // does not hold up the join below.
+    let legacy_secret_upgrade_f = async {
+        if server_mode
+            && iteration.is_some()
+            && iteration.as_ref().unwrap().should_run(30)
+            && windmill_common::variables::legacy_secret_upgrade_pending()
+        {
+            if let Some(db) = conn.as_sql() {
+                let db = db.clone();
+                tokio::spawn(async move {
+                    windmill_common::variables::upgrade_legacy_secret_variables(&db).await
+                });
+            }
+        }
+    };
+
     // Delete the AI session backups older than their workspace's retention. Every ~40 min
     // (240 iterations at the default 10 s, the most a u8 `should_run` counts): the retention
     // counts in days. Spawned for the same reason as the credential maintenance above, a
@@ -4477,7 +4556,9 @@ pub async fn monitor_db(
         cleanup_scheduled_job_deletions_f,
         git_auto_pull_f,
         git_credential_maintenance_f,
+        datatable_role_set_sweep_f,
         ai_session_retention_f,
+        legacy_secret_upgrade_f,
         pipeline_freshness_watchdog_f,
         reconcile_unarmed_schedules_f,
         stranded_jobs_f,
@@ -5576,6 +5657,7 @@ pub async fn expose_queue_metrics(db: &Pool<Postgres>) {
         for q in QUEUE_COUNT_TAGS.read().await.iter() {
             if queue_stats.get(q).is_none() {
                 (*QUEUE_COUNT).with_label_values(&[q]).set(0);
+                (*QUEUE_DELAY_SECONDS).with_label_values(&[q]).set(0.0);
             }
         }
     }
@@ -5584,6 +5666,7 @@ pub async fn expose_queue_metrics(db: &Pool<Postgres>) {
         for q in OTEL_QUEUE_COUNT_TAGS.read().await.iter() {
             if queue_stats.get(q).is_none() {
                 otel_set_queue_count(q, 0);
+                otel_set_queue_delay(q, 0.0);
             }
         }
     }
@@ -5599,6 +5682,9 @@ pub async fn expose_queue_metrics(db: &Pool<Postgres>) {
         if metrics_enabled {
             let metric = (*QUEUE_COUNT).with_label_values(&[tag]);
             metric.set(count as i64);
+            (*QUEUE_DELAY_SECONDS)
+                .with_label_values(&[tag])
+                .set(stat.delay);
             tags_to_watch.push(tag.to_string());
         }
 
@@ -5606,6 +5692,7 @@ pub async fn expose_queue_metrics(db: &Pool<Postgres>) {
             otel_tags_to_watch.push(tag.to_string());
         }
         otel_set_queue_count(tag, count as i64);
+        otel_set_queue_delay(tag, stat.delay);
     }
 
     if save_metrics {
@@ -5656,8 +5743,13 @@ pub async fn reload_worker_config(db: &DB, tx: KillpillSender, kill_if_change: b
                 .as_ref()
                 .is_some_and(|dws| !dws.is_empty());
 
+        // Pausing or resuming must not restart the workers, dedicated ones included: a reload
+        // whose only difference is the flag skips every restart below.
+        let only_pause_changed = wc.paused != config.paused
+            && WorkerConfig { paused: wc.paused, ..config.clone() } == **wc;
+
         if **wc != config || has_dedicated {
-            if kill_if_change {
+            if kill_if_change && !only_pause_changed {
                 if has_dedicated
                     || wc.dedicated_worker != config.dedicated_worker
                     || wc.dedicated_workers != config.dedicated_workers
@@ -6146,6 +6238,21 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, node_n
             continue;
         }
         if let Some(job) = job.unwrap() {
+            // Read while the job is still queued: a re-run (perpetual, retry) takes its cap from
+            // here once the `job_perms` row is swept after completion. A failed read leaves the
+            // job for the next sweep rather than completing it with no cap.
+            let perms =
+                match windmill_common::auth::get_job_perms(db, &job.id, &job.workspace_id).await {
+                    Ok(perms) => perms,
+                    Err(e) => {
+                        tracing::error!(
+                            "Could not read the permissions of zombie job {}: {e:#}",
+                            job.id
+                        );
+                        continue;
+                    }
+                };
+            let job_token_scopes = perms.as_ref().and_then(|p| p.job_token_scopes.clone());
             let label = ephemeral_script_token_label(&job.permissioned_as, &job.created_by);
             let token = create_token_for_owner(
                 &db,
@@ -6155,7 +6262,7 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, node_n
                 job_token_expiry_secs(&db, &job.workspace_id).await,
                 &job.permissioned_as_email,
                 &job.id,
-                None,
+                perms,
                 Some(format!("handle_zombie_jobs")),
             )
             .await
@@ -6177,10 +6284,12 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, node_n
             );
             let memory_peak = job.memory_peak.unwrap_or(0);
             let (_, killpill_rx_never_used) = KillpillSender::new(1);
+            let mut completed = windmill_queue::MiniCompletedJob::from(job);
+            completed.job_token_scopes = job_token_scopes;
             let _ = handle_job_error(
                 db,
                 &client,
-                &windmill_queue::MiniCompletedJob::from(job),
+                &completed,
                 memory_peak,
                 None,
                 error::Error::ExecutionErr(error_message.clone()),
diff --git a/backend/summarized_schema.txt b/backend/summarized_schema.txt
index 169eb81681..ac07dc06d6 100644
--- a/backend/summarized_schema.txt
+++ b/backend/summarized_schema.txt
@@ -97,7 +97,7 @@ draft: workspace_id(char), path(char), typ(draft_type), value(json), created_at(
 email_to_igroup: email(char), igroup(char)
 email_trigger: path(char), local_part(char), workspaced_local_part(bool), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
 favorite: usr(char), workspace_id(char), path(char), favorite_kind(favorite_kind)
-flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of(varchar), on_behalf_of_email(text), lock_error_logs(text), labels(text[])
+flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of(varchar), on_behalf_of_email(text), lock_error_logs(text), labels(text[]), job_token_scopes(text[])
   FK: (workspace_id) -> workspace(id)
 flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char), is_test(bool)
   FK: (workspace_id) -> workspace(id)
@@ -132,7 +132,7 @@ input: id(uuid), workspace_id(char), runnable_id(char), runnable_type(runnable_t
   FK: (workspace_id) -> workspace(id)
 instance_group: name(char), summary(char), id(char), scim_display_name(char), external_id(char)
 job_logs: job_id(uuid), workspace_id(char), created_at(ts), logs(text), log_offset(int), log_file_index(text[])
-job_perms: job_id(uuid), email(char), username(char), is_admin(bool), is_operator(bool), created_at(ts), workspace_id(char), groups(text[]), folders(jsonb[]), end_user_email(char)
+job_perms: job_id(uuid), email(char), username(char), is_admin(bool), is_operator(bool), created_at(ts), workspace_id(char), groups(text[]), folders(jsonb[]), end_user_email(char), job_token_scopes(text[])
 job_resolution: job_id(uuid), workspace_id(char), resolved_at(ts), resolved_by(char), note(text), automatic(bool)
 job_result_stream: job_id(uuid), workspace_id(text), stream(text)
 job_result_stream_v2: job_id(uuid), workspace_id(text), stream(text), idx(int)
@@ -180,10 +180,11 @@ resource_type: workspace_id(char), name(char), schema(jsonb), description(text),
   FK: (workspace_id) -> workspace(id)
 resume_job: id(uuid), job(uuid), flow(uuid), created_at(ts), value(jsonb), approver(char), resume_id(int), approved(bool)
   FK: (flow) -> v2_job_queue(id)
+runnable_job_stats: hour(bigint), workspace_id(char), runnable_path(char), worker_group(text), job_count(int), total_duration_ms(bigint), max_memory_peak(int), sum_memory_peak(bigint), memory_sample_count(int), total_cpu_ms(bigint)
 runnable_settings: hash(bigint), debouncing_settings(bigint), concurrency_settings(bigint)
 schedule: workspace_id(char), path(char), edited_by(char), edited_at(ts), schedule(char), enabled(bool), script_path(char), args(jsonb), extra_perms(jsonb), is_flow(bool), email(char), error(text), timezone(char), on_failure(char), on_recovery(char), on_failure_times(int), on_failure_exact(bool), on_failure_extra_args(jsonb), on_recovery_times(int), on_recovery_extra_args(jsonb), ws_error_handler_muted(bool), retry(jsonb), summary(char), no_flow_overlap(bool), tag(char), paused_until(ts), on_success(char), on_success_extra_args(jsonb), cron_version(text), description(text), dynamic_skip(char), labels(text[])
   FK: (workspace_id) -> workspace(id)
-script: workspace_id(char), hash(bigint), path(char), parent_hashes(bigint[]), summary(text), description(text), content(text), created_by(char), created_at(ts), archived(bool), schema(json), deleted(bool), is_template(bool), extra_perms(jsonb), lock(text), lock_error_logs(text), language(script_lang), kind(script_kind), tag(char), draft_only(bool), envs(char), concurrent_limit(int), concurrency_time_window_s(int), cache_ttl(int), dedicated_worker(bool), ws_error_handler_muted(bool), priority(smallint), timeout(int), delete_after_use(bool), restart_unless_cancelled(bool), concurrency_key(char), visible_to_runner_only(bool), auto_kind(varchar), codebase(char), has_preprocessor(bool), schema_validation(bool), assets(jsonb), debounce_key(char), debounce_delay_s(int), cache_ignore_s3_path(bool), runnable_settings_handle(bigint), labels(text[]), on_behalf_of(varchar), on_behalf_of_email(text)
+script: workspace_id(char), hash(bigint), path(char), parent_hashes(bigint[]), summary(text), description(text), content(text), created_by(char), created_at(ts), archived(bool), schema(json), deleted(bool), is_template(bool), extra_perms(jsonb), lock(text), lock_error_logs(text), language(script_lang), kind(script_kind), tag(char), draft_only(bool), envs(char), concurrent_limit(int), concurrency_time_window_s(int), cache_ttl(int), dedicated_worker(bool), ws_error_handler_muted(bool), priority(smallint), timeout(int), delete_after_use(bool), restart_unless_cancelled(bool), concurrency_key(char), visible_to_runner_only(bool), auto_kind(varchar), codebase(char), has_preprocessor(bool), schema_validation(bool), assets(jsonb), debounce_key(char), debounce_delay_s(int), cache_ignore_s3_path(bool), runnable_settings_handle(bigint), labels(text[]), on_behalf_of(varchar), on_behalf_of_email(text), job_token_scopes(text[])
   FK: (workspace_id) -> workspace(id)
 skip_workspace_diff_tally: workspace_id(char), added_at(ts)
 sqs_trigger: path(char), queue_url(char), aws_resource_path(char), message_attributes(text[]), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error(text), server_id(char), last_server_ping(ts), aws_auth_resource_type(aws_auth_resource_type), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
@@ -219,7 +220,7 @@ websocket_trigger: path(char), url(char), script_path(char), is_flow(bool), work
 windmill_migrations: name(text), created_at(ts)
 worker_group_job_stats: hour(bigint), worker_group(text), script_lang(char), workspace_id(char), job_count(int), total_duration_ms(bigint)
   FK: (workspace_id) -> workspace(id)
-worker_ping: worker(char), worker_instance(char), ping_at(ts), started_at(ts), ip(char), jobs_executed(int), custom_tags(text[]), worker_group(char), dedicated_worker(char), wm_version(char), current_job_id(uuid), current_job_workspace_id(char), vcpus(bigint), memory(bigint), occupancy_rate(float), memory_usage(bigint), wm_memory_usage(bigint), occupancy_rate_15s(float), occupancy_rate_5m(float), occupancy_rate_30m(float), job_isolation(text), dedicated_workers(text[])
+worker_ping: worker(char), worker_instance(char), ping_at(ts), started_at(ts), ip(char), jobs_executed(int), custom_tags(text[]), worker_group(char), dedicated_worker(char), wm_version(char), current_job_id(uuid), current_job_workspace_id(char), vcpus(bigint), memory(bigint), occupancy_rate(float), memory_usage(bigint), wm_memory_usage(bigint), occupancy_rate_15s(float), occupancy_rate_5m(float), occupancy_rate_30m(float), job_isolation(text), dedicated_workers(text[]), draining(bool)
 workspace: id(char), name(char), owner(char), deleted(bool), premium(bool), parent_workspace_id(char), is_dev_workspace(bool)
   FK: (parent_workspace_id) -> workspace(id)
 workspace_dependencies: id(bigint), name(char), content(text), language(script_lang), description(text), archived(bool), workspace_id(char), created_at(ts)
diff --git a/backend/tests/ai_agent_nul.rs b/backend/tests/ai_agent_nul.rs
new file mode 100644
index 0000000000..1af46ecc82
--- /dev/null
+++ b/backend/tests/ai_agent_nul.rs
@@ -0,0 +1,125 @@
+use axum::{routing::post, Json, Router};
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+use std::time::Duration;
+use windmill_common::{flows::FlowValue, jobs::JobPayload};
+use windmill_test_utils::{
+    completed_job, in_test_worker, listen_for_completed_jobs, ApiServer, RunJob, StreamFind,
+};
+
+const MEMORY_ID: &str = "0199c0de-0000-7000-8000-000000000001";
+
+/// A model that puts a U+0000 in its tool call arguments, then in its answer.
+async fn model(Json(body): Json<Value>) -> ([(&'static str, &'static str); 1], String) {
+    let finished = body["messages"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .any(|m| m["role"] == "tool");
+    let delta = if finished {
+        json!({"role":"assistant", "content":"are\u{0}tired"})
+    } else {
+        json!({"role":"assistant", "tool_calls":[{
+            "index":0, "id":"call_0", "type":"function",
+            "function":{"name":"echo", "arguments":"{\"x\":\"a\\u0000b\"}"}
+        }]})
+    };
+    let event = json!({"choices":[{"index":0, "delta":delta, "finish_reason":null}]});
+    let end = json!({"choices":[{"index":0, "delta":{}, "finish_reason":if finished {"stop"} else {"tool_calls"}}]});
+    (
+        [("content-type", "text/event-stream")],
+        format!("data: {event}\n\ndata: {end}\n\ndata: [DONE]\n\n"),
+    )
+}
+
+async fn run_flow(db: &Pool<Postgres>, modules: Value) -> anyhow::Result<Value> {
+    let server = ApiServer::start(db.clone()).await?;
+    let flow: FlowValue = serde_json::from_value(json!({ "modules": modules }))?;
+    let id = RunJob::from(JobPayload::RawFlow {
+        value: flow,
+        path: Some("u/test/nul".into()),
+        restarted_from: None,
+    })
+    .push(db)
+    .await;
+    let notifications = listen_for_completed_jobs(db).await;
+    tokio::time::timeout(
+        Duration::from_secs(45),
+        in_test_worker(db, notifications.find(&id), server.addr.port()),
+    )
+    .await?;
+    let job = completed_job(id, db).await;
+    server.close().await?;
+    assert!(job.success, "{:?}", job.result);
+    Ok(job.json_result().expect("flow result"))
+}
+
+#[sqlx::test(fixtures("base"))]
+#[serial_test::serial]
+async fn agent_step_survives_nul_in_model_output(db: Pool<Postgres>) -> anyhow::Result<()> {
+    std::env::set_var("ALLOW_PRIVATE_AI_BASE_URLS", "true");
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+    let base = format!("http://{}", listener.local_addr()?);
+    let stub = tokio::spawn(async move {
+        let router = Router::new().route("/v1/chat/completions", post(model));
+        axum::serve(listener, router).await.unwrap();
+    });
+    let result = run_flow(
+        &db,
+        json!([{"id":"agent","value":{
+            "type":"aiagent",
+            "tools":[{"id":"t0","summary":"echo","value":{
+                "type":"rawscript", "language":"bun", "input_transforms":{},
+                "content":"export async function main(x: string) { return x }"
+            }}],
+            "input_transforms":{
+                "provider":{"type":"static","value":{"kind":"customai","model":"nul-test","resource":{"base_url":format!("{base}/v1")}}},
+                "user_message":{"type":"static","value":"echo"},
+                "memory":{"type":"static","value":{"kind":"auto","context_length":10,"memory_id":MEMORY_ID}}
+            }
+        }}]),
+    )
+    .await?;
+    stub.abort();
+    assert_eq!(result["output"], "aretired");
+    let tool_message = result["messages"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|m| m["role"] == "tool")
+        .expect("tool message");
+    assert_eq!(tool_message["content"], "\"ab\"");
+    // The model's own words are also written to a jsonb column the job result never passes through.
+    let memory: String = sqlx::query_scalar(
+        "SELECT messages::text FROM ai_agent_memory WHERE conversation_id = $1::uuid",
+    )
+    .bind(MEMORY_ID)
+    .fetch_one(&db)
+    .await?;
+    assert!(memory.contains("aretired"), "{memory}");
+    Ok(())
+}
+
+/// A step's args are evaluated from the previous step's result as the worker holds it, not as
+/// the completed job stored it.
+#[sqlx::test(fixtures("base"))]
+#[serial_test::serial]
+async fn flow_step_args_survive_nul_in_previous_result(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let result = run_flow(
+        &db,
+        json!([
+            {"id":"a","value":{
+                "type":"rawscript", "language":"bun", "input_transforms":{},
+                "content":"export async function main() { return 'a\\u0000b' }"
+            }},
+            {"id":"b","value":{
+                "type":"rawscript", "language":"bun",
+                "input_transforms":{"x":{"type":"javascript","expr":"results.a"}},
+                "content":"export async function main(x: string) { return x }"
+            }}
+        ]),
+    )
+    .await?;
+    assert_eq!(result, "ab");
+    Ok(())
+}
diff --git a/backend/tests/ai_decision.rs b/backend/tests/ai_decision.rs
new file mode 100644
index 0000000000..d6359c1cea
--- /dev/null
+++ b/backend/tests/ai_decision.rs
@@ -0,0 +1,148 @@
+//! AI decision steps run end to end against a stand-in for the decision endpoints: TypeSafe's
+//! System One, Cloudflare Workers AI's, which serves each model at its own URL inside an API
+//! envelope, and OpenAI's Decisions API.
+
+use axum::{routing::post, Json, Router};
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+use windmill_common::{flows::FlowValue, jobs::JobPayload};
+use windmill_test_utils::*;
+
+/// Answers every question as a choice of `refund`, the way TypeSafe shapes an answer.
+fn refund_answers(body: &Value) -> Value {
+    let answers = body["questions"]
+        .as_object()
+        .into_iter()
+        .flatten()
+        .map(|(name, _)| {
+            let answer = json!({
+                "type": "choice",
+                "choice": "refund",
+                "probabilities": {"refund": 0.9, "bug": 0.1},
+                "confidence": 0.8
+            });
+            (name.clone(), answer)
+        })
+        .collect::<serde_json::Map<_, _>>();
+    json!({"model": body["model"], "answers": answers, "usage": {"input_tokens": 10}})
+}
+
+async fn start_decision_stub() -> anyhow::Result<u16> {
+    let app = Router::new()
+        .route(
+            "/v1/systemone",
+            post(|Json(body): Json<Value>| async move { Json(refund_answers(&body)) }),
+        )
+        .route(
+            "/accounts/acc/ai/run/@cf/cloudflare/clef-flash",
+            post(|Json(body): Json<Value>| async move {
+                Json(json!({"result": refund_answers(&body), "success": true, "errors": []}))
+            }),
+        )
+        // OpenAI's Decisions API takes the questions as a list and answers with one.
+        .route(
+            "/openai/v1/decisions",
+            post(|Json(body): Json<Value>| async move {
+                let answers = body["questions"]
+                    .as_array()
+                    .into_iter()
+                    .flatten()
+                    .map(|q| json!({"type": "choice", "name": q["name"], "choice": "refund"}))
+                    .collect::<Vec<_>>();
+                Json(json!({"answers": answers}))
+            }),
+        );
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+    let port = listener.local_addr()?.port();
+    tokio::spawn(async move { axum::serve(listener, app).await });
+    Ok(port)
+}
+
+/// A decision's answers reach later steps as `results.<id>.output`, which a Branch to one after it
+/// routes on.
+#[cfg(feature = "quickjs")]
+#[sqlx::test(fixtures("base"))]
+async fn test_ai_decision_answers_route_a_following_branch(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // The stub listens on loopback, which the SSRF check refuses without this.
+    std::env::set_var("ALLOW_PRIVATE_AI_BASE_URLS", "true");
+    let stub_port = start_decision_stub().await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for provider in [
+        json!({
+            "kind": "typesafe",
+            "resource": {"api_key": "key", "base_url": format!("http://127.0.0.1:{stub_port}/v1")},
+            "model": "jev-latest"
+        }),
+        json!({
+            "kind": "cloudflare",
+            "resource": {
+                "token": "key",
+                "base_url": format!("http://127.0.0.1:{stub_port}/accounts/acc/ai/run/@cf/cloudflare")
+            },
+            "model": "clef-flash"
+        }),
+        json!({
+            "kind": "openai",
+            "resource": {"api_key": "key", "base_url": format!("http://127.0.0.1:{stub_port}/openai/v1")},
+            "model": "gpt-6-luna"
+        }),
+    ] {
+        let flow: FlowValue = serde_json::from_value(json!({
+            "modules": [
+                {"id": "d", "value": {
+                    "type": "aidecision",
+                    "input_transforms": {
+                        "provider": {"type": "static", "value": provider},
+                        "state": {"type": "static", "value": "I was charged twice"},
+                        "questions": {"type": "static", "value": {"intent": {
+                            "type": "choice",
+                            "instructions": "What does the customer want?",
+                            "criteria": {"refund": "Money back", "bug": "Something is broken"}
+                        }}}
+                    }
+                }},
+                {"id": "route", "value": {
+                    "type": "branchone",
+                    "branches": [
+                        {
+                            "expr": "results.d.output.intent.choice === 'bug'",
+                            "modules": [{"id": "b", "value": {"type": "identity"}}]
+                        },
+                        {
+                            "expr": "results.d.output.intent.choice === 'refund'",
+                            "modules": [{"id": "r", "value": {
+                                "type": "rawscript",
+                                "language": "bun",
+                                "content": "export function main(choice){ return 'handled ' + choice }",
+                                "input_transforms": {"choice": {
+                                    "type": "javascript",
+                                    "expr": "results.d.output.intent.choice"
+                                }}
+                            }}]
+                        }
+                    ],
+                    "default": []
+                }}
+            ]
+        }))?;
+
+        let job = run_job_in_new_worker_until_complete(
+            &db,
+            false,
+            JobPayload::RawFlow { value: flow, path: None, restarted_from: None },
+            port,
+        )
+        .await;
+        assert_eq!(
+            job.json_result(),
+            Some(json!("handled refund")),
+            "{provider}"
+        );
+    }
+    Ok(())
+}
diff --git a/backend/tests/app_ctx_inputs.rs b/backend/tests/app_ctx_inputs.rs
new file mode 100644
index 0000000000..cf386adc89
--- /dev/null
+++ b/backend/tests/app_ctx_inputs.rs
@@ -0,0 +1,88 @@
+//! A context input a raw app runnable declares (`fields.<arg> = { type: "ctx", .. }`) is
+//! filled by the server from the viewer's session. Whatever the request sends under that
+//! name is discarded: a runnable filters rows on it, so a viewer who could set it would
+//! read someone else's.
+//!
+//! Users from the `base` fixture:
+//!   test-user   (admin,     token SECRET_TOKEN)
+//!   test-user-2 (developer, token SECRET_TOKEN_2)
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const ADMIN_TOKEN: &str = "SECRET_TOKEN";
+const VIEWER_TOKEN: &str = "SECRET_TOKEN_2";
+const APP_PATH: &str = "u/test-user/ctx_app";
+const CONTENT: &str = "export function main(who: string) { return who }";
+// sha256 of CONTENT, the key an inline runnable is pinned under.
+const CONTENT_SHA: &str = "6e198199621d57e4fed834510cb0c2692274aa4cbe976e1704fab2806be9d744";
+
+fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
+    builder.header("Authorization", format!("Bearer {}", token))
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn a_declared_ctx_input_ignores_the_value_the_viewer_sends(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let ws = format!("http://localhost:{port}/api/w/test-workspace");
+    let client = reqwest::Client::new();
+
+    let resp = authed(client.post(format!("{ws}/apps/create")), ADMIN_TOKEN)
+        .json(&json!({
+            "path": APP_PATH,
+            "summary": "ctx inputs",
+            "value": {
+                "runnables": {
+                    "whoami": {
+                        "type": "inline",
+                        "inlineScript": { "language": "bun", "content": CONTENT },
+                        "fields": { "who": { "type": "ctx", "ctx": "username" } }
+                    }
+                }
+            },
+            // The policy says nothing of context inputs: the server reads the
+            // declaration from the deployed runnable.
+            "policy": {
+                "execution_mode": "anonymous",
+                "triggerables_v2": {
+                    format!("whoami:rawscript/{CONTENT_SHA}"): {
+                        "static_inputs": {},
+                        "one_of_inputs": {}
+                    }
+                }
+            }
+        }))
+        .send()
+        .await?;
+    assert!(resp.status().is_success(), "{}", resp.text().await?);
+
+    // Both spellings a viewer could send: a forged literal, and no argument at all.
+    for args in [json!({ "who": "test-user" }), json!({})] {
+        let resp = authed(
+            client.post(format!("{ws}/apps_u/execute_component/{APP_PATH}")),
+            VIEWER_TOKEN,
+        )
+        .json(&json!({
+            "component": "whoami",
+            "args": args,
+            "raw_code": { "language": "bun", "content": CONTENT }
+        }))
+        .send()
+        .await?;
+        assert!(resp.status().is_success(), "{}", resp.text().await?);
+        let job_id: uuid::Uuid = resp.text().await?.parse()?;
+
+        let queued: serde_json::Value = sqlx::query_scalar("SELECT args FROM v2_job WHERE id = $1")
+            .bind(job_id)
+            .fetch_one(&db)
+            .await?;
+        assert_eq!(queued["who"], json!("test-user-2"), "sent {args}");
+    }
+
+    Ok(())
+}
diff --git a/backend/tests/asset_trigger_dispatch.rs b/backend/tests/asset_trigger_dispatch.rs
index c165958a33..08d755f5d1 100644
--- a/backend/tests/asset_trigger_dispatch.rs
+++ b/backend/tests/asset_trigger_dispatch.rs
@@ -245,6 +245,7 @@ fn make_mini(id: Uuid, runnable_path: &str) -> MiniCompletedJob {
         cache_ignore_s3_path: None,
         runnable_settings_handle: None,
         build_binary_only: false,
+        job_token_scopes: None,
     }
 }
 
@@ -330,6 +331,7 @@ async fn end_to_end_asset_dispatch(db: Pool<Postgres>) -> anyhow::Result<()> {
         concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(),
         debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     };
     let completed = RunJob::from(job).run_until_complete(&db, false, port).await;
     assert!(
@@ -493,6 +495,7 @@ async fn partition_dynamic_resolved_persisted_and_propagated(
         concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(),
         debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     };
     let completed = RunJob::from(job)
         .arg("tenant_id", json!("acme"))
diff --git a/backend/tests/batch_rerun.rs b/backend/tests/batch_rerun.rs
index 51a6afa565..58cf27db87 100644
--- a/backend/tests/batch_rerun.rs
+++ b/backend/tests/batch_rerun.rs
@@ -53,6 +53,7 @@ fn script_payload() -> JobPayload {
         concurrency_settings: ConcurrencySettings::default().into(),
         debouncing_settings: DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     }
 }
 
@@ -63,6 +64,7 @@ fn flow_payload() -> JobPayload {
         apply_preprocessor: false,
         version: FLOW_VERSION,
         labels: None,
+        job_token_scopes: None,
     }
 }
 
diff --git a/backend/tests/bun_jobs.rs b/backend/tests/bun_jobs.rs
index 14f8c422a4..50fad28a04 100644
--- a/backend/tests/bun_jobs.rs
+++ b/backend/tests/bun_jobs.rs
@@ -854,6 +854,7 @@ fn run_main_script_job(hash: i64) -> RunJob {
         concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(),
         debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     })
 }
 
diff --git a/backend/tests/caller_modules_strip.rs b/backend/tests/caller_modules_strip.rs
index e6f96c04ec..a65ca22d1b 100644
--- a/backend/tests/caller_modules_strip.rs
+++ b/backend/tests/caller_modules_strip.rs
@@ -54,6 +54,7 @@ async fn stored_modules(db: &Pool<Postgres>, payload: JobPayload) -> Option<serd
         None,
         None,
         None,
+        None,
     )
     .await
     .expect("push must succeed");
@@ -81,6 +82,7 @@ async fn caller_modules_never_reach_a_job(db: Pool<Postgres>) {
         concurrency_settings: ConcurrencySettings::default(),
         debouncing_settings: DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     };
     assert_eq!(stored_modules(&db, deployed).await, None);
 
diff --git a/backend/tests/debounce_e2e.rs b/backend/tests/debounce_e2e.rs
index 9a2351f135..709629d825 100644
--- a/backend/tests/debounce_e2e.rs
+++ b/backend/tests/debounce_e2e.rs
@@ -33,7 +33,7 @@ mod debounce_e2e {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export async function main(items: any[]) { return items }",
                     "input_transforms": {
                         "items": { "type": "javascript", "expr": "flow_input.items" }
diff --git a/backend/tests/dedicated_workers.rs b/backend/tests/dedicated_workers.rs
index 13fb043454..5e9c371f90 100644
--- a/backend/tests/dedicated_workers.rs
+++ b/backend/tests/dedicated_workers.rs
@@ -85,6 +85,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000001,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -122,6 +123,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000002,
+            job_token_scopes: None,
         })
         .arg("x", json!(7))
         .push(&db)
@@ -161,6 +163,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000003,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -205,6 +208,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(21))
         .push(&db)
@@ -247,6 +251,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -265,6 +270,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -327,6 +333,7 @@ mod dedicated_worker_tests {
                     apply_preprocessor: false,
                     labels: None,
                     version: 3000000000000004,
+                    job_token_scopes: None,
                 })
                 .run_until_complete(&db, false, port)
                 .await
@@ -356,6 +363,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000005,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -391,6 +399,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000006,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -427,6 +436,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000007,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -465,6 +475,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000008,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -500,6 +511,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000009,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -511,6 +523,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000010,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -564,6 +577,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -622,6 +636,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(7))
         .push(&db)
@@ -634,6 +649,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000011,
+            job_token_scopes: None,
         })
         .arg("x", json!(7))
         .push(&db)
@@ -683,6 +699,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000012,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -742,6 +759,7 @@ mod dedicated_worker_tests {
                     apply_preprocessor: false,
                     labels: None,
                     version: 3000000000000013,
+                    job_token_scopes: None,
                 })
                 .run_until_complete(&db, false, port)
                 .await
@@ -777,6 +795,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -795,6 +814,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -848,6 +868,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -867,6 +888,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -926,6 +948,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000014,
+            job_token_scopes: None,
         })
         .arg("x", json!(20))
         .push(&db)
@@ -938,6 +961,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000014,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -988,6 +1012,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1038,6 +1063,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1089,6 +1115,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1142,6 +1169,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1160,6 +1188,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1222,6 +1251,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(7))
         .push(&db)
@@ -1240,6 +1270,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .workspace("test-workspace-2")
         .arg("x", json!(7))
@@ -1294,6 +1325,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1338,6 +1370,7 @@ mod dedicated_worker_tests {
             concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
             ),
             debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1375,6 +1408,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000015,
+            job_token_scopes: None,
         })
         .push(&db)
         .await;
@@ -1412,6 +1446,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000019,
+            job_token_scopes: None,
         })
         .push(&db)
         .await;
@@ -1451,6 +1486,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000016,
+            job_token_scopes: None,
         })
         .arg("x", json!(1))
         .push(&db)
@@ -1490,6 +1526,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000017,
+            job_token_scopes: None,
         })
         .arg("x", json!(5))
         .push(&db)
@@ -1529,6 +1566,7 @@ mod dedicated_worker_tests {
             apply_preprocessor: false,
             labels: None,
             version: 3000000000000018,
+            job_token_scopes: None,
         })
         .push(&db)
         .await;
diff --git a/backend/tests/dependency_job_tag.rs b/backend/tests/dependency_job_tag.rs
new file mode 100644
index 0000000000..58b320d2c1
--- /dev/null
+++ b/backend/tests/dependency_job_tag.rs
@@ -0,0 +1,126 @@
+//! Sets the process-wide `DEPENDENCY_JOB_TAG`, so it lives in its own test binary: any other
+//! test queuing a dependency job in the same process would land on the overridden tag.
+
+use sqlx::{Pool, Postgres};
+use windmill_common::worker::DEPENDENCY_JOB_TAG;
+use windmill_dep_map::scoped_dependency_map::DependencyDependent;
+
+#[sqlx::test(fixtures("base"))]
+async fn relocks_go_to_the_configured_dependency_job_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
+    DEPENDENCY_JOB_TAG.store(std::sync::Arc::new(Some("deps-$workspace".to_string())));
+
+    for (path, hash, tag) in [
+        ("f/tags/tagged", 7_100_001_i64, Some("default-$workspace")),
+        ("f/tags/plain", 7_100_002_i64, None),
+    ] {
+        sqlx::query(
+            "INSERT INTO script(workspace_id, created_by, content, schema, summary, description, path, hash, language, tag)
+             VALUES ('test-workspace', 'test-user', 'def main(): pass', '{}', '', '', $1, $2, 'python3', $3)",
+        )
+        .bind(path)
+        .bind(hash)
+        .bind(tag)
+        .execute(&db)
+        .await?;
+    }
+    let importers = ["f/tags/tagged", "f/tags/plain"]
+        .map(|p| DependencyDependent {
+            importer_path: p.to_string(),
+            importer_kind: "script".to_string(),
+            importer_node_ids: None,
+        })
+        .to_vec();
+    windmill_dep_map::trigger_dependents::trigger_dependents_to_recompute_dependencies(
+        "test-workspace",
+        importers,
+        None,
+        None,
+        "test@windmill.dev",
+        "test-user",
+        "u/test-user",
+        &db,
+        vec![],
+    )
+    .await?;
+
+    let tags: Vec<(String, String)> = sqlx::query_as(
+        "SELECT runnable_path, tag FROM v2_job WHERE kind = 'dependencies' ORDER BY runnable_path",
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        tags,
+        vec![
+            (
+                "f/tags/plain".to_string(),
+                "deps-test-workspace".to_string()
+            ),
+            (
+                "f/tags/tagged".to_string(),
+                "deps-test-workspace".to_string()
+            ),
+        ]
+    );
+
+    // A binary prebuild given `auto_build_binary_tag` keeps it; an untagged one follows its
+    // dependency job.
+    assert_eq!(
+        push_binary_prebuild(&db, Some("build-pool")).await?,
+        "build-pool"
+    );
+    assert_eq!(
+        push_binary_prebuild(&db, None).await?,
+        "deps-test-workspace"
+    );
+    Ok(())
+}
+
+async fn push_binary_prebuild(db: &Pool<Postgres>, tag: Option<&str>) -> anyhow::Result<String> {
+    let mut args = std::collections::HashMap::new();
+    args.insert(
+        "build_binary_only".to_string(),
+        windmill_common::worker::to_raw_value(&true),
+    );
+    let (build_id, tx) = windmill_queue::push(
+        db,
+        windmill_queue::PushIsolationLevel::IsolatedRoot(db.clone()),
+        "test-workspace",
+        windmill_common::jobs::JobPayload::BuildBinary {
+            path: "f/tags/plain".to_string(),
+            hash: windmill_common::scripts::ScriptHash(7_100_002),
+            language: windmill_common::scripts::ScriptLang::Go,
+        },
+        windmill_queue::PushArgs::from(&args),
+        "test-user",
+        "test@windmill.dev",
+        "u/test-user".to_string(),
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        false,
+        false,
+        None,
+        true,
+        tag.map(str::to_string),
+        None,
+        None,
+        None,
+        None,
+        false,
+        None,
+        None,
+        None,
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+    Ok(sqlx::query_scalar("SELECT tag FROM v2_job WHERE id = $1")
+        .bind(build_id)
+        .fetch_one(db)
+        .await?)
+}
diff --git a/backend/tests/dependency_map.rs b/backend/tests/dependency_map.rs
index 59895b7a3a..dad6c86aa3 100644
--- a/backend/tests/dependency_map.rs
+++ b/backend/tests/dependency_map.rs
@@ -452,6 +452,7 @@ def main():
                 ws_error_handler_muted: None,
                 labels: None,
                 skip_draft_deletion: None,
+                job_token_scopes: None,
             })
             .send()
             .await
diff --git a/backend/tests/drafts_delete_for_user.rs b/backend/tests/drafts_delete_for_user.rs
new file mode 100644
index 0000000000..9c48f8828c
--- /dev/null
+++ b/backend/tests/drafts_delete_for_user.rs
@@ -0,0 +1,85 @@
+//! Only a workspace admin can delete a draft that belongs to another user.
+//!
+//! A discard through `drafts/update` is scoped to the caller's own row, so it
+//! never reaches someone else's draft. `drafts/delete_for_user` is the admin
+//! route for that, and it must stay closed to everyone else.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+#[sqlx::test(fixtures("base"))]
+async fn test_only_admin_deletes_another_users_draft(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/drafts");
+    let client = reqwest::Client::new();
+    let path = "script/u/test-user-2/theirs";
+
+    let save = |token: &'static str| {
+        client
+            .post(format!("{base}/update/{path}"))
+            .header("Authorization", format!("Bearer {token}"))
+            .json(&json!({ "value": { "path": "u/test-user-2/theirs", "content": "" } }))
+            .send()
+    };
+    let resp = save("SECRET_TOKEN_2").await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+
+    let delete = |token: &'static str| {
+        client
+            .post(format!(
+                "{base}/delete_for_user/{path}?username=test-user-2"
+            ))
+            .header("Authorization", format!("Bearer {token}"))
+            .send()
+    };
+    let own_draft = || async {
+        client
+            .get(format!("{base}/get_own/{path}"))
+            .header("Authorization", "Bearer SECRET_TOKEN_2")
+            .send()
+            .await?
+            .json::<Value>()
+            .await
+    };
+
+    let resp = delete("SECRET_TOKEN_3").await?;
+    assert_eq!(resp.status(), 403, "{}", resp.text().await?);
+    assert!(
+        !own_draft().await?.is_null(),
+        "a non-admin deleted the draft"
+    );
+
+    let resp = delete("SECRET_TOKEN").await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    assert!(own_draft().await?.is_null(), "the draft is still there");
+
+    let resp = delete("SECRET_TOKEN").await?;
+    assert_eq!(resp.status(), 404, "{}", resp.text().await?);
+
+    // Without a username the delete takes every draft at the path.
+    for token in ["SECRET_TOKEN_2", "SECRET_TOKEN"] {
+        let resp = save(token).await?;
+        assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    }
+    let delete_all = |token: &'static str| {
+        client
+            .post(format!("{base}/delete_for_user/{path}"))
+            .header("Authorization", format!("Bearer {token}"))
+            .send()
+    };
+    let resp = delete_all("SECRET_TOKEN_3").await?;
+    assert_eq!(resp.status(), 403, "{}", resp.text().await?);
+    let resp = delete_all("SECRET_TOKEN").await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    let left: i64 = sqlx::query_scalar(
+        "SELECT count(*) FROM draft WHERE workspace_id = 'test-workspace' AND path = 'u/test-user-2/theirs'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(left, 0, "drafts survived a path-wide delete");
+    Ok(())
+}
diff --git a/backend/tests/end_user_email.rs b/backend/tests/end_user_email.rs
index 366c220c62..0d8ff7be9a 100644
--- a/backend/tests/end_user_email.rs
+++ b/backend/tests/end_user_email.rs
@@ -1,10 +1,8 @@
 //! Tests for WM_END_USER_EMAIL environment variable.
 //!
 //! These tests verify that WM_END_USER_EMAIL is populated with the authenticated
-//! user's email when executing app components.
-//!
-//! TODO: Add tests for scripts and flows once public execution endpoints are identified.
-//! Currently only apps support non-workspace-member execution via OptAuthed + token lookup.
+//! user's email when executing app components and when running scripts and flows directly.
+//! Only apps support non-workspace-member execution via OptAuthed + token lookup.
 
 use serde_json::json;
 use sqlx::{Pool, Postgres};
@@ -27,40 +25,6 @@ fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuil
     builder.header("Authorization", format!("Bearer {}", token))
 }
 
-// TODO: Script tests - need to identify public execution endpoints for non-workspace-members
-// async fn run_script(port: u16, token: &str) -> anyhow::Result<String> {
-//     let url = format!(
-//         "http://localhost:{}/api/w/test-workspace/jobs/run_wait_result/p/f/test/get_end_user_email",
-//         port
-//     );
-//     let resp = authed(client().post(&url), token)
-//         .json(&json!({}))
-//         .send()
-//         .await?;
-//     if !resp.status().is_success() {
-//         anyhow::bail!("script run failed: {} - {}", resp.status(), resp.text().await?);
-//     }
-//     Ok(resp.json::<serde_json::Value>().await?
-//         .as_str().unwrap_or("").to_string())
-// }
-
-// TODO: Flow tests - need to identify public execution endpoints for non-workspace-members
-// async fn run_flow(port: u16, token: &str) -> anyhow::Result<String> {
-//     let url = format!(
-//         "http://localhost:{}/api/w/test-workspace/jobs/run_wait_result/f/f/test/get_end_user_email_flow",
-//         port
-//     );
-//     let resp = authed(client().post(&url), token)
-//         .json(&json!({}))
-//         .send()
-//         .await?;
-//     if !resp.status().is_success() {
-//         anyhow::bail!("flow run failed: {} - {}", resp.status(), resp.text().await?);
-//     }
-//     Ok(resp.json::<serde_json::Value>().await?
-//         .as_str().unwrap_or("").to_string())
-// }
-
 /// Create an app with inline script via API
 async fn create_app_with_inline_script(port: u16, path: &str) -> anyhow::Result<()> {
     let url = format!("http://localhost:{}/api/w/test-workspace/apps/create", port);
@@ -74,8 +38,8 @@ async fn create_app_with_inline_script(port: u16, path: &str) -> anyhow::Result<
                 "subgrids": {},
                 "hiddenInlineScripts": [{
                     "name": "get_email",
-                    "language": "deno",
-                    "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }",
+                    "language": "bun",
+                    "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }",
                     "path": "f/test/email_app/get_email"
                 }]
             },
@@ -89,7 +53,7 @@ async fn create_app_with_inline_script(port: u16, path: &str) -> anyhow::Result<
                         "one_of_inputs": {}
                     },
                     // SHA256 hash of raw_code content for anonymous execution
-                    "rawscript/6428aba5aa2d3ea8e1215bfdccbedd3718b18da7a239e3778a9787bb9a0ea606": {
+                    "rawscript/894d2f85ea2411e777e7d5787366c9fec4c1a7a5f83482748f1d129196c9f54f": {
                         "static_inputs": {},
                         "one_of_inputs": {}
                     }
@@ -120,8 +84,8 @@ async fn create_raw_app_with_inline_script(port: u16, path: &str) -> anyhow::Res
                 "css": "",
                 "inlineScripts": [{
                     "name": "get_email",
-                    "language": "deno",
-                    "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }"
+                    "language": "bun",
+                    "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }"
                 }]
             },
             "policy": {
@@ -134,7 +98,7 @@ async fn create_raw_app_with_inline_script(port: u16, path: &str) -> anyhow::Res
                         "one_of_inputs": {}
                     },
                     // SHA256 hash of raw_code content for anonymous execution
-                    "rawscript/6428aba5aa2d3ea8e1215bfdccbedd3718b18da7a239e3778a9787bb9a0ea606": {
+                    "rawscript/894d2f85ea2411e777e7d5787366c9fec4c1a7a5f83482748f1d129196c9f54f": {
                         "static_inputs": {},
                         "one_of_inputs": {}
                     }
@@ -233,8 +197,8 @@ async fn run_app_inline_script(
         "args": {},
         "component": "get_email",
         "raw_code": {
-            "language": "deno",
-            "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }",
+            "language": "bun",
+            "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }",
             "path": format!("{}/get_email", app_path)
         }
     });
@@ -270,8 +234,8 @@ async fn run_raw_app_inline_script(
         "args": {},
         "component": "get_email",
         "raw_code": {
-            "language": "deno",
-            "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }"
+            "language": "bun",
+            "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }"
         }
     });
     if force_viewer {
@@ -312,41 +276,111 @@ async fn wait_for_job_result(port: u16, token: &str, job_id: &str) -> anyhow::Re
     anyhow::bail!("timeout waiting for job result")
 }
 
-// TODO: Script tests - need to identify public execution endpoints for non-workspace-members
-// #[cfg(feature = "deno_core")]
-// #[sqlx::test(fixtures("base", "end_user_email"))]
-// async fn test_script_wm_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
-//     initialize_tracing().await;
-//     set_jwt_secret().await;
-//     let server = ApiServer::start(db.clone()).await?;
-//     let port = server.addr.port();
-//
-//     in_test_worker(Connection::Sql(db.clone()), async move {
-//         let result = run_script(port, SAME_WS_TOKEN).await?;
-//         assert_eq!(result, SAME_WS_EMAIL, "same workspace user should get their email");
-//         Ok::<(), anyhow::Error>(())
-//     }, port).await?;
-//
-//     Ok(())
-// }
+async fn run_direct(port: u16, token: &str, route: &str) -> anyhow::Result<String> {
+    let url = format!(
+        "http://localhost:{}/api/w/test-workspace/jobs/run/{}",
+        port, route
+    );
+    let resp = authed(client().post(&url), token)
+        .json(&json!({}))
+        .send()
+        .await?;
+    if !resp.status().is_success() {
+        anyhow::bail!(
+            "run {route} failed: {} - {}",
+            resp.status(),
+            resp.text().await?
+        );
+    }
+    let job_id = resp.text().await?;
+    wait_for_job_result(port, token, &job_id).await
+}
 
-// TODO: Flow tests - need to identify public execution endpoints for non-workspace-members
-// #[cfg(feature = "deno_core")]
-// #[sqlx::test(fixtures("base", "end_user_email"))]
-// async fn test_flow_wm_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
-//     initialize_tracing().await;
-//     set_jwt_secret().await;
-//     let server = ApiServer::start(db.clone()).await?;
-//     let port = server.addr.port();
-//
-//     in_test_worker(Connection::Sql(db.clone()), async move {
-//         let result = run_flow(port, SAME_WS_TOKEN).await?;
-//         assert_eq!(result, SAME_WS_EMAIL, "same workspace user should get their email");
-//         Ok::<(), anyhow::Error>(())
-//     }, port).await?;
-//
-//     Ok(())
-// }
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base", "end_user_email"))]
+async fn test_direct_run_wm_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    in_test_worker(
+        Connection::Sql(db.clone()),
+        async move {
+            let result = run_direct(port, SAME_WS_TOKEN, "p/f/test/get_end_user_email").await?;
+            assert_eq!(result, SAME_WS_EMAIL, "a script run should see its caller");
+
+            let result =
+                run_direct(port, SAME_WS_TOKEN, "f/f/test/get_end_user_email_flow").await?;
+            assert_eq!(
+                result, SAME_WS_EMAIL,
+                "every flow step should see the flow's caller"
+            );
+
+            Ok::<(), anyhow::Error>(())
+        },
+        port,
+    )
+    .await?;
+
+    Ok(())
+}
+
+/// A job's `WM_TOKEN` names the identity the job runs as, which differs from its end user when
+/// the job runs on behalf of another account. A run it starts must keep the job's end user.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base", "end_user_email"))]
+async fn test_job_token_run_keeps_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let calling_job = uuid::Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, end_user_email)
+         VALUES ($1, 'test2@windmill.dev', 'test-user-2', false, false, '{}', '{}', 'test-workspace', $2)",
+    )
+    .bind(calling_job)
+    .bind(SAME_WS_EMAIL)
+    .execute(&db)
+    .await?;
+    let wm_token = windmill_common::auth::create_jwt_token(
+        windmill_common::db::Authed {
+            email: "test2@windmill.dev".to_string(),
+            username: "test-user-2".to_string(),
+            is_admin: false,
+            is_operator: false,
+            groups: vec!["all".to_string()],
+            folders: vec![],
+            scopes: None,
+            token_prefix: None,
+        },
+        "test-workspace",
+        3600,
+        Some(calling_job),
+        None,
+        None,
+        None,
+    )
+    .await?;
+
+    in_test_worker(
+        Connection::Sql(db.clone()),
+        async move {
+            let result = run_direct(port, &wm_token, "p/f/test/get_end_user_email").await?;
+            assert_eq!(
+                result, SAME_WS_EMAIL,
+                "the calling job's end user, not its run-as identity"
+            );
+            Ok::<(), anyhow::Error>(())
+        },
+        port,
+    )
+    .await?;
+
+    Ok(())
+}
 
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base", "end_user_email"))]
diff --git a/backend/tests/error_handler.rs b/backend/tests/error_handler.rs
index 5d5b7a828b..2e10006d2f 100644
--- a/backend/tests/error_handler.rs
+++ b/backend/tests/error_handler.rs
@@ -104,7 +104,7 @@ export async function main(path: string, email: string, job_id: string, is_flow:
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 1111111111, 'f/test/error_handler', $1, 'deno', 'script', 'test-user', '{}', 'Error handler script', 'Handles failed job completions', '')
+        VALUES ('test-workspace', 1111111111, 'f/test/error_handler', $1, 'bun', 'script', 'test-user', '{}', 'Error handler script', 'Handles failed job completions', E'{}\n//bun.lock\n<empty>')
         "#,
         error_handler_code
     )
@@ -118,7 +118,7 @@ export async function main(path: string, email: string, job_id: string, is_flow:
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', $1, 'f/test/failing_script', $2, 'deno', 'script', 'test-user', '{}', 'Failing test script', 'A script that always fails', '')
+        VALUES ('test-workspace', $1, 'f/test/failing_script', $2, 'bun', 'script', 'test-user', '{}', 'Failing test script', 'A script that always fails', E'{}\n//bun.lock\n<empty>')
         "#,
         failing_script_hash,
         failing_script_code
@@ -155,12 +155,13 @@ export async function main(path: string, email: string, job_id: string, is_flow:
         cache_ttl: None,
         cache_ignore_s3_path: None,
         dedicated_worker: None,
-        language: ScriptLang::Deno,
+        language: ScriptLang::Bun,
         priority: None,
         apply_preprocessor: false,
         concurrency_settings: ConcurrencySettings::default(),
         debouncing_settings: DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, server.addr.port())
     .await;
@@ -233,7 +234,7 @@ async fn test_error_handler_muted_on_script(db: Pool<Postgres>) -> anyhow::Resul
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 3333333333, 'f/test/error_handler', 'export function main() { return "handled"; }', 'deno', 'script', 'test-user', '{}', '', '', '')
+        VALUES ('test-workspace', 3333333333, 'f/test/error_handler', 'export function main() { return "handled"; }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\n//bun.lock\n<empty>')
         "#,
     )
     .execute(&db)
@@ -244,7 +245,7 @@ async fn test_error_handler_muted_on_script(db: Pool<Postgres>) -> anyhow::Resul
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock, ws_error_handler_muted)
-        VALUES ('test-workspace', $1, 'f/test/muted_failing_script', 'export function main() { throw new Error("fail"); }', 'deno', 'script', 'test-user', '{}', '', '', '', true)
+        VALUES ('test-workspace', $1, 'f/test/muted_failing_script', 'export function main() { throw new Error("fail"); }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\n//bun.lock\n<empty>', true)
         "#,
         failing_script_hash,
     )
@@ -279,12 +280,13 @@ async fn test_error_handler_muted_on_script(db: Pool<Postgres>) -> anyhow::Resul
         cache_ttl: None,
         cache_ignore_s3_path: None,
         dedicated_worker: None,
-        language: ScriptLang::Deno,
+        language: ScriptLang::Bun,
         priority: None,
         apply_preprocessor: false,
         concurrency_settings: ConcurrencySettings::default(),
         debouncing_settings: DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, server.addr.port())
     .await;
@@ -329,7 +331,7 @@ async fn test_error_handler_not_triggered_on_success(db: Pool<Postgres>) -> anyh
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 5555555555, 'f/test/error_handler', 'export function main() { return "handled"; }', 'deno', 'script', 'test-user', '{}', '', '', '')
+        VALUES ('test-workspace', 5555555555, 'f/test/error_handler', 'export function main() { return "handled"; }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\n//bun.lock\n<empty>')
         "#,
     )
     .execute(&db)
@@ -340,7 +342,7 @@ async fn test_error_handler_not_triggered_on_success(db: Pool<Postgres>) -> anyh
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', $1, 'f/test/success_script', 'export function main() { return "ok"; }', 'deno', 'script', 'test-user', '{}', '', '', '')
+        VALUES ('test-workspace', $1, 'f/test/success_script', 'export function main() { return "ok"; }', 'bun', 'script', 'test-user', '{}', '', '', E'{}\n//bun.lock\n<empty>')
         "#,
         success_script_hash,
     )
@@ -375,12 +377,13 @@ async fn test_error_handler_not_triggered_on_success(db: Pool<Postgres>) -> anyh
         cache_ttl: None,
         cache_ignore_s3_path: None,
         dedicated_worker: None,
-        language: ScriptLang::Deno,
+        language: ScriptLang::Bun,
         priority: None,
         apply_preprocessor: false,
         concurrency_settings: ConcurrencySettings::default(),
         debouncing_settings: DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, server.addr.port())
     .await;
@@ -408,3 +411,70 @@ async fn test_error_handler_not_triggered_on_success(db: Pool<Postgres>) -> anyh
 
     Ok(())
 }
+
+/// A hub script run at the top level (a schedule, a trigger, the API) is a `script_hub` job,
+/// and its failure must reach the workspace error handler like a workspace script's.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[sqlx::test(fixtures("base"))]
+async fn test_error_handler_triggered_on_hub_script_failure(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::jobs::JobPayload;
+
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+
+    let version = "990000002";
+    let hub_dir = &*windmill_common::worker::HUB_CACHE_DIR;
+    tokio::fs::create_dir_all(hub_dir).await?;
+    tokio::fs::write(
+        format!("{hub_dir}/{version}"),
+        r#"{"content":"exit 1","lockfile":null,"language":"bash","schema":{},"summary":null}"#,
+    )
+    .await?;
+
+    // The workspace handler settings are cached per workspace id across the tests of this
+    // binary, so this reuses the handler path every other test here configures.
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
+         VALUES ('test-workspace', 1111111112, 'f/test/error_handler', 'echo handled', 'bash', 'script', 'test-user', '{}', '', '', '')",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET error_handler = '{"path": "script/f/test/error_handler"}'::jsonb
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let completed_job = RunJob::from(JobPayload::ScriptHub {
+        path: format!("hub/{version}/test/fail"),
+        apply_preprocessor: false,
+    })
+    .run_until_complete(&db, false, server.addr.port())
+    .await;
+    assert!(!completed_job.success, "Hub script should have failed");
+
+    let mut handler_parent = None;
+    for _ in 0..50 {
+        handler_parent = sqlx::query_scalar::<_, Option<uuid::Uuid>>(
+            "SELECT parent_job FROM v2_job
+             WHERE workspace_id = 'test-workspace' AND permissioned_as_email = 'error_handler@windmill.dev'",
+        )
+        .fetch_optional(&db)
+        .await?;
+        if handler_parent.is_some() {
+            break;
+        }
+        tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;
+    }
+    assert_eq!(
+        handler_parent,
+        Some(Some(completed_job.id)),
+        "Workspace error handler should handle the failed hub script"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/fixtures/end_user_email.sql b/backend/tests/fixtures/end_user_email.sql
index 596d34e3e3..3b376525a4 100644
--- a/backend/tests/fixtures/end_user_email.sql
+++ b/backend/tests/fixtures/end_user_email.sql
@@ -40,9 +40,9 @@ VALUES (encode(sha256('NO_WS_TOKEN'::bytea), 'hex'), 'NO_WS_TOKE', 'NO_WS_TOKEN'
 INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, extra_perms)
 VALUES (
     'test-workspace', 'test-user',
-    'export function main() { return Deno.env.get("WM_END_USER_EMAIL") || ""; }',
+    'export function main() { return process.env.WM_END_USER_EMAIL || ""; }',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    'Returns WM_END_USER_EMAIL', '', 'f/test/get_end_user_email', 900001, 'deno', '', 'script',
+    'Returns WM_END_USER_EMAIL', '', 'f/test/get_end_user_email', 900001, 'bun', E'{}\n//bun.lock\n<empty>', 'script',
     '{"g/all": true}'
 );
 
@@ -51,7 +51,7 @@ INSERT INTO flow (workspace_id, summary, description, path, versions, schema, va
 VALUES (
     'test-workspace', 'Returns WM_END_USER_EMAIL', '', 'f/test/get_end_user_email_flow', '{900002}',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}, {"id": "b", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}]}',
+    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "bun", "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }", "input_transforms": {}}}, {"id": "b", "value": {"type": "rawscript", "language": "bun", "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }", "input_transforms": {}}}]}',
     'test-user',
     '{"g/all": true}'
 );
@@ -60,6 +60,6 @@ INSERT INTO flow_version (id, workspace_id, path, schema, value, created_by)
 VALUES (
     900002, 'test-workspace', 'f/test/get_end_user_email_flow',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}, {"id": "b", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}]}',
+    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "bun", "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }", "input_transforms": {}}}, {"id": "b", "value": {"type": "rawscript", "language": "bun", "content": "export function main() { return process.env.WM_END_USER_EMAIL || \"\"; }", "input_transforms": {}}}]}',
     'test-user'
 );
diff --git a/backend/tests/fixtures/hello.sql b/backend/tests/fixtures/hello.sql
index 962f6441d9..4c40ac3290 100644
--- a/backend/tests/fixtures/hello.sql
+++ b/backend/tests/fixtures/hello.sql
@@ -11,7 +11,7 @@ export function main(world: string) {
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"world":{"default":"world","description":"","type":"string"}},"required":[],"type":"object"}',
 '',
 '',
-'f/system/hello', 123412, 'deno', '');
+'f/system/hello', 123412, 'bun', E'{}\n//bun.lock\n<empty>');
 
 INSERT INTO public.script(workspace_id, created_by, content, schema, summary, description, path, hash, language, lock) VALUES (
 'test-workspace',
@@ -28,7 +28,7 @@ export async function main(foo: string, bar: string) {
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"foo":{"default":null,"description":"","originalType":"string","type":"string"},"bar":{"default":null,"description":"","originalType":"string","type":"string"}},"required":["foo","bar"],"type":"object"}',
 '',
 '',
-'f/system/hello_with_preprocessor', 123413, 'deno', '');
+'f/system/hello_with_preprocessor', 123413, 'bun', E'{}\n//bun.lock\n<empty>');
 
 INSERT INTO public.script(workspace_id, created_by, content, schema, summary, description, path, hash, language, lock) VALUES (
 'test-workspace',
@@ -140,7 +140,7 @@ INSERT INTO public.flow(workspace_id, summary, description, path, versions, sche
 'f/system/hello_with_nodes_flow',
 '{1443253234253454}',
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"world":{"default":"world","description":"","type":"string"}},"required":[],"type":"object"}',
-E'{"modules":[{"id":"a","value":{"type":"forloopflow","modules":[{"id":"b","value":{"type":"rawscript","content":"export function main(world: string) {\\n    const greet = `Hello ${world}!`;\\n    console.log(greet)\\n    return greet\\n}\\n","language":"deno","input_transforms":{"world":{"type":"javascript","expr":"flow_input.iter.value"}},"is_trigger":false}},{"id":"c","value":{"type":"rawscript","content":"export function main(hello: string) {\\n    const dareyou = `Did you just say \\"${hello}\\"??!`;\\n    console.log(dareyou)\\n    return dareyou\\n}","language":"deno","input_transforms":{"hello":{"type":"javascript","value":"${results.b}","expr":"`${results.b}`"}},"is_trigger":false}}],"iterator":{"type":"javascript","expr":"[''foo'', ''bar'', ''baz'']"},"skip_failures":true,"parallel":false}}],"same_worker":false}',
+E'{"modules":[{"id":"a","value":{"type":"forloopflow","modules":[{"id":"b","value":{"type":"rawscript","content":"export function main(world: string) {\\n    const greet = `Hello ${world}!`;\\n    console.log(greet)\\n    return greet\\n}\\n","language":"bun","input_transforms":{"world":{"type":"javascript","expr":"flow_input.iter.value"}},"is_trigger":false}},{"id":"c","value":{"type":"rawscript","content":"export function main(hello: string) {\\n    const dareyou = `Did you just say \\"${hello}\\"??!`;\\n    console.log(dareyou)\\n    return dareyou\\n}","language":"bun","input_transforms":{"hello":{"type":"javascript","value":"${results.b}","expr":"`${results.b}`"}},"is_trigger":false}}],"iterator":{"type":"javascript","expr":"[''foo'', ''bar'', ''baz'']"},"skip_failures":true,"parallel":false}}],"same_worker":false}',
 'system'
 );
 
@@ -149,7 +149,7 @@ INSERT INTO public.flow_version(id, workspace_id, path, schema, value, created_b
 'test-workspace',
 'f/system/hello_with_nodes_flow',
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"world":{"default":"world","description":"","type":"string"}},"required":[],"type":"object"}',
-E'{"modules":[{"id":"a","value":{"type":"forloopflow","modules":[{"id":"b","value":{"type":"rawscript","content":"export function main(world: string) {\\n    const greet = `Hello ${world}!`;\\n    console.log(greet)\\n    return greet\\n}\\n","language":"deno","input_transforms":{"world":{"type":"javascript","expr":"flow_input.iter.value"}},"is_trigger":false}},{"id":"c","value":{"type":"rawscript","content":"export function main(hello: string) {\\n    const dareyou = `Did you just say \\"${hello}\\"??!`;\\n    console.log(dareyou)\\n    return dareyou\\n}","language":"deno","input_transforms":{"hello":{"type":"javascript","value":"${results.b}","expr":"`${results.b}`"}},"is_trigger":false}}],"iterator":{"type":"javascript","expr":"[''foo'', ''bar'', ''baz'']"},"skip_failures":true,"parallel":false}}],"same_worker":false}',
+E'{"modules":[{"id":"a","value":{"type":"forloopflow","modules":[{"id":"b","value":{"type":"rawscript","content":"export function main(world: string) {\\n    const greet = `Hello ${world}!`;\\n    console.log(greet)\\n    return greet\\n}\\n","language":"bun","input_transforms":{"world":{"type":"javascript","expr":"flow_input.iter.value"}},"is_trigger":false}},{"id":"c","value":{"type":"rawscript","content":"export function main(hello: string) {\\n    const dareyou = `Did you just say \\"${hello}\\"??!`;\\n    console.log(dareyou)\\n    return dareyou\\n}","language":"bun","input_transforms":{"hello":{"type":"javascript","value":"${results.b}","expr":"`${results.b}`"}},"is_trigger":false}}],"iterator":{"type":"javascript","expr":"[''foo'', ''bar'', ''baz'']"},"skip_failures":true,"parallel":false}}],"same_worker":false}',
 'system'
 );
 
@@ -160,7 +160,7 @@ INSERT INTO public.flow(workspace_id, summary, description, path, versions, sche
 'f/system/hello_with_preprocessor',
 '{1443253234253456}',
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"foo":{"type":"string","description":"","default":""},"bar":{"type":"string","description":"","default":""}},"required":[],"type":"object","order":["foo","bar"]}',
-E'{"modules":[{"id":"a","value":{"type":"rawscript","content":"export async function main(foo: string, bar: string) {\\n  return ''Hello '' + foo + ''-'' + bar\\n}\\n","language":"deno","is_trigger":false,"input_transforms":{"bar":{"expr":"flow_input.bar","type":"javascript"},"foo":{"expr":"flow_input.foo","type":"javascript"}}}}],"preprocessor_module":{"id":"preprocessor","value":{"type":"rawscript","content":"export async function preprocessor(\\n\\twm_trigger: {\\n\\t\\tkind: ''http'' | ''email'' | ''webhook'' | ''websocket'' | ''kafka'' | ''nats'',\\n\\t\\thttp?: {\\n\\t\\t\\troute: string\\n\\t\\t\\tpath: string\\n\\t\\t\\tmethod: string\\n\\t\\t\\tparams: Record<string, string>\\n\\t\\t\\tquery: Record<string, string>\\n\\t\\t\\theaders: Record<string, string>\\n\\t\\t},\\n\\t\\twebsocket?: {\\n\\t\\t\\turl: string\\n\\t\\t},\\n\\t\\tkafka?: {\\n\\t\\t\\tbrokers: string[]\\n\\t\\t\\ttopic: string\\n\\t\\t\\tgroup_id: string\\n\\t\\t},\\n\\t\\tnats?: {\\n\\t\\t\\tservers: string[]\\n\\t\\t\\tsubject: string\\n\\t\\t\\theaders?: Record<string, string[]>\\n\\t\\t\\tstatus?: number\\n\\t\\t\\tdescription?: string\\n\\t\\t\\tlength: number\\n\\t\\t}\\n\\t},\\n) {\\n\\treturn {\\n\\t\\tfoo: ''bar'',\\n\\t\\tbar: ''baz''\\n\\t}\\n}","language":"deno","is_trigger":false,"input_transforms":{"wm_trigger":{"type":"static"}}}}}',
+E'{"modules":[{"id":"a","value":{"type":"rawscript","content":"export async function main(foo: string, bar: string) {\\n  return ''Hello '' + foo + ''-'' + bar\\n}\\n","language":"bun","is_trigger":false,"input_transforms":{"bar":{"expr":"flow_input.bar","type":"javascript"},"foo":{"expr":"flow_input.foo","type":"javascript"}}}}],"preprocessor_module":{"id":"preprocessor","value":{"type":"rawscript","content":"export async function preprocessor(\\n\\twm_trigger: {\\n\\t\\tkind: ''http'' | ''email'' | ''webhook'' | ''websocket'' | ''kafka'' | ''nats'',\\n\\t\\thttp?: {\\n\\t\\t\\troute: string\\n\\t\\t\\tpath: string\\n\\t\\t\\tmethod: string\\n\\t\\t\\tparams: Record<string, string>\\n\\t\\t\\tquery: Record<string, string>\\n\\t\\t\\theaders: Record<string, string>\\n\\t\\t},\\n\\t\\twebsocket?: {\\n\\t\\t\\turl: string\\n\\t\\t},\\n\\t\\tkafka?: {\\n\\t\\t\\tbrokers: string[]\\n\\t\\t\\ttopic: string\\n\\t\\t\\tgroup_id: string\\n\\t\\t},\\n\\t\\tnats?: {\\n\\t\\t\\tservers: string[]\\n\\t\\t\\tsubject: string\\n\\t\\t\\theaders?: Record<string, string[]>\\n\\t\\t\\tstatus?: number\\n\\t\\t\\tdescription?: string\\n\\t\\t\\tlength: number\\n\\t\\t}\\n\\t},\\n) {\\n\\treturn {\\n\\t\\tfoo: ''bar'',\\n\\t\\tbar: ''baz''\\n\\t}\\n}","language":"bun","is_trigger":false,"input_transforms":{"wm_trigger":{"type":"static"}}}}}',
 'system'
 );
 
@@ -169,6 +169,6 @@ INSERT INTO public.flow_version(id, workspace_id, path, schema, value, created_b
 'test-workspace',
 'f/system/hello_with_preprocessor',
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"foo":{"type":"string","description":"","default":""},"bar":{"type":"string","description":"","default":""}},"required":[],"type":"object","order":["foo","bar"]}',
-E'{"modules":[{"id":"a","value":{"type":"rawscript","content":"export async function main(foo: string, bar: string) {\\n  return ''Hello '' + foo + ''-'' + bar\\n}\\n","language":"deno","is_trigger":false,"input_transforms":{"bar":{"expr":"flow_input.bar","type":"javascript"},"foo":{"expr":"flow_input.foo","type":"javascript"}}}}],"preprocessor_module":{"id":"preprocessor","value":{"type":"rawscript","content":"export async function preprocessor(\\n\\twm_trigger: {\\n\\t\\tkind: ''http'' | ''email'' | ''webhook'' | ''websocket'' | ''kafka'' | ''nats'',\\n\\t\\thttp?: {\\n\\t\\t\\troute: string\\n\\t\\t\\tpath: string\\n\\t\\t\\tmethod: string\\n\\t\\t\\tparams: Record<string, string>\\n\\t\\t\\tquery: Record<string, string>\\n\\t\\t\\theaders: Record<string, string>\\n\\t\\t},\\n\\t\\twebsocket?: {\\n\\t\\t\\turl: string\\n\\t\\t},\\n\\t\\tkafka?: {\\n\\t\\t\\tbrokers: string[]\\n\\t\\t\\ttopic: string\\n\\t\\t\\tgroup_id: string\\n\\t\\t},\\n\\t\\tnats?: {\\n\\t\\t\\tservers: string[]\\n\\t\\t\\tsubject: string\\n\\t\\t\\theaders?: Record<string, string[]>\\n\\t\\t\\tstatus?: number\\n\\t\\t\\tdescription?: string\\n\\t\\t\\tlength: number\\n\\t\\t}\\n\\t},\\n) {\\n\\treturn {\\n\\t\\tfoo: ''bar'',\\n\\t\\tbar: ''baz''\\n\\t}\\n}","language":"deno","is_trigger":false,"input_transforms":{"wm_trigger":{"type":"static"}}}}}',
+E'{"modules":[{"id":"a","value":{"type":"rawscript","content":"export async function main(foo: string, bar: string) {\\n  return ''Hello '' + foo + ''-'' + bar\\n}\\n","language":"bun","is_trigger":false,"input_transforms":{"bar":{"expr":"flow_input.bar","type":"javascript"},"foo":{"expr":"flow_input.foo","type":"javascript"}}}}],"preprocessor_module":{"id":"preprocessor","value":{"type":"rawscript","content":"export async function preprocessor(\\n\\twm_trigger: {\\n\\t\\tkind: ''http'' | ''email'' | ''webhook'' | ''websocket'' | ''kafka'' | ''nats'',\\n\\t\\thttp?: {\\n\\t\\t\\troute: string\\n\\t\\t\\tpath: string\\n\\t\\t\\tmethod: string\\n\\t\\t\\tparams: Record<string, string>\\n\\t\\t\\tquery: Record<string, string>\\n\\t\\t\\theaders: Record<string, string>\\n\\t\\t},\\n\\t\\twebsocket?: {\\n\\t\\t\\turl: string\\n\\t\\t},\\n\\t\\tkafka?: {\\n\\t\\t\\tbrokers: string[]\\n\\t\\t\\ttopic: string\\n\\t\\t\\tgroup_id: string\\n\\t\\t},\\n\\t\\tnats?: {\\n\\t\\t\\tservers: string[]\\n\\t\\t\\tsubject: string\\n\\t\\t\\theaders?: Record<string, string[]>\\n\\t\\t\\tstatus?: number\\n\\t\\t\\tdescription?: string\\n\\t\\t\\tlength: number\\n\\t\\t}\\n\\t},\\n) {\\n\\treturn {\\n\\t\\tfoo: ''bar'',\\n\\t\\tbar: ''baz''\\n\\t}\\n}","language":"bun","is_trigger":false,"input_transforms":{"wm_trigger":{"type":"static"}}}}}',
 'system'
 );
diff --git a/backend/tests/fixtures/jobs_read_auth.sql b/backend/tests/fixtures/jobs_read_auth.sql
index 980d68b711..e175a9c065 100644
--- a/backend/tests/fixtures/jobs_read_auth.sql
+++ b/backend/tests/fixtures/jobs_read_auth.sql
@@ -29,6 +29,13 @@ INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, sc
     ARRAY['jobs:run:flows:f/shared/flow1']
 );
 
+-- A path-scoped read token for test-user-2: it reads the runs of `f/shared/flow1` only.
+INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, scopes) VALUES (
+    encode(sha256('READ_SCOPED_TOKEN'::bytea), 'hex'), 'READ_SCOP', 'READ_SCOPED_TOKEN',
+    'test2@windmill.dev', 'flow history token', false,
+    ARRAY['jobs:read:f/shared/flow1']
+);
+
 -- Same, scoped to a script. The two jobs below both run through a `singlestepflow`
 -- wrapper (native retry / scheduled runs produce these) — one wrapping a script, one
 -- wrapping a flow — so the confinement has to project each onto the runnable it wraps
@@ -91,6 +98,32 @@ INSERT INTO public.v2_job_completed (id, workspace_id, duration_ms, status, resu
     ('18181818-1818-1818-1818-181818181818', 'test-workspace', 1000, 'success'::job_status,
      '{"agent": "AGENT_CHAT_RESULT"}');
 
+-- A lock job for flow `f/shared/flow1`, as `wmill generate-metadata` queues it, and the
+-- token CI would lock with.
+INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, scopes) VALUES (
+    encode(sha256('RUN_SCOPED_DEPS_TOKEN'::bytea), 'hex'), 'RUN_DEPS_', 'RUN_SCOPED_DEPS_TOKEN',
+    'test2@windmill.dev', 'lock token', false,
+    ARRAY['jobs:run:dependencies:f/shared/*']
+);
+INSERT INTO public.v2_job (
+    id, workspace_id, created_by, created_at, permissioned_as, permissioned_as_email,
+    kind, runnable_path, tag, visible_to_owner
+) VALUES (
+    '19191919-1919-1919-1919-191919191919', 'test-workspace', 'test-user-2',
+    '2023-01-01 00:00:00', 'u/test-user-2', 'test2@windmill.dev',
+    'flowdependencies', 'f/shared/flow1', 'dependency', true
+), (
+    -- Queued by a broader token with `*` as its path, which the request body allows.
+    '20202020-2020-2020-2020-202020202020', 'test-workspace', 'test-user-2',
+    '2023-01-01 00:00:00', 'u/test-user-2', 'test2@windmill.dev',
+    'dependencies', '*', 'dependency', true
+);
+INSERT INTO public.v2_job_completed (id, workspace_id, duration_ms, status, result) VALUES
+    ('19191919-1919-1919-1919-191919191919', 'test-workspace', 1000, 'success'::job_status,
+     '{"lock": "DEPS_RESULT"}'),
+    ('20202020-2020-2020-2020-202020202020', 'test-workspace', 1000, 'success'::job_status,
+     '{"lock": "WILDCARD_DEPS_RESULT"}');
+
 -- A token pairing an app scope with a run scope, as someone driving an app's components
 -- programmatically would build. `APP_INLINE_JOB` is an inline-script component run: no
 -- `jobs:run` scope can name its kind, so only the `apps:run` half puts it in reach.
diff --git a/backend/tests/fixtures/schedule.sql b/backend/tests/fixtures/schedule.sql
index 8d851369b0..999aa4770f 100644
--- a/backend/tests/fixtures/schedule.sql
+++ b/backend/tests/fixtures/schedule.sql
@@ -13,7 +13,7 @@ export async function main(fail: boolean = true) {
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"fail":{"default":true,"description":"","type":"boolean"}},"required":[],"type":"object"}',
 '',
 '',
-'f/system/failing_script', 12349, 'deno', '');
+'f/system/failing_script', 12349, 'bun', E'{}\n//bun.lock\n<empty>');
 
 INSERT INTO public.script(workspace_id, created_by, content, schema, summary, description, path, hash, language, lock) VALUES (
 'test-workspace',
@@ -26,7 +26,7 @@ export async function main() {
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"path":{"default":null,"description":"","type":"string"},"schedule_path":{"default":null,"description":"","type":"string"},"error":{"default":null,"description":"","properties":{},"type":"object"}},"required":["path","schedule_path","error"],"type":"object"}',
 '',
 '',
-'f/system/schedule_error_handler', 123410, 'deno', '');
+'f/system/schedule_error_handler', 123410, 'bun', E'{}\n//bun.lock\n<empty>');
 
 INSERT INTO public.script(workspace_id, created_by, content, schema, summary, description, path, hash, language, lock) VALUES (
 'test-workspace',
@@ -39,7 +39,7 @@ export async function main() {
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"path":{"default":null,"description":"","type":"string"},"schedule_path":{"default":null,"description":"","type":"string"},"previous_job_error":{"default":null,"description":"","type":"string"},"result":{"default":null,"description":"","type":"string"}},"required":["path","schedule_path","previous_job_error","result"],"type":"object"}',
 '',
 '',
-'f/system/schedule_recovery_handler', 123411, 'deno', '');
+'f/system/schedule_recovery_handler', 123411, 'bun', E'{}\n//bun.lock\n<empty>');
 
 INSERT INTO public.flow(workspace_id, summary, description, path, versions, schema, value, edited_by) VALUES (
 'test-workspace',
diff --git a/backend/tests/flow_engine_parity.rs b/backend/tests/flow_engine_parity.rs
index 7ea221c2e8..2d4f72f336 100644
--- a/backend/tests/flow_engine_parity.rs
+++ b/backend/tests/flow_engine_parity.rs
@@ -50,6 +50,7 @@ fn flow_module(id: &str, value: FlowModuleValue) -> FlowModule {
         apply_preprocessor: None,
         pass_flow_input_directly: None,
         debouncing: None,
+        job_token_scopes: None,
     }
 }
 
@@ -84,7 +85,7 @@ async fn test_flow_linear_input_transforms(db: Pool<Postgres>) -> anyhow::Result
         modules: vec![
             flow_module("a", FlowModuleValue::RawScript {
                 input_transforms: [static_input("x", 10), static_input("y", 5)].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(x: number, y: number) {
     return {sum: x + y, product: x * y, items: [1, 2, 3, 4, 5]};
@@ -104,7 +105,7 @@ export function main(x: number, y: number) {
                     js_input("filtered", "results.a.items.filter(x => x > 2)"),
                     js_input("from_flow_input", "flow_input.multiplier * results.a.sum"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(total: number, doubled_items: number[], filtered: number[], from_flow_input: number) {
     return {total, doubled_items, filtered, from_flow_input};
@@ -156,7 +157,7 @@ async fn test_flow_forloop_complex_expressions(db: Pool<Postgres>) -> anyhow::Re
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {
@@ -198,7 +199,7 @@ export function main() {
                                 js_input("index", "flow_input.iter.index"),
                             ]
                             .into(),
-                            language: ScriptLang::Deno,
+                            language: ScriptLang::Bun,
                             content: r#"
 export function main(user_name: string, user_score: number, bonus: number, index: number) {
     return {name: user_name, final_score: user_score + bonus, position: index};
@@ -260,7 +261,7 @@ async fn test_flow_branchone_conditions(db: Pool<Postgres>) -> anyhow::Result<()
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {status: "premium", score: 95, items: [1, 2, 3]};
@@ -292,7 +293,7 @@ export function main() {
                                         js_input("score_from_a", "results.a.score"),
                                     ]
                                     .into(),
-                                    language: ScriptLang::Deno,
+                                    language: ScriptLang::Bun,
                                     content: r#"
 export function main(discount: number, score_from_a: number) {
     return {branch: "premium_high", discount, score_from_a};
@@ -319,7 +320,7 @@ export function main(discount: number, score_from_a: number) {
                                 "premium_low",
                                 FlowModuleValue::RawScript {
                                     input_transforms: Default::default(),
-                                    language: ScriptLang::Deno,
+                                    language: ScriptLang::Bun,
                                     content: r#"
 export function main() {
     return {branch: "premium_low", discount: 10};
@@ -343,7 +344,7 @@ export function main() {
                         "default_branch",
                         FlowModuleValue::RawScript {
                             input_transforms: Default::default(),
-                            language: ScriptLang::Deno,
+                            language: ScriptLang::Bun,
                             content: r#"
 export function main() {
     return {branch: "default", discount: 0};
@@ -397,7 +398,7 @@ async fn test_flow_previous_result_aggregation(db: Pool<Postgres>) -> anyhow::Re
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {value: 10, items: [1, 2, 3]};
@@ -423,7 +424,7 @@ export function main() {
                         ),
                     ]
                     .into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(prev_value: number, prev_items_sum: number) {
     return {value: prev_value * 2, sum: prev_items_sum};
@@ -451,7 +452,7 @@ export function main(prev_value: number, prev_items_sum: number) {
                         ),
                     ]
                     .into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(a_value: number, b_value: number, b_sum: number, combined: number) {
     return {a_value, b_value, b_sum, combined};
@@ -503,7 +504,7 @@ async fn test_flow_nested_complexity(db: Pool<Postgres>) -> anyhow::Result<()> {
         modules: vec![
             flow_module("data", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -540,7 +541,7 @@ export function main() {
                             js_input("values", "results.data.base_values.map(v => v * flow_input.iter.value.multiplier)"),
                             js_input("sum", "results.data.base_values.reduce((a, b) => a + b, 0) * flow_input.iter.value.multiplier"),
                         ].into(),
-                        language: ScriptLang::Deno,
+                        language: ScriptLang::Bun,
                         content: r#"
 export function main(cat_name: string, multiplier: number, values: number[], sum: number) {
     return {category: cat_name, multiplier, computed_values: values, total: sum};
@@ -601,7 +602,7 @@ async fn test_flow_object_transformations(db: Pool<Postgres>) -> anyhow::Result<
         modules: vec![
             flow_module("source", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -632,7 +633,7 @@ export function main() {
                     js_input("active_bonus", "results.source.config.activeBonus"),
                     js_input("all_users", "results.source.users"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(admins: string[], active_count: number, admin_bonus: number, active_bonus: number, all_users: any[]) {
     // Compute user_summary and total_bonus in the script since complex expressions in input_transforms
@@ -701,7 +702,7 @@ async fn test_flow_skip_if_expressions(db: Pool<Postgres>) -> anyhow::Result<()>
                 "check",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {should_skip: true, value: 100};
@@ -721,7 +722,7 @@ export function main() {
                     "maybe_skipped",
                     FlowModuleValue::RawScript {
                         input_transforms: [js_input("input_val", "results.check.value * 2")].into(),
-                        language: ScriptLang::Deno,
+                        language: ScriptLang::Bun,
                         content: r#"
 export function main(input_val: number) {
     return {processed: input_val, was_run: true};
@@ -749,7 +750,7 @@ export function main(input_val: number) {
                         js_input("prev", "previous_result"),
                     ]
                     .into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(check_val: number, prev: any) {
     return {check_val, previous: prev};
@@ -798,7 +799,7 @@ async fn test_flow_template_literals(db: Pool<Postgres>) -> anyhow::Result<()> {
         modules: vec![
             flow_module("data", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -824,7 +825,7 @@ export function main() {
                     js_input("upper_name", "results.data.firstName.toUpperCase()"),
                     js_input("items_formatted", "`Items: ${results.data.items.map(i => i.charAt(0).toUpperCase() + i.slice(1)).join(', ')}`"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(full_name: string, greeting: string, items_str: string, upper_name: string, items_formatted: string) {
     return {full_name, greeting, items_str, upper_name, items_formatted};
@@ -872,7 +873,7 @@ async fn test_flow_optional_chaining(db: Pool<Postgres>) -> anyhow::Result<()> {
         modules: vec![
             flow_module("data", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -904,7 +905,7 @@ export function main() {
                     js_input("default_city", "results.data.partial_user?.address?.city ?? 'Unknown'"),
                     js_input("default_country", "results.data.user?.address?.country ?? 'USA'"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(city: string, missing_city: any, null_user_name: any, default_city: string, default_country: string) {
     return {city, missing_city, null_user_name, default_city, default_country};
@@ -954,7 +955,7 @@ async fn test_flow_parallel_forloop(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "data",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {items: [1, 2, 3, 4, 5]};
@@ -989,7 +990,7 @@ export function main() {
                                 js_input("cubed", "flow_input.iter.value.value ** 3"),
                             ]
                             .into(),
-                            language: ScriptLang::Deno,
+                            language: ScriptLang::Bun,
                             content: r#"
 export function main(original: number, squared: number, cubed: number) {
     return {original, squared, cubed};
@@ -1088,7 +1089,7 @@ async fn test_flow_env_access(db: Pool<Postgres>) -> anyhow::Result<()> {
                     js_input("retry_count", "flow_env.CONFIG.retries"),
                     js_input("has_auth", "flow_env.CONFIG.features.includes('auth')"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(env_name: string, is_debug: boolean, timeout_val: number, api_url: string, retry_count: number, has_auth: boolean) {
     return {env_name, is_debug, timeout_val, api_url, retry_count, has_auth};
@@ -1157,7 +1158,7 @@ async fn test_flow_input_and_env_combined(db: Pool<Postgres>) -> anyhow::Result<
                     // Conditional based on both
                     js_input("multiplier", "flow_env.ENV === 'production' ? flow_input.prod_mult : 1"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(effective_limit: number, env_prefix: string, is_prod: boolean, doubled_input: number, multiplier: number) {
     return {effective_limit, env_prefix, is_prod, doubled_input, final_value: doubled_input * multiplier};
@@ -1214,7 +1215,7 @@ async fn test_flow_results_optional_chaining(db: Pool<Postgres>) -> anyhow::Resu
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {
@@ -1286,7 +1287,7 @@ export function main() {
                         ),
                     ]
                     .into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(
     user_name: string,
@@ -1360,7 +1361,7 @@ async fn test_flow_large_integers(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {
@@ -1400,7 +1401,7 @@ export function main() {
                         ),
                     ]
                     .into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(
     small: number, i32_max: number, over_i32: number,
@@ -1458,7 +1459,7 @@ async fn test_flow_unicode_emoji(db: Pool<Postgres>) -> anyhow::Result<()> {
         modules: vec![
             flow_module("a", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -1488,7 +1489,7 @@ export function main() {
                     js_input("mixed_upper", "results.a.mixed.toUpperCase()"),
                     js_input("template", "`Welcome: ${results.a.greeting}`"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(
     greeting: string, greeting_len: number, simple_str: string, has_world: boolean,
@@ -1543,7 +1544,7 @@ async fn test_flow_complex_array_operations(db: Pool<Postgres>) -> anyhow::Resul
         modules: vec![
             flow_module("a", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -1584,7 +1585,7 @@ export function main() {
                     js_input("first_three", "results.a.numbers.slice(0, 3)"),
                     js_input("last_two", "results.a.numbers.slice(-2)"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(
     sorted_asc: number[], sorted_desc: number[], active_names: string[],
@@ -1650,7 +1651,7 @@ async fn test_flow_multiline_expressions(db: Pool<Postgres>) -> anyhow::Result<(
         modules: vec![
             flow_module("a", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -1709,7 +1710,7 @@ export function main() {
                         }
                     "#),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(
     subtotal: number, discounted_total: number,
@@ -1767,7 +1768,7 @@ async fn test_flow_spread_with_results(db: Pool<Postgres>) -> anyhow::Result<()>
         modules: vec![
             flow_module("a", FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {
@@ -1802,7 +1803,7 @@ export function main() {
                     // Combining multiple spreads
                     js_input("combined", "{config: {...results.a.config}, tags: [...results.a.tags], source: 'flow'}"),
                 ].into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main(
     merged_config: any, all_tags: string[], full_user: any,
@@ -1868,7 +1869,7 @@ async fn test_flow_nested_forloop_results_access(db: Pool<Postgres>) -> anyhow::
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return {
@@ -1907,7 +1908,7 @@ export function main() {
                                     js_input("multiplier", "results.a.multiplier"), // Access outer step from inside for-loop
                                 ]
                                 .into(),
-                                language: ScriptLang::Deno,
+                                language: ScriptLang::Bun,
                                 content: r#"
 export function main(category: string, multiplier: number) {
     return {
@@ -1938,7 +1939,7 @@ export function main(category: string, multiplier: number) {
                                     js_input("original_mult", "results.a.multiplier"), // Access outer step
                                 ]
                                 .into(),
-                                language: ScriptLang::Deno,
+                                language: ScriptLang::Bun,
                                 content: r#"
 export function main(items: any[], category: string, original_mult: number) {
     return {
@@ -2012,7 +2013,7 @@ async fn test_flow_results_non_existent_step(db: Pool<Postgres>) -> anyhow::Resu
                 "a",
                 FlowModuleValue::RawScript {
                     input_transforms: Default::default(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main() {
     return { value: 42 };
@@ -2049,7 +2050,7 @@ export function main() {
                         ),
                     ]
                     .into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(
     existing: number,
@@ -2125,7 +2126,7 @@ async fn test_flow_env_skip_if_inside_branchone(db: Pool<Postgres>) -> anyhow::R
             "inner",
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {ran: true};
@@ -2155,7 +2156,7 @@ export function main() {
         "branch_marker",
         FlowModuleValue::RawScript {
             input_transforms: Default::default(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main() {
     return {marker: "branch-marker"};
@@ -2192,7 +2193,7 @@ export function main() {
                 "after",
                 FlowModuleValue::RawScript {
                     input_transforms: [js_input("prev", "previous_result")].into(),
-                    language: ScriptLang::Deno,
+                    language: ScriptLang::Bun,
                     content: r#"
 export function main(prev: any) {
     return {prev};
@@ -2257,7 +2258,7 @@ async fn test_flow_env_skip_if_nested_branchone(db: Pool<Postgres>) -> anyhow::R
             "leaf",
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {ran: true};
@@ -2281,7 +2282,7 @@ export function main() {
         "inner_marker",
         FlowModuleValue::RawScript {
             input_transforms: Default::default(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main() {
     return {marker: "inner"};
@@ -2336,7 +2337,7 @@ export function main() {
         "after",
         FlowModuleValue::RawScript {
             input_transforms: [js_input("prev", "previous_result")].into(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main(prev: any) {
     return {prev};
@@ -2413,7 +2414,7 @@ async fn test_flow_env_complex_input_transform_in_branch(db: Pool<Postgres>) ->
                 "Math.min(flow_env.LIMIT, 10) + flow_env.OFFSET",
             )]
             .into(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main(value: number) {
     return {value};
@@ -2486,7 +2487,7 @@ async fn test_flow_env_skip_if_in_parallel_forloop(db: Pool<Postgres>) -> anyhow
         "marker",
         FlowModuleValue::RawScript {
             input_transforms: [js_input("i", "flow_input.iter.value")].into(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main(i: number) {
     return {marker: i};
@@ -2507,7 +2508,7 @@ export function main(i: number) {
             "leaf",
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {ran: true};
@@ -2593,7 +2594,7 @@ async fn test_flow_env_imported_flow_uses_own_env(db: Pool<Postgres>) -> anyhow:
             "id": "leaf",
             "value": {
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "content": "export function main(key: string) { return {key}; }",
                 "input_transforms": {
                     "key": { "type": "javascript", "expr": "flow_env.KEY" }
@@ -2678,7 +2679,7 @@ async fn test_flow_env_imported_flow_inherits_when_unset(db: Pool<Postgres>) ->
                 "id": "marker",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return {marker: \"from-imported\"}; }",
                     "input_transforms": {}
                 }
@@ -2687,7 +2688,7 @@ async fn test_flow_env_imported_flow_inherits_when_unset(db: Pool<Postgres>) ->
                 "id": "leaf",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return {ran: true}; }",
                     "input_transforms": {}
                 },
@@ -2790,7 +2791,7 @@ async fn test_flow_env_imported_flow_with_nested_branch(db: Pool<Postgres>) -> a
                             "id": "marker",
                             "value": {
                                 "type": "rawscript",
-                                "language": "deno",
+                                "language": "bun",
                                 "content": "export function main() { return {marker: \"from-imported-branch\"}; }",
                                 "input_transforms": {}
                             }
@@ -2799,7 +2800,7 @@ async fn test_flow_env_imported_flow_with_nested_branch(db: Pool<Postgres>) -> a
                             "id": "leaf",
                             "value": {
                                 "type": "rawscript",
-                                "language": "deno",
+                                "language": "bun",
                                 "content": "export function main() { return {ran: true}; }",
                                 "input_transforms": {}
                             },
@@ -2931,13 +2932,13 @@ async fn test_flow_env_marks_sub_flows_only_without_ancestor_env(
             "parallel": true,
             "modules": [{ "id": "leaf", "value": {
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "content": "export function main(key: any) { return key ?? null; }",
                 "input_transforms": { "key": { "type": "javascript", "expr": "flow_env.KEY" } }
             }}, { "id": "tail", "value": {
                 // A single simple step is inlined rather than stored as a flow node.
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "content": "export function main(prev: any) { return prev; }",
                 "input_transforms": { "prev": { "type": "javascript", "expr": "results.leaf" } }
             }}]
@@ -2974,6 +2975,7 @@ async fn test_flow_env_marks_sub_flows_only_without_ancestor_env(
                 apply_preprocessor: false,
                 version,
                 labels: None,
+                job_token_scopes: None,
             })
             .run_until_complete(&db, false, port)
             .await;
@@ -3022,7 +3024,7 @@ async fn test_flow_env_in_stop_after_if(db: Pool<Postgres>) -> anyhow::Result<()
             "first",
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return {stage: "first"};
@@ -3050,7 +3052,7 @@ export function main() {
         "second",
         FlowModuleValue::RawScript {
             input_transforms: Default::default(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main() {
     return {stage: "second"};
@@ -3108,7 +3110,7 @@ async fn test_stop_after_if_error_include_result(db: Pool<Postgres>) -> anyhow::
             "step",
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     return { userErrors: ["email taken"], ok: false };
@@ -3198,7 +3200,7 @@ async fn test_flow_env_in_retry_if(db: Pool<Postgres>) -> anyhow::Result<()> {
             "fails",
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 content: r#"
 export function main() {
     throw new Error("nope");
@@ -3272,7 +3274,7 @@ async fn test_flow_env_in_stop_after_all_iters_if(db: Pool<Postgres>) -> anyhow:
         "iter_step",
         FlowModuleValue::RawScript {
             input_transforms: [js_input("i", "flow_input.iter.value")].into(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main(i: number) {
     return {iter: i};
@@ -3314,7 +3316,7 @@ export function main(i: number) {
         "after",
         FlowModuleValue::RawScript {
             input_transforms: Default::default(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main() {
     return {stage: "after-loop"};
@@ -3373,7 +3375,7 @@ async fn test_stop_after_all_iters_if_error_includes_result(
         "iter_step",
         FlowModuleValue::RawScript {
             input_transforms: [js_input("i", "flow_input.iter.value")].into(),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             content: r#"
 export function main(i: number) {
     return { iter: i };
@@ -3451,8 +3453,8 @@ async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
             id,
             FlowModuleValue::RawScript {
                 input_transforms: Default::default(),
-                language: ScriptLang::Deno,
-                content: "export function main() { return { lang: 'bun' } }".to_string(),
+                language: ScriptLang::Bun,
+                content: "export function main() { return { lang: 'python3' } }".to_string(),
                 path: None,
                 lock: None,
                 tag: tag.map(str::to_string),
@@ -3482,7 +3484,7 @@ async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
     .bind(job.id)
     .fetch_one(&db)
     .await?;
-    assert_eq!(b_tag, "bun");
+    assert_eq!(b_tag, "python3");
 
     assert!(!job.success);
     let result = job.json_result().unwrap();
diff --git a/backend/tests/instance_config.rs b/backend/tests/instance_config.rs
index 52ebbee7e7..24937a3ce5 100644
--- a/backend/tests/instance_config.rs
+++ b/backend/tests/instance_config.rs
@@ -237,7 +237,7 @@ async fn test_diff_global_settings_empty_string_routes_to_delete(db: Pool<Postgr
         "empty-string value must route to deletes"
     );
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
     assert!(
         get_global_setting(&db, "npmrc").await.is_none(),
         "npmrc row must be deleted after apply"
@@ -319,7 +319,7 @@ async fn test_diff_global_settings_rejects_worker_configs_upsert(db: Pool<Postgr
         "worker_configs must never be written as a global setting"
     );
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
     assert!(
         get_global_setting(&db, "worker_configs").await.is_none(),
         "worker_configs row must not exist in global_settings after apply"
@@ -444,7 +444,7 @@ async fn test_apply_settings_diff_upserts_only(db: Pool<Postgres>) {
         ..Default::default()
     };
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert_eq!(
         get_global_setting(&db, "key_a").await,
@@ -468,7 +468,7 @@ async fn test_apply_settings_diff_deletes_only(db: Pool<Postgres>) {
         ..Default::default()
     };
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert!(get_global_setting(&db, "to_delete_1").await.is_none());
     assert!(get_global_setting(&db, "to_delete_2").await.is_none());
@@ -489,7 +489,7 @@ async fn test_apply_settings_diff_upserts_and_deletes(db: Pool<Postgres>) {
         ..Default::default()
     };
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert!(get_global_setting(&db, "old_key").await.is_none());
     assert_eq!(
@@ -503,7 +503,7 @@ async fn test_apply_settings_diff_empty_noop(db: Pool<Postgres>) {
     insert_global_setting(&db, "preexisting", serde_json::json!("value")).await;
 
     let diff = SettingsDiff::default();
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert_eq!(
         get_global_setting(&db, "preexisting").await,
@@ -525,7 +525,7 @@ async fn test_apply_settings_diff_upsert_overwrites(db: Pool<Postgres>) {
         ..Default::default()
     };
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert_eq!(
         get_global_setting(&db, "overwrite_me").await,
@@ -553,7 +553,7 @@ async fn test_apply_settings_diff_complex_json(db: Pool<Postgres>) {
         ..Default::default()
     };
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     let stored = get_global_setting(&db, "complex_setting").await.unwrap();
     assert_eq!(stored, complex_value);
@@ -568,7 +568,7 @@ async fn test_apply_settings_diff_delete_nonexistent_is_noop(db: Pool<Postgres>)
     };
 
     // Should not error
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 }
 
 // ========================================================================
@@ -589,7 +589,7 @@ async fn test_apply_configs_diff_upserts_with_prefix(db: Pool<Postgres>) {
         deletes: vec![],
     };
 
-    apply_configs_diff(&db, &diff).await.unwrap();
+    apply_configs_diff(&db, &diff, &()).await.unwrap();
 
     let stored = get_config(&db, "worker__mygroup").await.unwrap();
     assert_eq!(stored["init_bash"], "echo hi");
@@ -601,7 +601,7 @@ async fn test_apply_configs_diff_deletes_with_prefix(db: Pool<Postgres>) {
 
     let diff = ConfigsDiff { upserts: BTreeMap::new(), deletes: vec!["to_remove".to_string()] };
 
-    apply_configs_diff(&db, &diff).await.unwrap();
+    apply_configs_diff(&db, &diff, &()).await.unwrap();
 
     assert!(get_config(&db, "worker__to_remove").await.is_none());
 }
@@ -619,7 +619,7 @@ async fn test_apply_configs_diff_upsert_overwrites(db: Pool<Postgres>) {
         deletes: vec![],
     };
 
-    apply_configs_diff(&db, &diff).await.unwrap();
+    apply_configs_diff(&db, &diff, &()).await.unwrap();
 
     let stored = get_config(&db, "worker__grp").await.unwrap();
     assert_eq!(stored, serde_json::json!({"new": true}));
@@ -630,7 +630,7 @@ async fn test_apply_configs_diff_empty_noop(db: Pool<Postgres>) {
     insert_config(&db, "worker__keep", serde_json::json!({"keep": true})).await;
 
     let diff = ConfigsDiff::default();
-    apply_configs_diff(&db, &diff).await.unwrap();
+    apply_configs_diff(&db, &diff, &()).await.unwrap();
 
     assert!(get_config(&db, "worker__keep").await.is_some());
 }
@@ -641,7 +641,7 @@ async fn test_apply_configs_diff_does_not_touch_non_worker_configs(db: Pool<Post
 
     let diff = ConfigsDiff { upserts: BTreeMap::new(), deletes: vec!["server_config".to_string()] };
 
-    apply_configs_diff(&db, &diff).await.unwrap();
+    apply_configs_diff(&db, &diff, &()).await.unwrap();
 
     // The delete targets "worker__server_config", not "server_config"
     assert!(
@@ -692,7 +692,7 @@ async fn test_roundtrip_write_read_modify_apply(db: Pool<Postgres>) {
     assert!(diff.upserts.contains_key("expose_metrics"));
     assert!(diff.deletes.is_empty());
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Step 5: Read back and verify
     let config2 = InstanceConfig::from_db(&db).await.unwrap();
@@ -729,7 +729,7 @@ async fn test_roundtrip_replace_mode_deletes(db: Pool<Postgres>) {
     assert!(diff.deletes.contains(&"retention_period_secs".to_string()));
     assert!(diff.deletes.contains(&"expose_metrics".to_string()));
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert!(get_global_setting(&db, "retention_period_secs")
         .await
@@ -782,7 +782,7 @@ async fn test_roundtrip_worker_configs(db: Pool<Postgres>) {
     assert!(diff.upserts.contains_key("gpu")); // new
     assert_eq!(diff.deletes, vec!["legacy".to_string()]);
 
-    apply_configs_diff(&db, &diff).await.unwrap();
+    apply_configs_diff(&db, &diff, &()).await.unwrap();
 
     // Verify
     let config2 = InstanceConfig::from_db(&db).await.unwrap();
@@ -820,7 +820,7 @@ async fn test_roundtrip_to_settings_map_from_db_consistency(db: Pool<Postgres>)
     let diff =
         SettingsDiff { upserts: map.into_iter().collect(), deletes: vec![], ..Default::default() };
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     let config = InstanceConfig::from_db(&db).await.unwrap();
     assert_eq!(config.global_settings.base_url, original.base_url);
@@ -868,8 +868,8 @@ async fn test_idempotent_apply(db: Pool<Postgres>) {
     };
 
     // Apply twice
-    apply_settings_diff(&db, &diff).await.unwrap();
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     assert_eq!(
         get_global_setting(&db, "idem_key").await,
@@ -1069,7 +1069,7 @@ async fn test_diff_apply_only_touches_changed_rows(db: Pool<Postgres>) {
     assert!(!diff.upserts.contains_key("unchanged_1"));
     assert!(!diff.upserts.contains_key("unchanged_2"));
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Verify all 4 settings present
     assert_eq!(count_global_settings(&db).await, 4);
@@ -1148,7 +1148,7 @@ async fn test_replace_mode_protects_settings_in_integration(db: Pool<Postgres>)
     // But normal_setting should be deleted
     assert!(diff.deletes.contains(&"normal_setting".to_string()));
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Verify protected settings survived
     assert!(get_global_setting(&db, "ducklake_settings").await.is_some());
@@ -1196,7 +1196,7 @@ async fn test_jwt_secret_roundtrip_as_string_or_secret_ref(db: Pool<Postgres>) {
 
     let diff =
         SettingsDiff { upserts: map.into_iter().collect(), deletes: vec![], ..Default::default() };
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Read back from DB — jwt_secret should survive the roundtrip
     let config = InstanceConfig::from_db(&db).await.unwrap();
@@ -1239,7 +1239,7 @@ async fn test_rsa_keys_roundtrip_via_extra(db: Pool<Postgres>) {
     let map = settings.to_settings_map();
     let diff =
         SettingsDiff { upserts: map.into_iter().collect(), deletes: vec![], ..Default::default() };
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Read back from DB
     let config = InstanceConfig::from_db(&db).await.unwrap();
@@ -1296,7 +1296,7 @@ async fn test_replace_mode_protects_jwt_secret_and_rsa_keys(db: Pool<Postgres>)
         "normal_setting should be deleted"
     );
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Both protected settings survive
     assert_eq!(
@@ -1371,7 +1371,7 @@ async fn test_alert_config_in_global_settings_roundtrip(db: Pool<Postgres>) {
         "alert_config change should be detected in diff"
     );
 
-    apply_settings_diff(&db, &diff).await.unwrap();
+    apply_settings_diff(&db, &diff, &()).await.unwrap();
 
     // Re-read and verify the update
     let config2 = InstanceConfig::from_db(&db).await.unwrap();
@@ -1455,6 +1455,7 @@ async fn declarative_sync_rejects_an_unusable_webhook_base_url(db: Pool<Postgres
         &db,
         &BTreeMap::new(),
         &desired,
+        &(),
     )
     .await
     .expect_err("an invalid webhook base url must fail the sync");
@@ -1474,6 +1475,7 @@ async fn declarative_sync_rejects_an_unusable_webhook_base_url(db: Pool<Postgres
         &db,
         &BTreeMap::new(),
         &wrong_type,
+        &(),
     )
     .await
     .expect_err("a non-string webhook base url must fail the sync");
@@ -1511,6 +1513,7 @@ async fn declarative_sync_rejects_an_unusable_instance_banner(db: Pool<Postgres>
         &db,
         &BTreeMap::new(),
         &desired,
+        &(),
     )
     .await
     .expect_err("a javascript: banner link must fail the sync");
@@ -1545,6 +1548,7 @@ async fn declarative_sync_rejects_a_malformed_max_token_expiration(db: Pool<Post
         &db,
         &BTreeMap::new(),
         &desired,
+        &(),
     )
     .await
     .expect_err("a ceiling the token routes cannot read must fail the sync");
@@ -1578,6 +1582,7 @@ async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<P
             &db,
             &BTreeMap::new(),
             &desired,
+            &(),
         )
         .await
         .expect_err(&format!("{bad} must fail the sync"));
@@ -1604,6 +1609,7 @@ async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<P
         &db,
         &BTreeMap::new(),
         &desired,
+        &(),
     )
     .await
     .expect("a valid origin list must sync");
@@ -1635,7 +1641,10 @@ async fn declarative_sync_keeps_the_external_cluster_while_it_holds_databases(db
         let (db, current) = (db.clone(), current.clone());
         async move {
             windmill_common::instance_config::sync_global_settings_declarative(
-                &db, &current, &desired,
+                &db,
+                &current,
+                &desired,
+                &(),
             )
             .await
         }
@@ -1670,6 +1679,7 @@ async fn declarative_sync_rejects_a_non_hex_accent_color(db: Pool<Postgres>) {
         &db,
         &BTreeMap::new(),
         &desired,
+        &(),
     )
     .await
     .expect_err("a non-hex accent color must fail the sync");
@@ -1681,7 +1691,109 @@ async fn declarative_sync_rejects_a_non_hex_accent_color(db: Pool<Postgres>) {
         &db,
         &BTreeMap::new(),
         &desired,
+        &(),
     )
     .await
     .expect("a hex accent color must sync");
 }
+
+/// A declarative sync has no user request behind it, so its observer is the only thing
+/// that audits it: one entry per setting or worker config it actually writes, values
+/// recorded under the API path's rule, and none for what it leaves as is.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[sqlx::test(fixtures("base"))]
+async fn test_declarative_sync_audits_only_what_it_writes(db: Pool<Postgres>) {
+    use windmill_audit::instance_config::{
+        declarative_sync_author, DeclarativeSource, InstanceConfigAuditor,
+    };
+
+    insert_global_setting(&db, "retention_period_secs", serde_json::json!(100)).await;
+    insert_global_setting(&db, "expose_metrics", serde_json::json!(true)).await;
+    insert_global_setting(&db, "scim_token", serde_json::json!("old-scim-secret")).await;
+    insert_global_setting(
+        &db,
+        "npm_config_registry",
+        serde_json::json!("https://u:p@npm"),
+    )
+    .await;
+    insert_config(
+        &db,
+        "worker__kept",
+        serde_json::json!({"worker_tags": ["a"]}),
+    )
+    .await;
+    insert_config(
+        &db,
+        "worker__dropped",
+        serde_json::json!({"worker_tags": ["b"]}),
+    )
+    .await;
+
+    let config: windmill_common::instance_config::InstanceConfig =
+        serde_json::from_value(serde_json::json!({
+            "global_settings": {
+                "retention_period_secs": 200,
+                "expose_metrics": true,
+                "scim_token": "new-scim-secret",
+            },
+            "worker_configs": {
+                "kept": {"worker_tags": ["a"]},
+                "added": {"init_bash": "export TOKEN=init-secret"},
+            },
+        }))
+        .unwrap();
+    let author = declarative_sync_author();
+    config
+        .sync_to_db(
+            &db,
+            &InstanceConfigAuditor {
+                db: &db,
+                author: &author,
+                source: Some(DeclarativeSource::SyncConfig),
+            },
+        )
+        .await
+        .unwrap();
+
+    let entries: Vec<(String, String, serde_json::Value)> = sqlx::query_as(
+        "SELECT operation, resource, parameters FROM audit_partitioned \
+         WHERE workspace_id = 'global' AND username = $1 AND resource = ANY($2) \
+         ORDER BY resource",
+    )
+    .bind(&author.username)
+    .bind(vec![
+        "retention_period_secs",
+        "expose_metrics",
+        "scim_token",
+        "npm_config_registry",
+        "worker__kept",
+        "worker__dropped",
+        "worker__added",
+    ])
+    .fetch_all(&db)
+    .await
+    .unwrap();
+
+    let source = serde_json::json!({"source": "sync-config"});
+    let entry = |operation: &str, resource: &str, parameters: &serde_json::Value| {
+        (
+            operation.to_string(),
+            resource.to_string(),
+            parameters.clone(),
+        )
+    };
+    assert_eq!(
+        entries,
+        vec![
+            entry("global_settings.delete", "npm_config_registry", &source),
+            entry(
+                "global_settings.update",
+                "retention_period_secs",
+                &serde_json::json!({"source": "sync-config", "value": "200"}),
+            ),
+            entry("global_settings.update", "scim_token", &source),
+            entry("worker_config.update", "worker__added", &source),
+            entry("worker_config.delete", "worker__dropped", &source),
+        ]
+    );
+}
diff --git a/backend/tests/job_payload.rs b/backend/tests/job_payload.rs
index 1a973f6fe6..c40feb1650 100644
--- a/backend/tests/job_payload.rs
+++ b/backend/tests/job_payload.rs
@@ -54,9 +54,10 @@ mod job_payload {
                 cache_ttl: None,
                 cache_ignore_s3_path: None,
                 dedicated_worker: None,
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 priority: None,
                 apply_preprocessor: false,
+                job_token_scopes: None,
             })
             .arg("world", json!("foo"))
             .run_until_complete(&db, false, port)
@@ -84,7 +85,7 @@ mod job_payload {
                 cache_ttl: None,
                 cache_ignore_s3_path: None,
                 dedicated_worker: None,
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 priority: None,
                 apply_preprocessor: true,
                 concurrency_settings:
@@ -92,6 +93,7 @@ mod job_payload {
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .run_until_complete_with(db, false, port, |id| async move {
                 let job = sqlx::query!("SELECT preprocessed FROM v2_job WHERE id = $1", id)
@@ -163,7 +165,7 @@ mod job_payload {
         let test = || async {
             let result = RunJob::from(JobPayload::FlowScript {
                 id: flow_scripts[0],
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 concurrency_settings:
                     windmill_common::runnable_settings::ConcurrencySettings::default(),
                 cache_ttl: None,
@@ -183,7 +185,7 @@ mod job_payload {
         let test = || async {
             let result = RunJob::from(JobPayload::FlowScript {
                 id: flow_scripts[1],
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
                 concurrency_settings:
                     windmill_common::runnable_settings::ConcurrencySettings::default(),
                 cache_ttl: None,
@@ -261,7 +263,7 @@ mod job_payload {
         let result = RunJob::from(JobPayload::Dependencies {
             path: "f/system/hello".to_string(),
             hash: ScriptHash(123412),
-            language: ScriptLang::Deno,
+            language: ScriptLang::Bun,
             debouncing_settings: Default::default(),
             dedicated_worker: None,
         })
@@ -349,7 +351,7 @@ mod job_payload {
                                 console.log(greet)
                                 return greet
                             }"#,
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "world": { "type": "javascript", "expr": "flow_input.world" }
                             }
@@ -405,7 +407,7 @@ mod job_payload {
                     return greet
                 }"#
                 .into(),
-                language: ScriptLang::Deno,
+                language: ScriptLang::Bun,
             })
             .run_until_complete(&db, false, port)
             .await
@@ -414,7 +416,10 @@ mod job_payload {
 
             assert_eq!(
                 result,
-                json!({ "lock": "", "status": "Successful lock file generation" })
+                json!({
+                    "lock": "{\n  \"dependencies\": {}\n}\n//bun.lock\n<empty>",
+                    "status": "Successful lock file generation"
+                })
             );
         };
         test_for_versions(VERSION_FLAGS.iter().copied(), test).await;
@@ -435,6 +440,7 @@ mod job_payload {
                 apply_preprocessor: false,
                 version: 1443253234253454,
                 labels: None,
+                job_token_scopes: None,
             })
             .run_until_complete(&db, false, port)
             .await
@@ -485,6 +491,7 @@ mod job_payload {
                 apply_preprocessor: true,
                 version: 1443253234253456,
                 labels: None,
+                job_token_scopes: None,
             })
             .run_until_complete_with(db, false, port, |id| async move {
                 let job = sqlx::query!("SELECT preprocessed FROM v2_job WHERE id = $1", id)
@@ -556,6 +563,7 @@ mod job_payload {
                 apply_preprocessor: true,
                 version: 1443253234253454,
                 labels: None,
+                job_token_scopes: None,
             })
             .run_until_complete(&db, false, port)
             .await
@@ -621,7 +629,7 @@ mod job_payload {
                                 console.log(greet)
                                 return greet
                             }"#,
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "world": { "type": "javascript", "expr": "flow_input.world" }
                             }
@@ -668,7 +676,7 @@ mod job_payload {
                             "content": r#"export function main(world: string) {
                                 return `Hello ${world}!`;
                             }"#,
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "world": { "type": "javascript", "expr": "flow_input.world" }
                             }
@@ -680,7 +688,7 @@ mod job_payload {
                             "content": r#"export function main(world: string, a: string) {
                                 return `${a} ${world}!`;
                             }"#,
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "world": { "type": "javascript", "expr": "flow_input.world" },
                                 "a": { "type": "javascript", "expr": "results.a" }
@@ -699,7 +707,7 @@ mod job_payload {
                                         "x": { "type": "javascript", "expr": "flow_input.iter.value" }
                                     },
                                     "type": "rawscript",
-                                    "language": "deno",
+                                    "language": "bun",
                                     "content": r#"export function main(world: string, b: string, x: string) {
                                         return `${x}: ${b} ${world}!`;
                                     }"#,
@@ -852,7 +860,7 @@ mod job_payload {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "input_transforms": {
                         "world": { "type": "javascript", "expr": "flow_input.world" }
                     },
@@ -869,7 +877,7 @@ mod job_payload {
                             "id": "inner_first",
                             "value": {
                                 "type": "rawscript",
-                                "language": "deno",
+                                "language": "bun",
                                 "input_transforms": {
                                     "world": { "type": "javascript", "expr": "flow_input.world" }
                                 },
@@ -879,7 +887,7 @@ mod job_payload {
                             "id": "inner_second",
                             "value": {
                                 "type": "rawscript",
-                                "language": "deno",
+                                "language": "bun",
                                 "input_transforms": {
                                     "world": { "type": "javascript", "expr": "flow_input.world" },
                                     "first": { "type": "javascript", "expr": "results.inner_first" }
@@ -1040,7 +1048,7 @@ mod job_payload {
                         "id": "inner",
                         "value": {
                             "type": "rawscript",
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "iter_val": { "type": "javascript", "expr": "flow_input.iter.value" },
                                 "tag": { "type": "javascript", "expr": "flow_input.tag" }
@@ -1150,6 +1158,7 @@ mod job_payload {
                 apply_preprocessor: true,
                 version: 1443253234253454,
                 labels: None,
+                job_token_scopes: None,
             })
             .run_until_complete(db, false, port)
             .await;
@@ -1238,7 +1247,7 @@ mod job_payload {
                                 "id": "leaf",
                                 "value": {
                                     "type": "rawscript",
-                                    "language": "deno",
+                                    "language": "bun",
                                     "input_transforms": {
                                         "tag": { "type": "javascript", "expr": "flow_input.tag" },
                                         "iv": { "type": "javascript", "expr": "flow_input.iter.value" }
@@ -1382,7 +1391,7 @@ mod job_payload {
                                         "id": "leaf",
                                         "value": {
                                             "type": "rawscript",
-                                            "language": "deno",
+                                            "language": "bun",
                                             "input_transforms": {
                                                 "tag": { "type": "javascript", "expr": "flow_input.tag" }
                                             },
@@ -1625,6 +1634,7 @@ mod job_payload {
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .arg("foo", json!("hello"))
             .arg("bar", json!("world"))
@@ -1676,6 +1686,7 @@ mod job_payload {
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .arg("foo", json!("hello"))
             .arg("bar", json!("world"))
@@ -1727,6 +1738,7 @@ mod job_payload {
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .arg("foo", json!("hello"))
             .arg("bar", json!("world"))
@@ -1778,6 +1790,7 @@ mod job_payload {
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .arg("foo", json!("hello"))
             .arg("bar", json!("world"))
@@ -1831,6 +1844,7 @@ mod job_payload {
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .arg("foo", json!("hello"))
             .arg("bar", json!("world"))
diff --git a/backend/tests/job_provenance.rs b/backend/tests/job_provenance.rs
index 42ccf829e6..4eda4e5e17 100644
--- a/backend/tests/job_provenance.rs
+++ b/backend/tests/job_provenance.rs
@@ -150,3 +150,104 @@ async fn flow_steps_are_latest_only_under_a_current_unrestarted_flow(db: Pool<Po
         assert_eq!(p.latest, latest, "job {job}");
     }
 }
+
+/// `wmill digest` hashes a sync checkout of the same items to the same values
+/// (`cli/test/item_digest_unit.test.ts`), so a trust policy can compare the claim to git.
+#[sqlx::test(fixtures("base"))]
+async fn digests_match_the_cli_vectors(db: Pool<Postgres>) {
+    use serde_json::{json, Value};
+    use windmill_common::job_provenance::RunAsType;
+
+    let v: Value =
+        serde_json::from_str(include_str!("../../cli/test/fixtures/item_digest_vectors.json"))
+            .unwrap();
+    let (script, flow) = (&v["script"], &v["flow"]);
+
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, lock, modules, language, kind, created_by, schema, summary, description)
+         VALUES ('test-workspace', 777, $1, $2, $3, $4, 'bun', 'script', 'test-user', '{}', '', '')",
+    )
+    .bind(script["path"].as_str())
+    .bind(script["content"].as_str())
+    .bind(script["lock"].as_str())
+    .bind(&script["modules"])
+    .execute(&db)
+    .await
+    .unwrap();
+
+    // Version 889 holds step `a` by reference, which no checkout can reproduce.
+    let step = &flow["value"]["modules"][0]["value"];
+    let mut by_ref = flow["value"].clone();
+    by_ref["modules"][0]["value"] = json!({
+        "type": "flowscript", "id": 999, "language": step["language"],
+        "input_transforms": step["input_transforms"],
+    });
+    sqlx::query(
+        "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, versions)
+         VALUES ('test-workspace', $1, '', '', $2, 'test-user', ARRAY[888::bigint, 889::bigint])",
+    )
+    .bind(flow["path"].as_str())
+    .bind(&flow["value"])
+    .execute(&db)
+    .await
+    .unwrap();
+    for (id, value) in [(888, &flow["value"]), (889, &by_ref)] {
+        sqlx::query(
+            "INSERT INTO flow_version (id, workspace_id, path, value, schema, created_by)
+             VALUES ($1, 'test-workspace', $2, $3, '{}', 'test-user')",
+        )
+        .bind(id as i64)
+        .bind(flow["path"].as_str())
+        .bind(value)
+        .execute(&db)
+        .await
+        .unwrap();
+    }
+    sqlx::query(
+        "INSERT INTO flow_node (id, workspace_id, path, code, lock, hash_v2)
+         VALUES (999, 'test-workspace', $1, $2, $3, 'h')",
+    )
+    .bind(flow["path"].as_str())
+    .bind(step["content"].as_str())
+    .bind(step["lock"].as_str())
+    .execute(&db)
+    .await
+    .unwrap();
+
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, kind, runnable_path, runnable_id, parent_job, trigger, trigger_kind, tag, created_by, permissioned_as, permissioned_as_email)
+         VALUES
+            ('3bb0c0de-0000-4000-8000-000000000201', 'test-workspace', 'script', $1, 777, NULL, NULL, NULL, 'bun', 'test-user', 'g/all', 'group-all@windmill.dev'),
+            ('3bb0c0de-0000-4000-8000-000000000202', 'test-workspace', 'flow', $2, 888, NULL, 'f/digest/nightly', 'schedule', 'flow', 'test-user', 'u/test-user', 'test@windmill.dev'),
+            ('3bb0c0de-0000-4000-8000-000000000203', 'test-workspace', 'flowscript', $2 || '/a', 999, '3bb0c0de-0000-4000-8000-000000000202', NULL, NULL, 'gpu', 'test-user', 'u/test-user', 'test@windmill.dev'),
+            ('3bb0c0de-0000-4000-8000-000000000204', 'test-workspace', 'flow', $2, 889, NULL, NULL, NULL, 'flow', 'test-user', 'u/test-user', 'test@windmill.dev')",
+    )
+    .bind(script["path"].as_str())
+    .bind(flow["path"].as_str())
+    .execute(&db)
+    .await
+    .unwrap();
+    for q in [
+        "INSERT INTO worker_ping (worker, worker_instance, worker_group) VALUES ('wk-gpu', 'wk', 'gpu-group')",
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, running, worker, tag)
+         VALUES ('3bb0c0de-0000-4000-8000-000000000203', 'test-workspace', now(), true, 'wk-gpu', 'gpu')",
+    ] {
+        sqlx::query(q).execute(&db).await.unwrap();
+    }
+
+    let s = provenance(&db, "3bb0c0de-0000-4000-8000-000000000201").await;
+    assert_eq!(s.digest.as_deref(), script["digest"].as_str());
+    assert_eq!(s.root_digest, s.digest);
+    assert_eq!(s.run_as_type, RunAsType::Group);
+    assert_eq!(s.worker_group, None);
+
+    let step = provenance(&db, "3bb0c0de-0000-4000-8000-000000000203").await;
+    assert_eq!(step.digest.as_deref(), flow["steps"]["a"].as_str());
+    assert_eq!(step.root_digest.as_deref(), flow["digest"].as_str());
+    assert_eq!(step.root_trigger.as_deref(), Some("f/digest/nightly"));
+    assert_eq!(step.tag, "gpu");
+    assert_eq!(step.worker_group.as_deref(), Some("gpu-group"));
+    assert_eq!(step.run_as_type, RunAsType::User);
+
+    assert_eq!(provenance(&db, "3bb0c0de-0000-4000-8000-000000000204").await.digest, None);
+}
diff --git a/backend/tests/job_token_scopes.rs b/backend/tests/job_token_scopes.rs
new file mode 100644
index 0000000000..f805168bfa
--- /dev/null
+++ b/backend/tests/job_token_scopes.rs
@@ -0,0 +1,431 @@
+//! A job token restricted by `job_token_scopes` reaches only what its scopes allow, plus the
+//! runtime routes about its own job, and no job it creates holds a wider token than it.
+
+use reqwest::StatusCode;
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use uuid::Uuid;
+use windmill_common::jobs::JobPayload;
+use windmill_test_utils::*;
+
+const OIDC_JOB: &str = "b0000000-0000-0000-0000-000000000001";
+const RUN_JOB: &str = "b0000000-0000-0000-0000-000000000002";
+const FLOW_JOB: &str = "b0000000-0000-0000-0000-000000000003";
+
+async fn insert_job(
+    db: &Pool<Postgres>,
+    id: &str,
+    parent: Option<&str>,
+    scopes: &[&str],
+) -> anyhow::Result<()> {
+    insert_job_with(db, id, parent, Some(scopes)).await
+}
+
+async fn insert_job_with(
+    db: &Pool<Postgres>,
+    id: &str,
+    parent: Option<&str>,
+    scopes: Option<&[&str]>,
+) -> anyhow::Result<()> {
+    let id = Uuid::parse_str(id)?;
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, permissioned_as, permissioned_as_email,
+            kind, script_lang, runnable_path, tag, parent_job)
+        VALUES ($1, 'test-workspace', 'test-user-3', 'u/test-user-3', 'test3@windmill.dev',
+            'script', 'deno', 'u/test-user-3/agent', 'deno', $2)",
+    )
+    .bind(id)
+    .bind(parent.map(Uuid::parse_str).transpose()?)
+    .execute(db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups,
+            workspace_id, job_token_scopes)
+        VALUES ($1, 'test3@windmill.dev', 'test-user-3', false, false, '{}', '{}',
+            'test-workspace', $2)",
+    )
+    .bind(id)
+    .bind(scopes)
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+async fn job_token(db: &Pool<Postgres>, id: &str) -> anyhow::Result<String> {
+    Ok(windmill_common::auth::create_token_for_owner(
+        db,
+        "test-workspace",
+        "u/test-user-3",
+        "ephemeral-script",
+        300,
+        "test3@windmill.dev",
+        &Uuid::parse_str(id)?,
+        None,
+        None,
+    )
+    .await?)
+}
+
+async fn insert_script(
+    db: &Pool<Postgres>,
+    path: &str,
+    hash: i64,
+    scopes: Option<&[&str]>,
+) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO script (workspace_id, created_by, content, schema, summary, description,
+            path, hash, language, lock, kind, job_token_scopes)
+        VALUES ('test-workspace', 'test-user-3', 'export function main() {}', '{}', '', '',
+            $1, $2, 'deno', '', 'script', $3)",
+    )
+    .bind(path)
+    .bind(hash)
+    .bind(scopes)
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_restricted_job_token_is_confined(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    insert_script(&db, "u/test-user-3/open", 515151, None).await?;
+    insert_script(
+        &db,
+        "u/test-user-3/oidc_only",
+        525252,
+        Some(&["oidc:write"]),
+    )
+    .await?;
+    insert_job(&db, FLOW_JOB, None, &["oidc:write"]).await?;
+    insert_job(&db, OIDC_JOB, Some(FLOW_JOB), &["oidc:write"]).await?;
+    insert_job(&db, RUN_JOB, None, &["jobs:run"]).await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    set_jwt_secret().await;
+    let base = format!(
+        "http://localhost:{}/api/w/test-workspace",
+        server.addr.port()
+    );
+    let client = reqwest::Client::new();
+    let oidc_token = job_token(&db, OIDC_JOB).await?;
+
+    let refused = [
+        client.get(format!("{base}/variables/get_value/u/test-user-3/secret")),
+        client
+            .post(format!("{base}/scripts/create"))
+            .json(&json!({})),
+        client
+            .post(format!("{base}/schedules/create"))
+            .json(&json!({})),
+        client
+            .post(format!("{base}/jobs/run/p/u/test-user-3/open"))
+            .json(&json!({})),
+    ];
+    for request in refused {
+        let resp = request.bearer_auth(&oidc_token).send().await?;
+        assert_eq!(
+            resp.status(),
+            StatusCode::FORBIDDEN,
+            "{}",
+            resp.text().await?
+        );
+    }
+    let own = client
+        .get(format!("{base}/jobs_u/get_root_job_id/{OIDC_JOB}"))
+        .bearer_auth(&oidc_token)
+        .send()
+        .await?;
+    assert_eq!(own.status(), StatusCode::OK, "{}", own.text().await?);
+    // The orchestrator reads a flow's step results with the token of the step that just ran.
+    for (job, refused) in [(FLOW_JOB, false), (RUN_JOB, true)] {
+        let resp = client
+            .get(format!("{base}/jobs/result_by_id/{job}/a"))
+            .bearer_auth(&oidc_token)
+            .send()
+            .await?;
+        assert_eq!(resp.status() == StatusCode::FORBIDDEN, refused, "{job}");
+    }
+    // Its progress reaches only the flow it runs in.
+    for (flow, refused) in [(FLOW_JOB, false), (RUN_JOB, true)] {
+        let resp = client
+            .post(format!("{base}/job_metrics/set_progress/{OIDC_JOB}"))
+            .bearer_auth(&oidc_token)
+            .json(&json!({ "percent": 50, "flow_job_id": flow }))
+            .send()
+            .await?;
+        assert_eq!(resp.status() == StatusCode::FORBIDDEN, refused, "{flow}");
+    }
+
+    // Imported queue rows bypass push, so a restricted token cannot import, even an admin's.
+    let admin_job = Uuid::parse_str("b0000000-0000-0000-0000-000000000004")?;
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, permissioned_as, permissioned_as_email,
+            kind, script_lang, runnable_path, tag)
+        VALUES ($1, 'test-workspace', 'test-user', 'u/test-user', 'test@windmill.dev',
+            'script', 'deno', 'u/test-user/agent', 'deno')",
+    )
+    .bind(admin_job)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups,
+            workspace_id, job_token_scopes)
+        VALUES ($1, 'test@windmill.dev', 'test-user', true, false, '{}', '{}', 'test-workspace',
+            '{jobs:write,jobs:run}')",
+    )
+    .bind(admin_job)
+    .execute(&db)
+    .await?;
+    let admin_token = windmill_common::auth::create_token_for_owner(
+        &db,
+        "test-workspace",
+        "u/test-user",
+        "ephemeral-script",
+        300,
+        "test@windmill.dev",
+        &admin_job,
+        None,
+        None,
+    )
+    .await?;
+    let resp = client
+        .post(format!("{base}/jobs/queue/import"))
+        .bearer_auth(&admin_token)
+        .json(&json!([]))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+    assert!(resp.text().await?.contains("cannot import"));
+    // Nor can it, even an admin's, place a child in an unrelated run: the flow-run routes
+    // trust that lineage.
+    let resp = client
+        .post(format!(
+            "{base}/jobs/run/p/u/test-user-3/open?root_job={RUN_JOB}"
+        ))
+        .bearer_auth(&admin_token)
+        .json(&json!({}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), StatusCode::CREATED, "{}", resp.text().await?);
+    let child = Uuid::parse_str(&resp.text().await?)?;
+    let claimed: bool = sqlx::query_scalar(
+        "SELECT $2 IN (parent_job, root_job, flow_innermost_root_job) IS TRUE FROM v2_job
+        WHERE id = $1",
+    )
+    .bind(child)
+    .bind(Uuid::parse_str(RUN_JOB)?)
+    .fetch_one(&db)
+    .await?;
+    assert!(!claimed);
+
+    // A job it starts is capped at its own scopes, intersected with the target's setting.
+    let run_token = job_token(&db, RUN_JOB).await?;
+    for (path, expected) in [
+        ("open", vec!["jobs:run".to_string()]),
+        ("oidc_only", vec![]),
+    ] {
+        let resp = client
+            .post(format!("{base}/jobs/run/p/u/test-user-3/{path}"))
+            .bearer_auth(&run_token)
+            .json(&json!({}))
+            .send()
+            .await?;
+        assert_eq!(resp.status(), StatusCode::CREATED);
+        let child = Uuid::parse_str(&resp.text().await?)?;
+        let scopes: Option<Vec<String>> =
+            sqlx::query_scalar("SELECT job_token_scopes FROM job_perms WHERE job_id = $1")
+                .bind(child)
+                .fetch_one(&db)
+                .await?;
+        assert_eq!(scopes, Some(expected), "child of {path}");
+    }
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_flow_steps_inherit_the_flow_restriction(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let value = json!({ "modules": [
+        { "id": "a", "value": { "type": "identity" },
+          "job_token_scopes": ["oidc:write", "variables:read"] },
+        { "id": "b", "value": { "type": "identity" } },
+    ] });
+    sqlx::query(
+        "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, edited_at,
+            schema, extra_perms, versions)
+        VALUES ('test-workspace', 'u/test-user/agent_flow', '', '', $1, 'test-user', now(), '{}',
+            '{}', '{7171}')",
+    )
+    .bind(&value)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO flow_version (id, workspace_id, path, value, schema, created_by)
+        VALUES (7171, 'test-workspace', 'u/test-user/agent_flow', $1, '{}', 'test-user')",
+    )
+    .bind(&value)
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let scopes = |v: &[&str]| Some(v.iter().map(|s| s.to_string()).collect::<Vec<_>>());
+    // A step's own setting narrows the flow's restriction and never widens it; in an
+    // unrestricted flow it restricts that step alone.
+    for (flow_scopes, expected_a, expected_b) in [
+        (scopes(&["oidc:write"]), scopes(&["oidc:write"]), scopes(&["oidc:write"])),
+        (None, scopes(&["oidc:write", "variables:read"]), None),
+    ] {
+        let flow = RunJob::from(JobPayload::Flow {
+            path: "u/test-user/agent_flow".to_string(),
+            dedicated_worker: None,
+            apply_preprocessor: false,
+            version: 7171,
+            labels: None,
+            job_token_scopes: flow_scopes.clone(),
+        })
+        .run_until_complete(&db, false, server.addr.port())
+        .await;
+
+        let steps: Vec<(String, Option<Vec<String>>)> = sqlx::query_as(
+            "SELECT j.flow_step_id, p.job_token_scopes FROM v2_job j
+            JOIN job_perms p ON p.job_id = j.id
+            WHERE j.parent_job = $1 ORDER BY j.flow_step_id",
+        )
+        .bind(flow.id)
+        .fetch_all(&db)
+        .await?;
+        assert_eq!(
+            steps,
+            vec![("a".to_string(), expected_a), ("b".to_string(), expected_b)],
+            "flow scopes {flow_scopes:?}"
+        );
+    }
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_deploy_without_the_field_keeps_the_restriction(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api/w/test-workspace", server.addr.port());
+    let client = reqwest::Client::new();
+    let script = |path: &str, scopes: Option<serde_json::Value>| {
+        let mut body = json!({
+            "path": path, "summary": "", "description": "", "content": "echo 42", "language": "bash",
+        });
+        if let Some(scopes) = scopes {
+            body["job_token_scopes"] = scopes;
+        }
+        body
+    };
+    let stored = |path: &'static str| {
+        let db = db.clone();
+        async move {
+            sqlx::query_scalar::<_, Option<Vec<String>>>(
+                "SELECT job_token_scopes FROM script WHERE path = $1 ORDER BY created_at DESC LIMIT 1",
+            )
+            .bind(path)
+            .fetch_one(&db)
+            .await
+        }
+    };
+
+    let resp = client
+        .post(format!("{base}/scripts/create"))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&script("u/test-user/agent", Some(json!(["oidc:write"]))))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), StatusCode::CREATED, "{}", resp.text().await?);
+
+    // A rename by a client that does not know the field carries the restriction along.
+    let resp = client
+        .post(format!("{base}/scripts/update/u/test-user/agent"))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&script("u/test-user/renamed", None))
+        .send()
+        .await?;
+    assert!(resp.status().is_success(), "{}", resp.text().await?);
+    assert_eq!(stored("u/test-user/renamed").await?, Some(vec!["oidc:write".to_string()]));
+
+    // An explicit null clears it.
+    let resp = client
+        .post(format!("{base}/scripts/update/u/test-user/renamed"))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&script("u/test-user/renamed", Some(serde_json::Value::Null)))
+        .send()
+        .await?;
+    assert!(resp.status().is_success(), "{}", resp.text().await?);
+    assert_eq!(stored("u/test-user/renamed").await?, None);
+    Ok(())
+}
+
+/// The OIDC `job_token_scopes` claim states the scopes of the token that asked for it.
+#[cfg(all(feature = "enterprise", feature = "private", feature = "openidconnect"))]
+#[sqlx::test(fixtures("base"))]
+async fn test_oidc_claim_carries_the_presented_scopes(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use base64::Engine;
+
+    initialize_tracing().await;
+    const OPEN_JOB: &str = "b0000000-0000-0000-0000-000000000005";
+    insert_script(&db, "u/test-user-3/agent", 535353, None).await?;
+    insert_job(&db, OIDC_JOB, None, &["oidc:write"]).await?;
+    insert_job_with(&db, OPEN_JOB, None, None).await?;
+    sqlx::query("UPDATE v2_job SET runnable_id = 535353 WHERE id = ANY($1)")
+        .bind([Uuid::parse_str(OIDC_JOB)?, Uuid::parse_str(OPEN_JOB)?])
+        .execute(&db)
+        .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, running, scheduled_for, tag)
+        SELECT id, workspace_id, true, now(), tag FROM v2_job WHERE id = ANY($1)",
+    )
+    .bind([Uuid::parse_str(OIDC_JOB)?, Uuid::parse_str(OPEN_JOB)?])
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    set_jwt_secret().await;
+    // The issuer of the minted token.
+    windmill_common::BASE_URL.store(std::sync::Arc::new("http://localhost".to_string()));
+    let base = format!(
+        "http://localhost:{}/api/w/test-workspace",
+        server.addr.port()
+    );
+    let client = reqwest::Client::new();
+    for (job, expected) in [(OIDC_JOB, json!(["oidc:write"])), (OPEN_JOB, json!(null))] {
+        let resp = client
+            .post(format!("{base}/oidc/token/test-audience"))
+            .bearer_auth(job_token(&db, job).await?)
+            .send()
+            .await?;
+        let status = resp.status();
+        let id_token = resp.text().await?;
+        assert_eq!(status, StatusCode::OK, "{id_token}");
+        let payload = id_token.split('.').nth(1).expect("a JWT payload");
+        let claims: serde_json::Value = serde_json::from_slice(
+            &base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(payload)?,
+        )?;
+        assert_eq!(claims["job_token_scopes"], expected, "{job}");
+    }
+
+    // A soft-canceled job is still `running` until its worker kills it.
+    sqlx::query("UPDATE v2_job_queue SET canceled_by = 'test-user' WHERE id = $1")
+        .bind(Uuid::parse_str(OIDC_JOB)?)
+        .execute(&db)
+        .await?;
+    let resp = client
+        .post(format!("{base}/oidc/token/test-audience"))
+        .bearer_auth(job_token(&db, OIDC_JOB).await?)
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        StatusCode::FORBIDDEN,
+        "{}",
+        resp.text().await?
+    );
+    Ok(())
+}
diff --git a/backend/tests/jobs_read_auth.rs b/backend/tests/jobs_read_auth.rs
index fd2969a18f..bffacfbaf0 100644
--- a/backend/tests/jobs_read_auth.rs
+++ b/backend/tests/jobs_read_auth.rs
@@ -476,6 +476,44 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
         );
     }
 
+    // A lock job belongs to `jobs:run:dependencies`: its path is whatever the caller sent,
+    // so a token scoped to run the flow at that path must not read it.
+    let path = "completed/get_result/19191919-1919-1919-1919-191919191919";
+    let (status, body) = get(&base, path, Some("RUN_SCOPED_DEPS_TOKEN")).await;
+    assert!(
+        status.is_success() && body.contains("DEPS_RESULT"),
+        "dependencies-scoped token must read its lock job (got {status}): {body}"
+    );
+    let (status, body) = get(&base, path, Some("RUN_SCOPED_TOKEN")).await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::NOT_FOUND,
+        "a flow-scoped token must not read a lock job (got {status}): {body}"
+    );
+    let (status, body) = get(
+        &base,
+        &format!("completed/get_result/{FLOW_JOB}"),
+        Some("RUN_SCOPED_DEPS_TOKEN"),
+    )
+    .await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::NOT_FOUND,
+        "dependencies-scoped token must not read a flow run at its path (got {status}): {body}"
+    );
+    // A lock job filed at `*` matches no path-scoped grant: the stored path is not a pattern.
+    let (status, body) = get(
+        &base,
+        "completed/get_result/20202020-2020-2020-2020-202020202020",
+        Some("RUN_SCOPED_DEPS_TOKEN"),
+    )
+    .await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::NOT_FOUND,
+        "a path-scoped token must not read a lock job filed at `*` (got {status}): {body}"
+    );
+
     // An `apps:run:<app>` scope is a start grant too: the inline-script component run it
     // launched — a kind no `jobs:run` scope can name — stays readable to a token scoped
     // to that app, and stays out of reach for one that is only scoped to run jobs.
@@ -564,6 +602,56 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
         "run-scoped token must not enumerate jobs (got {status}): {body}"
     );
 
+    // ---- PATH-SCOPED READ TOKEN: READ_SCOPED_TOKEN is test-user-2's
+    //      `jobs:read:f/shared/flow1`. It reads that flow's runs and the steps beneath
+    //      them, and nothing else its owner created.
+    for (path, expected) in [
+        (
+            format!("completed/get_result/{FLOW_JOB}"),
+            r#""flow": "done""#,
+        ),
+        (
+            format!("completed/get_result/{STEP_JOB}"),
+            "STEP_RESULT_INHERITED",
+        ),
+    ] {
+        let (status, body) = get(&base, &path, Some("READ_SCOPED_TOKEN")).await;
+        assert!(
+            status.is_success() && body.contains(expected),
+            "read-scoped token must read a run of its flow ({path}, got {status}): {body}"
+        );
+    }
+    for path in [
+        format!("completed/get_result/{VICTIM}"),
+        format!("get/{VICTIM}"),
+        format!("flow/approval_info/{VICTIM}"),
+    ] {
+        let (status, body) = get(&base, &path, Some("READ_SCOPED_TOKEN")).await;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::NOT_FOUND,
+            "read-scoped token must not read a job outside its paths ({path}, got {status}): {body}"
+        );
+    }
+    // The lists answer with the top-level runs at its paths only, where the same user's
+    // unscoped token sees the other runs too.
+    for list in ["list", "completed/list"] {
+        let (status, body) = get(&authed_base, list, Some("READ_SCOPED_TOKEN")).await;
+        assert!(status.is_success(), "{list} (got {status}): {body}");
+        let jobs: Vec<serde_json::Value> = serde_json::from_str(&body)?;
+        let mut ids: Vec<&str> = jobs.iter().filter_map(|j| j["id"].as_str()).collect();
+        ids.sort();
+        assert_eq!(ids, [WRAPPED_FLOW_JOB, FLOW_JOB], "{list}: {body}");
+    }
+    let (_, body) = get(&authed_base, "list", Some("SECRET_TOKEN_2")).await;
+    assert!(body.contains(VICTIM), "unscoped list: {body}");
+    let (status, body) = get(&authed_base, "completed/count", Some("READ_SCOPED_TOKEN")).await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::FORBIDDEN,
+        "read-scoped token must not count the workspace's jobs (got {status}): {body}"
+    );
+
     // ---- APP EMBED TOKEN: cancellation confined to the app's own jobs. The token
     //      may cancel a job it launched (created_by == viewer), but `cancel_job_api`
     //      denies (NotFound) a job created by someone else, even one the (admin)
diff --git a/backend/tests/list_jobs.rs b/backend/tests/list_jobs.rs
index 29a49c1610..d33618d048 100644
--- a/backend/tests/list_jobs.rs
+++ b/backend/tests/list_jobs.rs
@@ -957,6 +957,7 @@ async fn test_job_labels_propagated_at_push_time(db: Pool<Postgres>) -> anyhow::
             .into(),
         debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
         labels: Some(vec!["prod".to_string(), "deploy".to_string()]),
+        job_token_scopes: None,
     })
     .push(&db)
     .await;
@@ -1060,6 +1061,7 @@ async fn test_job_label_filter(db: Pool<Postgres>) -> anyhow::Result<()> {
             .into(),
         debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
         labels: Some(vec!["prod".to_string()]),
+        job_token_scopes: None,
     })
     .push(&db)
     .await;
@@ -1077,6 +1079,7 @@ async fn test_job_label_filter(db: Pool<Postgres>) -> anyhow::Result<()> {
             .into(),
         debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
         labels: Some(vec!["staging".to_string()]),
+        job_token_scopes: None,
     })
     .push(&db)
     .await;
diff --git a/backend/tests/mcp_header_var_refs.rs b/backend/tests/mcp_header_var_refs.rs
new file mode 100644
index 0000000000..158bc71a5f
--- /dev/null
+++ b/backend/tests/mcp_header_var_refs.rs
@@ -0,0 +1,110 @@
+//! An MCP resource header whose value is a `$var:` reference reaches the MCP
+//! server as the variable's value, and only for a caller allowed to read it.
+#![cfg(feature = "mcp")]
+
+use sqlx::{Pool, Postgres};
+use tokio::io::AsyncReadExt;
+use windmill_common::client::AuthedClient;
+use windmill_test_utils::*;
+use windmill_worker::{load_mcp_tools, McpResourceConfig};
+
+const SECRET_VALUE: &str = "S3CRET-MCP-HEADER-VALUE";
+
+/// A secret variable and an MCP resource at `url` sending it as a header.
+async fn seed(db: &Pool<Postgres>, url: &str) -> anyhow::Result<()> {
+    let mc = windmill_common::variables::build_crypt(db, "test-workspace").await?;
+    sqlx::query(
+        "INSERT INTO variable (workspace_id, path, value, is_secret, description, extra_perms)
+         VALUES ('test-workspace', 'u/test-user/mcp_header', $1, true, '', '{}')",
+    )
+    .bind(windmill_common::variables::encrypt(&mc, SECRET_VALUE))
+    .execute(db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO resource (workspace_id, path, value, resource_type, extra_perms, created_by)
+         VALUES ('test-workspace', 'u/test-user/mcp', $1, 'mcp', '{}', 'test-user')",
+    )
+    .bind(serde_json::json!({
+        "name": "mcp",
+        "url": url,
+        "headers": { "X-Api-Key": "$var:u/test-user/mcp_header", "X-Plain": "plain" }
+    }))
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_mcp_header_var_ref_is_resolved(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    std::env::set_var("ALLOW_PRIVATE_MCP_SERVER_URLS", "true");
+
+    // Not an MCP server: it captures the first request and hangs up, so loading
+    // fails at the connect step after the headers were sent.
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+    let mcp_port = listener.local_addr()?.port();
+    let first_request = tokio::spawn(async move {
+        let (mut socket, _) = listener.accept().await?;
+        let mut buf = vec![0u8; 16 * 1024];
+        let n = socket.read(&mut buf).await?;
+        anyhow::Ok(String::from_utf8_lossy(&buf[..n]).to_lowercase())
+    });
+    seed(&db, &format!("http://127.0.0.1:{mcp_port}/mcp")).await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let client = AuthedClient::new(
+        format!("http://localhost:{}", server.addr.port()),
+        "test-workspace".to_string(),
+        "SECRET_TOKEN".to_string(),
+        None,
+    );
+    let config = vec![McpResourceConfig {
+        resource_path: "$res:u/test-user/mcp".to_string(),
+        include_tools: None,
+        exclude_tools: None,
+    }];
+    let _ = load_mcp_tools(&db, "test-workspace", config, &client).await;
+
+    let request = first_request.await??;
+    assert!(
+        request.contains(&format!("x-api-key: {}", SECRET_VALUE.to_lowercase())),
+        "the header must carry the variable's value, not the reference: {request}"
+    );
+    assert!(request.contains("x-plain: plain"), "{request}");
+
+    Ok(())
+}
+
+/// A token scoped to the resource alone must not have the API read the
+/// variable a header points at.
+#[sqlx::test(fixtures("base"))]
+async fn test_mcp_header_var_ref_requires_variable_scope(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    seed(&db, "https://mcp.invalid.windmill.test").await?;
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('RES_ONLY_TOKEN'::bytea), 'hex'), 'RES_ONLY_T', 'RES_ONLY_TOKEN',
+                 'test@windmill.dev', 'resources only', false, '{resources:read}')",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let resp = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{}/api/w/test-workspace/resources/mcp_tools/u/test-user/mcp",
+            server.addr.port()
+        ))
+        .header("Authorization", "Bearer RES_ONLY_TOKEN")
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, reqwest::StatusCode::FORBIDDEN, "{body}");
+    assert!(
+        body.contains("variables:read:u/test-user/mcp_header"),
+        "{body}"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/nativets_stress.rs b/backend/tests/nativets_stress.rs
index 21d3911778..d1e371ef81 100644
--- a/backend/tests/nativets_stress.rs
+++ b/backend/tests/nativets_stress.rs
@@ -191,6 +191,7 @@ async fn push_job(db: &Pool<Postgres>, content: &str, args: &serde_json::Value)
         None,
         None,
         None,
+        None,
     )
     .await
     .expect("push must succeed");
diff --git a/backend/tests/otel.rs b/backend/tests/otel.rs
index 1a4040d390..30585c08a1 100644
--- a/backend/tests/otel.rs
+++ b/backend/tests/otel.rs
@@ -168,6 +168,7 @@ async fn test_all_metrics_e2e() {
     // ── Gauges ──────────────────────────────────────────────────────
 
     otel_set_queue_count("python3", 42);
+    otel_set_queue_delay("python3", 12.5);
     otel_set_queue_running_count("deno", 5);
     otel_set_worker_busy("worker-test-1", 1);
     otel_set_db_pool(5, 10, 20);
@@ -175,6 +176,10 @@ async fn test_all_metrics_e2e() {
     otel_set_worker_uptime("w-uptime", 3600.0);
     otel_set_health_status_phase("healthy");
     otel_set_health_db_unresponsive(true);
+    otel_set_worker_memory("w-res", "gpu", Some(512), Some(128), Some(1024));
+    otel_add_worker_cpu("w-res", "gpu", 1.5, 40, 7, 0.35);
+    otel_set_worker_occupancy_rate("w-res", "gpu", "5m", 0.25);
+    otel_record_job_memory_peak("python3", 100 * 1024 * 1024);
 
     // ── Histograms ──────────────────────────────────────────────────
 
@@ -188,7 +193,7 @@ async fn test_all_metrics_e2e() {
     let metrics = flush_and_get_metrics(&state);
     let names = metric_names(&metrics);
 
-    // ── Verify all 20 metric names are present ──────────────────────
+    // ── Verify all metric names are present ─────────────────────────
 
     let expected = [
         "windmill.queue.push_count",
@@ -197,6 +202,7 @@ async fn test_all_metrics_e2e() {
         "windmill.queue.zombie_restart_count",
         "windmill.queue.zombie_delete_count",
         "windmill.queue.count",
+        "windmill.queue.delay",
         "windmill.queue.running_count",
         "windmill.worker.execution_count",
         "windmill.worker.execution_duration",
@@ -211,6 +217,15 @@ async fn test_all_metrics_e2e() {
         "windmill.worker.uptime",
         "windmill.health.status",
         "windmill.health.db_unresponsive",
+        "windmill.worker.memory_usage",
+        "windmill.worker.windmill_memory_usage",
+        "windmill.worker.memory_limit",
+        "windmill.worker.cpu_usage",
+        "windmill.worker.cpu_periods",
+        "windmill.worker.cpu_throttled_periods",
+        "windmill.worker.cpu_throttled_time",
+        "windmill.worker.occupancy_rate",
+        "windmill.worker.job_memory_peak",
     ];
     for name in expected {
         assert!(
@@ -261,6 +276,9 @@ async fn test_all_metrics_e2e() {
         .expect("queue.count data point with tag=python3 not found");
     assert_eq!(dp.1, 42);
 
+    let m = find_metric(&metrics, "windmill.queue.delay").unwrap();
+    assert!((gauge_f64_value(m).unwrap() - 12.5).abs() < f64::EPSILON);
+
     let m = find_metric(&metrics, "windmill.queue.running_count").unwrap();
     let values = gauge_i64_values(m);
     let dp = values
@@ -285,6 +303,18 @@ async fn test_all_metrics_e2e() {
         .expect("worker.busy data point with worker=worker-test-1 not found");
     assert_eq!(dp.1, 1);
 
+    let m = find_metric(&metrics, "windmill.worker.memory_limit").unwrap();
+    let values = gauge_i64_values(m);
+    let dp = values
+        .iter()
+        .find(|(attrs, _)| {
+            attrs
+                .iter()
+                .any(|kv| kv.key.as_str() == "worker_group" && kv.value.as_str() == "gpu")
+        })
+        .expect("worker.memory_limit data point with worker_group=gpu not found");
+    assert_eq!(dp.1, 1024);
+
     let m = find_metric(&metrics, "windmill.db.pool.active").unwrap();
     assert_eq!(gauge_i64_values(m)[0].1, 5);
     let m = find_metric(&metrics, "windmill.db.pool.idle").unwrap();
diff --git a/backend/tests/preview_native_tag.rs b/backend/tests/preview_native_tag.rs
index eba686396a..39f985cefe 100644
--- a/backend/tests/preview_native_tag.rs
+++ b/backend/tests/preview_native_tag.rs
@@ -76,6 +76,7 @@ async fn push_preview_and_get_row(
         None,
         None,
         None,
+        None,
     )
     .await
     .expect("push must succeed");
diff --git a/backend/tests/python_jobs.rs b/backend/tests/python_jobs.rs
index 9616df267a..4236599aba 100644
--- a/backend/tests/python_jobs.rs
+++ b/backend/tests/python_jobs.rs
@@ -496,6 +496,28 @@ async def main(x: int):
         );
     }
 
+    // `hasattr` does not swallow the KeyError this `__getattr__` raises; released
+    // `wmill` clients ship an `S3Object` built this way.
+    #[test]
+    fn test_python_execd_result_with_keyerror_getattr() {
+        let script = r#"
+class AttrDict(dict):
+    def __getattr__(self, attr):
+        return self[attr]
+
+def main(x: str):
+    return AttrDict(s3=x)
+"#;
+        let results = run_py_raw_protocol_test(
+            &[("f/test/attr_dict", script)],
+            vec![ProtocolCmd::Execd { args: serde_json::json!({"x": "a/b.txt"}) }],
+        );
+        assert_eq!(
+            results,
+            vec![DedicatedWorkerResult::Success(serde_json::json!({"s3": "a/b.txt"}))]
+        );
+    }
+
     // ==================== Argument Transformation Tests ====================
 
     #[test]
@@ -1278,6 +1300,7 @@ async fn test_python_wac_v2_with_preprocessor(db: Pool<Postgres>) -> anyhow::Res
                     debouncing_settings:
                         windmill_common::runnable_settings::DebouncingSettings::default(),
                     labels: None,
+                    job_token_scopes: None,
                 })
                 .arg("who", json!("alice"))
                 .arg("count", json!(7))
diff --git a/backend/tests/restart_at_step_api.rs b/backend/tests/restart_at_step_api.rs
index c5ab703f46..f6fc2a04d3 100644
--- a/backend/tests/restart_at_step_api.rs
+++ b/backend/tests/restart_at_step_api.rs
@@ -41,6 +41,7 @@ async fn test_api_restart_at_step_nested_happy(db: Pool<Postgres>) -> anyhow::Re
         apply_preprocessor: true,
         version: 1443253234253454,
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, port)
     .await;
@@ -85,6 +86,7 @@ async fn test_api_restart_at_step_top_level_happy(db: Pool<Postgres>) -> anyhow:
         apply_preprocessor: true,
         version: 1443253234253454,
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, port)
     .await;
@@ -118,6 +120,7 @@ async fn test_api_restart_at_step_rejects_unknown_step(db: Pool<Postgres>) -> an
         apply_preprocessor: true,
         version: 1443253234253454,
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, port)
     .await;
@@ -161,6 +164,7 @@ async fn test_api_restart_at_step_rejects_out_of_range_iteration(
         apply_preprocessor: true,
         version: 1443253234253454,
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, port)
     .await;
@@ -213,7 +217,7 @@ async fn test_api_restart_at_step_rejects_parallel_loop(db: Pool<Postgres>) -> a
                     "id": "inner",
                     "value": {
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "input_transforms": {},
                         "content": "export function main() { return 'ok' }"
                     }
diff --git a/backend/tests/restart_flow_version_scope.rs b/backend/tests/restart_flow_version_scope.rs
index 82e8f8e4e7..551e8c3619 100644
--- a/backend/tests/restart_flow_version_scope.rs
+++ b/backend/tests/restart_flow_version_scope.rs
@@ -53,6 +53,7 @@ async fn push_restart(
         None,
         None,
         None,
+        None,
     )
     .await?;
     tx.commit().await?;
diff --git a/backend/tests/retry.rs b/backend/tests/retry.rs
index e804b96f0e..d80e386b61 100644
--- a/backend/tests/retry.rs
+++ b/backend/tests/retry.rs
@@ -70,12 +70,20 @@ mod retry {
 
     fn inner_step() -> &'static str {
         r#"
+import { connect } from "node:net";
+
 export async function main(index, port) {
-    const buf = new Uint8Array([0]);
-    const sock = await Deno.connect({ port });
-    await sock.write(new Uint8Array([index]));
-    if (await sock.read(buf) != 1) throw Error("read");
-    return buf[0];
+    return await new Promise((resolve, reject) => {
+        const sock = connect({ port, host: "127.0.0.1" }, () => {
+            sock.write(new Uint8Array([index]));
+        });
+        sock.on("data", (data) => {
+            resolve(data[0]);
+            sock.destroy();
+        });
+        sock.on("error", reject);
+        sock.on("close", () => reject(Error("read")));
+    });
 }
             "#
     }
@@ -105,7 +113,7 @@ def main(last, port):
                                 "port": { "type": "javascript", "expr": "flow_input.port" },
                             },
                             "type": "rawscript",
-                            "language": "deno",
+                            "language": "bun",
                             "content": inner_step(),
                         },
                     }],
@@ -281,7 +289,7 @@ def main(last, port):
                 "value": {
                     "input_transforms": {},
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return \"ok\" }",
                 },
             }, {
@@ -293,7 +301,7 @@ def main(last, port):
                         "port": { "type": "javascript", "expr": "flow_input.port" },
                     },
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": inner_step(),
                 },
                 "retry": { "constant": { "attempts": 1, "seconds": 0 } },
diff --git a/backend/tests/success_handler.rs b/backend/tests/success_handler.rs
index fe6127c27e..14df1a4c25 100644
--- a/backend/tests/success_handler.rs
+++ b/backend/tests/success_handler.rs
@@ -2,6 +2,36 @@ use sqlx::{Pool, Postgres};
 
 use windmill_test_utils::*;
 
+/// Both job-running tests seed `f/test/success_handler` with a different hash, each in its own
+/// database, while the deployed-script caches are process-global and keyed by workspace and
+/// path. With them on, one test resolves the handler to the other's hash and the handler push
+/// 404s whenever that hash's info is not cached yet.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn disable_deployed_script_cache() {
+    windmill_common::DEPLOYED_SCRIPT_CACHE_DISABLED
+        .store(true, std::sync::atomic::Ordering::Relaxed);
+}
+
+/// The handler job is pushed after the job it handles is reported complete.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn wait_for_success_handler_job(
+    db: &Pool<Postgres>,
+) -> anyhow::Result<Option<(Option<String>, Option<uuid::Uuid>)>> {
+    for _ in 0..100 {
+        let job = sqlx::query_as::<_, (Option<String>, Option<uuid::Uuid>)>(
+            "SELECT runnable_path, parent_job FROM v2_job
+             WHERE workspace_id = 'test-workspace' AND permissioned_as_email = 'success_handler@windmill.dev'",
+        )
+        .fetch_optional(db)
+        .await?;
+        if job.is_some() {
+            return Ok(job);
+        }
+        tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;
+    }
+    Ok(None)
+}
+
 /// Test that the workspace success handler cache works correctly with 60s TTL
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base"))]
@@ -108,6 +138,7 @@ async fn test_success_handler_triggered_on_success(db: Pool<Postgres>) -> anyhow
     use windmill_common::scripts::{ScriptHash, ScriptLang};
 
     initialize_tracing().await;
+    disable_deployed_script_cache();
 
     let server = ApiServer::start(db.clone()).await?;
 
@@ -123,7 +154,7 @@ export async function main(path: string, email: string, job_id: string, is_flow:
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 1234567890, 'f/test/success_handler', $1, 'deno', 'script', 'test-user', '{}', 'Success handler script', 'Handles successful job completions', '')
+        VALUES ('test-workspace', 1234567890, 'f/test/success_handler', $1, 'bun', 'script', 'test-user', '{}', 'Success handler script', 'Handles successful job completions', E'{}\n//bun.lock\n<empty>')
         "#,
         success_handler_code
     )
@@ -138,7 +169,7 @@ export async function main(path: string, email: string, job_id: string, is_flow:
     sqlx::query!(
         r#"
         INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', $1, 'f/test/simple_script', $2, 'deno', 'script', 'test-user', '{}', 'Simple test script', 'A simple test script', '')
+        VALUES ('test-workspace', $1, 'f/test/simple_script', $2, 'bun', 'script', 'test-user', '{}', 'Simple test script', 'A simple test script', E'{}\n//bun.lock\n<empty>')
         "#,
         test_script_hash,
         test_script_code
@@ -175,12 +206,13 @@ export async function main(path: string, email: string, job_id: string, is_flow:
         cache_ttl: None,
         cache_ignore_s3_path: None,
         dedicated_worker: None,
-        language: ScriptLang::Deno,
+        language: ScriptLang::Bun,
         priority: None,
         apply_preprocessor: false,
         concurrency_settings: ConcurrencySettings::default(),
         debouncing_settings: DebouncingSettings::default(),
         labels: None,
+        job_token_scopes: None,
     })
     .run_until_complete(&db, false, server.addr.port())
     .await;
@@ -190,51 +222,72 @@ export async function main(path: string, email: string, job_id: string, is_flow:
 
     let main_job_id = completed_job.id;
 
-    // Wait a short time for the success handler job to be created
-    tokio::time::sleep(tokio::time::Duration::from_millis(500)).await;
-
-    // Verify the success handler job was created (query by email since trigger is not set)
-    let success_handler_job = sqlx::query!(
-        r#"
-        SELECT
-            id,
-            runnable_path,
-            permissioned_as_email,
-            parent_job
-        FROM v2_job
-        WHERE workspace_id = 'test-workspace'
-            AND permissioned_as_email = 'success_handler@windmill.dev'
-        ORDER BY created_at DESC
-        LIMIT 1
-        "#
-    )
-    .fetch_optional(&db)
-    .await?;
-
-    assert!(
-        success_handler_job.is_some(),
-        "Success handler job should have been created"
-    );
-
-    let handler_job = success_handler_job.unwrap();
-
-    // Verify the success handler job has correct parameters
+    let handler_job = wait_for_success_handler_job(&db).await?;
     assert_eq!(
-        handler_job.runnable_path.as_deref(),
-        Some("f/test/success_handler"),
-        "Success handler should run the configured script"
-    );
-    assert_eq!(
-        handler_job.permissioned_as_email.as_str(),
-        "success_handler@windmill.dev",
-        "Success handler should run as success_handler user"
-    );
-    assert_eq!(
-        handler_job.parent_job,
-        Some(main_job_id),
-        "Success handler should have main job as parent"
+        handler_job,
+        Some((
+            Some("f/test/success_handler".to_string()),
+            Some(main_job_id)
+        )),
+        "Success handler should run the configured script with the main job as parent"
     );
     // Note: root_job may be None when it equals parent_job (optimization in push function)
 
     Ok(())
 }
+
+/// A hub script run at the top level (a schedule, a trigger, the API) is a `script_hub` job,
+/// and its success must reach the workspace success handler like a workspace script's.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[sqlx::test(fixtures("base"))]
+async fn test_success_handler_triggered_on_hub_script_success(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::jobs::JobPayload;
+
+    initialize_tracing().await;
+    disable_deployed_script_cache();
+
+    let server = ApiServer::start(db.clone()).await?;
+
+    let version = "990000003";
+    let hub_dir = &*windmill_common::worker::HUB_CACHE_DIR;
+    tokio::fs::create_dir_all(hub_dir).await?;
+    tokio::fs::write(
+        format!("{hub_dir}/{version}"),
+        r#"{"content":"echo ok","lockfile":null,"language":"bash","schema":{},"summary":null}"#,
+    )
+    .await?;
+
+    // The workspace handler settings are cached per workspace id across the tests of this
+    // binary, so this reuses the handler path every other test here configures.
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
+         VALUES ('test-workspace', 1234567891, 'f/test/success_handler', 'echo handled', 'bash', 'script', 'test-user', '{}', '', '', '')",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET success_handler = '{"path": "script/f/test/success_handler"}'::jsonb
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let completed_job = RunJob::from(JobPayload::ScriptHub {
+        path: format!("hub/{version}/test/ok"),
+        apply_preprocessor: false,
+    })
+    .run_until_complete(&db, false, server.addr.port())
+    .await;
+    assert!(completed_job.success, "Hub script should have succeeded");
+
+    let handler_job = wait_for_success_handler_job(&db).await?;
+    assert_eq!(
+        handler_job.map(|(_, parent)| parent),
+        Some(Some(completed_job.id)),
+        "Workspace success handler should handle the successful hub script"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/suspend_resume.rs b/backend/tests/suspend_resume.rs
index 6fb5d68004..0decc16519 100644
--- a/backend/tests/suspend_resume.rs
+++ b/backend/tests/suspend_resume.rs
@@ -63,11 +63,11 @@ mod suspend_resume {
                             "op": { "type": "javascript", "expr": "flow_input.op ?? 'resume'", },
                         },
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "\
                             export async function main(n, port, op) {\
-                                const job = Deno.env.get('WM_JOB_ID');
-                                const token = Deno.env.get('WM_TOKEN');
+                                const job = process.env.WM_JOB_ID;
+                                const token = process.env.WM_TOKEN;
                                 const r = await fetch(
                                     `http://localhost:${port}/api/w/test-workspace/jobs/job_signature/${job}/0?token=${token}&approver=ruben`,\
                                     {\
@@ -102,7 +102,7 @@ mod suspend_resume {
                             "resumes": { "type": "javascript", "expr": "resumes", },
                         },
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export function main(n, resume, resumes) { return { n: n + 1, resume, resumes } }"
                     },
                     "suspend": {
@@ -116,7 +116,7 @@ mod suspend_resume {
                             "resumes": { "type": "javascript", "expr": "resumes", },
                         },
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export function main(last, resume, resumes) { return { last, resume, resumes } }"
                     },
                 }],
@@ -256,11 +256,11 @@ mod suspend_resume {
                         "port": { "type": "javascript", "expr": "flow_input.port" },
                     },
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "\
                         export async function main(port) {\
-                            const job = Deno.env.get('WM_JOB_ID');\
-                            const token = Deno.env.get('WM_TOKEN');\
+                            const job = process.env.WM_JOB_ID;\
+                            const token = process.env.WM_TOKEN;\
                             const secret = await (await fetch(\
                                 `http://localhost:${port}/api/w/test-workspace/jobs/job_signature/${job}/0?token=${token}&approver=ruben`,\
                                 { headers: { 'Authorization': `Bearer ${token}` } }\
@@ -278,7 +278,7 @@ mod suspend_resume {
                 "value": {
                     "input_transforms": {},
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'b ran' }",
                 },
                 // The gate holds `b` back, so `b` never runs and its error policy describes
@@ -290,7 +290,7 @@ mod suspend_resume {
                 "value": {
                     "input_transforms": {},
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'handled' }",
                 },
             },
@@ -343,7 +343,7 @@ mod suspend_resume {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step1'; }"
                 },
                 "suspend": {
@@ -355,7 +355,7 @@ mod suspend_resume {
                 "id": "b",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step2 - after approval'; }"
                 }
             }]
@@ -454,7 +454,7 @@ mod suspend_resume {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step1'; }"
                 },
                 "suspend": {
@@ -466,7 +466,7 @@ mod suspend_resume {
                 "id": "b",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step2 - after approval'; }"
                 }
             }]
@@ -556,7 +556,7 @@ mod suspend_resume {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step1'; }"
                 },
                 "suspend": {
@@ -567,7 +567,7 @@ mod suspend_resume {
                 "id": "b",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step2 - after approval'; }"
                 }
             }]
@@ -658,7 +658,7 @@ mod suspend_resume {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step1'; }"
                 },
                 "suspend": {
@@ -670,7 +670,7 @@ mod suspend_resume {
                 "id": "b",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step2 - after approval'; }"
                 }
             }]
@@ -764,7 +764,7 @@ mod suspend_resume {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step1'; }"
                 },
                 "suspend": {
@@ -776,7 +776,7 @@ mod suspend_resume {
                 "id": "b",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return 'step2 - after approval'; }"
                 }
             }]
@@ -933,7 +933,7 @@ mod suspend_resume {
                     "suspend": { "required_events": 1, "timeout": 86400 },
                     "value": {
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export async function main() { return 1 }",
                         "input_transforms": {},
                     },
@@ -942,7 +942,7 @@ mod suspend_resume {
                     "id": "b",
                     "value": {
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export async function main() { return 42 }",
                         "input_transforms": {},
                     },
@@ -980,7 +980,7 @@ mod suspend_resume {
                     "suspend": { "required_events": APPROVALS, "timeout": 86400 },
                     "value": {
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export async function main() { return 1 }",
                         "input_transforms": {},
                     },
@@ -989,7 +989,7 @@ mod suspend_resume {
                     "id": "b",
                     "value": {
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export function main(resumes) { return resumes.length }",
                         "input_transforms": {
                             "resumes": { "type": "javascript", "expr": "resumes" },
diff --git a/backend/tests/v2_job_delete_orphans.rs b/backend/tests/v2_job_delete_orphans.rs
index 2b11deab77..45029f024d 100644
--- a/backend/tests/v2_job_delete_orphans.rs
+++ b/backend/tests/v2_job_delete_orphans.rs
@@ -205,6 +205,75 @@ async fn test_delete_jobs_removes_a_conversation_once_its_last_message_goes(
     Ok(())
 }
 
+/// The agent step completes, and so expires, before the flow run that holds the question: its
+/// job going must leave the answer in place, and the run going must take the whole turn.
+#[sqlx::test(fixtures("base"))]
+async fn test_delete_jobs_removes_a_turn_with_its_flow_run(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let flow_job = Uuid::new_v4();
+    let step_job = Uuid::new_v4();
+    insert_job(&db, WS, flow_job).await?;
+    insert_job(&db, WS, step_job).await?;
+
+    let conv_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by)
+         VALUES ($1, $2, 'f/flow', 'test-user')",
+    )
+    .bind(conv_id)
+    .bind(WS)
+    .execute(&db)
+    .await?;
+    let mut tx = db.begin().await?;
+    for (job_id, message_type) in [
+        (
+            flow_job,
+            windmill_common::flow_conversations::MessageType::User,
+        ),
+        (
+            step_job,
+            windmill_common::flow_conversations::MessageType::Assistant,
+        ),
+    ] {
+        windmill_common::flow_conversations::add_message_to_conversation_tx(
+            &mut tx,
+            conv_id,
+            Some(job_id),
+            flow_job,
+            "hi",
+            message_type,
+            None,
+            true,
+            None,
+        )
+        .await?;
+    }
+    tx.commit().await?;
+
+    let messages = "SELECT count(*) FROM flow_conversation_message WHERE conversation_id = $1";
+    let mut conn = db.acquire().await?;
+    windmill_common::jobs::delete_jobs(&mut conn, &[step_job]).await?;
+    drop(conn);
+    assert_eq!(
+        count(&db, messages, conv_id).await?,
+        2,
+        "the step's job going must keep the turn"
+    );
+
+    let mut conn = db.acquire().await?;
+    windmill_common::jobs::delete_jobs(&mut conn, &[flow_job]).await?;
+    drop(conn);
+    assert_eq!(
+        count(&db, messages, conv_id).await?,
+        0,
+        "the run going must take the turn"
+    );
+    Ok(())
+}
+
 /// Turns that start while retention is collecting their conversation must land, not fail:
 /// the conversation lookup locks the row, so each turn waits for the collector's commit,
 /// finds the conversation gone, and creates it again — the first insert wins and the other
@@ -265,6 +334,7 @@ async fn test_new_turns_wait_for_conversation_cleanup_and_recreate(
                     &mut tx,
                     conv_id,
                     Some(new_job),
+                    new_job,
                     "hi again",
                     windmill_common::flow_conversations::MessageType::User,
                     None,
diff --git a/backend/tests/wac_suspend_started_at.rs b/backend/tests/wac_suspend_started_at.rs
index 5a83730d24..ca364e5993 100644
--- a/backend/tests/wac_suspend_started_at.rs
+++ b/backend/tests/wac_suspend_started_at.rs
@@ -109,3 +109,91 @@ async fn wac_suspend_stands_down_for_a_cancel(db: Pool<Postgres>) -> anyhow::Res
 
     Ok(())
 }
+
+/// Each park clears `started_at`, so the completion would otherwise store only the last
+/// segment: a workflow that waited an hour on its tasks would read as a sub-second job that
+/// started an hour late. The completed row spans the workflow from its first start, and
+/// keeps the last segment aside: that is what is metered and what worker-time readers sum.
+#[sqlx::test]
+async fn wac_completion_spans_the_workflow_and_keeps_the_last_segment(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    let job_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, created_at, permissioned_as, \
+            permissioned_as_email, kind, script_lang, runnable_path, tag, visible_to_owner) \
+         VALUES ($1, 'test-workspace', 'test-user', now() - interval '2 hours', 'u/test-user', \
+            'test@windmill.dev', 'script', 'bun', 'u/test-user/wac', 'bun', true)",
+    )
+    .bind(job_id)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, running, tag, started_at) \
+         VALUES ($1, 'test-workspace', now(), true, 'bun', now() - interval '1 hour')",
+    )
+    .bind(job_id)
+    .execute(&db)
+    .await?;
+
+    // Two parks, each followed by the pull re-stamping `started_at`: the second park must
+    // not replace the first start with its own segment's.
+    for resumed_ago in ["10 minutes", "3 seconds"] {
+        let mut tx = db.begin().await?;
+        suspend_wac_parent(&mut tx, &job_id, "test-workspace", 1, 3600.0).await?;
+        tx.commit().await?;
+        sqlx::query(
+            "UPDATE v2_job_queue SET suspend = 0, started_at = now() - $2::text::interval \
+             WHERE id = $1",
+        )
+        .bind(job_id)
+        .bind(resumed_ago)
+        .execute(&db)
+        .await?;
+    }
+
+    let job = windmill_queue::get_mini_completed_job(&job_id, "test-workspace", &db)
+        .await?
+        .unwrap();
+    let result = serde_json::value::to_raw_value(&serde_json::json!("done"))?;
+    let (_, span) = windmill_queue::add_completed_job(
+        &db,
+        &job,
+        true,
+        false,
+        sqlx::types::Json(&result),
+        None,
+        0,
+        None,
+        false,
+        Some(3000),
+        false,
+    )
+    .await?;
+
+    let (started_ago_s, duration_ms, last_segment_ms): (f64, i64, Option<i64>) = sqlx::query_as(
+        "SELECT extract(epoch FROM now() - started_at)::float8, duration_ms, \
+                (extras->>'wac_last_segment_ms')::bigint \
+         FROM v2_job_completed WHERE id = $1",
+    )
+    .bind(job_id)
+    .fetch_one(&db)
+    .await?;
+    assert!(
+        (started_ago_s - 3600.0).abs() < 60.0,
+        "started_at must be the first start, got {started_ago_s}s ago"
+    );
+    assert!(
+        (duration_ms - 3_600_000).abs() < 60_000,
+        "duration_ms must be the wall time since the first start, got {duration_ms}"
+    );
+    assert_eq!(last_segment_ms, Some(3000));
+    assert_eq!(
+        span.duration_ms, duration_ms,
+        "a flow records the step with the span the row holds"
+    );
+    assert!(span.outlasts_run(job.started_at));
+    assert_eq!(span.last_run_ms, 3000, "only the last segment is left to meter");
+
+    Ok(())
+}
diff --git a/backend/tests/wm_token_confinement.rs b/backend/tests/wm_token_confinement.rs
index 23d88301b7..e75170ec6f 100644
--- a/backend/tests/wm_token_confinement.rs
+++ b/backend/tests/wm_token_confinement.rs
@@ -319,7 +319,7 @@ async fn test_wm_token_is_confined_to_its_workspace(db: Pool<Postgres>) -> anyho
         );
     }
     // ...and the `settings/global` keys on the allowlist, which the CLI reads from a job: on a
-    // git-sync push, and in `u/admin/hub_sync`. `ws_base_url` is the control: the handler
+    // git-sync push, and in `wmill hub pull`. `ws_base_url` is the control: the handler
     // leaves it as ungated as these, so only the allowlist stops it.
     for key in ["automate_username_creation", "uid", "hub_base_url"] {
         let resp = authed(
diff --git a/backend/tests/worker.rs b/backend/tests/worker.rs
index e00ce1172b..751752eb00 100644
--- a/backend/tests/worker.rs
+++ b/backend/tests/worker.rs
@@ -166,7 +166,7 @@ async fn test_iteration_parallel(db: Pool<Postgres>) -> anyhow::Result<()> {
 
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base"))]
-async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
+async fn test_bun_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
 
     let server = ApiServer::start(db.clone()).await?;
@@ -183,7 +183,7 @@ async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
                     id: "a".to_string(),
                     value: FlowModuleValue::RawScript {
                         input_transforms: Default::default(),
-                        language: ScriptLang::Deno,
+                        language: ScriptLang::Bun,
                         content: numbers.to_string(),
                         path: None,
                         lock: None,
@@ -212,6 +212,7 @@ async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
                 FlowModule {
                     id: "b".to_string(),
@@ -231,7 +232,7 @@ async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
                                     },
                                 )]
                                 .into(),
-                                language: ScriptLang::Deno,
+                                language: ScriptLang::Bun,
                                 content: doubles.to_string(),
                                 path: None,
                                 lock: None,
@@ -260,6 +261,7 @@ async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
                             apply_preprocessor: None,
                             pass_flow_input_directly: None,
                             debouncing: None,
+                            job_token_scopes: None,
                         }],
                         modules_node: None,
                     }
@@ -282,6 +284,7 @@ async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
             ],
             same_worker: false,
@@ -293,7 +296,7 @@ async fn test_deno_flow(db: Pool<Postgres>) -> anyhow::Result<()> {
     let port = server.addr.port();
 
     for i in 0..50 {
-        println!("deno flow iteration: {}", i);
+        println!("bun flow iteration: {}", i);
         let job = run_job_in_new_worker_until_complete(&db, false, job.clone(), port).await;
         // println!("job: {:#?}", job.flow_status);
         let result = job.json_result().unwrap();
@@ -343,13 +346,13 @@ async fn test_identity(db: Pool<Postgres>) -> anyhow::Result<()> {
 
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base"))]
-async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
+async fn test_bun_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
 
     let server = ApiServer::start(db.clone()).await?;
 
     let write_file = r#"export async function main(loop: boolean, i: number, path: string) {
-            await Deno.writeTextFile(`./shared/${path}`, `${loop} ${i}`);
+            await Bun.write(`./shared/${path}`, `${loop} ${i}`);
         }"#
     .to_string();
 
@@ -370,7 +373,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                             ),
                         ]
                         .into(),
-                        language: ScriptLang::Deno,
+                        language: ScriptLang::Bun,
                         content: write_file.clone(),
                         path: None,
                         lock: None,
@@ -398,6 +401,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
                 FlowModule {
                     id: "b".to_string(),
@@ -428,7 +432,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                                         ),
                                     ]
                                     .into(),
-                                    language: ScriptLang::Deno,
+                                    language: ScriptLang::Bun,
                                     content: write_file,
                                     path: None,
                                     lock: None,
@@ -455,6 +459,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                                 apply_preprocessor: None,
                                 pass_flow_input_directly: None,
                                 debouncing: None,
+                                job_token_scopes: None,
                             },
                             FlowModule {
                                 id: "e".to_string(),
@@ -467,9 +472,9 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                                         InputTransform::Static { value: windmill_common::worker::to_raw_value(&"outer.txt") },
                                     )]
                                     .into(),
-                                    language: ScriptLang::Deno,
+                                    language: ScriptLang::Bun,
                                     content: r#"export async function main(path: string, path2: string) {
-                                        return await Deno.readTextFile(`./shared/${path}`) + "," + await Deno.readTextFile(`./shared/${path2}`);
+                                        return await Bun.file(`./shared/${path}`).text() + "," + await Bun.file(`./shared/${path2}`).text();
                                     }"#
                                     .to_string(),
                                     path: None,
@@ -498,6 +503,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                                 apply_preprocessor: None,
                                 pass_flow_input_directly: None,
                                 debouncing: None,
+                                job_token_scopes: None,
                             },
                         ],
                         modules_node: None,
@@ -520,6 +526,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
                 FlowModule {
                     id: "c".to_string(),
@@ -539,9 +546,9 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                             ),
                         ]
                         .into(),
-                        language: ScriptLang::Deno,
+                        language: ScriptLang::Bun,
                         content: r#"export async function main(path: string, loops: string[], path2: string) {
-                            return await Deno.readTextFile(`./shared/${path}`) + "," + loops + "," + await Deno.readTextFile(`./shared/${path2}`);
+                            return await Bun.file(`./shared/${path}`).text() + "," + loops + "," + await Bun.file(`./shared/${path2}`).text();
                         }"#
                         .to_string(),
                         path: None,
@@ -569,6 +576,7 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
             ],
             same_worker: true,
@@ -610,7 +618,7 @@ async fn test_same_worker_survives_empty_branch(db: Pool<Postgres>) -> anyhow::R
                             "id": "c",
                             "value": {
                                 "type": "rawscript",
-                                "language": "deno",
+                                "language": "bun",
                                 "content": "export function main(){ return 1 }",
                             }
                         }]
@@ -622,7 +630,7 @@ async fn test_same_worker_survives_empty_branch(db: Pool<Postgres>) -> anyhow::R
                 "id": "b",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return 42 }",
                 }
             }
@@ -663,7 +671,7 @@ async fn test_flow_result_by_id(db: Pool<Postgres>) -> anyhow::Result<()> {
                     "id": "a",
                     "value": {
                         "type": "rawscript",
-                        "language": "deno",
+                        "language": "bun",
                         "content": "export function main(){ return 42 }",
                     }
                 },
@@ -678,7 +686,7 @@ async fn test_flow_result_by_id(db: Pool<Postgres>) -> anyhow::Result<()> {
                                             "value": {
                                                 "input_transforms": {"v": {"type": "javascript", "expr": "results.a"}},
                                                 "type": "rawscript",
-                                                "language": "deno",
+                                                "language": "bun",
                                                 "content": "export function main(v){ return v }",
                                             }
 
@@ -1723,6 +1731,286 @@ async fn test_postgresql_cached_connection_resets_session(
     Ok(())
 }
 
+/// The idle cached connection must not hold the server slot a job's own
+/// connection needs. A role limited to one connection stands in for a
+/// session-mode pooler with one slot, where the second job would wait forever
+/// instead of failing.
+#[sqlx::test(fixtures("base"))]
+#[serial(pg_cache)]
+async fn test_postgresql_cached_connection_released_for_other_key(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_worker::pg_executor::clear_pg_cache;
+
+    initialize_tracing().await;
+    clear_pg_cache().await;
+
+    sqlx::query(
+        "DO $$ BEGIN
+           IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'wm_pg_cache_one_conn') THEN
+             CREATE ROLE wm_pg_cache_one_conn LOGIN PASSWORD 'changeme' CONNECTION LIMIT 1;
+           END IF;
+         END $$",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Keys for the same role: one pool scope when only the sslmode differs, two
+    // when the database does, which the role's limit still counts together.
+    let run = |dbname: &str, sslmode: &str| {
+        RunJob::from(JobPayload::Code(RawCode {
+            hash: None,
+            content: "SELECT 1 as n;".into(),
+            path: None,
+            lock: None,
+            language: ScriptLang::Postgresql,
+            cache_ttl: None,
+            cache_ignore_s3_path: None,
+            dedicated_worker: None,
+            concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
+            )
+            .into(),
+            debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            modules: None,
+            tag: None,
+        }))
+        .arg(
+            "database",
+            json!({"host": "localhost", "port": 5432, "dbname": dbname,
+                   "user": "wm_pg_cache_one_conn", "password": "changeme", "sslmode": sslmode}),
+        )
+        .run_until_complete(&db, false, port)
+    };
+
+    // The evicted connection's backend exits asynchronously, so a fresh
+    // connection can briefly still count it. Retrying absorbs that; without the
+    // eviction the cached connection stays open for 60s and every retry fails.
+    for (dbname, sslmode) in [
+        ("windmill", "disable"),
+        ("windmill", "prefer"),
+        ("postgres", "disable"),
+        ("windmill", "disable"),
+    ] {
+        let mut result = json!(null);
+        for _ in 0..5 {
+            result = run(dbname, sslmode).await.json_result().unwrap();
+            if result == json!([{"n": 1}]) {
+                break;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(200)).await;
+        }
+        assert_eq!(result, json!([{"n": 1}]), "{dbname} sslmode={sslmode}");
+    }
+
+    clear_pg_cache().await;
+    Ok(())
+}
+
+/// A transaction a script leaves open must not carry over into the next job
+/// that would reuse the connection.
+#[sqlx::test(fixtures("base"))]
+#[serial(pg_cache)]
+async fn test_postgresql_open_transaction_not_reused(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use windmill_worker::pg_executor::clear_pg_cache;
+
+    initialize_tracing().await;
+    clear_pg_cache().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let dbname: String = sqlx::query_scalar("SELECT current_database()")
+        .fetch_one(&db)
+        .await?;
+
+    let run = |content: &str| {
+        RunJob::from(JobPayload::Code(RawCode {
+            hash: None,
+            content: content.to_string(),
+            path: None,
+            lock: None,
+            language: ScriptLang::Postgresql,
+            cache_ttl: None,
+            cache_ignore_s3_path: None,
+            dedicated_worker: None,
+            concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
+            )
+            .into(),
+            debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            modules: None,
+            tag: None,
+        }))
+        .arg(
+            "database",
+            json!({"host": "localhost", "port": 5432, "dbname": dbname, "user": "postgres", "password": "changeme"}),
+        )
+        .run_until_complete(&db, false, port)
+    };
+
+    run("SELECT 1 as n;").await.json_result().unwrap();
+    let opened = run("BEGIN; SELECT 1 as n;").await.json_result().unwrap();
+    assert_eq!(opened, json!([{"n": 1}]));
+    run("SELECT 2 as n;").await.json_result().unwrap();
+
+    // A connection kept in the cache with the transaction open would sit idle
+    // in it, holding its locks, and run the next job inside it.
+    let mut idle_in_transaction = -1;
+    for _ in 0..20 {
+        idle_in_transaction = sqlx::query_scalar::<_, i64>(
+            "SELECT count(*) FROM pg_stat_activity
+             WHERE datname = current_database() AND state LIKE 'idle in transaction%'",
+        )
+        .fetch_one(&db)
+        .await?;
+        if idle_in_transaction == 0 {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+    }
+    assert_eq!(idle_in_transaction, 0);
+
+    clear_pg_cache().await;
+    Ok(())
+}
+
+/// Closing the connection of a cancelled job does not stop its query: the server
+/// only notices once it next writes to the client.
+#[sqlx::test(fixtures("base"))]
+#[serial(pg_cache)]
+async fn test_postgresql_cancelled_job_stops_its_query(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use windmill_worker::pg_executor::clear_pg_cache;
+
+    initialize_tracing().await;
+    clear_pg_cache().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let dbname: String = sqlx::query_scalar("SELECT current_database()")
+        .fetch_one(&db)
+        .await?;
+    let still_running = "SELECT count(*) FROM pg_stat_activity
+         WHERE datname = current_database() AND state = 'active'
+           AND pid <> pg_backend_pid() AND query LIKE '%pg_sleep(30)%'";
+
+    let cancelled = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "SELECT pg_sleep(30);".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Postgresql,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .arg(
+        "database",
+        json!({"host": "localhost", "port": 5432, "dbname": dbname, "user": "postgres", "password": "changeme"}),
+    )
+    .run_until_complete_with(&db, false, port, |id| {
+        let (db, cancelled) = (db.clone(), cancelled.clone());
+        async move {
+            tokio::spawn(async move {
+                while sqlx::query_scalar::<_, i64>(still_running)
+                    .fetch_one(&db)
+                    .await
+                    .unwrap()
+                    == 0
+                {
+                    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+                }
+                sqlx::query("UPDATE v2_job_queue SET canceled_by = 'test-user' WHERE id = $1")
+                    .bind(id)
+                    .execute(&db)
+                    .await
+                    .unwrap();
+                cancelled.store(true, std::sync::atomic::Ordering::Relaxed);
+            });
+        }
+    })
+    .await;
+    assert!(!job.success);
+    // Otherwise the job failed before its query ran, and there was nothing to stop.
+    assert!(cancelled.load(std::sync::atomic::Ordering::Relaxed));
+
+    let mut running = -1;
+    for _ in 0..50 {
+        running = sqlx::query_scalar::<_, i64>(still_running)
+            .fetch_one(&db)
+            .await?;
+        if running == 0 {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+    }
+    assert_eq!(running, 0);
+
+    clear_pg_cache().await;
+    Ok(())
+}
+
+/// A worker alternating between two databases keeps a connection for each.
+#[sqlx::test(fixtures("base"))]
+#[serial(pg_cache)]
+async fn test_postgresql_cache_keeps_a_connection_per_database(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use std::sync::atomic::Ordering;
+    use windmill_worker::pg_executor::{clear_pg_cache, CACHE_HITS};
+
+    initialize_tracing().await;
+    clear_pg_cache().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let run = |dbname: &str| {
+        RunJob::from(JobPayload::Code(RawCode {
+            hash: None,
+            content: "SELECT current_database() as d;".into(),
+            path: None,
+            lock: None,
+            language: ScriptLang::Postgresql,
+            cache_ttl: None,
+            cache_ignore_s3_path: None,
+            dedicated_worker: None,
+            concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default(
+            )
+            .into(),
+            debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+            modules: None,
+            tag: None,
+        }))
+        .arg(
+            "database",
+            json!({"host": "localhost", "port": 5432, "dbname": dbname,
+                   "user": "postgres", "password": "changeme"}),
+        )
+        .run_until_complete(&db, false, port)
+    };
+
+    let hits_before = CACHE_HITS.load(Ordering::Relaxed);
+    for dbname in ["windmill", "postgres", "windmill", "postgres"] {
+        let result = run(dbname).await.json_result().unwrap();
+        assert_eq!(result, json!([{"d": dbname}]));
+    }
+    let hits = CACHE_HITS.load(Ordering::Relaxed) - hits_before;
+    assert_eq!(
+        hits, 2,
+        "the last two jobs should reuse a cached connection"
+    );
+
+    clear_pg_cache().await;
+    Ok(())
+}
+
 /// Runs multiple PG jobs through a SINGLE worker (like production) to verify
 /// that SET ROLE / search_path changes do not leak across jobs.
 #[sqlx::test(fixtures("base"))]
@@ -3569,7 +3857,7 @@ fn module_add_item_to_list(i: i32, id: &str) -> serde_json::Value {
                 }
             },
             "type": "rawscript",
-            "language": "deno",
+            "language": "bun",
             "content": "export function main(array, i){ array.push(i); return array }",
         }
     })
@@ -3580,7 +3868,7 @@ fn module_failure() -> serde_json::Value {
         "value": {
             "input_transforms": {},
             "type": "rawscript",
-            "language": "deno",
+            "language": "bun",
             "content": "export function main(){ throw Error('failure') }",
         }
     })
@@ -3598,7 +3886,7 @@ async fn test_branchone_simple(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3636,7 +3924,7 @@ async fn test_branchone_with_cond(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3674,7 +3962,7 @@ async fn test_branchall_sequential(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3714,7 +4002,7 @@ async fn test_branchall_simple(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3762,7 +4050,7 @@ async fn test_branchall_skip_failure(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3798,7 +4086,7 @@ async fn test_branchall_skip_failure(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3844,7 +4132,7 @@ async fn test_branchone_nested(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [] }",
                 }
             },
@@ -3903,7 +4191,7 @@ async fn test_branchall_nested(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "id": "a",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(){ return [1] }",
                 }
             },
@@ -3969,7 +4257,7 @@ async fn test_failure_module(db: Pool<Postgres>) -> anyhow::Result<()> {
                         "n": { "type": "javascript", "expr": "flow_input.n", },
                     },
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(n, l) { if (n == 0) throw Error(JSON.stringify(l)); return { l: [...l, 0] } }",
                 },
             }, {
@@ -3980,7 +4268,7 @@ async fn test_failure_module(db: Pool<Postgres>) -> anyhow::Result<()> {
                         "n": { "type": "javascript", "expr": "flow_input.n", },
                     },
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(n, l) { if (n == 1) throw Error(JSON.stringify(l)); return { l: [...l, 1] } }",
                 },
             }, {
@@ -3990,7 +4278,7 @@ async fn test_failure_module(db: Pool<Postgres>) -> anyhow::Result<()> {
                         "n": { "type": "javascript", "expr": "flow_input.n", },
                     },
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(n, l) { if (n == 2) throw Error(JSON.stringify(l)); return { l: [...l, 2] } }",
                 },
             }],
@@ -3998,7 +4286,7 @@ async fn test_failure_module(db: Pool<Postgres>) -> anyhow::Result<()> {
                 "value": {
                     "input_transforms": { "error": { "type": "javascript", "expr": "previous_result", } },
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main(error) { return { 'from failure module': error } }",
                 }
             },
@@ -4187,7 +4475,7 @@ fn hanging_step_value() -> serde_json::Value {
     serde_json::json!({
         "input_transforms": {},
         "type": "rawscript",
-        "language": "deno",
+        "language": "bun",
         "content": "export async function main() { await new Promise((r) => setTimeout(r, 600000)); }",
     })
 }
@@ -4199,7 +4487,7 @@ fn marker_failure_module() -> serde_json::Value {
         "value": {
             "input_transforms": { "error": { "type": "javascript", "expr": "previous_result", } },
             "type": "rawscript",
-            "language": "deno",
+            "language": "bun",
             "content": "export function main(error) { return { handled_unrecoverable: true, error } }",
         }
     })
@@ -4297,7 +4585,7 @@ async fn test_unrecoverable_failure_on_continue_on_error_runs_failure_module(
                 "value": {
                     "input_transforms": {},
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "content": "export function main() { return { ran_b: true }; }",
                 },
             },
@@ -4336,7 +4624,7 @@ async fn test_run_wait_result_early_return_with_failure_module(
             "id": "a",
             "value": {
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "input_transforms": {},
                 "content": "export function main() { throw new Error('boom'); }",
             },
@@ -4344,7 +4632,7 @@ async fn test_run_wait_result_early_return_with_failure_module(
         "failure_module": {
             "value": {
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "input_transforms": {},
                 "content": "export function main() { return { recovered: true } }",
             },
@@ -4410,6 +4698,142 @@ async fn test_run_wait_result_early_return_with_failure_module(
     Ok(())
 }
 
+/// `recover: true` from the error handler of a step that fails inside a loop turns the flow
+/// green, as it does for a top-level step, without changing which steps run: a loop that
+/// stops at a failed iteration still stops there, one that skips failures still carries on.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_failure_module_recover_inside_loop(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let failing_loop = |skip_failures: bool| {
+        json!({
+            "id": "loop",
+            "value": {
+                "type": "forloopflow",
+                "iterator": { "type": "static", "value": [1, 2, 3] },
+                "skip_failures": skip_failures,
+                "modules": [{
+                    "id": "a",
+                    "value": {
+                        "input_transforms": {},
+                        "type": "rawscript",
+                        "language": "bun",
+                        "content": "export function main() { throw new Error('boom'); }",
+                    },
+                }],
+            },
+        })
+    };
+    let run = |loop_step: serde_json::Value| {
+        let flow: FlowValue = serde_json::from_value(json!({
+            "modules": [loop_step, {
+                "id": "b",
+                "value": {
+                    "input_transforms": {},
+                    "type": "rawscript",
+                    "language": "bun",
+                    "content": "export function main() { return { ran_b: true } }",
+                },
+            }],
+            "failure_module": {
+                "value": {
+                    "input_transforms": {},
+                    "type": "rawscript",
+                    "language": "bun",
+                    "content": "export function main() { return { handled: true, recover: true } }",
+                },
+            },
+        }))
+        .unwrap();
+        RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
+            .run_until_complete(&db, false, port)
+    };
+    let handler_runs = || {
+        sqlx::query_scalar::<_, i64>(
+            "SELECT count(*) FROM v2_job_completed c JOIN v2_job j USING (id)
+             WHERE j.kind = 'preview' AND c.result @> '{\"handled\": true}'::jsonb",
+        )
+        .fetch_one(&db)
+    };
+
+    let stopped = run(failing_loop(false)).await;
+    let stopped_handler_runs = handler_runs().await?;
+    let skipping = run(failing_loop(true)).await;
+    let skipping_handler_runs = handler_runs().await? - stopped_handler_runs;
+    // A parallel node counts its iterations' stored status: an iteration that ended on a
+    // recovered failure must still be stored as failed there.
+    let parallel = run(json!({
+        "id": "par",
+        "value": {
+            "type": "forloopflow",
+            "iterator": { "type": "static", "value": [1, 2] },
+            "parallel": true,
+            "skip_failures": false,
+            "modules": [failing_loop(false)],
+        },
+    }))
+    .await;
+    // A recovery the inner loop absorbs, then an error raised starting the next step: that
+    // error is a new failure and must leave the flow failed.
+    #[cfg(feature = "quickjs")]
+    let chaining_error = run(json!({
+        "id": "outer",
+        "value": {
+            "type": "forloopflow",
+            "iterator": { "type": "static", "value": [1] },
+            "skip_failures": false,
+            "modules": [failing_loop(true), {
+                "id": "guarded",
+                "skip_if": { "expr": "missingFunction()" },
+                "value": { "input_transforms": {}, "type": "identity" },
+            }],
+        },
+    }))
+    .await;
+
+    server.close().await.unwrap();
+
+    #[cfg(feature = "quickjs")]
+    assert!(
+        !chaining_error.success,
+        "an error no handler recovered must keep the flow failed"
+    );
+
+    assert!(
+        stopped.success,
+        "a recovered failure inside a loop should end the flow as a success"
+    );
+    assert!(
+        stopped.json_result().unwrap().get("ran_b").is_none(),
+        "the step after the loop must not run, as without recovery"
+    );
+    assert_eq!(
+        stopped_handler_runs, 1,
+        "the loop must stop at the first failed iteration"
+    );
+
+    assert!(skipping.success);
+    assert_eq!(
+        skipping.json_result().unwrap(),
+        json!({ "ran_b": true }),
+        "a loop that skips failures runs every iteration and the following step"
+    );
+    assert_eq!(skipping_handler_runs, 3);
+
+    assert!(
+        !parallel
+            .json_result()
+            .unwrap()
+            .to_string()
+            .contains("ran_b"),
+        "the parallel loop fails as without recovery, so the step after it must not run"
+    );
+    Ok(())
+}
+
 #[cfg(feature = "python")]
 #[sqlx::test(fixtures("base"))]
 async fn test_flow_lock_all(db: Pool<Postgres>) -> anyhow::Result<()> {
@@ -4576,6 +5000,101 @@ async fn test_flow_lock_all(db: Pool<Postgres>) -> anyhow::Result<()> {
     Ok(())
 }
 
+/// A deployed flow runs a multi-step loop body as the flow node its deploy stored, which
+/// carries its own copy of the flow's `preserve_step_tags`. A preview never loads that node.
+#[sqlx::test(fixtures("base"))]
+async fn test_saved_flow_preserves_nested_step_tags(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use futures::StreamExt;
+
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = reqwest::Client::new();
+    let flow = json!({
+        "path": "g/all/saved_step_tags", "summary": "", "description": "", "tag": "python3",
+        "schema": { "type": "object", "properties": {}, "required": [] },
+        "value": {
+            "preserve_step_tags": true,
+            "modules": [{
+                "id": "loop",
+                "value": {
+                    "type": "forloopflow", "skip_failures": false,
+                    "iterator": { "type": "static", "value": [2, 3] },
+                    "modules": [{
+                        "id": "own_tag",
+                        "value": {
+                            "type": "rawscript", "language": "bun", "lock": "", "tag": "bun",
+                            "content": "export function main(n: number) { return n * n; }",
+                            "input_transforms": {
+                                "n": { "type": "javascript", "expr": "flow_input.iter.value" }
+                            }
+                        }
+                    }, {
+                        "id": "untagged",
+                        "value": {
+                            "type": "rawscript", "language": "bun", "lock": "",
+                            "content": "export function main(n: number) { return n + 1; }",
+                            "input_transforms": {
+                                "n": { "type": "javascript", "expr": "results.own_tag" }
+                            }
+                        }
+                    }]
+                }
+            }]
+        }
+    });
+    let mut completed = listen_for_completed_jobs(&db).await;
+    client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/flows/create"
+        ))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&flow)
+        .send()
+        .await?
+        .error_for_status()?;
+    let deployment = in_test_worker(&db, completed.next(), port).await.unwrap();
+    let deployed = completed_job(deployment, &db).await;
+    assert!(deployed.success, "{:?}", deployed.result);
+
+    let job_id = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/jobs/run/f/g/all/saved_step_tags"
+        ))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&json!({}))
+        .send()
+        .await?
+        .error_for_status()?
+        .text()
+        .await?
+        .parse::<Uuid>()?;
+    in_test_worker(&db, completed.find(&job_id), port).await;
+    let job = completed_job(job_id, &db).await;
+    assert!(job.success, "{:?}", job.result);
+    let tags = sqlx::query_as::<_, (String, String)>(
+        "WITH RECURSIVE descendants AS (
+            SELECT id FROM v2_job WHERE id = $1
+            UNION ALL
+            SELECT child.id FROM v2_job child JOIN descendants ON child.parent_job = descendants.id
+        )
+        SELECT DISTINCT flow_step_id, tag FROM v2_job
+        WHERE id IN (SELECT id FROM descendants) AND flow_step_id IN ('own_tag', 'untagged')
+        ORDER BY flow_step_id, tag",
+    )
+    .bind(job_id)
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        tags,
+        vec![
+            ("own_tag".to_owned(), "bun".to_owned()),
+            ("untagged".to_owned(), "python3".to_owned())
+        ]
+    );
+    Ok(())
+}
+
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base"))]
 
@@ -5276,7 +5795,7 @@ async fn test_job_labels(db: Pool<Postgres>) -> anyhow::Result<()> {
                         console.log(greet)
                         return { greet, wm_labels: ["yolo", "greet", "greet", world] };
                     }"#,
-                        "language": "deno",
+                        "language": "bun",
                         "input_transforms": {
                             "world": { "type": "javascript", "expr": "flow_input.world" }
                         }
@@ -5485,7 +6004,7 @@ async fn test_flow_substep_tag_availability_check(db: Pool<Postgres>) -> anyhow:
             "id": "a",
             "value": {
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "content": "export function main() { return 42; }",
                 "tag": "restricted-tag",
             },
@@ -5545,7 +6064,7 @@ async fn test_flow_substep_tag_checked_on_resolved_value(db: Pool<Postgres>) ->
             "id": id,
             "value": {
                 "type": "rawscript",
-                "language": "deno",
+                "language": "bun",
                 "content": "export function main() { return { lang: 'bun' } }",
                 "tag": tag,
             },
@@ -5653,6 +6172,7 @@ async fn test_flow_tag_judged_as_written_before_preprocessor(
         apply_preprocessor: true,
         version: 1443253234253456,
         labels: None,
+        job_token_scopes: None,
     })
     .as_user("test-user-2", "test2@windmill.dev")
     .run_until_complete(&db, false, port)
diff --git a/backend/tests/worker_group_pause.rs b/backend/tests/worker_group_pause.rs
new file mode 100644
index 0000000000..b528bbfd77
--- /dev/null
+++ b/backend/tests/worker_group_pause.rs
@@ -0,0 +1,71 @@
+//! In its own test binary: it flips the process-wide `WORKER_CONFIG`, which would stall every
+//! other worker test sharing the process.
+
+use futures::StreamExt;
+use sqlx::{Pool, Postgres};
+use std::time::Duration;
+use windmill_common::{
+    jobs::{JobPayload, RawCode},
+    scripts::ScriptLang,
+    worker::{Connection, WORKER_CONFIG},
+};
+use windmill_test_utils::*;
+
+fn set_paused(paused: bool) {
+    let mut wc = (**WORKER_CONFIG.load()).clone();
+    wc.paused = paused;
+    WORKER_CONFIG.store(std::sync::Arc::new(wc));
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn paused_worker_leaves_jobs_queued_until_resumed(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    set_paused(true);
+    let id = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "echo done".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Bash,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .push(&db)
+    .await;
+
+    let mut completed = listen_for_completed_jobs(&db).await;
+    in_test_worker(
+        Connection::Sql(db.clone()),
+        async {
+            tokio::time::sleep(Duration::from_secs(3)).await;
+            let running =
+                sqlx::query_scalar::<_, bool>("SELECT running FROM v2_job_queue WHERE id = $1")
+                    .bind(id)
+                    .fetch_optional(&db)
+                    .await
+                    .unwrap();
+            assert_eq!(
+                running,
+                Some(false),
+                "a paused worker must not pull the job"
+            );
+
+            set_paused(false);
+            while completed.next().await != Some(id) {}
+        },
+        port,
+    )
+    .await;
+
+    assert!(completed_job(id, &db).await.success);
+    Ok(())
+}
diff --git a/backend/tests/worker_ping_ip.rs b/backend/tests/worker_ping_ip.rs
index 772f4193c3..2421e888ef 100644
--- a/backend/tests/worker_ping_ip.rs
+++ b/backend/tests/worker_ping_ip.rs
@@ -2,10 +2,19 @@ use sqlx::{Pool, Postgres};
 use uuid::Uuid;
 use windmill_common::{
     external_ip::UNKNOWN_IP,
-    worker::{insert_ping_query, update_worker_ping_main_loop_query},
+    worker::{insert_ping_query, set_worker_draining_query, update_worker_ping_main_loop_query},
 };
 
 async fn insert_ping(db: &Pool<Postgres>, worker: &str, ip: Option<&str>) -> anyhow::Result<()> {
+    register(db, worker, ip, None).await
+}
+
+async fn register(
+    db: &Pool<Postgres>,
+    worker: &str,
+    ip: Option<&str>,
+    draining: Option<bool>,
+) -> anyhow::Result<()> {
     insert_ping_query(
         "test-instance",
         worker,
@@ -19,12 +28,33 @@ async fn insert_ping(db: &Pool<Postgres>, worker: &str, ip: Option<&str>) -> any
         None,
         None,
         false,
+        draining,
         db,
     )
     .await?;
     Ok(())
 }
 
+/// A worker re-registers mid-life once its external IP resolves. That registration must not
+/// clear a draining flag the same process already published; only a worker starting up under
+/// a reclaimed name resets it.
+#[sqlx::test]
+async fn only_a_starting_worker_resets_draining(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let draining = || async {
+        sqlx::query_scalar::<_, bool>("SELECT draining FROM worker_ping WHERE worker = 'wk-drain'")
+            .fetch_one(&db)
+            .await
+    };
+    register(&db, "wk-drain", None, Some(false)).await?;
+    set_worker_draining_query("wk-drain", &db).await?;
+    register(&db, "wk-drain", Some("1.2.3.4"), None).await?;
+    assert!(draining().await?);
+
+    register(&db, "wk-drain", None, Some(false)).await?;
+    assert!(!draining().await?);
+    Ok(())
+}
+
 /// The external IP resolves in the background, so the initial ping often has none yet. That must
 /// not blank the address a previous process wrote to the row this one reclaims — worker names are
 /// stable across restarts under EXIT_AFTER_N_JOBS.
diff --git a/backend/tests/zombie_flow_recovery.rs b/backend/tests/zombie_flow_recovery.rs
index fb658dfb03..333aac70a8 100644
--- a/backend/tests/zombie_flow_recovery.rs
+++ b/backend/tests/zombie_flow_recovery.rs
@@ -78,7 +78,7 @@ async fn test_between_steps_zombie_restart_reuses_all_children(
                         "id": "inner",
                         "value": {
                             "type": "rawscript",
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "v": { "type": "javascript", "expr": "flow_input.iter.value" }
                             },
@@ -91,7 +91,7 @@ async fn test_between_steps_zombie_restart_reuses_all_children(
                 "id": "after",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "input_transforms": {
                         "loop_res": { "type": "javascript", "expr": "results.fanout" }
                     },
@@ -210,7 +210,7 @@ async fn test_mid_iteration_zombie_not_reused(db: Pool<Postgres>) -> anyhow::Res
                         "id": "inner",
                         "value": {
                             "type": "rawscript",
-                            "language": "deno",
+                            "language": "bun",
                             "input_transforms": {
                                 "v": { "type": "javascript", "expr": "flow_input.iter.value" }
                             },
@@ -223,7 +223,7 @@ async fn test_mid_iteration_zombie_not_reused(db: Pool<Postgres>) -> anyhow::Res
                 "id": "after",
                 "value": {
                     "type": "rawscript",
-                    "language": "deno",
+                    "language": "bun",
                     "input_transforms": {
                         "loop_res": { "type": "javascript", "expr": "results.fanout" }
                     },
@@ -331,7 +331,7 @@ async fn test_nested_restart_not_swallowed_by_zombie_reuse(
                             {
                                 "id": "inner_first",
                                 "value": {
-                                    "type": "rawscript", "language": "deno",
+                                    "type": "rawscript", "language": "bun",
                                     "input_transforms": {},
                                     "content": "export function main() { return 'first' }"
                                 }
@@ -339,7 +339,7 @@ async fn test_nested_restart_not_swallowed_by_zombie_reuse(
                             {
                                 "id": "inner_second",
                                 "value": {
-                                    "type": "rawscript", "language": "deno",
+                                    "type": "rawscript", "language": "bun",
                                     "input_transforms": {
                                         "first": { "type": "javascript", "expr": "results.inner_first" }
                                     },
@@ -353,7 +353,7 @@ async fn test_nested_restart_not_swallowed_by_zombie_reuse(
             {
                 "id": "after",
                 "value": {
-                    "type": "rawscript", "language": "deno",
+                    "type": "rawscript", "language": "bun",
                     "input_transforms": {
                         "b": { "type": "javascript", "expr": "results.branch" }
                     },
@@ -466,7 +466,7 @@ async fn test_raw_flow_restart_does_not_reuse_edited_step(
                         "modules": [{
                             "id": "inner",
                             "value": {
-                                "type": "rawscript", "language": "deno",
+                                "type": "rawscript", "language": "bun",
                                 "input_transforms": {
                                     "v": { "type": "javascript", "expr": "flow_input.iter.value" }
                                 },
@@ -478,7 +478,7 @@ async fn test_raw_flow_restart_does_not_reuse_edited_step(
                 {
                     "id": "after",
                     "value": {
-                        "type": "rawscript", "language": "deno",
+                        "type": "rawscript", "language": "bun",
                         "input_transforms": {
                             "loop_res": { "type": "javascript", "expr": "results.fanout" }
                         },
@@ -578,7 +578,7 @@ async fn test_non_monitor_cancel_is_not_reused(db: Pool<Postgres>) -> anyhow::Re
                     "modules": [{
                         "id": "inner",
                         "value": {
-                            "type": "rawscript", "language": "deno",
+                            "type": "rawscript", "language": "bun",
                             "input_transforms": {
                                 "v": { "type": "javascript", "expr": "flow_input.iter.value" }
                             },
@@ -590,7 +590,7 @@ async fn test_non_monitor_cancel_is_not_reused(db: Pool<Postgres>) -> anyhow::Re
             {
                 "id": "after",
                 "value": {
-                    "type": "rawscript", "language": "deno",
+                    "type": "rawscript", "language": "bun",
                     "input_transforms": {
                         "loop_res": { "type": "javascript", "expr": "results.fanout" }
                     },
diff --git a/backend/windmill-ai/Cargo.toml b/backend/windmill-ai/Cargo.toml
index b1dea3ae54..44c4ac83c7 100644
--- a/backend/windmill-ai/Cargo.toml
+++ b/backend/windmill-ai/Cargo.toml
@@ -28,6 +28,7 @@ eventsource-stream.workspace = true
 futures.workspace = true
 http.workspace = true
 mime_guess.workspace = true
+rand.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/backend/windmill-ai/src/ai_bedrock.rs b/backend/windmill-ai/src/ai_bedrock.rs
index a9318a1f3a..f55fcca415 100644
--- a/backend/windmill-ai/src/ai_bedrock.rs
+++ b/backend/windmill-ai/src/ai_bedrock.rs
@@ -477,6 +477,29 @@ pub async fn assume_role_with_oidc_token(
 // Error Formatting
 // ============================================================================
 
+/// The error for a Bedrock stream that failed after it opened, retrying the exceptions the
+/// Vercel AI SDK retries (`amazon-bedrock-stream-error.ts`) and a broken connection. The
+/// SDK's own retries cover the opening call alone.
+pub fn bedrock_stream_error<R: std::fmt::Debug>(
+    error: &aws_sdk_bedrockruntime::error::SdkError<
+        aws_sdk_bedrockruntime::types::error::ConverseStreamOutputError,
+        R,
+    >,
+) -> Error {
+    let message = format!("Bedrock stream error: {}", format_bedrock_error(error));
+    match error.as_service_error() {
+        Some(e)
+            if !(e.is_internal_server_exception()
+                || e.is_model_stream_error_exception()
+                || e.is_service_unavailable_exception()
+                || e.is_throttling_exception()) =>
+        {
+            Error::AIError(message)
+        }
+        _ => crate::retry::transient_error(message, None),
+    }
+}
+
 /// Format AWS SDK errors with detailed information
 pub fn format_bedrock_error<E, R>(error: &aws_sdk_bedrockruntime::error::SdkError<E, R>) -> String
 where
diff --git a/backend/windmill-ai/src/ai_google.rs b/backend/windmill-ai/src/ai_google.rs
index bb8ae83e13..9f48edca8a 100644
--- a/backend/windmill-ai/src/ai_google.rs
+++ b/backend/windmill-ai/src/ai_google.rs
@@ -326,6 +326,17 @@ pub struct GeminiSSEEvent {
     pub candidates: Option<Vec<GeminiSSECandidate>>,
     #[serde(rename = "usageMetadata")]
     pub usage_metadata: Option<GeminiUsageMetadata>,
+    #[serde(default)]
+    pub error: Option<crate::retry::StreamErrorBody>,
+    #[serde(rename = "promptFeedback", default)]
+    pub prompt_feedback: Option<GeminiPromptFeedback>,
+}
+
+/// Set when Gemini refuses the prompt itself, in which case no candidate follows.
+#[derive(Deserialize, Debug)]
+pub struct GeminiPromptFeedback {
+    #[serde(rename = "blockReason", default)]
+    pub block_reason: Option<String>,
 }
 
 // ============================================================================
@@ -550,10 +561,40 @@ pub fn openai_tools_to_gemini(
     }
 }
 
+/// Follows a Gemini stream to tell a complete turn from one cut short.
+#[derive(Default)]
+pub struct GeminiTurn {
+    ended: bool,
+    has_output: bool,
+}
+
+impl GeminiTurn {
+    pub fn observe(&mut self, event: &GeminiParsedEvent) {
+        // A function call arrives whole and may come without a `finishReason`, so it
+        // counts too, as in gemini-cli's stream validation.
+        self.ended |= event.finish_reason.is_some() || !event.tool_calls.is_empty();
+        self.has_output |= event.text.is_some() || event.reasoning.is_some();
+    }
+
+    /// Whether the turn's final event arrived.
+    pub fn ended(&self) -> bool {
+        self.ended
+    }
+
+    /// Whether a stream that closed cleanly here holds the whole turn. Gemini 2.5 closes
+    /// its stream without a single event when thinking spends the whole
+    /// `maxOutputTokens`: an empty answer, which a retry would only get again, rather
+    /// than a cut one.
+    pub fn complete_at_close(&self) -> bool {
+        self.ended || !self.has_output
+    }
+}
+
 /// Parse one Gemini SSE data line into a [`GeminiParsedEvent`].
 ///
 /// Returns `Ok(None)` for empty data or unrecognised payloads (e.g. `"[DONE]"`).
 /// Logs a warning and returns `Ok(None)` on JSON parse errors rather than propagating.
+/// An error the stream reports is returned as one.
 pub fn parse_gemini_sse_event(data: &str) -> Result<Option<GeminiParsedEvent>, Error> {
     if data.is_empty() || data == "[DONE]" {
         return Ok(None);
@@ -567,6 +608,21 @@ pub fn parse_gemini_sse_event(data: &str) -> Result<Option<GeminiParsedEvent>, E
         }
     };
 
+    if let Some(error) = event.error {
+        return Err(error.into_error("Gemini"));
+    }
+
+    // `BLOCK_REASON_UNSPECIFIED` is the protobuf enum's placeholder, not a block.
+    if let Some(reason) = event
+        .prompt_feedback
+        .and_then(|f| f.block_reason)
+        .filter(|r| !matches!(r.as_str(), "" | "BLOCK_REASON_UNSPECIFIED"))
+    {
+        return Err(Error::AIError(format!(
+            "Gemini blocked the prompt: {reason}"
+        )));
+    }
+
     let mut parsed = GeminiParsedEvent { usage: event.usage_metadata, ..Default::default() };
 
     let Some(candidates) = event.candidates else {
diff --git a/backend/windmill-ai/src/ai_providers.rs b/backend/windmill-ai/src/ai_providers.rs
index a4dcbc4f35..3b3af833d6 100644
--- a/backend/windmill-ai/src/ai_providers.rs
+++ b/backend/windmill-ai/src/ai_providers.rs
@@ -39,6 +39,7 @@ lazy_static::lazy_static! {
 pub const OPENAI_BASE_URL: &str = "https://api.openai.com/v1";
 pub const DEEPSEEK_BASE_URL: &str = "https://api.deepseek.com/v1";
 pub const GOOGLE_AI_BASE_URL: &str = "https://generativelanguage.googleapis.com/v1beta";
+pub const TYPESAFE_BASE_URL: &str = "https://api.typesafe.ai/v1";
 
 /// Hosts that serve the OpenAI API with Azure conventions: Azure OpenAI
 /// (`*.openai.azure.com`), AI Foundry (`*.services.ai.azure.com`,
@@ -122,9 +123,41 @@ pub enum AIProvider {
     CustomAI,
     #[serde(rename = "aws_bedrock")]
     AWSBedrock,
+    /// TypeSafe's Jev decision model. It answers typed questions rather than chatting, so only
+    /// an AI decision runs it (`run_decision`), never the agent loop.
+    TypeSafe,
+    /// Cloudflare Workers AI, for its Jev-compatible decision models (Clef). Decisions only, as
+    /// for TypeSafe; its base URL comes from the resource's account id.
+    Cloudflare,
 }
 
+/// The Workers AI models URL of a Cloudflare account. The id goes into the path, so it is held to
+/// the characters an account id has rather than trusted to stay inside its segment.
+pub fn cloudflare_workers_ai_base_url(account_id: Option<&str>) -> Result<String> {
+    match account_id {
+        Some(id) if !id.is_empty() && id.chars().all(|c| c.is_ascii_alphanumeric()) => Ok(format!(
+            "https://api.cloudflare.com/client/v4/accounts/{id}/ai/run/@cf/cloudflare"
+        )),
+        Some(_) => Err(Error::BadRequest(
+            "The Cloudflare account_id must be letters and digits only".to_string(),
+        )),
+        None => Err(Error::BadRequest(
+            "A Cloudflare resource needs an account_id".to_string(),
+        )),
+    }
+}
 impl AIProvider {
+    /// A provider that answers decisions (typed questions) and serves no chat.
+    pub fn is_decision_provider(&self) -> bool {
+        matches!(self, AIProvider::TypeSafe | AIProvider::Cloudflare)
+    }
+
+    /// A provider an AI decision runs on: the decision providers, and OpenAI, whose Decisions
+    /// API sits next to its chat routes on the same resource.
+    pub fn runs_decisions(&self) -> bool {
+        self.is_decision_provider() || matches!(self, AIProvider::OpenAI)
+    }
+
     /// Get the base URL for the AI provider
     pub async fn get_base_url(&self, resource_base_url: Option<String>, db: &DB) -> Result<String> {
         if let Some(base_url) = resource_base_url {
@@ -177,6 +210,10 @@ impl AIProvider {
             AIProvider::TogetherAI => Ok("https://api.together.xyz/v1".to_string()),
             AIProvider::Anthropic => Ok("https://api.anthropic.com/v1".to_string()),
             AIProvider::Mistral => Ok("https://api.mistral.ai/v1".to_string()),
+            AIProvider::TypeSafe => Ok(TYPESAFE_BASE_URL.to_string()),
+            AIProvider::Cloudflare => Err(Error::BadRequest(
+                "A Cloudflare resource needs an account_id".to_string(),
+            )),
             p @ (AIProvider::CustomAI | AIProvider::AzureOpenAI | AIProvider::AzureFoundry) => {
                 Err(Error::BadRequest(format!(
                     "{:?} provider requires a base URL in the resource",
diff --git a/backend/windmill-ai/src/decision.rs b/backend/windmill-ai/src/decision.rs
new file mode 100644
index 0000000000..b3a35dab2a
--- /dev/null
+++ b/backend/windmill-ai/src/decision.rs
@@ -0,0 +1,556 @@
+//! AI decision steps: one call to a decision endpoint, which answers typed questions (`choice`,
+//! `score`, `noul`) about a state with calibrated probabilities instead of text. The questions and
+//! answers are System One's (TypeSafe's Jev, Cloudflare's Jev-compatible Clef on Workers AI);
+//! OpenAI's Decisions API is asked and read through a translation to that shape.
+
+use std::time::Duration;
+
+use serde::{Deserialize, Serialize};
+use serde_json::{value::RawValue, Map, Value};
+use windmill_common::error::{Error, Result};
+
+use crate::{
+    ai_providers::AIProvider,
+    credentials::ProviderCredentials,
+    proxy::{common_outbound_headers, retain_effective_credentials},
+    types::{ProviderWithResource, TokenUsage},
+    utils::pinned_ai_client_for,
+};
+
+/// The inputs of an AI decision step or tool, as its `input_transforms` resolve them.
+#[derive(Deserialize, Debug)]
+pub struct AIDecisionArgs {
+    pub provider: ProviderWithResource,
+    #[serde(default)]
+    pub state: Option<Value>,
+    #[serde(default)]
+    pub questions: Option<Value>,
+}
+
+/// The alias TypeSafe keeps on its current model, sent when the step names none.
+pub const TYPESAFE_DEFAULT_MODEL: &str = "jev-latest";
+/// Cloudflare's larger decision model, run when the step names none.
+pub const CLOUDFLARE_DEFAULT_MODEL: &str = "clef";
+/// The model OpenAI's Decisions API serves, run when the step names none.
+pub const OPENAI_DEFAULT_MODEL: &str = "gpt-6-luna";
+
+#[derive(Serialize)]
+struct SystemOneRequest<'a> {
+    model: &'a str,
+    state: &'a Value,
+    questions: &'a Map<String, Value>,
+}
+
+#[derive(Deserialize)]
+struct SystemOneResponse {
+    #[serde(default)]
+    model: Option<String>,
+    answers: Box<RawValue>,
+    #[serde(default)]
+    usage: Option<SystemOneUsage>,
+}
+
+/// Workers AI wraps the System One response in its API envelope.
+#[derive(Deserialize)]
+struct CloudflareEnvelope {
+    result: SystemOneResponse,
+}
+
+#[derive(Deserialize)]
+struct SystemOneUsage {
+    input_tokens: Option<i32>,
+    output_tokens: Option<i32>,
+}
+
+/// A decision's result. `output` holds the answers keyed by question name, where an agent's
+/// holds its answer, so a later step reads both as `results.<step>.output`.
+#[derive(Serialize)]
+pub struct DecisionResult {
+    pub output: Box<RawValue>,
+    /// The version that answered, which `jev-latest` resolves to.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub usage: Option<TokenUsage>,
+}
+
+/// The state and questions of a decision, refused here rather than by the endpoint when
+/// either is missing or of a shape TypeSafe rejects: a flow that passes an empty expression result
+/// should read what it forgot, without a request going out.
+pub fn decision_inputs<'a>(
+    state: Option<&'a Value>,
+    questions: Option<&'a Value>,
+) -> Result<(&'a Value, &'a Map<String, Value>)> {
+    let state = match state {
+        None | Some(Value::Null) => {
+            return Err(Error::BadRequest(
+                "'state' must be provided for an AI decision".to_string(),
+            ))
+        }
+        Some(Value::String(s)) if s.trim().is_empty() => {
+            return Err(Error::BadRequest(
+                "'state' must be provided for an AI decision".to_string(),
+            ))
+        }
+        Some(state @ (Value::String(_) | Value::Object(_) | Value::Array(_))) => state,
+        Some(_) => {
+            return Err(Error::BadRequest(
+                "'state' must be a text, an object or an array for an AI decision".to_string(),
+            ))
+        }
+    };
+    let questions = match questions {
+        Some(Value::Object(questions)) if !questions.is_empty() => questions,
+        _ => {
+            return Err(Error::BadRequest(
+                "'questions' must be an object naming at least one question for an AI decision"
+                    .to_string(),
+            ))
+        }
+    };
+    Ok((state, questions))
+}
+
+/// Posts a decision request with the resource's bearer key and returns the response body.
+async fn post_decision<T: Serialize>(
+    credentials: &ProviderCredentials,
+    endpoint: &str,
+    vendor: &str,
+    payload: &T,
+    timeout: Duration,
+) -> Result<String> {
+    let auth_headers = retain_effective_credentials(
+        credentials,
+        vec![(
+            "Authorization",
+            format!(
+                "Bearer {}",
+                credentials.api_key.as_deref().unwrap_or_default()
+            ),
+        )],
+    );
+
+    // The endpoint derives from the resource's base URL, so the connect is pinned to the
+    // address the SSRF check validated.
+    let client = pinned_ai_client_for(&credentials.base_url).await?;
+    let mut request = client.post(endpoint).timeout(timeout);
+    for (name, value) in auth_headers {
+        request = request.header(name, value);
+    }
+    for (name, value) in common_outbound_headers(credentials) {
+        request = request.header(name, value);
+    }
+
+    let response = request
+        .json(payload)
+        .send()
+        .await
+        .map_err(|e| Error::ExecutionErr(format!("Failed to call {vendor}: {e}")))?;
+
+    let status = response.status();
+    if !status.is_success() {
+        let body = response
+            .text()
+            .await
+            .unwrap_or_else(|_| "<failed to read body>".to_string());
+        return Err(Error::ExecutionErr(format!(
+            "{vendor} error calling {endpoint}: {status} - {body}"
+        )));
+    }
+
+    response
+        .text()
+        .await
+        .map_err(|e| Error::ExecutionErr(format!("Failed to read the {vendor} response: {e}")))
+}
+
+/// Answers a decision on the endpoint its provider serves.
+pub async fn run_decision(
+    credentials: &ProviderCredentials,
+    model: &str,
+    state: &Value,
+    questions: &Map<String, Value>,
+    timeout: Duration,
+) -> Result<DecisionResult> {
+    if credentials.provider == AIProvider::OpenAI {
+        run_openai_decisions(credentials, model, state, questions, timeout).await
+    } else {
+        run_systemone(credentials, model, state, questions, timeout).await
+    }
+}
+
+#[derive(Serialize)]
+struct OpenAIDecisionsRequest<'a> {
+    model: &'a str,
+    input: Value,
+    questions: Vec<Value>,
+}
+
+#[derive(Deserialize)]
+struct OpenAIDecisionsResponse {
+    #[serde(default)]
+    model: Option<String>,
+    answers: Vec<Map<String, Value>>,
+    #[serde(default)]
+    usage: Option<SystemOneUsage>,
+}
+
+/// The state as a Decisions `input`. OpenAI reads a text or a list of user messages, so a list of
+/// user messages (the only way to pass an image) goes as it is and any other object or array,
+/// a chat history included, as its JSON text.
+fn openai_input(state: &Value) -> Value {
+    match state {
+        Value::String(_) => state.clone(),
+        Value::Array(items) if !items.is_empty() && items.iter().all(is_openai_user_message) => {
+            state.clone()
+        }
+        _ => Value::String(state.to_string()),
+    }
+}
+
+/// Exactly a message the Decisions API reads: `role: "user"` with a text, or with parts that are
+/// each an `input_text` or an `input_image`.
+fn is_openai_user_message(message: &Value) -> bool {
+    let is_part = |part: &Value| match part.get("type").and_then(Value::as_str) {
+        Some("input_text") => part.get("text").is_some_and(Value::is_string),
+        Some("input_image") => part.get("image_url").is_some_and(Value::is_string),
+        _ => false,
+    };
+    message.get("role").and_then(Value::as_str) == Some("user")
+        && match message.get("content") {
+            Some(Value::String(_)) => true,
+            Some(Value::Array(parts)) => !parts.is_empty() && parts.iter().all(is_part),
+            _ => false,
+        }
+}
+
+/// The questions as OpenAI's Decisions API takes them: a list naming each question, with a
+/// `noul` asked as its `predicate` and each score level as a label.
+fn openai_questions(questions: &Map<String, Value>) -> Result<Vec<Value>> {
+    let text = |v: &Value| match v {
+        Value::String(s) => s.clone(),
+        v => v.to_string(),
+    };
+    // A structured description goes as its JSON text, as structured instructions do.
+    let stated = |description: Option<&Value>| match description {
+        None | Some(Value::Null) => None,
+        Some(Value::String(d)) if d.trim().is_empty() => None,
+        Some(d) => Some(text(d)),
+    };
+    questions
+        .iter()
+        .map(|(name, question)| {
+            let criteria = question.get("criteria");
+            let mut instructions = question.get("instructions").map(text).unwrap_or_default();
+            let mut asked = Map::new();
+            let kind = match question.get("type").and_then(Value::as_str) {
+                Some("choice") => {
+                    let choices = criteria
+                        .and_then(Value::as_object)
+                        .filter(|c| !c.is_empty())
+                        .ok_or_else(|| {
+                            Error::BadRequest(format!(
+                                "The choice question '{name}' needs its options as 'criteria'"
+                            ))
+                        })?
+                        .iter()
+                        .map(|(value, d)| match stated(Some(d)) {
+                            Some(d) => serde_json::json!({"value": value, "description": d}),
+                            None => serde_json::json!({"value": value}),
+                        })
+                        .collect();
+                    asked.insert("choices".to_string(), Value::Array(choices));
+                    "choice"
+                }
+                Some("score") => {
+                    let levels = criteria
+                        .and_then(Value::as_array)
+                        .filter(|c| !c.is_empty())
+                        .ok_or_else(|| {
+                            Error::BadRequest(format!(
+                                "The score question '{name}' needs its levels as 'criteria'"
+                            ))
+                        })?
+                        .iter()
+                        .map(|level| serde_json::json!({"label": text(level)}))
+                        .collect();
+                    asked.insert("levels".to_string(), Value::Array(levels));
+                    "score"
+                }
+                Some("noul") => {
+                    for (key, meaning) in [("true", "Yes"), ("false", "No")] {
+                        if let Some(d) = stated(criteria.and_then(|c| c.get(key))) {
+                            instructions.push_str(&format!("\n{meaning}: {d}"));
+                        }
+                    }
+                    "predicate"
+                }
+                other => {
+                    return Err(Error::BadRequest(format!(
+                    "The question '{name}' has type {}, which is not 'choice', 'score' or 'noul'",
+                    other.map_or("none".to_string(), |t| format!("'{t}'"))
+                )))
+                }
+            };
+            asked.insert("type".to_string(), kind.into());
+            asked.insert("name".to_string(), name.as_str().into());
+            asked.insert("instructions".to_string(), instructions.into());
+            Ok(Value::Object(asked))
+        })
+        .collect()
+}
+
+/// OpenAI's answers keyed by question name, as every decision's are. A predicate's probability is
+/// also given as `noul`, so a flow reads a yes/no answer the same way whichever provider gave it.
+/// A refused question fails the decision: left in the output it has no `choice` or `noul`, so a
+/// branch on it would quietly take its "no" or default arm.
+fn openai_answers(answers: Vec<Map<String, Value>>) -> Result<Map<String, Value>> {
+    let mut by_name = Map::new();
+    for mut answer in answers {
+        let Some(Value::String(name)) = answer.remove("name") else {
+            continue;
+        };
+        match answer.get("type").and_then(Value::as_str) {
+            Some("refusal") => {
+                return Err(Error::ExecutionErr(format!(
+                    "OpenAI refused to answer the question '{name}': {}",
+                    Value::Object(answer)
+                )))
+            }
+            Some("predicate") => {
+                if let Some(probability) = answer.get("probability").cloned() {
+                    answer.insert("noul".to_string(), probability);
+                }
+            }
+            _ => {}
+        }
+        by_name.insert(name, Value::Object(answer));
+    }
+    Ok(by_name)
+}
+
+async fn run_openai_decisions(
+    credentials: &ProviderCredentials,
+    model: &str,
+    state: &Value,
+    questions: &Map<String, Value>,
+    timeout: Duration,
+) -> Result<DecisionResult> {
+    let model = match model.trim() {
+        "" => OPENAI_DEFAULT_MODEL,
+        model => model,
+    };
+    let endpoint = format!("{}/decisions", credentials.base_url.trim_end_matches('/'));
+    let body = post_decision(
+        credentials,
+        &endpoint,
+        "OpenAI",
+        &OpenAIDecisionsRequest {
+            model,
+            input: openai_input(state),
+            questions: openai_questions(questions)?,
+        },
+        timeout,
+    )
+    .await?;
+    let parsed = serde_json::from_str::<OpenAIDecisionsResponse>(&body)
+        .map_err(|e| Error::ExecutionErr(format!("Unexpected OpenAI response ({e}): {body}")))?;
+
+    Ok(DecisionResult {
+        output: serde_json::value::to_raw_value(&openai_answers(parsed.answers)?)
+            .map_err(|e| Error::internal_err(format!("serializing decision answers: {e}")))?,
+        model: parsed.model,
+        usage: parsed
+            .usage
+            .map(|u| TokenUsage::from_input_output(u.input_tokens, u.output_tokens))
+            .filter(|u| !u.is_empty()),
+    })
+}
+
+async fn run_systemone(
+    credentials: &ProviderCredentials,
+    model: &str,
+    state: &Value,
+    questions: &Map<String, Value>,
+    timeout: Duration,
+) -> Result<DecisionResult> {
+    let cloudflare = credentials.provider == AIProvider::Cloudflare;
+    let model = match model.trim() {
+        "" if cloudflare => CLOUDFLARE_DEFAULT_MODEL,
+        "" => TYPESAFE_DEFAULT_MODEL,
+        model => model,
+    };
+    let base = credentials.base_url.trim_end_matches('/');
+    // Workers AI serves each model at its own URL; the model goes into the path, so it is held to
+    // the characters a model id has.
+    let endpoint = if cloudflare {
+        if !model
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
+        {
+            return Err(Error::BadRequest(format!(
+                "Invalid Cloudflare decision model: {model}"
+            )));
+        }
+        format!("{base}/{model}")
+    } else {
+        format!("{base}/systemone")
+    };
+    let vendor = if cloudflare { "Cloudflare" } else { "TypeSafe" };
+    let body = post_decision(
+        credentials,
+        &endpoint,
+        vendor,
+        &SystemOneRequest { model, state, questions },
+        timeout,
+    )
+    .await?;
+    // Tried in turn rather than as an untagged enum, which cannot hold the raw `answers`.
+    let parsed = match serde_json::from_str::<SystemOneResponse>(&body) {
+        Ok(parsed) => parsed,
+        Err(e) => match serde_json::from_str::<CloudflareEnvelope>(&body) {
+            Ok(envelope) => envelope.result,
+            Err(_) => {
+                return Err(Error::ExecutionErr(format!(
+                    "Unexpected {vendor} response ({e}): {body}"
+                )))
+            }
+        },
+    };
+
+    Ok(DecisionResult {
+        output: parsed.answers,
+        model: parsed.model,
+        // Dropped when empty, as an agent's is, so `usage` is either counted or absent.
+        usage: parsed
+            .usage
+            .map(|u| TokenUsage::from_input_output(u.input_tokens, u.output_tokens))
+            .filter(|u| !u.is_empty()),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    /// The account id goes into the URL path, so anything that could leave its segment is refused.
+    #[test]
+    fn cloudflare_account_id_stays_in_its_segment() {
+        use crate::ai_providers::cloudflare_workers_ai_base_url;
+        assert_eq!(
+            cloudflare_workers_ai_base_url(Some("abc123")).unwrap(),
+            "https://api.cloudflare.com/client/v4/accounts/abc123/ai/run/@cf/cloudflare"
+        );
+        for id in [None, Some("a/b"), Some("../x"), Some("a?b"), Some("")] {
+            assert!(cloudflare_workers_ai_base_url(id).is_err(), "{id:?}");
+        }
+    }
+
+    /// A `noul` goes out as a predicate with its yes/no meanings in the instructions, and comes
+    /// back readable as `noul`; choices and levels go out as lists, answers come back by name.
+    #[test]
+    fn openai_questions_and_answers_translate() {
+        let questions = json!({
+            "intent": {"type": "choice", "instructions": "Why?", "criteria": {"refund": {"when": "paid"}, "bug": ""}},
+            "urgency": {"type": "score", "instructions": "How urgent?", "criteria": ["Can wait", "Now"]},
+            "angry": {"type": "noul", "instructions": "Angry?", "criteria": {"true": "Insults"}}
+        });
+        let asked = Value::Array(openai_questions(questions.as_object().unwrap()).unwrap());
+        assert_eq!(
+            asked,
+            json!([
+                {"choices": [
+                    {"value": "refund", "description": "{\"when\":\"paid\"}"},
+                    {"value": "bug"}
+                ], "type": "choice", "name": "intent", "instructions": "Why?"},
+                {"levels": [
+                    {"label": "Can wait"},
+                    {"label": "Now"}
+                ], "type": "score", "name": "urgency", "instructions": "How urgent?"},
+                {"type": "predicate", "name": "angry", "instructions": "Angry?\nYes: Insults"}
+            ])
+        );
+        for bad in [
+            json!({"q": {"type": "choice", "instructions": "?"}}),
+            json!({"q": {"type": "score", "instructions": "?", "criteria": []}}),
+            json!({"q": {"type": "predicate", "instructions": "?"}}),
+        ] {
+            assert!(openai_questions(bad.as_object().unwrap()).is_err(), "{bad}");
+        }
+
+        let answers = serde_json::from_value(json!([
+            {"type": "predicate", "name": "angry", "probability": 0.92},
+            {"type": "choice", "name": "intent", "choice": "refund", "confidence": 0.9}
+        ]))
+        .unwrap();
+        assert_eq!(
+            Value::Object(openai_answers(answers).unwrap()),
+            json!({
+                "angry": {"type": "predicate", "probability": 0.92, "noul": 0.92},
+                "intent": {"type": "choice", "choice": "refund", "confidence": 0.9}
+            })
+        );
+
+        let messages = json!([{"role": "user", "content": [{"type": "input_text", "text": "hi"}]}]);
+        assert_eq!(openai_input(&messages), messages);
+        assert_eq!(openai_input(&json!({"m": "hi"})), json!("{\"m\":\"hi\"}"));
+        assert_eq!(
+            openai_input(&json!([{"role": "admin"}])),
+            json!("[{\"role\":\"admin\"}]")
+        );
+        for records in [
+            json!([{"role": "user", "content": {"ticket": "charged twice"}}]),
+            json!([{"role": "user", "content": null}]),
+            json!([{"role": "user", "content": ["a"]}]),
+            json!([{"role": "user", "content": [{"type": "input_text", "text": {"t": 1}}]}]),
+            json!([{"role": "user", "content": [{"type": "input_image"}]}]),
+        ] {
+            assert_eq!(openai_input(&records), json!(records.to_string()));
+        }
+        assert_eq!(
+            openai_input(&json!([{"role": "user", "content": "Hi"}])),
+            json!([{"role": "user", "content": "Hi"}])
+        );
+        // A chat history is evaluated as text: OpenAI takes user messages only.
+        let history =
+            json!([{"role": "user", "content": "Hi"}, {"role": "assistant", "content": "Yo"}]);
+        assert_eq!(openai_input(&history), json!(history.to_string()));
+        let refused =
+            serde_json::from_value(json!([{"type": "refusal", "name": "angry"}])).unwrap();
+        assert!(openai_answers(refused).is_err());
+    }
+
+    /// Refused are the values a flow produces when it forgot the input (no key, `null`, a blank
+    /// string from an empty expression) and the scalars TypeSafe rejects. A text, an object or an
+    /// array is a state, whatever it holds.
+    #[test]
+    fn decision_inputs_refuse_what_typesafe_would() {
+        let questions = json!({"urgent": {"type": "noul", "instructions": "Is it urgent?"}});
+        for state in [
+            None,
+            Some(json!(null)),
+            Some(json!("  ")),
+            Some(json!(false)),
+            Some(json!(0)),
+        ] {
+            let err = decision_inputs(state.as_ref(), Some(&questions)).unwrap_err();
+            assert!(err.to_string().contains("'state'"), "{err}");
+        }
+        for state in [json!("0"), json!({}), json!([]), json!({"m": "hi"})] {
+            assert!(
+                decision_inputs(Some(&state), Some(&questions)).is_ok(),
+                "{state}"
+            );
+        }
+        for questions in [
+            None,
+            Some(json!({})),
+            Some(json!([])),
+            Some(json!("urgent")),
+        ] {
+            let err = decision_inputs(Some(&json!("hi")), questions.as_ref()).unwrap_err();
+            assert!(err.to_string().contains("'questions'"), "{err}");
+        }
+    }
+}
diff --git a/backend/windmill-ai/src/image_handler.rs b/backend/windmill-ai/src/image_handler.rs
index 5bd9794da5..a4f360cdb4 100644
--- a/backend/windmill-ai/src/image_handler.rs
+++ b/backend/windmill-ai/src/image_handler.rs
@@ -47,6 +47,9 @@ pub async fn upload_image_to_s3(
     })
 }
 
+// Bounds each attachment's download before base64 expansion; provider limits may be lower.
+const MAX_S3_MEDIA_BYTES: usize = 30 * 1024 * 1024;
+
 /// Download an S3 image and convert it to a base64 data URL.
 ///
 /// The caller must provide an AuthedClient authorized for `workspace_id`.
@@ -57,7 +60,12 @@ pub async fn download_and_encode_s3_image(
 ) -> Result<(String, String), Error> {
     // Download the image from S3
     let image_bytes = client
-        .download_s3_file(workspace_id, &image.s3, image.storage.clone())
+        .download_s3_file(
+            workspace_id,
+            &image.s3,
+            image.storage.clone(),
+            Some(MAX_S3_MEDIA_BYTES),
+        )
         .await
         .map_err(|e| Error::internal_err(format!("Failed to download S3 image: {}", e)))?;
 
diff --git a/backend/windmill-ai/src/lib.rs b/backend/windmill-ai/src/lib.rs
index e81d030ed3..634614a3cf 100644
--- a/backend/windmill-ai/src/lib.rs
+++ b/backend/windmill-ai/src/lib.rs
@@ -5,11 +5,13 @@ pub mod ai_google;
 pub mod ai_providers;
 pub mod ai_types;
 pub mod credentials;
+pub mod decision;
 pub mod image_handler;
 pub mod model_context;
 pub mod providers;
 pub mod proxy;
 pub mod query_builder;
+pub mod retry;
 pub mod sse;
 pub mod types;
 pub mod utils;
diff --git a/backend/windmill-ai/src/providers/bedrock.rs b/backend/windmill-ai/src/providers/bedrock.rs
index 836244a666..5aa142a127 100644
--- a/backend/windmill-ai/src/providers/bedrock.rs
+++ b/backend/windmill-ai/src/providers/bedrock.rs
@@ -9,11 +9,12 @@
 use super::{anthropic_model_rejects_sampling_params, REASONING_OFF_SENTINEL};
 use crate::{
     ai_bedrock::{
-        bedrock_model_supports_prompt_caching, bedrock_stream_event_is_block_stop,
-        bedrock_stream_event_to_reasoning_delta, bedrock_stream_event_to_text,
-        bedrock_stream_event_to_tool_delta, bedrock_stream_event_to_tool_delta_with_block_index,
-        bedrock_stream_event_to_tool_start, bedrock_stream_event_to_tool_start_with_block_index,
-        build_tool_config, create_inference_config, format_bedrock_error, json_to_document,
+        bedrock_model_supports_prompt_caching, bedrock_stream_error,
+        bedrock_stream_event_is_block_stop, bedrock_stream_event_to_reasoning_delta,
+        bedrock_stream_event_to_text, bedrock_stream_event_to_tool_delta,
+        bedrock_stream_event_to_tool_delta_with_block_index, bedrock_stream_event_to_tool_start,
+        bedrock_stream_event_to_tool_start_with_block_index, build_tool_config,
+        create_inference_config, format_bedrock_error, json_to_document,
         openai_messages_to_bedrock, streaming_tool_calls_to_openai, BearerTokenProvider,
         BedrockClient, StreamingToolCall,
     },
@@ -24,6 +25,7 @@ use crate::{
     image_handler::prepare_messages_for_api,
     proxy::ProxyBuildArgs,
     query_builder::{ParsedResponse, StreamEventSink},
+    retry::{openai_stream_error_chunk, truncated_stream_error},
     types::{OpenAIMessage, StreamingEvent, TokenUsage, ToolDef},
 };
 use bytes::Bytes;
@@ -461,26 +463,31 @@ pub fn sdk_stream_to_sse(
     async_stream::stream! {
         let mut stream = stream;
         let mut state = BedrockSseStreamState::new(id, model, created);
+        let mut message_stopped = false;
 
-        loop {
+        let failure = loop {
             match stream.recv().await {
                 Ok(Some(event)) => {
+                    if matches!(
+                        event,
+                        aws_sdk_bedrockruntime::types::ConverseStreamOutput::MessageStop(_)
+                    ) {
+                        message_stopped = true;
+                    }
                     for chunk in bedrock_sse_chunks_for_event(&event, &mut state) {
                         yield Ok(chunk);
                     }
                 }
-                Ok(None) => break,
-                Err(e) => {
-                    yield Err(std::io::Error::new(
-                        std::io::ErrorKind::Other,
-                        e.to_string(),
-                    ));
-                    break;
-                }
+                Ok(None) => break (!message_stopped).then(truncated_stream_error),
+                Err(_) if message_stopped => break None,
+                Err(e) => break Some(bedrock_stream_error(&e)),
             }
-        }
+        };
 
-        yield Ok(Bytes::from("data: [DONE]\n\n"));
+        match failure {
+            Some(error) => yield Ok(Bytes::from(openai_stream_error_chunk(&error))),
+            None => yield Ok(Bytes::from("data: [DONE]\n\n")),
+        }
     }
 }
 
@@ -1081,11 +1088,19 @@ impl BedrockQueryBuilder {
         // Claude reasoning block for the turn (only populated when thinking is on),
         // attached to the first tool call for replay before toolUse.
         let mut reasoning: Option<crate::ai_types::BedrockExtraContent> = None;
+        let mut message_stopped = false;
 
         // Process stream events using shared parsing functions
         loop {
             match stream.recv().await {
                 Ok(Some(event)) => {
+                    if matches!(
+                        event,
+                        aws_sdk_bedrockruntime::types::ConverseStreamOutput::MessageStop(_)
+                    ) {
+                        message_stopped = true;
+                    }
+
                     // Fold reasoning deltas into the turn's reasoning block (for
                     // replay before toolUse, required by Claude when thinking is
                     // on) and stream the readable summary as a thinking affordance.
@@ -1161,11 +1176,13 @@ impl BedrockQueryBuilder {
                     }
                 }
                 Ok(None) => break,
-                Err(e) => {
-                    return Err(Error::internal_err(format!("Bedrock stream error: {}", e)));
-                }
+                Err(_) if message_stopped => break,
+                Err(e) => return Err(bedrock_stream_error(&e)),
             }
         }
+        if !message_stopped {
+            return Err(truncated_stream_error());
+        }
 
         // Send tool call events to stream processor
         if let Some(processor) = stream_event_sink.as_ref() {
diff --git a/backend/windmill-ai/src/providers/google_ai.rs b/backend/windmill-ai/src/providers/google_ai.rs
index 97d0383ba4..bbf45e5e57 100644
--- a/backend/windmill-ai/src/providers/google_ai.rs
+++ b/backend/windmill-ai/src/providers/google_ai.rs
@@ -5,17 +5,20 @@ use crate::{
         parse_gemini_response, parse_gemini_sse_event, sanitize_schema_for_google,
         GeminiFunctionDeclaration, GeminiGenerationConfig, GeminiImageContent, GeminiImageRequest,
         GeminiImageResponse, GeminiInlineData, GeminiPart, GeminiPredictContent, GeminiTextRequest,
-        GeminiThinkingConfig, GeminiTool,
+        GeminiThinkingConfig, GeminiTool, GeminiTurn,
     },
     image_handler::{download_and_encode_s3_image, prepare_messages_for_api},
     proxy::{ProxyBuildArgs, ProxyRequest},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
+    retry::{
+        openai_stream_error_chunk, send_with_retries, transient_error, truncated_stream_error,
+    },
     sse::{GeminiSSEParser, SSEParser},
     types::*,
 };
 use async_trait::async_trait;
 use bytes::Bytes;
-use eventsource_stream::Eventsource;
+use eventsource_stream::{EventStreamError, Eventsource};
 use futures::{stream::BoxStream, StreamExt};
 use http::{header, HeaderMap, HeaderValue, Method, StatusCode};
 use serde::Deserialize;
@@ -336,9 +339,7 @@ pub async fn handle_google_ai_chat_proxy(
 ) -> Result<GoogleAIProxyResponse, Error> {
     let GoogleAIProxyRequest { request, model, stream } = build_google_ai_chat_proxy_request(args)?;
 
-    let response =
-        send_google_ai_proxy_request(client, request, "Failed to send request to Gemini API")
-            .await?;
+    let response = send_google_ai_proxy_request(client, request).await?;
 
     if stream {
         Ok(convert_streaming_response(response, &model))
@@ -356,8 +357,7 @@ pub async fn handle_google_ai_models_proxy(
     args: &ProxyBuildArgs<'_>,
 ) -> Result<GoogleAIProxyResponse, Error> {
     let request = build_google_ai_models_proxy_request(args);
-    let response =
-        send_google_ai_proxy_request(client, request, "Failed to fetch Gemini models").await?;
+    let response = send_google_ai_proxy_request(client, request).await?;
 
     let gemini_resp: GeminiModelsResponse = response.json().await.map_err(|e| {
         Error::internal_err(format!("Failed to parse Gemini models response: {}", e))
@@ -505,26 +505,13 @@ fn add_google_ai_auth_header(headers: &mut Vec<(String, String)>, api_key: &str,
 async fn send_google_ai_proxy_request(
     client: &reqwest::Client,
     proxy_request: ProxyRequest,
-    send_error_message: &str,
 ) -> Result<reqwest::Response, Error> {
     let mut request = client.request(proxy_request.method.clone(), &proxy_request.url);
     for (header_name, header_value) in &proxy_request.headers {
         request = request.header(header_name.as_str(), header_value.as_str());
     }
 
-    let response = request
-        .body(proxy_request.body)
-        .send()
-        .await
-        .map_err(|e| Error::internal_err(format!("{}: {}", send_error_message, e)))?;
-
-    if let Err(e) = response.error_for_status_ref() {
-        let status = e.status().map(|s| s.to_string()).unwrap_or_default();
-        let body = response.text().await.unwrap_or_default();
-        return Err(Error::AIError(format!("{}: {}", status, body)));
-    }
-
-    Ok(response)
+    send_with_retries(request.body(proxy_request.body)).await
 }
 
 fn convert_streaming_response(response: reqwest::Response, model: &str) -> GoogleAIProxyResponse {
@@ -535,10 +522,15 @@ fn convert_streaming_response(response: reqwest::Response, model: &str) -> Googl
     let openai_sse_stream = async_stream::stream! {
         tokio::pin!(gemini_sse_stream);
         let mut tool_call_index: usize = 0;
-        while let Some(event) = gemini_sse_stream.next().await {
+        let mut turn = GeminiTurn::default();
+        let failure = loop {
+            let Some(event) = gemini_sse_stream.next().await else {
+                break (!turn.complete_at_close()).then(truncated_stream_error);
+            };
             match event {
                 Ok(event) => match parse_gemini_sse_event(&event.data) {
                     Ok(Some(parsed)) => {
+                        turn.observe(&parsed);
                         for chunk in gemini_event_to_openai_sse_chunks(
                             &parsed, &id, &model, &mut tool_call_index,
                         ) {
@@ -546,12 +538,23 @@ fn convert_streaming_response(response: reqwest::Response, model: &str) -> Googl
                         }
                     }
                     Ok(None) => {}
-                    Err(e) => tracing::error!("Error parsing Gemini SSE event: {}", e),
+                    Err(e) => break Some(e),
                 },
+                Err(EventStreamError::Transport(_)) if turn.ended() => break None,
+                Err(EventStreamError::Transport(e)) => {
+                    break Some(transient_error(
+                        format!("The connection to Gemini broke off mid-response: {e}"),
+                        None,
+                    ));
+                }
                 Err(e) => tracing::error!("Error reading Gemini SSE stream: {}", e),
             }
-        }
-        yield Ok::<Bytes, reqwest::Error>(Bytes::from("data: [DONE]\n\n"));
+        };
+        let last = match failure {
+            Some(error) => openai_stream_error_chunk(&error),
+            None => "data: [DONE]\n\n".to_string(),
+        };
+        yield Ok::<Bytes, reqwest::Error>(Bytes::from(last));
     }
     .boxed();
 
diff --git a/backend/windmill-ai/src/providers/mod.rs b/backend/windmill-ai/src/providers/mod.rs
index b5b6281264..7dcddc93a3 100644
--- a/backend/windmill-ai/src/providers/mod.rs
+++ b/backend/windmill-ai/src/providers/mod.rs
@@ -62,9 +62,13 @@ const REASONING_RULES: &[ReasoningRule] = &[
         can_disable: false,
         completions_tools_need_off: false,
     },
-    // Live-verified: astra takes low..max only, where sol and luna also take `none`.
+    // Live-verified: gpt-6-astra and gpt-6.1-sol take low..max only, where gpt-6-sol and
+    // gpt-6-luna also take `none`.
     ReasoningRule {
-        matches: |m| base_id(m).starts_with("gpt-6-astra"),
+        matches: |m| {
+            let base = base_id(m);
+            base.starts_with("gpt-6-astra") || base.starts_with("gpt-6.1-sol")
+        },
         can_disable: false,
         completions_tools_need_off: true,
     },
@@ -204,6 +208,12 @@ pub fn create_query_builder(
         AIProvider::AzureFoundry if AIProvider::is_anthropic_model(model) => Box::new(
             AnthropicQueryBuilder::new(AIProvider::AzureFoundry, AIPlatform::Standard),
         ),
+        // Only for forwarding through the API proxy, which is bearer auth on `<base>/<path>` as
+        // TypeSafe and Cloudflare expect. Neither serves a chat route for its decision models, and
+        // `run_agent` refuses both before a chat request could be built.
+        AIProvider::TypeSafe | AIProvider::Cloudflare => {
+            Box::new(OtherQueryBuilder::new(credentials.provider.clone()))
+        }
         _ => Box::new(OtherQueryBuilder::new(credentials.provider.clone())),
     }
 }
diff --git a/backend/windmill-ai/src/providers/other.rs b/backend/windmill-ai/src/providers/other.rs
index 1ea54a7e79..fea8edbdac 100644
--- a/backend/windmill-ai/src/providers/other.rs
+++ b/backend/windmill-ai/src/providers/other.rs
@@ -266,6 +266,7 @@ impl QueryBuilder for OtherQueryBuilder {
             mut events_str,
             stream_event_processor,
             usage: openai_usage,
+            ..
         } = openai_sse_parser;
 
         // Process streaming events with error handling
diff --git a/backend/windmill-ai/src/proxy.rs b/backend/windmill-ai/src/proxy.rs
index 3af8f88a1d..887cab0f3e 100644
--- a/backend/windmill-ai/src/proxy.rs
+++ b/backend/windmill-ai/src/proxy.rs
@@ -72,7 +72,9 @@ pub fn proxy_execution_mode(provider: &AIProvider) -> ProxyExecutionMode {
         | AIProvider::Groq
         | AIProvider::OpenRouter
         | AIProvider::TogetherAI
-        | AIProvider::CustomAI => ProxyExecutionMode::HttpForward,
+        | AIProvider::CustomAI
+        | AIProvider::TypeSafe
+        | AIProvider::Cloudflare => ProxyExecutionMode::HttpForward,
         AIProvider::GoogleAI => ProxyExecutionMode::NativeGoogleAi,
         AIProvider::AWSBedrock => ProxyExecutionMode::NativeAwsBedrock,
     }
@@ -444,6 +446,8 @@ mod tests {
             (AIProvider::OpenRouter, ProxyExecutionMode::HttpForward),
             (AIProvider::TogetherAI, ProxyExecutionMode::HttpForward),
             (AIProvider::CustomAI, ProxyExecutionMode::HttpForward),
+            (AIProvider::TypeSafe, ProxyExecutionMode::HttpForward),
+            (AIProvider::Cloudflare, ProxyExecutionMode::HttpForward),
             (AIProvider::GoogleAI, ProxyExecutionMode::NativeGoogleAi),
             (AIProvider::AWSBedrock, ProxyExecutionMode::NativeAwsBedrock),
         ];
diff --git a/backend/windmill-ai/src/query_builder.rs b/backend/windmill-ai/src/query_builder.rs
index 986c433f42..a08d01dadd 100644
--- a/backend/windmill-ai/src/query_builder.rs
+++ b/backend/windmill-ai/src/query_builder.rs
@@ -1,5 +1,7 @@
+use std::borrow::Cow;
+
 use async_trait::async_trait;
-use windmill_common::{client::AuthedClient, error::Error};
+use windmill_common::{client::AuthedClient, error::Error, utils::strip_json_nul};
 use windmill_types::s3::S3Object;
 
 use crate::ai_types::OpenAIToolCall;
@@ -92,6 +94,39 @@ pub enum ParsedResponse {
     },
 }
 
+impl ParsedResponse {
+    /// Drops every U+0000 the model emitted. Postgres stores neither a NUL in `text` nor its
+    /// `\u0000` escape in `jsonb`, and this output is written to both: tool job args, the flow
+    /// status, agent memory, conversation rows.
+    pub fn without_nul(mut self) -> Self {
+        fn strip(s: &mut String) {
+            if s.contains('\0') {
+                s.retain(|c| c != '\0');
+            }
+        }
+        if let ParsedResponse::Text { content, reasoning, tool_calls, annotations, .. } = &mut self
+        {
+            for text in [content, reasoning].into_iter().flatten() {
+                strip(text);
+            }
+            for annotation in annotations {
+                strip(&mut annotation.url);
+                annotation.title.as_mut().into_iter().for_each(strip);
+            }
+            for tool_call in tool_calls {
+                strip(&mut tool_call.id);
+                strip(&mut tool_call.function.name);
+                // Arguments are serialized JSON, where a NUL is spelled as its escape.
+                strip(&mut tool_call.function.arguments);
+                if let Cow::Owned(stripped) = strip_json_nul(&tool_call.function.arguments) {
+                    tool_call.function.arguments = stripped;
+                }
+            }
+        }
+        self
+    }
+}
+
 /// Trait for streaming AI events to a sink (e.g., database persistence).
 /// Implemented by the worker's StreamEventProcessor.
 #[async_trait]
diff --git a/backend/windmill-ai/src/retry.rs b/backend/windmill-ai/src/retry.rs
new file mode 100644
index 0000000000..9de9d309da
--- /dev/null
+++ b/backend/windmill-ai/src/retry.rs
@@ -0,0 +1,474 @@
+use std::time::Duration;
+
+use reqwest::{header::HeaderMap, RequestBuilder, Response, StatusCode};
+use windmill_common::error::{to_anyhow, Error};
+
+/// How many times a provider call is retried after its first attempt.
+pub const MAX_RETRIES: u32 = 3;
+const BASE_DELAY: Duration = Duration::from_secs(1);
+const MAX_BACKOFF: Duration = Duration::from_secs(10);
+/// A provider that asks for a longer wait is out of capacity for longer than anyone should
+/// block on (a spent daily quota, say), so its error is returned instead of waited out.
+const MAX_RETRY_AFTER: Duration = Duration::from_secs(60);
+
+/// A provider call that failed for a reason a later attempt may not meet: the provider was
+/// overloaded, throttled or unreachable, or its response broke off part way.
+#[derive(Debug)]
+pub struct TransientAIError {
+    pub message: String,
+    /// The wait the provider asked for, when it named one.
+    pub retry_after: Option<Duration>,
+}
+
+impl std::fmt::Display for TransientAIError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for TransientAIError {}
+
+pub fn transient_error(message: impl Into<String>, retry_after: Option<Duration>) -> Error {
+    to_anyhow(TransientAIError { message: message.into(), retry_after }).into()
+}
+
+pub fn as_transient(error: &Error) -> Option<&TransientAIError> {
+    match error {
+        Error::Anyhow { error, .. } => error.downcast_ref::<TransientAIError>(),
+        _ => None,
+    }
+}
+
+/// The error to report once a transient failure is no longer retried, without the source
+/// location `Error::Anyhow` renders.
+pub fn into_final_error(error: Error) -> Error {
+    match as_transient(&error) {
+        Some(transient) => Error::AIError(transient.message.clone()),
+        None => error,
+    }
+}
+
+/// The statuses the OpenAI and Anthropic SDKs and the Vercel AI SDK retry.
+fn is_retryable_status(status: u16) -> bool {
+    matches!(status, 408 | 409 | 429 | 500..=599)
+}
+
+/// The error for a provider's error response. The rules follow the OpenAI and Anthropic
+/// SDKs (`x-should-retry`, then the status) and gemini-cli (a daily quota is spent until
+/// tomorrow, and the wait Gemini asks for is in its body).
+pub fn response_error(
+    status: StatusCode,
+    headers: &HeaderMap,
+    body: &str,
+    message: String,
+) -> Error {
+    let retryable = match headers.get("x-should-retry").and_then(|v| v.to_str().ok()) {
+        Some("true") => true,
+        Some("false") => false,
+        _ => {
+            is_retryable_status(status.as_u16())
+                // OpenAI answers a spent balance with the 429 it also uses for rate limits.
+                && !body.contains("insufficient_quota")
+                && !google_quota_spent_for_the_day(body)
+        }
+    };
+    if retryable {
+        transient_error(
+            message,
+            retry_after(headers).or_else(|| google_retry_delay(body)),
+        )
+    } else {
+        Error::AIError(message)
+    }
+}
+
+/// The `details` of a Google API error body, where Gemini puts its quota and retry hints.
+fn google_error_details(body: &str) -> Vec<serde_json::Value> {
+    serde_json::from_str::<serde_json::Value>(body)
+        .ok()
+        .and_then(|v| v.get("error")?.get("details")?.as_array().cloned())
+        .unwrap_or_default()
+}
+
+fn google_quota_spent_for_the_day(body: &str) -> bool {
+    google_error_details(body).iter().any(|detail| {
+        detail
+            .get("violations")
+            .and_then(|v| v.as_array())
+            .is_some_and(|violations| {
+                violations.iter().any(|violation| {
+                    violation
+                        .get("quotaId")
+                        .and_then(|id| id.as_str())
+                        .is_some_and(|id| id.contains("PerDay") || id.contains("Daily"))
+                })
+            })
+    })
+}
+
+/// The `RetryInfo.retryDelay` of a Google API error, a protobuf duration such as `"53s"`.
+fn google_retry_delay(body: &str) -> Option<Duration> {
+    google_error_details(body).iter().find_map(|detail| {
+        let delay = detail.get("retryDelay")?.as_str()?.strip_suffix('s')?;
+        let seconds = delay
+            .parse::<f64>()
+            .ok()
+            .filter(|v| v.is_finite() && *v >= 0.0)?;
+        Some(Duration::try_from_secs_f64(seconds).unwrap_or(Duration::MAX))
+    })
+}
+
+/// The wait a provider asked for in its `retry-after-ms` or `retry-after` header. An
+/// HTTP-date `retry-after` is ignored, which falls back to the computed backoff.
+fn retry_after(headers: &HeaderMap) -> Option<Duration> {
+    let seconds = |name: &str, scale: f64| {
+        headers
+            .get(name)?
+            .to_str()
+            .ok()?
+            .trim()
+            .parse::<f64>()
+            .ok()
+            .filter(|v| v.is_finite() && *v >= 0.0)
+            .map(|v| Duration::try_from_secs_f64(v / scale).unwrap_or(Duration::MAX))
+    };
+    seconds("retry-after-ms", 1000.0).or_else(|| seconds("retry-after", 1.0))
+}
+
+/// The error object a provider sends inside a stream: OpenAI-compatible chunks carry
+/// `type` and a string or status `code`, Anthropic `type`, Gemini a status `code` and
+/// `status`.
+#[derive(Debug, Default, serde::Deserialize)]
+pub struct StreamErrorBody {
+    #[serde(default)]
+    pub message: Option<String>,
+    #[serde(default, rename = "type")]
+    pub kind: Option<String>,
+    #[serde(default)]
+    pub code: Option<serde_json::Value>,
+    #[serde(default)]
+    pub status: Option<String>,
+}
+
+impl StreamErrorBody {
+    /// The error for a failure an OpenAI-compatible or Gemini stream reported after opening
+    /// with a 200, classified as the Vercel AI SDK classifies OpenAI stream errors
+    /// (`openai-stream-error.ts`): the status `code` holds, else the status its code and type
+    /// name, else a server error.
+    pub fn into_error(self, provider: &str) -> Error {
+        let code = self.code_str();
+        let discriminator = [code.as_deref(), self.kind.as_deref()]
+            .into_iter()
+            .flatten()
+            .collect::<Vec<_>>()
+            .join(" ")
+            .to_lowercase();
+        let has = |terms: &[&str]| terms.iter().any(|term| discriminator.contains(term));
+        let status = match code.as_deref().and_then(|code| code.parse::<u16>().ok()) {
+            Some(status @ 400..=599) => status,
+            _ if has(&["insufficient_quota", "rate_limit"]) => 429,
+            _ if has(&["authentication"]) => 401,
+            _ if has(&["permission"]) => 403,
+            _ if has(&["not_found"]) => 404,
+            _ if has(&["invalid", "bad_request", "context_length"]) => 400,
+            _ if has(&["overload"]) => 503,
+            _ if has(&["timeout"]) => 504,
+            _ => 500,
+        };
+        let retryable = !has(&["insufficient_quota"]) && is_retryable_status(status);
+        self.into_classified_error(provider, retryable)
+    }
+
+    /// The error for a failure an Anthropic stream reported after opening with a 200. The
+    /// kinds retried are those the Vercel AI SDK retries, plus `timeout_error`, which
+    /// Anthropic documents as its 504; any other kind is a fault in the request or account.
+    pub fn into_anthropic_error(self) -> Error {
+        let retryable = matches!(
+            self.kind.as_deref(),
+            Some("api_error" | "overloaded_error" | "rate_limit_error" | "timeout_error")
+        );
+        self.into_classified_error("Anthropic", retryable)
+    }
+
+    fn code_str(&self) -> Option<String> {
+        match self.code.as_ref()? {
+            serde_json::Value::String(code) => Some(code.clone()),
+            serde_json::Value::Number(code) => Some(code.to_string()),
+            _ => None,
+        }
+    }
+
+    fn into_classified_error(self, provider: &str, retryable: bool) -> Error {
+        let kind = [self.kind.clone(), self.code_str(), self.status]
+            .into_iter()
+            .flatten()
+            .collect::<Vec<_>>()
+            .join("/");
+        let message = format!(
+            "{provider} stream error{}: {}",
+            (!kind.is_empty())
+                .then(|| format!(" ({kind})"))
+                .unwrap_or_default(),
+            self.message.as_deref().unwrap_or("no details")
+        );
+        if retryable {
+            transient_error(message, None)
+        } else {
+            Error::AIError(message)
+        }
+    }
+}
+
+/// The error for a stream that closed before the provider sent the event ending a
+/// complete response: cut off by the provider or by a proxy in between.
+pub fn truncated_stream_error() -> Error {
+    transient_error(
+        "The AI provider's response stream ended before the response was complete",
+        None,
+    )
+}
+
+/// An OpenAI-format stream chunk reporting `error`, which ends a response converted to that
+/// format after it started streaming: the chat's OpenAI SDK throws on a chunk carrying
+/// `error`, where a bare end of stream would read as a finished answer.
+pub fn openai_stream_error_chunk(error: &Error) -> String {
+    let message = as_transient(error).map_or_else(|| error.to_string(), |t| t.message.clone());
+    format!(
+        "data: {}\n\n",
+        serde_json::json!({ "error": { "message": message } })
+    )
+}
+
+/// Sends a provider request, retrying a transient failure while nothing of the response
+/// has been read: a failed connection or an error status. Once retries are spent the error
+/// carries the provider's answer, as a single attempt's would.
+pub async fn send_with_retries(request: RequestBuilder) -> Result<Response, Error> {
+    let mut backoff = Backoff::default();
+    loop {
+        // A streamed body cannot be replayed, so such a request is sent once.
+        let Some(attempt) = request.try_clone() else {
+            return send_once(request).await.map_err(into_final_error);
+        };
+        let error = match send_once(attempt).await {
+            Ok(response) => return Ok(response),
+            Err(error) => error,
+        };
+        let Some(delay) = as_transient(&error).and_then(|t| backoff.next_delay(t)) else {
+            return Err(into_final_error(error));
+        };
+        tracing::warn!(
+            "AI provider call failed ({error}); retrying in {:.1}s ({}/{MAX_RETRIES})",
+            delay.as_secs_f64(),
+            backoff.retries()
+        );
+        tokio::time::sleep(delay).await;
+    }
+}
+
+/// The error for a provider request that failed before any response arrived. The request
+/// timeout is the caller's whole budget, so a timed-out call leaves no time for another
+/// attempt; a connect timeout has its own, shorter one.
+pub fn send_error(e: reqwest::Error, context: &str) -> Error {
+    let message = format!("{context}: {e}");
+    if e.is_builder() || (e.is_timeout() && !e.is_connect()) {
+        Error::AIError(message)
+    } else {
+        transient_error(message, None)
+    }
+}
+
+async fn send_once(request: RequestBuilder) -> Result<Response, Error> {
+    let response = request
+        .send()
+        .await
+        .map_err(|e| send_error(e, "Failed to reach the AI provider"))?;
+    let status = response.status();
+    if status.is_client_error() || status.is_server_error() {
+        let headers = response.headers().clone();
+        let body = response.text().await.unwrap_or_default();
+        return Err(response_error(status, &headers, &body, body.clone()));
+    }
+    Ok(response)
+}
+
+/// Counts the retries of one provider call and spaces them out.
+#[derive(Debug, Default)]
+pub struct Backoff {
+    retries: u32,
+}
+
+impl Backoff {
+    /// The wait before retrying a call that failed with `error`, or `None` once it should
+    /// fail instead.
+    pub fn next_delay(&mut self, error: &TransientAIError) -> Option<Duration> {
+        if self.retries >= MAX_RETRIES {
+            return None;
+        }
+        let delay = match error.retry_after {
+            Some(wait) if wait > MAX_RETRY_AFTER => return None,
+            // A zero wait would retry back to back, so it gets the computed backoff.
+            Some(wait) if !wait.is_zero() => wait,
+            // Jittered, so callers throttled together do not come back together.
+            _ => (BASE_DELAY * 2u32.pow(self.retries))
+                .min(MAX_BACKOFF)
+                .mul_f64(0.5 + rand::random::<f64>() * 0.5),
+        };
+        self.retries += 1;
+        Some(delay)
+    }
+
+    /// Retries granted so far.
+    pub fn retries(&self) -> u32 {
+        self.retries
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Error responses as providers send them, each with the retry decision of the client
+    /// the rule is taken from.
+    #[test]
+    fn classifies_error_responses() {
+        const GEMINI_QUOTA: &str = r#"{"error":{"code":429,"status":"RESOURCE_EXHAUSTED","details":[{"@type":"type.googleapis.com/google.rpc.QuotaFailure","violations":[{"quotaId":"QUOTA_ID"}]},{"@type":"type.googleapis.com/google.rpc.RetryInfo","retryDelay":"53s"}]}}"#;
+        let cases: &[(u16, &[(&str, &str)], &str, Option<Option<u64>>)] = &[
+            (
+                429,
+                &[],
+                r#"{"error":{"code":"rate_limit_exceeded"}}"#,
+                Some(None),
+            ),
+            (
+                429,
+                &[],
+                r#"{"error":{"type":"insufficient_quota","code":"insufficient_quota"}}"#,
+                None,
+            ),
+            (
+                529,
+                &[],
+                r#"{"type":"error","error":{"type":"overloaded_error"}}"#,
+                Some(None),
+            ),
+            (501, &[], "", Some(None)),
+            (400, &[], "", None),
+            (401, &[], "", None),
+            (400, &[("x-should-retry", "true")], "", Some(None)),
+            (503, &[("x-should-retry", "false")], "", None),
+            (429, &[("retry-after", "2")], "", Some(Some(2))),
+            (
+                429,
+                &[],
+                &GEMINI_QUOTA.replace("QUOTA_ID", "GenerateRequestsPerMinutePerProjectPerModel"),
+                Some(Some(53)),
+            ),
+            (
+                429,
+                &[],
+                &GEMINI_QUOTA.replace(
+                    "QUOTA_ID",
+                    "GenerateRequestsPerDayPerProjectPerModel-FreeTier",
+                ),
+                None,
+            ),
+        ];
+        for (status, headers, body, expected) in cases {
+            let headers = headers
+                .iter()
+                .map(|(k, v)| (k.parse().unwrap(), v.parse().unwrap()))
+                .collect::<HeaderMap>();
+            let error = response_error(
+                StatusCode::from_u16(*status).unwrap(),
+                &headers,
+                body,
+                String::new(),
+            );
+            let got = as_transient(&error).map(|t| t.retry_after.map(|d| d.as_secs()));
+            assert_eq!(&got, expected, "{status} {headers:?} {body}");
+        }
+    }
+
+    /// In-stream error objects as providers send them, after the 200 opened the stream.
+    #[test]
+    fn classifies_stream_errors() {
+        let retried = |json: &str, anthropic: bool| {
+            let body: StreamErrorBody = serde_json::from_str(json).unwrap();
+            let error = if anthropic {
+                body.into_anthropic_error()
+            } else {
+                body.into_error("AI provider")
+            };
+            as_transient(&error).is_some()
+        };
+        for (json, expected) in [
+            (r#"{"message":"m","type":"server_error"}"#, true),
+            (
+                r#"{"message":"m","type":"requests","code":"rate_limit_exceeded"}"#,
+                true,
+            ),
+            (
+                r#"{"message":"m","type":"insufficient_quota","code":"insufficient_quota"}"#,
+                false,
+            ),
+            (
+                r#"{"message":"m","type":"invalid_request_error","code":"context_length_exceeded"}"#,
+                false,
+            ),
+            // LiteLLM's proxy puts the upstream status in `code` as a string.
+            (r#"{"message":"m","type":"None","code":"400"}"#, false),
+            (r#"{"message":"m","code":"503"}"#, true),
+            (r#"{"code":503,"message":"m","status":"UNAVAILABLE"}"#, true),
+            (
+                r#"{"code":400,"message":"m","status":"INVALID_ARGUMENT"}"#,
+                false,
+            ),
+            (r#"{"message":"m"}"#, true),
+        ] {
+            assert_eq!(retried(json, false), expected, "{json}");
+        }
+        for (kind, expected) in [
+            ("overloaded_error", true),
+            ("api_error", true),
+            ("rate_limit_error", true),
+            ("timeout_error", true),
+            ("billing_error", false),
+            ("invalid_request_error", false),
+            ("some_new_error", false),
+        ] {
+            let json = format!(r#"{{"type":"{kind}","message":"m"}}"#);
+            assert_eq!(retried(&json, true), expected, "{kind}");
+        }
+    }
+
+    #[test]
+    fn honours_retry_after_up_to_a_bound() {
+        let mut headers = HeaderMap::new();
+        headers.insert("retry-after", "2".parse().unwrap());
+        assert_eq!(retry_after(&headers), Some(Duration::from_secs(2)));
+        headers.insert("retry-after-ms", "1500".parse().unwrap());
+        assert_eq!(retry_after(&headers), Some(Duration::from_millis(1500)));
+        headers.remove("retry-after-ms");
+        headers.insert("retry-after", "1e30".parse().unwrap());
+        assert_eq!(retry_after(&headers), Some(Duration::MAX));
+
+        let mut backoff = Backoff::default();
+        let asked = |secs| TransientAIError {
+            message: String::new(),
+            retry_after: Some(Duration::from_secs(secs)),
+        };
+        assert_eq!(backoff.next_delay(&asked(5)), Some(Duration::from_secs(5)));
+        assert_eq!(backoff.next_delay(&asked(3600)), None);
+    }
+
+    #[test]
+    fn stops_after_max_retries() {
+        let mut backoff = Backoff::default();
+        let error = TransientAIError { message: String::new(), retry_after: None };
+        for _ in 0..MAX_RETRIES {
+            let delay = backoff.next_delay(&error).expect("retry");
+            assert!(delay <= MAX_BACKOFF);
+        }
+        assert_eq!(backoff.next_delay(&error), None);
+    }
+}
diff --git a/backend/windmill-ai/src/sse.rs b/backend/windmill-ai/src/sse.rs
index ada50afca5..bdaa75025f 100644
--- a/backend/windmill-ai/src/sse.rs
+++ b/backend/windmill-ai/src/sse.rs
@@ -1,6 +1,6 @@
 use std::collections::HashMap;
 
-use eventsource_stream::Eventsource;
+use eventsource_stream::{EventStreamError, Eventsource};
 use indexmap::IndexMap;
 use reqwest::Response;
 use serde::Deserialize;
@@ -8,12 +8,13 @@ use tokio_stream::StreamExt;
 use windmill_common::{error::Error, utils::rd_string};
 
 use crate::{
-    ai_google::{parse_gemini_sse_event, GeminiUsageMetadata},
+    ai_google::{parse_gemini_sse_event, GeminiTurn, GeminiUsageMetadata},
     ai_types::UrlCitation,
     ai_types::{
         AnthropicExtraContent, ExtraContent, GoogleExtraContent, OpenAIFunction, OpenAIToolCall,
     },
     query_builder::StreamEventSink,
+    retry::{transient_error, truncated_stream_error, StreamErrorBody},
     types::{StreamingEvent, TokenUsage},
 };
 
@@ -43,6 +44,8 @@ pub struct OpenAIChoiceDelta {
 #[derive(Deserialize)]
 pub struct OpenAIChoice {
     pub delta: Option<OpenAIChoiceDelta>,
+    #[serde(default)]
+    pub finish_reason: Option<String>,
 }
 
 /// Nested prompt token details returned by the Chat Completions API.
@@ -87,6 +90,8 @@ pub struct OpenAISSEEvent {
     pub choices: Option<Vec<OpenAIChoice>>,
     #[serde(default)]
     pub usage: Option<OpenAIChatUsage>,
+    #[serde(default)]
+    pub error: Option<StreamErrorBody>,
 }
 
 lazy_static::lazy_static! {
@@ -99,6 +104,14 @@ lazy_static::lazy_static! {
 pub trait SSEParser {
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error>;
 
+    /// Whether the stream delivered the event that ends a complete response.
+    fn is_complete(&self) -> bool;
+
+    /// Whether a stream that closed cleanly holds a complete response.
+    fn is_complete_at_close(&self) -> bool {
+        self.is_complete()
+    }
+
     async fn parse_events(&mut self, response: Response) -> Result<(), Error> {
         let mut stream = response.bytes_stream().eventsource();
         let mut consecutive_errors = 0;
@@ -113,6 +126,18 @@ pub trait SSEParser {
 
                     self.parse_event_data(&event.data).await?;
                 }
+                // The body ends right after a transport error, so it cannot be skipped
+                // like a malformed event. A timeout spent the caller's whole budget.
+                Err(EventStreamError::Transport(_)) if self.is_complete() => break,
+                Err(EventStreamError::Transport(e)) => {
+                    let message =
+                        format!("The connection to the AI provider broke off mid-response: {e}");
+                    return Err(if e.is_timeout() {
+                        Error::AIError(message)
+                    } else {
+                        transient_error(message, None)
+                    });
+                }
                 Err(e) => {
                     consecutive_errors += 1;
                     tracing::error!("Failed to parse SSE event: {}", e);
@@ -130,6 +155,9 @@ pub trait SSEParser {
             }
         }
 
+        if !self.is_complete_at_close() {
+            return Err(truncated_stream_error());
+        }
         Ok(())
     }
 }
@@ -145,6 +173,9 @@ pub struct OpenAISSEParser {
     pub stream_event_processor: Box<dyn StreamEventSink>,
     /// Token usage from final chunk (when stream_options.include_usage is true)
     pub usage: Option<OpenAIChatUsage>,
+    /// Set by `[DONE]` or by a choice's `finish_reason`: OpenAI-compatible gateways do not
+    /// all send `[DONE]`.
+    complete: bool,
 }
 
 impl OpenAISSEParser {
@@ -156,13 +187,19 @@ impl OpenAISSEParser {
             events_str: String::new(),
             stream_event_processor,
             usage: None,
+            complete: false,
         }
     }
 }
 
 impl SSEParser for OpenAISSEParser {
+    fn is_complete(&self) -> bool {
+        self.complete
+    }
+
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error> {
         if data == "[DONE]" {
+            self.complete = true;
             return Ok(());
         }
 
@@ -173,13 +210,21 @@ impl SSEParser for OpenAISSEParser {
             .ok();
 
         if let Some(event) = event {
+            if let Some(error) = event.error {
+                return Err(error.into_error("AI provider"));
+            }
+
             // Extract usage from final chunk (when stream_options.include_usage is true)
             if let Some(usage) = event.usage {
                 self.usage = Some(usage);
             }
 
             if let Some(mut choices) = event.choices.filter(|s| !s.is_empty()) {
-                if let Some(delta) = choices.remove(0).delta {
+                let choice = choices.remove(0);
+                if choice.finish_reason.is_some() {
+                    self.complete = true;
+                }
+                if let Some(delta) = choice.delta {
                     if let Some(reasoning) = delta.reasoning_content.filter(|s| !s.is_empty()) {
                         self.accumulated_reasoning.push_str(&reasoning);
                         let event = StreamingEvent::ReasoningTokenDelta { content: reasoning };
@@ -345,6 +390,8 @@ pub enum AnthropicSSEEvent {
     MessageDelta {
         #[serde(default)]
         usage: Option<AnthropicUsage>,
+        #[serde(default)]
+        delta: Option<AnthropicMessageDelta>,
     },
     #[serde(rename = "message_stop")]
     MessageStop {},
@@ -353,12 +400,18 @@ pub enum AnthropicSSEEvent {
     #[serde(rename = "error")]
     Error {
         #[serde(default)]
-        message: Option<String>,
+        error: StreamErrorBody,
     },
     #[serde(other)]
     Unknown,
 }
 
+#[derive(Deserialize, Debug)]
+pub struct AnthropicMessageDelta {
+    #[serde(default)]
+    pub stop_reason: Option<String>,
+}
+
 /// Tracks state of a content block during streaming
 #[derive(Debug)]
 #[allow(dead_code)]
@@ -391,6 +444,9 @@ pub struct AnthropicSSEParser {
     /// can be replayed before `tool_use` (required by Claude when thinking is on).
     pending_reasoning: Option<AnthropicExtraContent>,
     reasoning_attached: bool,
+    /// Set by `message_stop` or by the `stop_reason` of the `message_delta` sent just
+    /// before it, so a gateway that drops `message_stop` does not fail a whole answer.
+    complete: bool,
 }
 
 impl AnthropicSSEParser {
@@ -407,11 +463,16 @@ impl AnthropicSSEParser {
             usage: None,
             pending_reasoning: None,
             reasoning_attached: false,
+            complete: false,
         }
     }
 }
 
 impl SSEParser for AnthropicSSEParser {
+    fn is_complete(&self) -> bool {
+        self.complete
+    }
+
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error> {
         let event: Option<AnthropicSSEEvent> = serde_json::from_str(data)
             .inspect_err(|e| {
@@ -583,9 +644,8 @@ impl SSEParser for AnthropicSSEParser {
                             .await?;
                     }
                 }
-                AnthropicSSEEvent::Error { message } => {
-                    let error_msg = message.unwrap_or_else(|| "Unknown error".to_string());
-                    tracing::error!("Anthropic streaming error: {}", error_msg);
+                AnthropicSSEEvent::Error { error } => {
+                    return Err(error.into_anthropic_error());
                 }
                 AnthropicSSEEvent::MessageStart { message } => {
                     // The only event carrying the prompt-side counts. `message_delta`
@@ -595,7 +655,10 @@ impl SSEParser for AnthropicSSEParser {
                         self.usage = Some(usage);
                     }
                 }
-                AnthropicSSEEvent::MessageDelta { usage } => {
+                AnthropicSSEEvent::MessageDelta { usage, delta } => {
+                    if delta.is_some_and(|d| d.stop_reason.is_some()) {
+                        self.complete = true;
+                    }
                     if let Some(u) = usage {
                         match &mut self.usage {
                             // Field by field, so the prompt counts from `message_start`
@@ -614,10 +677,9 @@ impl SSEParser for AnthropicSSEParser {
                         }
                     }
                 }
+                AnthropicSSEEvent::MessageStop {} => self.complete = true,
                 // Ignore other events
-                AnthropicSSEEvent::MessageStop {}
-                | AnthropicSSEEvent::Ping {}
-                | AnthropicSSEEvent::Unknown => {}
+                AnthropicSSEEvent::Ping {} | AnthropicSSEEvent::Unknown => {}
             }
         }
 
@@ -645,6 +707,7 @@ pub struct GeminiSSEParser {
     pub annotations: Vec<UrlCitation>,
     pub used_websearch: bool,
     pub usage: Option<GeminiUsageMetadata>,
+    turn: GeminiTurn,
 }
 
 impl GeminiSSEParser {
@@ -659,15 +722,25 @@ impl GeminiSSEParser {
             annotations: Vec::new(),
             used_websearch: false,
             usage: None,
+            turn: GeminiTurn::default(),
         }
     }
 }
 
 impl SSEParser for GeminiSSEParser {
+    fn is_complete(&self) -> bool {
+        self.turn.ended()
+    }
+
+    fn is_complete_at_close(&self) -> bool {
+        self.turn.complete_at_close()
+    }
+
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error> {
         let Some(parsed) = parse_gemini_sse_event(data)? else {
             return Ok(());
         };
+        self.turn.observe(&parsed);
 
         if let Some(reasoning) = parsed.reasoning.filter(|s| !s.is_empty()) {
             self.accumulated_reasoning.push_str(&reasoning);
@@ -797,6 +870,8 @@ impl OpenAIResponsesUsage {
 pub struct OpenAIResponsesResponse {
     #[serde(default)]
     pub usage: Option<OpenAIResponsesUsage>,
+    #[serde(default)]
+    pub error: Option<StreamErrorBody>,
 }
 
 /// SSE event types for OpenAI Responses API streaming
@@ -833,6 +908,20 @@ pub enum OpenAIResponsesSSEEvent {
     #[serde(rename = "response.incomplete")]
     Incomplete { response: OpenAIResponsesResponse },
 
+    #[serde(rename = "response.failed")]
+    Failed { response: OpenAIResponsesResponse },
+
+    /// Flat (`code`, `message`) from OpenAI, nested under `error` from some compatible servers.
+    #[serde(rename = "error")]
+    Error {
+        #[serde(default)]
+        code: Option<serde_json::Value>,
+        #[serde(default)]
+        message: Option<String>,
+        #[serde(default)]
+        error: Option<StreamErrorBody>,
+    },
+
     /// Response created
     #[serde(rename = "response.created")]
     Created {},
@@ -890,6 +979,7 @@ pub struct OpenAIResponsesSSEParser {
     pub usage: Option<OpenAIResponsesUsage>,
     /// Reasoning summary parts seen so far, to separate them as paragraphs
     reasoning_summary_parts: usize,
+    response_ended: bool,
 }
 
 impl OpenAIResponsesSSEParser {
@@ -906,11 +996,16 @@ impl OpenAIResponsesSSEParser {
             used_websearch: false,
             usage: None,
             reasoning_summary_parts: 0,
+            response_ended: false,
         }
     }
 }
 
 impl SSEParser for OpenAIResponsesSSEParser {
+    fn is_complete(&self) -> bool {
+        self.response_ended
+    }
+
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error> {
         let event: Option<OpenAIResponsesSSEEvent> = serde_json::from_str(data)
             .inspect_err(|e| {
@@ -1010,11 +1105,22 @@ impl SSEParser for OpenAIResponsesSSEParser {
 
                 OpenAIResponsesSSEEvent::Completed { response }
                 | OpenAIResponsesSSEEvent::Incomplete { response } => {
+                    self.response_ended = true;
                     if let Some(usage) = response.usage {
                         self.usage = Some(usage);
                     }
                 }
 
+                OpenAIResponsesSSEEvent::Failed { response } => {
+                    return Err(response.error.unwrap_or_default().into_error("OpenAI"));
+                }
+
+                OpenAIResponsesSSEEvent::Error { code, message, error } => {
+                    return Err(error
+                        .unwrap_or(StreamErrorBody { code, message, ..Default::default() })
+                        .into_error("OpenAI"));
+                }
+
                 OpenAIResponsesSSEEvent::ReasoningSummaryPartAdded {} => {
                     self.reasoning_summary_parts += 1;
                     if self.reasoning_summary_parts > 1 {
@@ -1037,9 +1143,10 @@ impl SSEParser for OpenAIResponsesSSEParser {
                     }
                 }
 
+                OpenAIResponsesSSEEvent::Done {} => self.response_ended = true,
+
                 // Ignore other event types
-                OpenAIResponsesSSEEvent::Done {}
-                | OpenAIResponsesSSEEvent::Created {}
+                OpenAIResponsesSSEEvent::Created {}
                 | OpenAIResponsesSSEEvent::InProgress {}
                 | OpenAIResponsesSSEEvent::OutputItemDone {}
                 | OpenAIResponsesSSEEvent::ContentPartAdded {}
@@ -1093,6 +1200,117 @@ mod tests {
         }
     }
 
+    fn sse_response(chunks: Vec<Result<&'static str, std::io::Error>>) -> Response {
+        let body = reqwest::Body::wrap_stream(futures::stream::iter(chunks));
+        Response::from(http::Response::new(body))
+    }
+
+    /// A stream that breaks off, or reports a failure inside its 200, must fail the call
+    /// rather than hand back what arrived as if it were the whole answer.
+    #[tokio::test]
+    async fn stream_failures_are_errors_not_partial_answers() {
+        use crate::retry::as_transient;
+
+        const STARTED: &str = concat!(
+            "data: {\"type\":\"message_start\"}\n\n",
+            "data: {\"type\":\"content_block_start\",\"index\":0,\"content_block\":{\"type\":\"text\",\"text\":\"\"}}\n\n",
+            "data: {\"type\":\"content_block_delta\",\"index\":0,\"delta\":{\"type\":\"text_delta\",\"text\":\"Hel\"}}\n\n",
+        );
+        let anthropic = |chunks| async move {
+            AnthropicSSEParser::new(Box::new(NoopSink))
+                .parse_events(sse_response(chunks))
+                .await
+        };
+
+        let overloaded = anthropic(vec![
+            Ok(STARTED),
+            Ok("data: {\"type\":\"error\",\"error\":{\"type\":\"overloaded_error\",\"message\":\"Overloaded\"}}\n\n"),
+        ])
+        .await
+        .unwrap_err();
+        assert!(as_transient(&overloaded).is_some(), "{overloaded}");
+
+        let refused = anthropic(vec![
+            Ok(STARTED),
+            Ok("data: {\"type\":\"error\",\"error\":{\"type\":\"invalid_request_error\",\"message\":\"bad\"}}\n\n"),
+        ])
+        .await
+        .unwrap_err();
+        assert!(as_transient(&refused).is_none(), "{refused}");
+
+        let truncated = anthropic(vec![Ok(STARTED)]).await.unwrap_err();
+        assert!(as_transient(&truncated).is_some(), "{truncated}");
+
+        let dropped = anthropic(vec![
+            Ok(STARTED),
+            Err(std::io::Error::new(
+                std::io::ErrorKind::ConnectionReset,
+                "reset",
+            )),
+        ])
+        .await
+        .unwrap_err();
+        assert!(as_transient(&dropped).is_some(), "{dropped}");
+
+        anthropic(vec![
+            Ok(STARTED),
+            Ok("data: {\"type\":\"message_stop\"}\n\n"),
+        ])
+        .await
+        .unwrap();
+
+        anthropic(vec![
+            Ok(STARTED),
+            Ok("data: {\"type\":\"message_delta\",\"delta\":{\"stop_reason\":\"end_turn\"}}\n\n"),
+        ])
+        .await
+        .unwrap();
+
+        let truncated = OpenAISSEParser::new(Box::new(NoopSink))
+            .parse_events(sse_response(vec![Ok(
+                "data: {\"choices\":[{\"delta\":{\"content\":\"Hi\"}}]}\n\n",
+            )]))
+            .await
+            .unwrap_err();
+        assert!(as_transient(&truncated).is_some(), "{truncated}");
+
+        let quota = OpenAIResponsesSSEParser::new(Box::new(NoopSink))
+            .parse_events(sse_response(vec![Ok(
+                "data: {\"type\":\"error\",\"error\":{\"type\":\"insufficient_quota\",\"code\":\"insufficient_quota\",\"message\":\"m\"}}\n\n",
+            )]))
+            .await
+            .unwrap_err();
+        assert!(as_transient(&quota).is_none(), "{quota}");
+
+        GeminiSSEParser::new(Box::new(NoopSink))
+            .parse_events(sse_response(vec![Ok(
+                "data: {\"candidates\":[{\"content\":{\"role\":\"model\",\"parts\":[{\"functionCall\":{\"name\":\"get_weather\",\"args\":{}}}]}}]}\n\n",
+            )]))
+            .await
+            .unwrap();
+
+        let gemini = |chunks| async move {
+            GeminiSSEParser::new(Box::new(NoopSink))
+                .parse_events(sse_response(chunks))
+                .await
+        };
+        // Thinking spent the whole `maxOutputTokens`: a clean close with no event.
+        gemini(vec![]).await.unwrap();
+        let dropped = gemini(vec![Err(std::io::Error::new(
+            std::io::ErrorKind::ConnectionReset,
+            "reset",
+        ))])
+        .await
+        .unwrap_err();
+        assert!(as_transient(&dropped).is_some(), "{dropped}");
+        let truncated = gemini(vec![Ok(
+            "data: {\"candidates\":[{\"content\":{\"role\":\"model\",\"parts\":[{\"text\":\"Hi\"}]}}]}\n\n",
+        )])
+        .await
+        .unwrap_err();
+        assert!(as_transient(&truncated).is_some(), "{truncated}");
+    }
+
     /// The prompt-side counts arrive only on `message_start` and the completion total
     /// only on `message_delta`; a parser that keeps just the last one reports a request
     /// with no input tokens at all.
diff --git a/backend/windmill-ai/src/types.rs b/backend/windmill-ai/src/types.rs
index 7e2de09e01..59733e352c 100644
--- a/backend/windmill-ai/src/types.rs
+++ b/backend/windmill-ai/src/types.rs
@@ -1,3 +1,4 @@
+use indexmap::IndexMap;
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
 use std::collections::HashMap;
@@ -269,6 +270,12 @@ pub struct ProviderResource {
     /// credentials exchange this crate does not perform.
     #[serde(default, deserialize_with = "empty_string_as_none")]
     pub token_url: Option<String>,
+    /// The API token of a `cloudflare` resource, which names it `token` rather than `api_key`.
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    pub token: Option<String>,
+    /// The account of a `cloudflare` resource, which its Workers AI URL is built from.
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    pub account_id: Option<String>,
 }
 
 #[derive(Deserialize, Debug)]
@@ -301,6 +308,11 @@ impl ProviderWithResource {
     }
 
     pub async fn get_base_url(&self, db: &DB) -> Result<String, Error> {
+        if self.kind == AIProvider::Cloudflare && self.resource.base_url.is_none() {
+            return crate::ai_providers::cloudflare_workers_ai_base_url(
+                self.resource.account_id.as_deref(),
+            );
+        }
         self.kind
             .get_base_url(self.resource.base_url.clone(), db)
             .await
@@ -320,7 +332,14 @@ impl ProviderWithResource {
         Ok(ProviderCredentials {
             provider: self.kind.clone(),
             base_url,
-            api_key: self.resource.api_key.clone(),
+            api_key: match self.kind {
+                AIProvider::Cloudflare => self
+                    .resource
+                    .api_key
+                    .clone()
+                    .or_else(|| self.resource.token.clone()),
+                _ => self.resource.api_key.clone(),
+            },
             access_token: None,
             organization_id: None,
             user: None,
@@ -515,7 +534,7 @@ pub struct OpenAPISchema {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub items: Option<Box<OpenAPISchema>>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub properties: Option<HashMap<String, Box<OpenAPISchema>>>,
+    pub properties: Option<IndexMap<String, Box<OpenAPISchema>>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub required: Option<Vec<String>>,
     #[serde(skip_serializing_if = "Option::is_none", rename = "oneOf")]
@@ -542,9 +561,9 @@ pub struct OpenAPISchema {
     #[serde(skip_serializing_if = "Option::is_none", rename = "$ref")]
     pub ref_path: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none", rename = "$defs")]
-    pub defs: Option<HashMap<String, Box<OpenAPISchema>>>,
+    pub defs: Option<IndexMap<String, Box<OpenAPISchema>>>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub definitions: Option<HashMap<String, Box<OpenAPISchema>>>,
+    pub definitions: Option<IndexMap<String, Box<OpenAPISchema>>>,
 
     // Schema composition
     #[serde(skip_serializing_if = "Option::is_none", rename = "allOf")]
@@ -811,7 +830,7 @@ impl OpenAPISchema {
 
         // Merge properties (other's properties are added if key doesn't exist)
         if let Some(ref other_props) = other.properties {
-            let props = self.properties.get_or_insert_with(HashMap::new);
+            let props = self.properties.get_or_insert_with(IndexMap::new);
             for (key, value) in other_props {
                 props.entry(key.clone()).or_insert_with(|| value.clone());
             }
@@ -862,13 +881,13 @@ impl OpenAPISchema {
 
         // Merge $defs and definitions
         if let Some(ref other_defs) = other.defs {
-            let defs = self.defs.get_or_insert_with(HashMap::new);
+            let defs = self.defs.get_or_insert_with(IndexMap::new);
             for (key, value) in other_defs {
                 defs.entry(key.clone()).or_insert_with(|| value.clone());
             }
         }
         if let Some(ref other_definitions) = other.definitions {
-            let definitions = self.definitions.get_or_insert_with(HashMap::new);
+            let definitions = self.definitions.get_or_insert_with(IndexMap::new);
             for (key, value) in other_definitions {
                 definitions
                     .entry(key.clone())
@@ -963,7 +982,29 @@ pub struct S3ObjectWithType {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::collections::HashMap;
+
+    /// The schema is part of the prompt prefix the provider caches on, so its keys must
+    /// serialize in the same order on every request.
+    #[test]
+    fn strict_schema_keeps_the_defined_property_order() {
+        let keys = [
+            "zeta", "alpha", "mid", "beta", "omega", "gamma", "delta", "kappa",
+        ];
+        let props = keys
+            .iter()
+            .map(|k| format!(r#""{k}":{{"type":"string"}}"#))
+            .collect::<Vec<_>>()
+            .join(",");
+        let mut schema: OpenAPISchema =
+            serde_json::from_str(&format!(r#"{{"type":"object","properties":{{{props}}}}}"#))
+                .unwrap();
+        schema.make_strict();
+
+        let value = serde_json::to_value(&schema).unwrap();
+        let serialized: Vec<&String> = value["properties"].as_object().unwrap().keys().collect();
+        assert_eq!(serialized, keys);
+        assert_eq!(value["required"], serde_json::json!(keys));
+    }
 
     /// Whichever provider served the request, `input_tokens` has to end up meaning the
     /// whole prompt. Leaving the Anthropic shape as reported under-states it by the
@@ -1230,7 +1271,7 @@ mod tests {
     #[test]
     fn test_make_strict_defs() {
         let def_schema = object_schema(vec![("prop", string_schema())]);
-        let mut defs = HashMap::new();
+        let mut defs = IndexMap::new();
         defs.insert("MyType".to_string(), Box::new(def_schema));
 
         let mut schema = OpenAPISchema { defs: Some(defs), ..Default::default() };
@@ -1256,7 +1297,7 @@ mod tests {
     #[test]
     fn test_make_strict_definitions() {
         let def_schema = object_schema(vec![("prop", string_schema())]);
-        let mut definitions = HashMap::new();
+        let mut definitions = IndexMap::new();
         definitions.insert("MyType".to_string(), Box::new(def_schema));
 
         let mut schema = OpenAPISchema { definitions: Some(definitions), ..Default::default() };
@@ -1510,7 +1551,7 @@ mod tests {
     #[test]
     fn test_flatten_all_of_preserves_defs() {
         let def_schema = object_schema(vec![("field", string_schema())]);
-        let mut defs = HashMap::new();
+        let mut defs = IndexMap::new();
         defs.insert("MyType".to_string(), Box::new(def_schema));
 
         let schema_with_defs = OpenAPISchema { defs: Some(defs), ..Default::default() };
@@ -1624,7 +1665,7 @@ mod tests {
             schema_url: Some("http://json-schema.org/draft-07/schema#".to_string()),
             ..Default::default()
         };
-        let mut defs = HashMap::new();
+        let mut defs = IndexMap::new();
         defs.insert("MyType".to_string(), Box::new(def_schema));
 
         let mut schema = OpenAPISchema {
diff --git a/backend/windmill-api-auth/src/auth.rs b/backend/windmill-api-auth/src/auth.rs
index 869f40e14c..720111e89d 100644
--- a/backend/windmill-api-auth/src/auth.rs
+++ b/backend/windmill-api-auth/src/auth.rs
@@ -104,6 +104,32 @@ pub struct ExpiringAuthCache {
     pub job_id: Option<uuid::Uuid>,
 }
 
+/// Whether `target` belongs to the flow run of the job `job_id`: the job itself, one of its
+/// ancestors, or a job whose parent or root is one of them (a sibling step, a loop or branch
+/// iteration, any job pushed as a child of one of them). A lookup that fails reads as no.
+pub async fn job_in_same_flow_run(db: &DB, job_id: uuid::Uuid, target: uuid::Uuid) -> bool {
+    if job_id == target {
+        return true;
+    }
+    sqlx::query_scalar!(
+        "SELECT EXISTS (
+            SELECT 1 FROM v2_job o, v2_job t,
+                LATERAL (SELECT ARRAY_REMOVE(ARRAY[o.id, o.parent_job, o.root_job,
+                    o.flow_innermost_root_job], NULL) AS run) l
+            WHERE o.id = $1 AND t.id = $2 AND t.workspace_id = o.workspace_id
+                AND (t.id = ANY(l.run) OR t.parent_job = ANY(l.run)
+                    OR t.root_job = ANY(l.run) OR t.flow_innermost_root_job = ANY(l.run))
+        )",
+        job_id,
+        target
+    )
+    .fetch_one(db)
+    .await
+    .ok()
+    .flatten()
+    .unwrap_or(false)
+}
+
 pub struct AuthCache {
     db: DB,
     superadmin_secret: Option<String>,
@@ -1131,8 +1157,20 @@ pub async fn resolve_opt_job_authed(
                         return Err((err, parts));
                     }
                 }
+                let own_job_runtime_route = match opt_job_authed.job_id {
+                    Some(job_id) if opt_job_authed.authed.scopes.is_some() => {
+                        crate::scopes::is_own_job_runtime_route(path, method, job_id)
+                            || match crate::scopes::flow_run_read_route_job(path, method) {
+                                Some(target) => {
+                                    job_in_same_flow_run(&cache.db, job_id, target).await
+                                }
+                                None => false,
+                            }
+                    }
+                    _ => false,
+                };
                 let authed = &mut opt_job_authed.authed;
-                if authed.scopes.is_some() {
+                if authed.scopes.is_some() && !own_job_runtime_route {
                     transform_old_scope_to_new_scope(authed.scopes.as_mut());
 
                     if let Err(err) = crate::scopes::check_scopes_for_route(
diff --git a/backend/windmill-api-auth/src/lib.rs b/backend/windmill-api-auth/src/lib.rs
index 12ad5f2654..30c3bb65af 100644
--- a/backend/windmill-api-auth/src/lib.rs
+++ b/backend/windmill-api-auth/src/lib.rs
@@ -35,6 +35,7 @@ use windmill_common::{
 };
 
 use scopes::ScopeDefinition;
+use windmill_common::scopes::scope_contains;
 
 // Re-export key auth types and functions
 pub use auth::{
@@ -475,11 +476,11 @@ pub fn is_effectively_unscoped(scopes: Option<&[String]>) -> bool {
 /// refused. An admin check is not a substitute — it answers for the user behind the
 /// token, not for the token's own scopes.
 ///
-/// This bounds the token making the request, not every route to the key. A job token
-/// is minted unscoped from its owner's privileges, so a `jobs:run` token still reaches
-/// the key indirectly by running a job as a workspace admin — the same property that
-/// lets git-sync export it. Confining that means not inheriting unscoped privilege
-/// into job tokens, which is a far wider change than this guard.
+/// This bounds the token making the request, not every route to the key. The jobs a
+/// scoped user token runs get a token with their owner's privileges, capped only by the
+/// runnable's own `job_token_scopes` (see [`caller_scope_ceiling`]), so a `jobs:run`
+/// token still reaches the key indirectly by running an unrestricted job as a workspace
+/// admin — the same property that lets git-sync export it.
 pub fn forbid_scoped_token_workspace_key(authed: &ApiAuthed) -> error::Result<()> {
     if is_effectively_unscoped(authed.scopes.as_deref()) {
         return Ok(());
@@ -492,6 +493,50 @@ pub fn forbid_scoped_token_workspace_key(authed: &ApiAuthed) -> error::Result<()
     ))
 }
 
+/// For a route that authenticates its token itself rather than through the route layer
+/// (which checks scopes): a job token restricted by `job_token_scopes` must still hold
+/// `required` there. Other credentials keep the access those routes always gave them.
+pub fn check_job_token_scope<F>(authed: &ApiAuthed, required: F) -> error::Result<()>
+where
+    F: FnOnce() -> String,
+{
+    if authed.job_id.is_some() {
+        check_scopes(authed, required)
+    } else {
+        Ok(())
+    }
+}
+
+/// The cap on the token of a job pushed on `authed`'s request, to pass to `push` as its
+/// scope ceiling. A job token caps every job it starts at its own job's scopes, so a
+/// restricted job cannot widen its reach by running another one; the job row is the
+/// source rather than the token's claims, which the MCP proxy narrows per route. Any
+/// other credential caps nothing: the jobs it runs act as their owner, as they always did.
+pub async fn caller_scope_ceiling(
+    db: &windmill_common::DB,
+    authed: &ApiAuthed,
+) -> error::Result<Option<Vec<String>>> {
+    let Some(job_id) = authed.job_id else {
+        return Ok(None);
+    };
+    // A job token is minted with scopes exactly when its job is restricted, so an unscoped one
+    // has nothing to read.
+    if authed.scopes.is_none() {
+        return Ok(None);
+    }
+    let row = sqlx::query_scalar!(
+        "SELECT job_token_scopes FROM job_perms WHERE job_id = $1",
+        job_id
+    )
+    .fetch_optional(db)
+    .await?;
+    Ok(match row {
+        Some(scopes) => scopes,
+        // The job left the queue and its row was swept: only the token's own claims are left.
+        None => authed.scopes.clone(),
+    })
+}
+
 /// Enforce monotonic privilege when a token lifecycle endpoint mints or rescopes
 /// a credential on behalf of `authed`: the resulting credential must never be
 /// more privileged than the caller's own token.
@@ -604,83 +649,6 @@ fn first_filter_tags(scopes: Option<&[String]>) -> Option<Vec<&str>> {
     })
 }
 
-/// Whether `caller` grants at least everything `requested` grants (directional
-/// containment).
-///
-/// This is intentionally NOT `ScopeDefinition::includes`: that method answers
-/// "does this scope grant access to a required action" using OR semantics over
-/// resources (any overlap counts, and a `*` on either side matches), which is
-/// correct for access checks but unsafe for subset checks — it would let a
-/// token scoped to `scripts:read:f/team/a` mint `scripts:read:*` or
-/// `scripts:read:f/team/a,f/other/b`. Subset containment instead requires that
-/// EVERY requested resource is covered by SOME caller resource.
-fn scope_contains(caller: &ScopeDefinition, requested: &ScopeDefinition) -> bool {
-    if caller.domain != requested.domain {
-        return false;
-    }
-
-    // write subsumes read; otherwise the action must match exactly.
-    match (caller.action.as_str(), requested.action.as_str()) {
-        (c, r) if c == r || (c == "write" && r == "read") => {}
-        // Apps only: `write` covers `run` (see `ScopeDefinition::includes`), so an
-        // app-editor token can mint the narrower run-only credential.
-        ("write", "run") if caller.domain == "apps" => {}
-        _ => return false,
-    }
-
-    if caller.domain == "jobs" && caller.action == "run" {
-        match (&caller.kind, &requested.kind) {
-            (Some(caller_kind), Some(requested_kind)) if caller_kind != requested_kind => {
-                return false
-            }
-            // Caller pinned to a kind, but the request covers any kind.
-            (Some(_), None) => return false,
-            _ => {}
-        }
-    }
-
-    match (&caller.resource, &requested.resource) {
-        // Caller is unrestricted on resources: covers everything.
-        (None, _) => true,
-        // Caller is resource-restricted but the request is not: broader, unless the
-        // caller lists `*` and so already spans every path. Kept in step with
-        // `ScopeDefinition::includes`, which accepts that same grant for a
-        // whole-collection read: what a token may exercise, it may also delegate.
-        (Some(caller_resources), None) => caller_resources.iter().any(|r| r == "*"),
-        (Some(caller_resources), Some(requested_resources)) => {
-            resource_set_contains(caller_resources, requested_resources)
-        }
-    }
-}
-
-/// Every resource in `requested` must be covered by some resource in `caller`.
-fn resource_set_contains(caller: &[String], requested: &[String]) -> bool {
-    if caller.iter().any(|r| r == "*") {
-        return true;
-    }
-    requested
-        .iter()
-        .all(|req| req != "*" && caller.iter().any(|c| resource_covers(c, req)))
-}
-
-/// Directional: does the single caller resource pattern cover `requested`?
-/// `caller` may be an exact path or a `<prefix>/*` subtree wildcard; `requested`
-/// may itself be a subtree wildcard, in which case the whole requested subtree
-/// must fall within the caller's subtree.
-fn resource_covers(caller: &str, requested: &str) -> bool {
-    if caller == requested {
-        return true;
-    }
-    let Some(prefix) = caller.strip_suffix("/*") else {
-        // An exact caller resource only covers itself (handled above).
-        return false;
-    };
-    let requested_base = requested.strip_suffix("/*").unwrap_or(requested);
-    requested_base == prefix
-        || (requested_base.starts_with(prefix)
-            && requested_base.as_bytes().get(prefix.len()) == Some(&b'/'))
-}
-
 /// Returns a predicate that checks whether `path` is within the token's
 /// scope for `{domain}:{action}:{path}`. For tokens without scope
 /// restrictions (no scopes at all, or only `if_jobs:filter_tags:*` scopes),
diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs
index e100cf88c6..21f916bf94 100644
--- a/backend/windmill-api-auth/src/scopes.rs
+++ b/backend/windmill-api-auth/src/scopes.rs
@@ -6,464 +6,9 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use itertools::Itertools;
-use serde::{Deserialize, Serialize};
-use std::collections::HashSet;
 use windmill_common::error::{Error, Result};
 
-/// Comprehensive scope system for JWT token authorization
-///
-/// Scopes follow the format: {domain}:{action}[:{resource}]
-/// Examples:
-/// - "jobs:read" - Read access to jobs
-/// - "scripts:write:f/folder/*" - Write access to scripts in a folder
-/// - "*" - Full access (superuser)
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ScopeDefinition {
-    pub domain: String,
-    pub action: String,
-    pub kind: Option<String>, // For jobs:run:kind (optional)
-    pub resource: Option<Vec<String>>,
-}
-
-impl ScopeDefinition {
-    pub fn new(
-        domain: &str,
-        action: &str,
-        kind: Option<&str>,
-        resource: Option<Vec<String>>,
-    ) -> Self {
-        Self {
-            domain: domain.to_string(),
-            action: action.to_string(),
-            kind: kind.map(|s| s.to_string()),
-            resource: resource,
-        }
-    }
-
-    pub fn from_scope_string(scope: &str) -> Result<Self> {
-        let parts: Vec<&str> = scope.split(':').collect();
-
-        let into_owned_vec = |resources: &str| -> Vec<String> {
-            let resources = resources
-                .split(",")
-                .collect_vec()
-                .into_iter()
-                .map(ToOwned::to_owned)
-                .collect_vec();
-
-            resources
-        };
-
-        match parts.len() {
-            2 => Ok(Self::new(parts[0], parts[1], None, None)), // domain:action
-            3 => {
-                if parts[0] == "jobs" && parts[1] == "run" {
-                    Ok(Self::new(parts[0], parts[1], Some(parts[2]), None))
-                } else {
-                    Ok(Self::new(
-                        parts[0],
-                        parts[1],
-                        None,
-                        Some(into_owned_vec(parts[2])),
-                    ))
-                }
-            }
-            4 => {
-                if parts[0] == "jobs" && parts[1] == "run" {
-                    Ok(Self::new(
-                        parts[0],
-                        parts[1],
-                        Some(parts[2]),
-                        Some(into_owned_vec(parts[3])),
-                    ))
-                } else {
-                    Err(Error::BadRequest(format!(
-                        "Invalid 4-part scope: {}",
-                        scope
-                    )))
-                }
-            }
-            _ => Err(Error::BadRequest(format!(
-                "Invalid scope format: {}",
-                scope
-            ))),
-        }
-    }
-
-    pub fn as_string(&self) -> String {
-        match (&self.kind, &self.resource) {
-            (Some(kind), Some(resource)) => {
-                format!(
-                    "{}:{}:{}:{}",
-                    self.domain,
-                    self.action,
-                    kind,
-                    resource.join(",")
-                )
-            }
-            (Some(kind), None) => {
-                format!("{}:{}:{}", self.domain, self.action, kind)
-            }
-            (None, Some(resource)) => {
-                format!("{}:{}:{}", self.domain, self.action, resource.join(","))
-            }
-            (None, None) => format!("{}:{}", self.domain, self.action),
-        }
-    }
-
-    pub fn includes(&self, other: &ScopeDefinition) -> bool {
-        if self.domain != other.domain {
-            return false;
-        }
-
-        match (self.action.as_str(), other.action.as_str()) {
-            (a, b) if (a == "write" && b == "read") || (a == b) => {}
-            // Apps only: `write` can rewrite the app and its policy, so it also covers
-            // running its components. Not general — `jobs:write` must not grant
-            // `jobs:run`. The resource check below still confines it to the same app.
-            ("write", "run") if self.domain == "apps" => {}
-            _ => return false,
-        }
-
-        if self.domain == "jobs" && self.action == "run" {
-            match (&self.kind, &other.kind) {
-                (Some(self_kind), Some(other_kind)) => {
-                    if self_kind != other_kind {
-                        return false;
-                    }
-                }
-                (Some(_), None) => {
-                    return false;
-                }
-                (None, _) => {
-                    return true;
-                }
-            }
-        }
-
-        match (&self.resource, &other.resource) {
-            (Some(self_resources), Some(other_resources)) => {
-                resources_match(self_resources, other_resources)
-            }
-            // A requirement naming no path is the whole domain, so only a grant that
-            // itself spans every path satisfies it. `*` is that grant — the scope UI
-            // accepts it as a resource path and `resources_match` already reads it as
-            // everything — while any listed path leaves the collection unauthorized.
-            (Some(self_resources), None) => self_resources.iter().any(|r| r == "*"),
-            (None, _) => true,
-        }
-    }
-}
-
-fn resources_match(scope_resources: &[String], accepted_resources: &[String]) -> bool {
-    if scope_resources.contains(&"*".to_string()) || accepted_resources.contains(&"*".to_string()) {
-        return true;
-    }
-
-    if scope_resources.len() <= 4 && accepted_resources.len() <= 4 {
-        return resources_match_small(scope_resources, accepted_resources);
-    }
-
-    resources_match_large(scope_resources, accepted_resources)
-}
-
-fn resources_match_small(scope_resources: &[String], accepted_resources: &[String]) -> bool {
-    for required in accepted_resources {
-        for scope_resource in scope_resources {
-            if resource_matches_pattern(scope_resource, required) {
-                return true;
-            }
-        }
-    }
-    false
-}
-
-fn resources_match_large(scope_resources: &[String], accepted_resources: &[String]) -> bool {
-    let mut exact_matches = HashSet::new();
-    let mut patterns = Vec::new();
-
-    for scope_resource in scope_resources {
-        if scope_resource.contains('*') {
-            patterns.push(scope_resource);
-        } else {
-            exact_matches.insert(scope_resource);
-        }
-    }
-
-    for accepted_resource in accepted_resources {
-        if exact_matches.contains(accepted_resource) {
-            return true;
-        }
-
-        for pattern in &patterns {
-            if resource_matches_pattern(pattern, accepted_resource) {
-                return true;
-            }
-        }
-    }
-
-    false
-}
-
-fn resource_matches_pattern(scope_resource: &str, accepted_resource: &str) -> bool {
-    if scope_resource == accepted_resource {
-        return true;
-    }
-
-    let matches_wildcard = |pattern: &str, resource: &str| -> bool {
-        if !pattern.ends_with("/*") {
-            return false;
-        }
-
-        let prefix = &pattern[..pattern.len() - 2];
-
-        if !resource.starts_with(prefix) {
-            return false;
-        }
-
-        // If the resource is exactly the prefix, it matches
-        if resource.len() == prefix.len() {
-            return true;
-        }
-
-        // If the resource is longer, the next character must be '/' for a valid match
-        // This prevents "u/user" from matching "u/use/*"
-        resource.chars().nth(prefix.len()) == Some('/')
-    };
-
-    // Check if either resource is a wildcard pattern and matches the other
-    matches_wildcard(scope_resource, accepted_resource)
-        || matches_wildcard(accepted_resource, scope_resource)
-}
-
-// ─────────────────────────────────────────────────────────────────
-// Route-level scope checking
-// ─────────────────────────────────────────────────────────────────
-
-/// Available scope domains (top-level API categories)
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum ScopeDomain {
-    // Core resource domains
-    Jobs,
-    Scripts,
-    /// The `/data_metrics` catalog. Its own domain, NOT an alias of `Scripts`: a
-    /// `data_metrics:read` token must reach only this route, never the broader
-    /// `/scripts` routes (some of which do no further scope check).
-    DataMetrics,
-    Flows,
-    FlowConversations,
-    Apps,
-    Variables,
-    Resources,
-    Schedules,
-    Folders,
-    Users,
-    Groups,
-    Workspaces,
-
-    // Trigger domains
-    HttpTriggers,
-    WebsocketTriggers,
-    KafkaTriggers,
-    NatsTriggers,
-    MqttTriggers,
-    AmqpTriggers,
-    SqsTriggers,
-    GcpTriggers,
-    AzureTriggers,
-    PostgresTriggers,
-    EmailTriggers,
-
-    // Native trigger domains
-    NativeTriggers,
-    TriggersHistory,
-
-    // System domains
-    Audit,
-    Settings,
-    Workers,
-    ServiceLogs,
-    Configs,
-    OAuth,
-    AI,
-    AiEvals, // AI agent eval datasets
-
-    Indexer,
-    Teams,   // Microsoft Teams integration
-    GitSync, // Git synchronization
-
-    // Special domains
-    Capture,           // Webhook capture
-    Drafts,            // Draft resources
-    Favorites,         // User favorites
-    Inputs,            // Input templates
-    JobHelpers,        // Job helper functions
-    ConcurrencyGroups, // Concurrency groups
-    Oidc,              // OpenID Connect
-    Openapi,           // OpenAPI generation
-
-    // Additional domains
-    Acls,         // Granular access control lists
-    RawApps,      // Raw application data
-    AgentWorkers, // Agent workers management
-    Mcp,          // MCP
-    Docs,         // Self-hosted documentation search (read-only)
-}
-
-impl ScopeDomain {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Jobs => "jobs",
-            Self::Scripts => "scripts",
-            Self::DataMetrics => "data_metrics",
-            Self::Flows => "flows",
-            Self::FlowConversations => "flow_conversations",
-            Self::Apps => "apps",
-            Self::Variables => "variables",
-            Self::Resources => "resources",
-            Self::Schedules => "schedules",
-            Self::Folders => "folders",
-            Self::Users => "users",
-            Self::Groups => "groups",
-            Self::Workspaces => "workspaces",
-            Self::HttpTriggers => "http_triggers",
-            Self::WebsocketTriggers => "websocket_triggers",
-            Self::KafkaTriggers => "kafka_triggers",
-            Self::NatsTriggers => "nats_triggers",
-            Self::MqttTriggers => "mqtt_triggers",
-            Self::AmqpTriggers => "amqp_triggers",
-            Self::SqsTriggers => "sqs_triggers",
-            Self::GcpTriggers => "gcp_triggers",
-            Self::AzureTriggers => "azure_triggers",
-            Self::PostgresTriggers => "postgres_triggers",
-            Self::EmailTriggers => "email_triggers",
-            Self::NativeTriggers => "native_triggers",
-            Self::TriggersHistory => "triggers_history",
-            Self::Audit => "audit",
-            Self::Settings => "settings",
-            Self::Workers => "workers",
-            Self::ServiceLogs => "service_logs",
-            Self::Configs => "configs",
-            Self::OAuth => "oauth",
-            Self::AI => "ai",
-            Self::AiEvals => "ai_evals",
-            Self::Capture => "capture",
-            Self::Drafts => "drafts",
-            Self::Favorites => "favorites",
-            Self::Inputs => "inputs",
-            Self::JobHelpers => "job_helpers",
-            Self::ConcurrencyGroups => "concurrency_groups",
-            Self::Oidc => "oidc",
-            Self::Openapi => "openapi",
-            Self::Acls => "acls",
-            Self::RawApps => "raw_apps",
-            Self::AgentWorkers => "agent_workers",
-            Self::Indexer => "indexer",
-            Self::Teams => "teams",
-            Self::GitSync => "git_sync",
-            Self::Mcp => "mcp",
-            Self::Docs => "docs",
-        }
-    }
-
-    pub fn from_str(s: &str) -> Option<Self> {
-        match s {
-            "jobs" | "jobs_u" => Some(Self::Jobs),
-            "scripts" => Some(Self::Scripts),
-            // A distinct domain, not an alias of `scripts` (see the enum variant):
-            // a `data_metrics:read` token must not reach the broader /scripts routes.
-            "data_metrics" => Some(Self::DataMetrics),
-            "flows" => Some(Self::Flows),
-            "flow_conversations" => Some(Self::FlowConversations),
-            "apps" | "apps_u" => Some(Self::Apps),
-            "variables" => Some(Self::Variables),
-            "resources" => Some(Self::Resources),
-            "schedules" => Some(Self::Schedules),
-            "folders" => Some(Self::Folders),
-            "users" => Some(Self::Users),
-            "groups" => Some(Self::Groups),
-            "workspaces" => Some(Self::Workspaces),
-            "http_triggers" => Some(Self::HttpTriggers),
-            "websocket_triggers" => Some(Self::WebsocketTriggers),
-            "kafka_triggers" => Some(Self::KafkaTriggers),
-            "nats_triggers" => Some(Self::NatsTriggers),
-            "mqtt_triggers" => Some(Self::MqttTriggers),
-            "amqp_triggers" => Some(Self::AmqpTriggers),
-            "sqs_triggers" => Some(Self::SqsTriggers),
-            "gcp_triggers" => Some(Self::GcpTriggers),
-            "azure_triggers" => Some(Self::AzureTriggers),
-            "postgres_triggers" => Some(Self::PostgresTriggers),
-            "email_triggers" => Some(Self::EmailTriggers),
-            "audit" => Some(Self::Audit),
-            "settings" => Some(Self::Settings),
-            "workers" => Some(Self::Workers),
-            "service_logs" => Some(Self::ServiceLogs),
-            "configs" => Some(Self::Configs),
-            "oauth" => Some(Self::OAuth),
-            "ai" => Some(Self::AI),
-            "ai_evals" => Some(Self::AiEvals),
-            "indexer" | "srch" => Some(Self::Indexer),
-            "teams" => Some(Self::Teams),
-            "native_triggers" => Some(Self::NativeTriggers),
-            "triggers_history" => Some(Self::TriggersHistory),
-            "git_sync" | "github_app" => Some(Self::GitSync),
-            "capture" => Some(Self::Capture),
-            "drafts" => Some(Self::Drafts),
-            "favorites" => Some(Self::Favorites),
-            "inputs" => Some(Self::Inputs),
-            "job_helpers" => Some(Self::JobHelpers),
-            "concurrency_groups" => Some(Self::ConcurrencyGroups),
-            "oidc" => Some(Self::Oidc),
-            "openapi" => Some(Self::Openapi),
-            "acls" => Some(Self::Acls),
-            "raw_apps" => Some(Self::RawApps),
-            "agent_workers" => Some(Self::AgentWorkers),
-            "mcp" => Some(Self::Mcp),
-            "docs" => Some(Self::Docs),
-            _ => None,
-        }
-    }
-}
-
-/// Available scope actions
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum ScopeAction {
-    Read,  // GET operations, list, view
-    Write, // POST, PUT, PATCH, DELETE operations, create, update, delete
-    Run,   // Special action for running (scripts, flows, etc.)
-}
-
-impl ScopeAction {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Read => "read",
-            Self::Write => "write",
-            Self::Run => "run",
-        }
-    }
-
-    pub fn from_str(s: &str) -> Option<Self> {
-        match s {
-            "read" => Some(Self::Read),
-            "write" => Some(Self::Write),
-            "delete" => Some(Self::Write),
-            "run" => Some(Self::Run),
-            _ => None,
-        }
-    }
-
-    /// Check if this action includes another action
-    /// Write includes Read
-    pub fn includes(&self, other: &ScopeAction) -> bool {
-        match (self, other) {
-            (ScopeAction::Write, ScopeAction::Read) => true,
-            (ScopeAction::Run, ScopeAction::Read) => true,
-            (a, b) => a == b,
-        }
-    }
-}
+pub use windmill_common::scopes::{ScopeAction, ScopeDefinition, ScopeDomain};
 
 pub fn check_route_access(
     token_scopes: &[String],
@@ -625,10 +170,16 @@ const FLOW_JOBS: [&'static str; 6] = [
 /// scoped by the agent's path like a deployed runnable's, as `jobs:run:agents:<path>`.
 const AGENT_JOBS: [&'static str; 1] = ["jobs/run/agent"];
 
+/// Lock resolution for scripts, apps and flows, scoped as `jobs:run:dependencies:<path>`.
+/// Resolving a package can run its build or install scripts on the worker, so this is
+/// still code execution: the scope only takes away the direct ways to run code.
+const DEPENDENCY_JOBS: [&'static str; 2] = ["jobs/run/dependencies", "jobs/run/flow_dependencies"];
+
 lazy_static::lazy_static! {
     static ref RUN_PATH_ACTIONS: Vec<&'static str> = {
-        let mut v = vec!["jobs/resume/", "jobs/run/batch_rerun_jobs", "jobs/run/workflow_as_code", "jobs/run/dependencies","jobs/run/flow_dependencies", "apps_u/execute_component", "apps_u/upload_s3_file"];
+        let mut v = vec!["jobs/resume/", "jobs/run/batch_rerun_jobs", "jobs/run/workflow_as_code", "apps_u/execute_component", "apps_u/upload_s3_file"];
 
+        v.extend(DEPENDENCY_JOBS);
         v.extend(SCRIPT_JOBS);
         v.extend(FLOW_JOBS);
         v.extend(AGENT_JOBS);
@@ -636,7 +187,38 @@ lazy_static::lazy_static! {
     };
 }
 
+/// The job routes a `jobs:cancel` scope reaches, as workspaced route suffixes. A
+/// path-scoped `jobs:cancel:<paths>` is resource-blind here like every scope; the
+/// handlers confine it through `job_cancel_path_confinement`, so a cancel route added
+/// here without that check would serve a path-scoped token every job.
+const CANCEL_PATH_ACTIONS: [&'static str; 4] = [
+    "jobs_u/queue/cancel/",
+    "jobs_u/queue/force_cancel/",
+    "jobs_u/queue/cancel_persistent/",
+    "jobs/queue/cancel_selection",
+];
+
+fn is_cancel_route(method: &str, route_path: &str) -> bool {
+    if !method.eq_ignore_ascii_case("POST") {
+        return false;
+    }
+    let mut parts = route_path.splitn(5, '/');
+    let (Some(""), Some("api"), Some("w"), Some(_), Some(suffix)) = (
+        parts.next(),
+        parts.next(),
+        parts.next(),
+        parts.next(),
+        parts.next(),
+    ) else {
+        return false;
+    };
+    CANCEL_PATH_ACTIONS.iter().any(|p| suffix.starts_with(p))
+}
+
 fn map_http_method_to_action(method: &str, route_path: &str) -> ScopeAction {
+    if is_cancel_route(method, route_path) {
+        return ScopeAction::Cancel;
+    }
     if RUN_PATH_ACTIONS
         .iter()
         .any(|run_path| route_path.contains(run_path))
@@ -651,11 +233,13 @@ fn map_http_method_to_action(method: &str, route_path: &str) -> ScopeAction {
     }
 }
 
-/// Checks the route path to determine the runnable kind ("agents", "flows" or "scripts").
+/// Checks the route path to determine the runnable kind ("dependencies", "agents", "flows"
+/// or "scripts").
 ///
 /// The order of checks is important:
-/// - Flow-related paths are checked first to avoid false positives, as some flow paths
-///   (e.g., `/run_preview_flow`) share prefixes with script paths (e.g., `/run_preview`).
+/// - Dependency paths are checked before flow paths: `flow_dependencies` starts with `f`.
+/// - Flow-related paths are checked before script paths to avoid false positives, as some
+///   flow paths (e.g., `/run_preview_flow`) share prefixes with script paths (e.g., `/run_preview`).
 ///
 /// Returns the kind based on the match, or `None` if no match is found.
 fn determine_kind_from_route(route_path: &str) -> Option<String> {
@@ -671,6 +255,12 @@ fn determine_kind_from_route(route_path: &str) -> Option<String> {
         {
             return None;
         }
+        if DEPENDENCY_JOBS
+            .iter()
+            .any(|path| route_path.starts_with(path))
+        {
+            return Some("dependencies".to_string());
+        }
         if AGENT_JOBS.iter().any(|path| route_path.starts_with(path)) {
             return Some("agents".to_string());
         }
@@ -726,7 +316,7 @@ fn extract_domain_from_route(
 /// Every entry is keyed by a job id and confines an authenticated caller to its own
 /// runnable — through `require_job_read_access`, through its own `jobs:run:flows:<path>`
 /// check, or, where an approval token or resume secret bypasses that gate, through a
-/// direct `require_job_within_run_scope`. The one exception is
+/// direct `require_job_within_read_scope`. The one exception is
 /// `jobs_u/get_root_job_id/`, which has no check at all but discloses only flow lineage,
 /// to anyone, authenticated or not. Workspace-wide enumeration (`jobs/list`, counts,
 /// exports) and credential minting (`job_view_token`) are deliberately absent — those are
@@ -943,23 +533,169 @@ fn resource_metadata_route_allowed(suffix: &str) -> bool {
         || suffix.starts_with("resources/type/")
 }
 
-/// The `jobs:run` scopes a token's job reads are confined to, or `None` when they are
-/// not confined to particular runnables.
+/// The by-id and list routes a path-scoped `jobs:read:<paths>` reaches, as workspaced
+/// route suffixes. Every other read in the domain is refused to it: counts, exports,
+/// uuid listings, queue positions and dispatch edges aggregate over the workspace, and
+/// the view-token and resume-url routes mint a credential (`approval_info` withholds
+/// its view token from a confined caller for the same reason).
+///
+/// Each entry confines the caller in its handler, through `require_job_read_access` or
+/// a direct `require_job_within_read_scope`. `jobs/result_by_id/` is absent because it
+/// resolves a node up through the enclosing flows, past the job the check admitted.
+/// A route added here without that check serves a path-scoped token every job.
+const READ_PATH_SCOPED_BY_ID_PATHS: [&'static str; 25] = [
+    "jobs_u/get/",
+    "jobs_u/get_logs/",
+    "jobs_u/get_completed_logs_tail/",
+    "jobs_u/get_flow_all_logs/",
+    "jobs_u/get_flow_all_logs_structured/",
+    "jobs_u/get_flow_all_results/",
+    "jobs_u/get_args/",
+    "jobs_u/get_flow_debug_info/",
+    "jobs_u/completed/get/",
+    "jobs_u/completed/get_result/",
+    "jobs_u/completed/get_result_maybe/",
+    "jobs_u/completed/get_timing/",
+    "jobs_u/dispatch_events/",
+    "jobs_u/getupdate/",
+    "jobs_u/getupdate_sse/",
+    "jobs_u/get_log_file/",
+    "jobs_u/get_flow/",
+    "jobs_u/flow/approval_info/",
+    "jobs/run_progress/",
+    "jobs/flow/user_states/",
+    "jobs/completed/get/",
+    "jobs/completed/get_result/",
+    "jobs/completed/get_result_maybe/",
+    "jobs/completed/get_timing/",
+    "jobs/get_otel_traces/",
+];
+
+/// Matched whole: `jobs/list` is also a prefix of the uuid listings. Their handlers
+/// filter in SQL to [`job_list_path_filter`].
+const READ_PATH_SCOPED_LIST_PATHS: [&'static str; 3] =
+    ["jobs/list", "jobs/completed/list", "jobs/queue/list"];
+
+fn is_read_path_scoped_route(suffix: &str) -> bool {
+    READ_PATH_SCOPED_LIST_PATHS.contains(&suffix)
+        || READ_PATH_SCOPED_BY_ID_PATHS
+            .iter()
+            .any(|p| suffix.starts_with(p))
+}
+
+/// The paths of a `jobs:read:<paths>` scope, or `None` when it spans every job: no
+/// path part, or `*` among them.
+fn job_read_scope_paths(scope: &ScopeDefinition) -> Option<&[String]> {
+    scope
+        .resource
+        .as_deref()
+        .filter(|paths| !paths.iter().any(|p| p == "*"))
+}
+
+/// The runnables a token's job reads are confined to: those its `jobs:run` scopes may
+/// start, and those its `jobs:read:<paths>` scopes name.
+pub struct JobReadConfinement {
+    run: Vec<ScopeDefinition>,
+    read_paths: crate::ScopePathFilter,
+}
+
+impl JobReadConfinement {
+    /// Whether a job that ran `runnable_path` as `kind` (`scripts`, `flows`, `agents` or
+    /// `dependencies`) is inside the confinement. A read path admits every kind; a run
+    /// scope only its own.
+    pub fn admits(&self, kind: &str, runnable_path: &str) -> bool {
+        if self.read_paths.allows(runnable_path) {
+            return true;
+        }
+        // Lock jobs and previews store the path their caller sent. The matcher reads `*`
+        // in it as a pattern, and `,`/`:` are scope syntax: such a path needs a grant
+        // covering every path, as enqueuing it did.
+        let resource = windmill_common::auth::is_scope_literal_path(runnable_path)
+            .then(|| vec![runnable_path.to_string()]);
+        let required = ScopeDefinition::new(
+            ScopeDomain::Jobs.as_str(),
+            ScopeAction::Run.as_str(),
+            Some(kind),
+            resource,
+        );
+        self.run.iter().any(|scope| scope.includes(&required))
+    }
+
+    /// Whether a `jobs:read:<paths>` scope is part of the confinement.
+    pub fn has_read_paths(&self) -> bool {
+        matches!(&self.read_paths, crate::ScopePathFilter::Restricted { exact, prefix }
+            if !exact.is_empty() || !prefix.is_empty())
+    }
+}
+
+fn push_read_paths(paths: &[String], exact: &mut Vec<String>, prefix: &mut Vec<String>) {
+    for path in paths {
+        match path.strip_suffix("/*") {
+            Some(p) => prefix.push(p.to_string()),
+            None => exact.push(path.clone()),
+        }
+    }
+}
+
+/// The paths a token's job lists are filtered to. Decided by its read grants alone,
+/// unlike [`job_read_confinement`]: a `jobs:run` scope grants no enumeration, so even a
+/// bare one beside a `jobs:read:<paths>` leaves the lists on those paths. Unrestricted
+/// for an unscoped token, a `jobs:read` naming no path (or `*`), and `jobs:write`.
+pub fn job_list_path_filter(scopes: Option<&[String]>) -> crate::ScopePathFilter {
+    let mut exact = Vec::new();
+    let mut prefix = Vec::new();
+    let mut scoped = false;
+    for scope in scopes
+        .unwrap_or_default()
+        .iter()
+        .filter(|s| !s.starts_with("if_jobs:filter_tags:"))
+    {
+        scoped = true;
+        let Ok(scope) = ScopeDefinition::from_scope_string(scope) else {
+            continue;
+        };
+        if ScopeDomain::from_str(&scope.domain) != Some(ScopeDomain::Jobs) {
+            continue;
+        }
+        match ScopeAction::from_str(&scope.action) {
+            Some(ScopeAction::Read) => match job_read_scope_paths(&scope) {
+                Some(paths) => push_read_paths(paths, &mut exact, &mut prefix),
+                None => return crate::ScopePathFilter::AllowAll,
+            },
+            Some(ScopeAction::Write) => return crate::ScopePathFilter::AllowAll,
+            _ => continue,
+        }
+    }
+    if scoped {
+        crate::ScopePathFilter::Restricted { exact, prefix }
+    } else {
+        crate::ScopePathFilter::AllowAll
+    }
+}
+
+/// What a token's job reads are confined to, or `None` when they are not confined to
+/// particular runnables.
 ///
 /// A run scope is what the trigger UI mints per script or flow and hands to a webhook
 /// caller / CI job: it may start the runnables it names and follow those runs, so its
-/// by-id job reads must stay within what it can start (enforced by
-/// `require_job_read_access`). Both the path (`jobs:run:flows:f/team/etl`) and the
-/// kind-only (`jobs:run:scripts`, which legacy `jobs:runscript` tokens carry) forms
-/// confine, since `ScopeDefinition::includes` already matches a candidate
-/// `jobs:run:<kind>:<path>` against either.
+/// by-id job reads must stay within what it can start. Both the path
+/// (`jobs:run:flows:f/team/etl`) and the kind-only (`jobs:run:scripts`, which legacy
+/// `jobs:runscript` tokens carry) forms confine, since `ScopeDefinition::includes`
+/// already matches a candidate `jobs:run:<kind>:<path>` against either.
+///
+/// A `jobs:read:<paths>` scope reads the runs of the runnables at those paths and
+/// nothing else. The two kinds of grant add up: a job either admits is readable.
 ///
 /// Returns `None` — unconfined — when the token is effectively unscoped, or carries a
-/// jobs scope that grants job reads in its own right: `jobs:read`/`jobs:write`, or a
-/// bare `jobs:run` (it can start anything, so confining its reads to "what it may run"
-/// would restrict nothing).
-pub fn job_read_run_confinement(scopes: Option<&[String]>) -> Option<Vec<ScopeDefinition>> {
-    let mut confinement = Vec::new();
+/// jobs scope that grants every job read in its own right: a `jobs:read` naming no path
+/// (or `*`), a bare `jobs:run` (it can start anything, so confining its reads to "what
+/// it may run" would restrict nothing), or `jobs:write`, whose paths are ignored on
+/// reads as they are on every job write.
+pub fn job_read_confinement(scopes: Option<&[String]>) -> Option<JobReadConfinement> {
+    let mut run = Vec::new();
+    let mut exact = Vec::new();
+    let mut prefix = Vec::new();
+    let mut confined = false;
     for scope in scopes?
         .iter()
         .filter(|s| !s.starts_with("if_jobs:filter_tags:"))
@@ -972,26 +708,76 @@ pub fn job_read_run_confinement(scopes: Option<&[String]>) -> Option<Vec<ScopeDe
         }
         match ScopeAction::from_str(&scope.action) {
             Some(ScopeAction::Run) if scope.kind.is_some() || scope.resource.is_some() => {
-                confinement.push(scope)
+                confined = true;
+                run.push(scope)
             }
+            Some(ScopeAction::Read) => {
+                let Some(paths) = job_read_scope_paths(&scope) else {
+                    return None;
+                };
+                confined = true;
+                push_read_paths(paths, &mut exact, &mut prefix);
+            }
+            // Grants no reads (see `scope_grants_access`), so it neither confines nor
+            // frees them.
+            Some(ScopeAction::Cancel) => continue,
             Some(_) => return None,
             None => continue,
         }
     }
+    confined.then_some(JobReadConfinement {
+        run,
+        read_paths: crate::ScopePathFilter::Restricted { exact, prefix },
+    })
+}
+
+/// The `jobs:cancel:<paths>` scopes a token's cancels are confined to, or `None` when
+/// they are not confined: an unscoped token, or one whose cancel grant is not
+/// path-scoped (`jobs:cancel`, or `jobs:write`, which stays resource-blind here as on
+/// every other job write).
+///
+/// A job is within the confinement when its own `runnable_path` or that of any of its
+/// `parent_job` ancestors matches (see `cancel_confinement_admits`), so a token scoped
+/// to a flow can cancel the flow's steps.
+pub fn job_cancel_path_confinement(scopes: Option<&[String]>) -> Option<Vec<ScopeDefinition>> {
+    let mut confinement = Vec::new();
+    for scope in scopes?
+        .iter()
+        .filter(|s| !s.starts_with("if_jobs:filter_tags:"))
+    {
+        let Ok(scope) = ScopeDefinition::from_scope_string(scope) else {
+            continue;
+        };
+        if ScopeDomain::from_str(&scope.domain) != Some(ScopeDomain::Jobs) {
+            continue;
+        }
+        match ScopeAction::from_str(&scope.action) {
+            Some(ScopeAction::Cancel) if scope.resource.is_some() => confinement.push(scope),
+            Some(ScopeAction::Cancel | ScopeAction::Write) => return None,
+            _ => continue,
+        }
+    }
     (!confinement.is_empty()).then_some(confinement)
 }
 
-/// Whether a job that ran `runnable_path` as `kind` (`scripts` or `flows`) is inside a
-/// [`job_read_run_confinement`] set.
-pub fn run_confinement_admits(
-    confinement: &[ScopeDefinition],
-    kind: &str,
-    runnable_path: &str,
-) -> bool {
+/// Whether the token holds a `jobs:cancel` scope, path-scoped or not.
+pub fn has_job_cancel_grant(scopes: Option<&[String]>) -> bool {
+    scopes.is_some_and(|scopes| {
+        scopes.iter().any(|s| {
+            ScopeDefinition::from_scope_string(s).is_ok_and(|s| {
+                ScopeDomain::from_str(&s.domain) == Some(ScopeDomain::Jobs)
+                    && ScopeAction::from_str(&s.action) == Some(ScopeAction::Cancel)
+            })
+        })
+    })
+}
+
+/// Whether a job of `runnable_path` is inside a [`job_cancel_path_confinement`] set.
+pub fn cancel_confinement_admits(confinement: &[ScopeDefinition], runnable_path: &str) -> bool {
     let required = ScopeDefinition::new(
         ScopeDomain::Jobs.as_str(),
-        ScopeAction::Run.as_str(),
-        Some(kind),
+        ScopeAction::Cancel.as_str(),
+        None,
         Some(vec![runnable_path.to_string()]),
     );
     confinement.iter().any(|scope| scope.includes(&required))
@@ -1052,6 +838,17 @@ fn scope_grants_access(
         }));
     }
 
+    // A path-scoped `jobs:read:<paths>` is the one job scope this layer does not treat
+    // as resource-blind: it reaches only the routes whose handlers confine it to those
+    // paths, so a job read route is refused to it until it is listed there.
+    if scope_domain == ScopeDomain::Jobs
+        && scope_action == ScopeAction::Read
+        && required_action == ScopeAction::Read
+        && job_read_scope_paths(scope).is_some()
+    {
+        return Ok(route_path.is_some_and(is_read_path_scoped_route));
+    }
+
     if !scope_action.includes(&required_action) {
         return Ok(false);
     }
@@ -1085,7 +882,8 @@ fn scope_grants_access(
 /// from its own super-admin gate, these among them, so each is already readable by every
 /// authenticated user; each is here because the CLI reads it from a job:
 /// `automate_username_creation` before creating a user during a git-sync push, `uid` and
-/// `hub_base_url` when `u/admin/hub_sync` pulls resource types from the Hub. The other
+/// `hub_base_url` when a job runs `wmill hub pull`, as an edited copy of the retired
+/// `u/admin/hub_sync` still does (servers sync resource types themselves). The other
 /// ungated keys have no such caller, so they stay confined — being ungated earns a key
 /// nothing on its own. Listing a gated key earns it nothing either: `require_super_admin`
 /// refuses every job token, so `hub_api_secret`, which that pull reads for a private Hub,
@@ -1202,6 +1000,61 @@ pub fn scope_for_route(method: &str, path: &str) -> Option<String> {
     })
 }
 
+/// Routes the runtime of a job calls about that job alone: progress, its root id, its
+/// resume and approval urls, a workflow-as-code checkpoint or task. A job token restricted
+/// by `job_token_scopes` keeps these whatever its scopes, or the job could not run at all,
+/// but only for its own job: the job id in the path must be the token's.
+pub fn is_own_job_runtime_route(route_path: &str, http_method: &str, job_id: uuid::Uuid) -> bool {
+    let Some(rest) = route_path.strip_prefix("/api/w/") else {
+        return false;
+    };
+    let Some((_workspace, rest)) = rest.split_once('/') else {
+        return false;
+    };
+    let segments: Vec<&str> = rest.split('/').collect();
+    let (method_ok, id_index) = match segments.as_slice() {
+        ["jobs_u", "get" | "get_root_job_id", ..] => (http_method == "GET", 2),
+        ["job_metrics", "set_progress", ..] => (http_method == "POST", 2),
+        ["job_metrics", "get_progress", ..] => (http_method == "GET", 2),
+        ["jobs" | "jobs_u", "resume_urls" | "wac_approval_urls", ..] => (http_method == "GET", 2),
+        ["jobs", "worker_is_draining", ..] => (http_method == "GET", 2),
+        ["jobs", "wac", "inline_checkpoint", ..] => (http_method == "POST", 3),
+        ["jobs", "run", "workflow_as_code", ..] => (http_method == "POST", 3),
+        _ => return false,
+    };
+    method_ok
+        && segments
+            .get(id_index)
+            .and_then(|id| uuid::Uuid::parse_str(id).ok())
+            .is_some_and(|id| id == job_id)
+}
+
+/// Routes reading the state of a flow run: step results (`results.x` in input transforms,
+/// loop and branch results) and the run's user state. The flow orchestrator evaluates a
+/// step's inputs with the token of the step that just finished, and the SDK reads user state
+/// at the root job, so a restricted job token keeps these for every job of its own run.
+/// Returns the job id the path names; the caller checks it against the token's lineage.
+pub fn flow_run_read_route_job(route_path: &str, http_method: &str) -> Option<uuid::Uuid> {
+    let rest = route_path.strip_prefix("/api/w/")?;
+    let (_workspace, rest) = rest.split_once('/')?;
+    let segments: Vec<&str> = rest.split('/').collect();
+    let id = match segments.as_slice() {
+        ["jobs" | "jobs_u", "result_by_id", id, ..] if http_method == "GET" => id,
+        ["jobs_u", "completed", "get_result" | "get_result_maybe", id, ..]
+            if http_method == "GET" =>
+        {
+            id
+        }
+        ["jobs" | "jobs_u", "flow", "user_states", id, ..]
+            if http_method == "GET" || http_method == "POST" =>
+        {
+            id
+        }
+        _ => return None,
+    };
+    uuid::Uuid::parse_str(id).ok()
+}
+
 /// Helper function to check if scopes allow access to a route
 pub fn check_scopes_for_route(
     token_scopes: Option<&[String]>,
@@ -1221,6 +1074,63 @@ pub fn check_scopes_for_route(
 mod tests {
     use super::*;
 
+    #[test]
+    fn own_job_runtime_routes_admit_only_the_tokens_job() {
+        let own = uuid::Uuid::new_v4();
+        let other = uuid::Uuid::new_v4();
+        let ok = |path: &str, method: &str| is_own_job_runtime_route(path, method, own);
+        assert!(ok(
+            &format!("/api/w/ws/job_metrics/set_progress/{own}"),
+            "POST"
+        ));
+        assert!(ok(
+            &format!("/api/w/ws/jobs_u/get_root_job_id/{own}"),
+            "GET"
+        ));
+        assert!(ok(&format!("/api/w/ws/jobs/resume_urls/{own}/0"), "GET"));
+        assert!(ok(
+            &format!("/api/w/ws/jobs/wac/inline_checkpoint/{own}"),
+            "POST"
+        ));
+        assert!(ok(
+            &format!("/api/w/ws/jobs/run/workflow_as_code/{own}/main"),
+            "POST"
+        ));
+        assert!(!ok(
+            &format!("/api/w/ws/job_metrics/set_progress/{other}"),
+            "POST"
+        ));
+        assert!(!ok(&format!("/api/w/ws/jobs_u/get/{own}"), "POST"));
+        assert!(!ok(&format!("/api/w/ws/jobs/run/p/{own}"), "POST"));
+        assert!(!ok("/api/w/ws/variables/get_value/u/admin/secret", "GET"));
+        let run = |path: &str, method: &str| flow_run_read_route_job(path, method);
+        assert_eq!(
+            run(&format!("/api/w/ws/jobs/result_by_id/{other}/b"), "GET"),
+            Some(other)
+        );
+        assert_eq!(
+            run(
+                &format!("/api/w/ws/jobs_u/completed/get_result/{other}"),
+                "GET"
+            ),
+            Some(other)
+        );
+        assert_eq!(
+            run(
+                &format!("/api/w/ws/jobs/flow/user_states/{other}/k"),
+                "POST"
+            ),
+            Some(other)
+        );
+        assert_eq!(
+            run(
+                &format!("/api/w/ws/jobs_u/completed/delete/{other}"),
+                "POST"
+            ),
+            None
+        );
+    }
+
     #[test]
     fn test_scope_definition_parsing() {
         let scope = ScopeDefinition::from_scope_string("jobs:read").unwrap();
@@ -1395,28 +1305,16 @@ mod tests {
     #[test]
     fn run_scopes_confine_job_reads_by_kind_and_path() {
         let confinement =
-            job_read_run_confinement(Some(&["jobs:run:flows:f/team/*".to_string()])).unwrap();
-        assert!(run_confinement_admits(&confinement, "flows", "f/team/etl"));
+            job_read_confinement(Some(&["jobs:run:flows:f/team/*".to_string()])).unwrap();
+        assert!(confinement.admits("flows", "f/team/etl"));
         // Right path, wrong kind — a script named like the flow is not the flow.
-        assert!(!run_confinement_admits(
-            &confinement,
-            "scripts",
-            "f/team/etl"
-        ));
-        assert!(!run_confinement_admits(
-            &confinement,
-            "flows",
-            "f/other/etl"
-        ));
+        assert!(!confinement.admits("scripts", "f/team/etl"));
+        assert!(!confinement.admits("flows", "f/other/etl"));
 
         // A kind-only scope confines to that kind, at any path.
-        let kind_only = job_read_run_confinement(Some(&["jobs:run:scripts".to_string()])).unwrap();
-        assert!(run_confinement_admits(
-            &kind_only,
-            "scripts",
-            "u/admin/anything"
-        ));
-        assert!(!run_confinement_admits(&kind_only, "flows", "f/team/etl"));
+        let kind_only = job_read_confinement(Some(&["jobs:run:scripts".to_string()])).unwrap();
+        assert!(kind_only.admits("scripts", "u/admin/anything"));
+        assert!(!kind_only.admits("flows", "f/team/etl"));
 
         // Scopes that grant job reads in their own right leave reads unconfined.
         for scopes in [
@@ -1429,11 +1327,111 @@ mod tests {
             vec!["if_jobs:filter_tags:deno".to_string()],
         ] {
             assert!(
-                job_read_run_confinement(Some(&scopes)).is_none(),
+                job_read_confinement(Some(&scopes)).is_none(),
                 "{scopes:?} must not confine job reads"
             );
         }
-        assert!(job_read_run_confinement(None).is_none());
+        assert!(job_read_confinement(None).is_none());
+    }
+
+    #[test]
+    fn jobs_read_paths_confine_reads_and_reach_only_confined_routes() {
+        let scopes = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let scoped = scopes(&["jobs:read:f/served/*,u/svc/report"]);
+        let confinement = job_read_confinement(Some(&scoped)).unwrap();
+        // Any kind of runnable at a named path.
+        assert!(confinement.admits("flows", "f/served/etl"));
+        assert!(confinement.admits("scripts", "u/svc/report"));
+        assert!(!confinement.admits("scripts", "f/other/etl"));
+        assert!(!confinement.admits("scripts", "f/served_not/etl"));
+        let lists = |s: &[&str], path: &str| job_list_path_filter(Some(&scopes(s))).allows(path);
+        assert!(lists(
+            &["jobs:read:f/served/*,u/svc/report"],
+            "f/served/etl"
+        ));
+        assert!(!lists(
+            &["jobs:read:f/served/*,u/svc/report"],
+            "f/other/etl"
+        ));
+
+        // A run scope adds the runnables it may start to the by-id reads, and nothing to
+        // the lists, not even a bare one that leaves the by-id reads unconfined.
+        let both = scopes(&["jobs:read:f/served/*", "jobs:run:scripts:f/other/etl"]);
+        let confinement = job_read_confinement(Some(&both)).unwrap();
+        assert!(confinement.admits("scripts", "f/other/etl"));
+        assert!(!confinement.admits("flows", "f/other/etl"));
+        for run in ["jobs:run:scripts:f/other/etl", "jobs:run"] {
+            assert!(
+                !lists(&["jobs:read:f/served/*", run], "f/other/etl"),
+                "{run}"
+            );
+        }
+        for unfiltered in [
+            &["jobs:read"][..],
+            &["jobs:read:f/served/*", "jobs:write"],
+            &["if_jobs:filter_tags:deno"],
+        ] {
+            assert!(lists(unfiltered, "f/other/etl"), "{unfiltered:?}");
+        }
+
+        for unconfined in [
+            &["jobs:read:*"][..],
+            &["jobs:read:f/served/*", "jobs:read"],
+            &["jobs:read:f/served/*", "jobs:write"],
+            &["jobs:write:f/served/*"],
+        ] {
+            assert!(
+                job_read_confinement(Some(&scopes(unconfined))).is_none(),
+                "{unconfined:?}"
+            );
+        }
+
+        let id = "0190f4c2-0000-7000-8000-000000000000";
+        for route in [
+            format!("jobs_u/get/{id}"),
+            format!("jobs_u/completed/get_result/{id}"),
+            format!("jobs_u/getupdate_sse/{id}"),
+            format!("jobs_u/flow/approval_info/{id}"),
+            "jobs/list".to_string(),
+            "jobs/completed/list".to_string(),
+            "jobs/queue/list".to_string(),
+        ] {
+            let route = format!("/api/w/ws/{route}");
+            assert!(
+                check_route_access(&scoped, &route, "GET").is_ok(),
+                "{route}"
+            );
+        }
+        // Reads that aggregate over the workspace, resolve past the job they name, or
+        // mint a credential stay with a `jobs:read` that names no path.
+        for route in [
+            "jobs/list_filtered_uuids".to_string(),
+            "jobs/queue/list_filtered_uuids".to_string(),
+            "jobs/queue/count".to_string(),
+            "jobs/completed/count".to_string(),
+            "jobs/completed/count_jobs".to_string(),
+            "jobs/completed/export".to_string(),
+            "jobs/queue/export".to_string(),
+            "jobs/asset_dispatch_edges".to_string(),
+            format!("jobs/queue/scheduled_for/{id}"),
+            format!("jobs/result_by_id/{id}/a"),
+            format!("jobs/job_view_token/{id}"),
+            format!("jobs_u/get_root_job_id/{id}"),
+        ] {
+            let route = format!("/api/w/ws/{route}");
+            assert!(
+                check_route_access(&scoped, &route, "GET").is_err(),
+                "{route}"
+            );
+            assert!(
+                check_route_access(&scopes(&["jobs:read"]), &route, "GET").is_ok(),
+                "{route}"
+            );
+            assert!(
+                check_route_access(&scopes(&["jobs:read:*"]), &route, "GET").is_ok(),
+                "{route}"
+            );
+        }
     }
 
     #[test]
@@ -1737,6 +1735,24 @@ mod tests {
             scope_for_route("POST", "/api/w/ws/jobs/run/agent/u/x/y").as_deref(),
             Some("jobs:run:agents")
         );
+        for path in [
+            "/api/w/ws/jobs/run/dependencies",
+            "/api/w/ws/jobs/run/dependencies_async",
+            "/api/w/ws/jobs/run/flow_dependencies",
+            "/api/w/ws/jobs/run/flow_dependencies_async",
+        ] {
+            assert_eq!(
+                scope_for_route("POST", path).as_deref(),
+                Some("jobs:run:dependencies"),
+                "{path}"
+            );
+            assert!(check_route_access(&["jobs:run:dependencies".into()], path, "POST").is_ok());
+            assert!(check_route_access(&["jobs:run:flows".into()], path, "POST").is_err());
+        }
+        // A dependencies grant reaches no other run route.
+        for path in ["/api/w/ws/jobs/run/preview", "/api/w/ws/jobs/run/p/u/x/y"] {
+            assert!(check_route_access(&["jobs:run:dependencies".into()], path, "POST").is_err());
+        }
 
         // Preview/bundle runs have no deployed path and their handlers require the
         // broad `jobs:run` scope, so the derived scope must not carry a kind.
@@ -1781,4 +1797,68 @@ mod tests {
         // Unknown route -> None so the caller fails closed.
         assert!(scope_for_route("GET", "/healthz").is_none());
     }
+
+    #[test]
+    fn jobs_cancel_grants_only_the_cancel_routes() {
+        let cancel = vec!["jobs:cancel:f/served/*".to_string()];
+        let id = "0190f4c2-0000-7000-8000-000000000000";
+        for route in [
+            format!("/api/w/ws/jobs_u/queue/cancel/{id}"),
+            format!("/api/w/ws/jobs_u/queue/force_cancel/{id}"),
+            "/api/w/ws/jobs_u/queue/cancel_persistent/f/served/s".to_string(),
+            "/api/w/ws/jobs/queue/cancel_selection".to_string(),
+        ] {
+            assert!(
+                check_route_access(&cancel, &route, "POST").is_ok(),
+                "{route}"
+            );
+            assert!(
+                check_route_access(&["jobs:write".to_string()], &route, "POST").is_ok(),
+                "{route}"
+            );
+            assert!(
+                check_route_access(&["jobs:read".to_string()], &route, "POST").is_err(),
+                "{route}"
+            );
+        }
+        for (route, method) in [
+            (format!("/api/w/ws/jobs_u/get/{id}"), "GET"),
+            ("/api/w/ws/jobs/list".to_string(), "GET"),
+            (format!("/api/w/ws/jobs/flow/resume_suspended/{id}"), "POST"),
+            (format!("/api/w/ws/jobs/queue/run_now/{id}"), "POST"),
+            ("/api/w/ws/jobs/run/p/f/served/s".to_string(), "POST"),
+        ] {
+            assert!(
+                check_route_access(&cancel, &route, method).is_err(),
+                "{route}"
+            );
+        }
+    }
+
+    #[test]
+    fn jobs_cancel_path_confinement() {
+        let scopes = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let conf =
+            job_cancel_path_confinement(Some(&scopes(&["jobs:cancel:f/served/*,u/svc/kill_me"])))
+                .unwrap();
+        assert!(cancel_confinement_admits(&conf, "f/served/etl"));
+        assert!(cancel_confinement_admits(&conf, "u/svc/kill_me"));
+        assert!(!cancel_confinement_admits(&conf, "f/other/etl"));
+        assert!(!cancel_confinement_admits(&conf, "f/served_not/etl"));
+
+        // A cancel grant that is not path-scoped leaves cancels unconfined.
+        for s in [
+            &["jobs:cancel"][..],
+            &["jobs:cancel:f/a/*", "jobs:write"],
+            &[],
+        ] {
+            assert!(
+                job_cancel_path_confinement(Some(&scopes(s))).is_none(),
+                "{s:?}"
+            );
+        }
+        // A cancel scope neither confines nor frees a run token's reads.
+        let run = scopes(&["jobs:run:flows:f/a/b", "jobs:cancel"]);
+        assert!(job_read_confinement(Some(&run)).is_some());
+    }
 }
diff --git a/backend/windmill-api-configs/src/lib.rs b/backend/windmill-api-configs/src/lib.rs
index 7598021f00..f1f4792e71 100644
--- a/backend/windmill-api-configs/src/lib.rs
+++ b/backend/windmill-api-configs/src/lib.rs
@@ -224,12 +224,13 @@ async fn update_config(
 
     #[cfg(not(feature = "enterprise"))]
     let config = if name.starts_with("worker__") {
-        // In CE, only allow setting worker_tags, cache_clear, init_bash, and native_mode
+        // In CE, only allow setting worker_tags, cache_clear, init_bash, native_mode and paused
         serde_json::json!({
             "worker_tags": config.get("worker_tags"),
             "cache_clear": config.get("cache_clear"),
             "init_bash": config.get("init_bash"),
-            "native_mode": config.get("native_mode")
+            "native_mode": config.get("native_mode"),
+            "paused": config.get("paused")
         })
     } else {
         config
@@ -272,6 +273,18 @@ async fn update_config(
     }
 
     let mut tx = db.begin().await?;
+    let was_paused = if name.starts_with("worker__") {
+        sqlx::query_scalar!(
+            "SELECT COALESCE(config->'paused' = 'true'::jsonb, false) FROM config WHERE name = $1 FOR UPDATE",
+            &name
+        )
+        .fetch_optional(&mut *tx)
+        .await?
+        .flatten()
+        .unwrap_or(false)
+    } else {
+        false
+    };
     sqlx::query!(
         "INSERT INTO config (name, config) VALUES ($1, $2) ON CONFLICT (name) DO UPDATE SET config = EXCLUDED.config",
         &name,
@@ -291,6 +304,17 @@ async fn update_config(
     )
     .await?;
     tx.commit().await?;
+
+    if name.starts_with("worker__") {
+        let paused = config.get("paused").and_then(|v| v.as_bool()) == Some(true);
+        if paused != was_paused {
+            windmill_common::feature_usage::log_feature_usage(
+                "worker_group",
+                "pause_toggle",
+                if paused { "pause" } else { "resume" },
+            );
+        }
+    }
     Ok(format!("Updated config {name}"))
 }
 
diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index aa86a7ff07..eab73bc015 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -20,7 +20,8 @@ use windmill_api_auth::{
     require_owner_of_path, ApiAuthed,
 };
 use windmill_common::workspaces::{
-    check_deploy_rules, check_operator_can_build_flows, operator_can_build_flows, RuleCheckResult,
+    check_deploy_rules, check_operator_can_build, operator_builder_rights, BuilderKind,
+    RuleCheckResult,
 };
 use windmill_common::{
     user_drafts::{overlay_or_draft_only, DraftUserRef, UserDraftItemKind, WithDraftOverlay},
@@ -243,7 +244,7 @@ async fn list_flows(
 
     // Append the authed user's drafts at paths with no deployed flow; see scripts.rs.
     if lq.include_draft_only.unwrap_or(false)
-        && (!authed.is_operator || operator_can_build_flows(&db, &w_id).await?)
+        && (!authed.is_operator || operator_builder_rights(&db, &w_id).await?.flows)
         && offset == 0
         && lq.path_start.is_none()
         && lq.path_exact.is_none()
@@ -258,7 +259,8 @@ async fn list_flows(
             r#"SELECT DISTINCT ON (path)
                       path,
                       value as "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-                      created_at
+                      created_at,
+                      email IS NULL as "legacy!"
                FROM draft
                WHERE workspace_id = $1
                  AND typ = 'flow'
@@ -315,9 +317,9 @@ async fn list_flows(
                 inherited_labels: None,
                 is_draft: true,
                 draft_path,
-                // Synthesized rows are the authed user's own draft.
+                // Owned by nobody when legacy; see scripts.rs.
                 draft_users: Some(sqlx::types::Json(vec![DraftUserRef {
-                    username: Some(authed.username.clone()),
+                    username: (!row.legacy).then(|| authed.username.clone()),
                 }])),
             });
         }
@@ -730,7 +732,14 @@ async fn create_flow(
     Path(w_id): Path<String>,
     Json(mut nf): Json<NewFlow>,
 ) -> Result<(StatusCode, String)> {
-    check_operator_can_build_flows(&db, &w_id, authed.is_operator, "create flows").await?;
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Flows,
+        "create flows",
+    )
+    .await?;
     check_scopes(&authed, || format!("flows:write:{}", nf.path))?;
 
     // A `<= 0` flow timeout is "unset", not a 0-second limit that kills every run instantly.
@@ -803,6 +812,24 @@ async fn create_flow(
     check_schedule_conflict(&mut tx, &w_id, &nf.path).await?;
 
     let schema_str = nf.schema.and_then(|x| serde_json::to_string(&x.0).ok());
+    let job_token_scopes = nf
+        .job_token_scopes
+        .as_ref()
+        .and_then(|scopes| scopes.as_deref())
+        .map(windmill_common::scopes::validate_job_token_scopes)
+        .transpose()?;
+    let restricts_steps = windmill_common::scopes::validate_flow_step_job_token_scopes(
+        &serde_json::from_str::<windmill_common::flows::FlowValue>(nf.value.get())
+            .map_err(|e| windmill_common::error::Error::BadRequest(e.to_string()))?,
+    )?;
+    if job_token_scopes.is_some() || restricts_steps {
+        windmill_common::min_version::MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES
+            .assert()
+            .await?;
+    }
+    if restricts_steps {
+        windmill_common::feature_usage::log_feature_usage("job_token_scopes", "deploy", "step:set");
+    }
     let resolved_on_behalf_of = windmill_common::resolve_on_behalf_of(
         nf.on_behalf_of_email.as_deref(),
         nf.on_behalf_of.as_deref(),
@@ -823,14 +850,14 @@ async fn create_flow(
         dedicated_worker, visible_to_runner_only,
         ws_error_handler_muted,
         value, schema, edited_by, edited_at, labels,
-        on_behalf_of, on_behalf_of_email
+        on_behalf_of, on_behalf_of_email, job_token_scopes
     ) VALUES (
         $1, $2, $3, $4,
         NULL, '', $5,
         $6, $7,
         $8,
         $9, $10::text::json, $11, now(), $12,
-        $13, $14
+        $13, $14, $15
     )"#,
         w_id,
         nf.path,
@@ -846,9 +873,11 @@ async fn create_flow(
         nf.labels.as_deref() as Option<&[String]>,
         resolved_on_behalf_of,
         legacy_on_behalf_of_email,
+        job_token_scopes.as_deref() as Option<&[String]>,
     )
     .execute(&mut *tx)
     .await?;
+    windmill_common::scopes::log_job_token_scopes_deploy("flow", job_token_scopes.as_deref());
 
     let version = sqlx::query_scalar!(
         "INSERT INTO flow_version (workspace_id, path, value, schema, created_by)
@@ -973,6 +1002,7 @@ async fn create_flow(
         None,
         None,
         None,
+        None,
     )
     .await?;
 
@@ -1152,7 +1182,7 @@ async fn get_flow_version(
     let mut tx = user_db.begin(&authed).await?;
 
     let flow = sqlx::query_as::<_, Flow>(
-        "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of, flow.labels, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
+        "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of, flow.labels, flow.job_token_scopes, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
         FROM flow
         LEFT JOIN flow_version ON flow_version.path = flow.path AND flow_version.workspace_id = flow.workspace_id
         WHERE flow.path = $1 AND flow.workspace_id = $2 AND flow_version.id = $3",
@@ -1212,6 +1242,7 @@ async fn get_flow_version_by_id(
             flow.visible_to_runner_only,
             flow.on_behalf_of,
             flow.labels,
+            flow.job_token_scopes,
             flow_version.schema,
             flow_version.value,
             flow_version.created_at as edited_at,
@@ -1321,7 +1352,14 @@ async fn update_flow(
     Path((w_id, flow_path)): Path<(String, StripPath)>,
     Json(ef): Json<EditFlow>,
 ) -> Result<String> {
-    check_operator_can_build_flows(&db, &w_id, authed.is_operator, "update flows").await?;
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Flows,
+        "update flows",
+    )
+    .await?;
     let flow_path = flow_path.to_path();
     // The URL identifies the flow being updated; the body path is only needed to rename.
     let mut nf = ef.into_new_flow(flow_path);
@@ -1367,6 +1405,27 @@ async fn update_flow(
     let old_dep_job = not_found_if_none(old_dep_job, "Flow", flow_path)?;
     let is_new_path = nf.path != flow_path;
     let schema_str = schema.and_then(|x| serde_json::to_string(&x).ok());
+    // Absent keeps the deployed value: a client unaware of the setting must not drop a
+    // restriction by saving the flow.
+    let set_job_token_scopes = nf.job_token_scopes.is_some();
+    let job_token_scopes = nf
+        .job_token_scopes
+        .as_ref()
+        .and_then(|scopes| scopes.as_deref())
+        .map(windmill_common::scopes::validate_job_token_scopes)
+        .transpose()?;
+    let restricts_steps = windmill_common::scopes::validate_flow_step_job_token_scopes(
+        &serde_json::from_str::<windmill_common::flows::FlowValue>(nf.value.get())
+            .map_err(|e| windmill_common::error::Error::BadRequest(e.to_string()))?,
+    )?;
+    if job_token_scopes.is_some() || restricts_steps {
+        windmill_common::min_version::MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES
+            .assert()
+            .await?;
+    }
+    if restricts_steps {
+        windmill_common::feature_usage::log_feature_usage("job_token_scopes", "deploy", "step:set");
+    }
     let resolved_on_behalf_of = windmill_common::resolve_on_behalf_of(
         nf.on_behalf_of_email.as_deref(),
         nf.on_behalf_of.as_deref(),
@@ -1401,7 +1460,8 @@ async fn update_flow(
             edited_at = now(),
             labels = COALESCE($13, labels),
             on_behalf_of = $14,
-            on_behalf_of_email = $15
+            on_behalf_of_email = $15,
+            job_token_scopes = CASE WHEN $16 THEN $17 ELSE job_token_scopes END
         WHERE
             path = $11 AND workspace_id = $12",
         if is_new_path { flow_path } else { &nf.path },
@@ -1419,19 +1479,24 @@ async fn update_flow(
         nf.labels.as_deref() as Option<&[String]>,
         resolved_on_behalf_of,
         legacy_on_behalf_of_email,
+        set_job_token_scopes,
+        job_token_scopes.as_deref() as Option<&[String]>,
     )
     .execute(&mut *tx)
     .await
     .map_err(|e| {
         error::Error::internal_err(format!("Error updating flow due to flow update: {e:#}"))
     })?;
+    if set_job_token_scopes {
+        windmill_common::scopes::log_job_token_scopes_deploy("flow", job_token_scopes.as_deref());
+    }
 
     if is_new_path {
         // if new path, must clone flow to new path and delete old flow for flow_version foreign key constraint
         sqlx::query!(
             "INSERT INTO flow
-                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels)
-            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels
+                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, job_token_scopes)
+            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, job_token_scopes
                 FROM flow
                 WHERE path = $2 AND workspace_id = $3",
             nf.path,
@@ -1695,6 +1760,7 @@ async fn update_flow(
         None,
         None,
         None,
+        None,
     )
     .await?;
 
@@ -1870,6 +1936,7 @@ async fn get_flow_by_path(
             flow.visible_to_runner_only, 
             flow.on_behalf_of,
             flow.labels,
+            flow.job_token_scopes,
             folder_labels(flow.workspace_id, flow.path) AS inherited_labels,
             flow_version.id AS version_id,
             flow_version.schema,
@@ -1911,6 +1978,7 @@ async fn get_flow_by_path(
             flow.visible_to_runner_only, 
             flow.on_behalf_of,
             flow.labels,
+            flow.job_token_scopes,
             folder_labels(flow.workspace_id, flow.path) AS inherited_labels,
             flow_version.id AS version_id,
             flow_version.schema,
@@ -1985,7 +2053,14 @@ async fn archive_flow_by_path(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(archived): Json<Archived>,
 ) -> Result<String> {
-    check_operator_can_build_flows(&db, &w_id, authed.is_operator, "archive flows").await?;
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Flows,
+        "archive flows",
+    )
+    .await?;
     let path = path.to_path();
     check_scopes(&authed, || format!("flows:write:{}", path))?;
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
@@ -2126,7 +2201,14 @@ async fn delete_flow_by_path(
     Path((w_id, path)): Path<(String, StripPath)>,
     Query(query): Query<DeleteFlowQuery>,
 ) -> Result<String> {
-    check_operator_can_build_flows(&db, &w_id, authed.is_operator, "delete flows").await?;
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Flows,
+        "delete flows",
+    )
+    .await?;
     let path = path.to_path();
     check_scopes(&authed, || format!("flows:write:{}", path))?;
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
@@ -2335,6 +2417,7 @@ mod tests {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
                 FlowModule {
                     id: "b".to_string(),
@@ -2370,6 +2453,7 @@ mod tests {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
                 FlowModule {
                     id: "c".to_string(),
@@ -2405,6 +2489,7 @@ mod tests {
                     apply_preprocessor: None,
                     pass_flow_input_directly: None,
                     debouncing: None,
+                    job_token_scopes: None,
                 },
             ],
             failure_module: Some(Box::new(FlowModule {
@@ -2439,6 +2524,7 @@ mod tests {
                 apply_preprocessor: None,
                 pass_flow_input_directly: None,
                 debouncing: None,
+                job_token_scopes: None,
             })),
             preprocessor_module: None,
             same_worker: false,
diff --git a/backend/windmill-api-groups/src/groups.rs b/backend/windmill-api-groups/src/groups.rs
index 0209af8585..d9550d2f5b 100644
--- a/backend/windmill-api-groups/src/groups.rs
+++ b/backend/windmill-api-groups/src/groups.rs
@@ -470,26 +470,16 @@ async fn update_igroup(
     require_super_admin(&db, &authed).await?;
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
 
-    let exists_opt = sqlx::query("SELECT 1 FROM instance_group WHERE name = $1")
-        .bind(name.clone())
-        .fetch_optional(&mut *tx)
-        .await?;
-    not_found_if_none(exists_opt, "instance_group", name.clone())?;
+    let old_role_opt = sqlx::query_scalar!(
+        "SELECT instance_role FROM instance_group WHERE name = $1 FOR UPDATE",
+        &name
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    let old_role = not_found_if_none(old_role_opt, "instance_group", name.clone())?;
 
     let validated_role = validate_instance_role(&igroup_update.instance_role)?;
 
-    // Fetch old role before updating so we can detect changes
-    let old_role = if igroup_update.instance_role.is_some() {
-        sqlx::query_scalar!(
-            "SELECT instance_role FROM instance_group WHERE name = $1",
-            &name
-        )
-        .fetch_one(&mut *tx)
-        .await?
-    } else {
-        None
-    };
-
     sqlx::query("UPDATE instance_group SET summary = $1, instance_role = $2 WHERE name = $3")
         .bind(igroup_update.new_summary)
         .bind(&validated_role)
@@ -497,8 +487,9 @@ async fn update_igroup(
         .execute(&mut *tx)
         .await?;
 
-    // If instance_role actually changed, propagate to all group members
-    if igroup_update.instance_role.is_some() && old_role != validated_role {
+    // An omitted or null instance_role is stored as NULL above, so it revokes like any other
+    // change: members must be recomputed whenever the stored role differs.
+    if old_role != validated_role {
         propagate_instance_group_roles(&name, &mut tx).await?;
     }
 
@@ -664,21 +655,19 @@ async fn delete_igroup(
 
     // FOR UPDATE: the group row is the group-level mutex, taken before the workspace
     // advisory locks (see reconcile_workspace_instance_groups).
-    let group_role = sqlx::query_scalar!(
+    sqlx::query_scalar!(
         "SELECT instance_role FROM instance_group WHERE name = $1 FOR UPDATE",
         &name
     )
     .fetch_optional(&mut *tx)
-    .await?
-    .flatten();
+    .await?;
 
-    let affected_members: Vec<String> = if group_role.is_some() {
+    // Collected whatever the group's current role: a member can still hold a role this group
+    // granted before it was cleared.
+    let affected_members: Vec<String> =
         sqlx::query_scalar!("SELECT email FROM email_to_igroup WHERE igroup = $1", &name)
             .fetch_all(&mut *tx)
-            .await?
-    } else {
-        vec![]
-    };
+            .await?;
 
     // Captured and advisory-locked before the settings update strips the group from them.
     #[cfg(feature = "private")]
diff --git a/backend/windmill-api-integration-tests/tests/datatable_roles.rs b/backend/windmill-api-integration-tests/tests/datatable_roles.rs
index ddb94f8c2b..023d9f20ed 100644
--- a/backend/windmill-api-integration-tests/tests/datatable_roles.rs
+++ b/backend/windmill-api-integration-tests/tests/datatable_roles.rs
@@ -417,6 +417,89 @@ async fn concurrent_role_creations_both_survive(db: Pool<Postgres>) -> anyhow::R
     outcome
 }
 
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn an_existing_role_is_taken_over_only_when_asked_and_never_with_members(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let suffix: String = uuid::Uuid::new_v4().simple().to_string()[..8].to_string();
+    let plain = format!("wmtest_plain_{suffix}");
+    let group = format!("wmtest_group_{suffix}");
+    let member = format!("wmtest_member_{suffix}");
+    for sql in [
+        // An expired password and no connection slot: kept as is, the login Windmill sets is dead.
+        format!(
+            "CREATE ROLE \"{plain}\" LOGIN PASSWORD 'theirs' VALID UNTIL '2000-01-01' \
+             CONNECTION LIMIT 0"
+        ),
+        format!("CREATE ROLE \"{group}\" NOLOGIN"),
+        format!("CREATE ROLE \"{member}\" LOGIN"),
+        format!("GRANT \"{group}\" TO \"{member}\""),
+    ] {
+        sqlx::query(&sql).execute(&db).await?;
+    }
+
+    let create = |name: String, take_over: bool| async move {
+        let resp = authed(
+            client().post(format!(
+                "http://localhost:{port}/api/settings/datatable_roles"
+            )),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({ "name": name, "take_over": take_over }))
+        .send()
+        .await?;
+        Ok::<_, anyhow::Error>((resp.status().as_u16(), resp.text().await?))
+    };
+    let outcome = async {
+        let (status, body) = create(plain.clone(), false).await?;
+        assert_eq!(
+            status, 409,
+            "an existing role is not taken without asking: {body}"
+        );
+
+        // The group's member would inherit every grant the data table role gets.
+        let (status, body) = create(group.clone(), true).await?;
+        assert_eq!(status, 400, "{body}");
+        assert!(
+            body.contains(&member),
+            "the refusal names the member: {body}"
+        );
+
+        let (status, body) = create(plain.clone(), true).await?;
+        assert_eq!(status, 200, "{body}");
+        let catalog = windmill_common::datatable_roles::read_role_catalog(
+            &db,
+            windmill_common::datatable_roles::DatatableRoleCluster::Instance,
+        )
+        .await?;
+        let taken = catalog
+            .values()
+            .find(|r| r.name == plain)
+            .ok_or_else(|| anyhow::anyhow!("{plain} is not in the catalog: {catalog:?}"))?;
+        let options = (*db.connect_options())
+            .clone()
+            .username(&plain)
+            .password(taken.pwd.as_deref().unwrap_or_default());
+        let mut login = <sqlx::PgConnection as sqlx::Connection>::connect_with(&options).await?;
+        sqlx::query("SELECT 1").execute(&mut login).await?;
+        Ok::<_, anyhow::Error>(())
+    }
+    .await;
+
+    // Roles are cluster-wide and outlive this test's database, whatever happened above.
+    for name in [&member, &group, &plain] {
+        let _ = sqlx::query(&format!("DROP ROLE IF EXISTS \"{name}\""))
+            .execute(&db)
+            .await;
+    }
+    outcome
+}
+
 #[cfg(all(feature = "private", feature = "enterprise"))]
 #[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
 async fn a_role_delete_that_fails_part_way_leaves_the_role_disabled(
@@ -1764,3 +1847,222 @@ async fn cleanup_waits_out_a_save_racing_it_for_an_instance_database(
     assert_eq!(users, vec!["test-workspace".to_string()]);
     Ok(())
 }
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_connection_naming_no_role_holds_the_default_one_and_the_viewers(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::workspaces::{get_datatable_resource_from_db, DatatableAccess};
+
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let suffix: String = uuid::Uuid::new_v4().simple().to_string()[..8].to_string();
+    let names = [
+        format!("wmtest_floor_{suffix}"),
+        format!("wmtest_emea_{suffix}"),
+        format!("wmtest_amer_{suffix}"),
+    ];
+    let roles_url = format!("http://localhost:{port}/api/settings/datatable_roles");
+    const MEMBER_LOGINS: &str = "SELECT m.rolname::text FROM pg_auth_members am
+         JOIN pg_roles r ON r.oid = am.roleid JOIN pg_roles m ON m.oid = am.member
+         WHERE r.rolname = $1 AND m.rolname LIKE 'wm\\_set\\_%'";
+
+    // The job is the app publisher's in every case: only the viewer the server recorded differs.
+    let connect = |role: Option<&'static str>, viewer: Option<&'static str>| {
+        get_datatable_resource_from_db(
+            &db,
+            "test-workspace",
+            "main",
+            role,
+            DatatableAccess::PermissionedAs {
+                permissioned_as: "u/test-user",
+                email: "test@windmill.dev",
+                end_user_email: viewer,
+            },
+        )
+    };
+    let set_permissions = |default_role: String, roles: Value| {
+        sqlx::query(
+            "UPDATE workspace_settings
+             SET datatable = jsonb_set(datatable, '{datatables,main,permissions}', $1)
+             WHERE workspace_id = 'test-workspace'",
+        )
+        .bind(json!({ "default_role": default_role, "roles": roles }))
+        .execute(&db)
+    };
+
+    let outcome = async {
+        let mut ids = vec![];
+        for name in &names {
+            let created: Value = authed(client().post(&roles_url), "SECRET_TOKEN")
+                .json(&json!({ "name": name }))
+                .send()
+                .await?
+                .error_for_status()?
+                .json()
+                .await?;
+            ids.push(created["id"].as_str().unwrap().to_string());
+        }
+        // `test-user-2` is named by both regional roles, one of them through a group, and by
+        // `admin`; `test-user-3` by one; the workspace admin `test-user` by neither.
+        let roles = json!({
+            "admin": {"tenants": ["u/test-user-2"]},
+            (ids[0].as_str()): {"tenants": ["*"]},
+            (ids[1].as_str()): {"tenants": ["u/test-user-2", "u/test-user-3"]},
+            (ids[2].as_str()): {"tenants": ["g/analysts"]},
+        });
+        set_permissions(ids[0].clone(), roles.clone()).await?;
+        sqlx::query(
+            "INSERT INTO usr_to_group (workspace_id, usr, group_)
+             VALUES ('test-workspace', 'test-user-2', 'analysts')",
+        )
+        .execute(&db)
+        .await?;
+        let member_of = |login: String| async {
+            let mut roles: Vec<String> = sqlx::query_scalar(
+                "SELECT r.rolname::text FROM pg_auth_members am
+                 JOIN pg_roles r ON r.oid = am.roleid JOIN pg_roles m ON m.oid = am.member
+                 WHERE m.rolname = $1",
+            )
+            .bind(login)
+            .fetch_all(&db)
+            .await?;
+            roles.sort();
+            Ok::<_, anyhow::Error>(roles)
+        };
+
+        let all = connect(None, Some("test2@windmill.dev")).await?;
+        let login = all["user"].as_str().unwrap().to_string();
+        assert!(login.starts_with("wm_set_"), "{login}");
+        let mut expected = names.to_vec();
+        expected.sort();
+        assert_eq!(
+            member_of(login.clone()).await?,
+            expected,
+            "the login holds the default role and the viewer's, and not `admin`"
+        );
+        assert_eq!(connect(None, Some("test2@windmill.dev")).await?, all);
+
+        let two = connect(None, Some("test3@windmill.dev")).await?;
+        let mut expected = names[..2].to_vec();
+        expected.sort();
+        assert_eq!(
+            member_of(two["user"].as_str().unwrap().to_string()).await?,
+            expected
+        );
+
+        // An admin may use every role, the one owning the tables included. As a viewer they add
+        // what names them, which here is nothing; nor does a job with no viewer recorded.
+        for viewer in [Some("test@windmill.dev"), None] {
+            assert_eq!(connect(None, viewer).await?["user"], names[0].as_str());
+        }
+        // A named role is that role alone, whoever is viewing.
+        let named: &'static str = Box::leak(names[1].clone().into_boxed_str());
+        assert_eq!(
+            connect(Some(named), Some("test2@windmill.dev")).await?["user"],
+            names[1].as_str()
+        );
+        // A default of `admin` is the connection it always was: the viewer's roles are not added.
+        set_permissions("admin".to_string(), roles.clone()).await?;
+        let admin = connect(None, Some("test2@windmill.dev")).await?;
+        assert_eq!(admin, connect(Some("admin"), None).await?);
+        assert!(!admin["user"].as_str().unwrap().starts_with("wm_"));
+
+        // With no default role the viewer's roles are all there is, the one open to everyone
+        // included, and a connection left with none is refused rather than resolved as anything.
+        set_permissions("$none".to_string(), roles.clone()).await?;
+        assert_eq!(
+            connect(None, Some("test3@windmill.dev")).await?,
+            two,
+            "no default changes nothing for a viewer the roles name"
+        );
+        assert!(connect(None, None).await.is_err());
+        // The same holds for a default the job's own identity is not a tenant of.
+        let mut closed = roles.clone();
+        closed[ids[0].as_str()] = json!({"tenants": []});
+        set_permissions(ids[0].clone(), closed).await?;
+        let as_member = |viewer: Option<&'static str>| {
+            get_datatable_resource_from_db(
+                &db,
+                "test-workspace",
+                "main",
+                None,
+                DatatableAccess::PermissionedAs {
+                    permissioned_as: "u/test-user-3",
+                    email: "test3@windmill.dev",
+                    end_user_email: viewer,
+                },
+            )
+        };
+        assert_eq!(
+            as_member(Some("test3@windmill.dev")).await?["user"],
+            names[1].as_str()
+        );
+        assert!(as_member(None).await.is_err());
+        set_permissions(ids[0].clone(), roles).await?;
+
+        // A set login nobody connects with any more is dropped, a recent one is kept, and a
+        // dropped one is made again for the next viewer who needs it.
+        let exists = || async {
+            sqlx::query_scalar::<_, bool>(
+                "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1)",
+            )
+            .bind(&login)
+            .fetch_one(&db)
+            .await
+        };
+        windmill_common::datatable_roles::sweep_unused_role_set_logins(&db).await?;
+        assert!(exists().await?, "a set login in use was swept");
+        sqlx::query("UPDATE datatable_role_set SET last_used_at = now() - interval '31 days'")
+            .execute(&db)
+            .await?;
+        windmill_common::datatable_roles::sweep_unused_role_set_logins(&db).await?;
+        assert!(!exists().await?, "an unused set login was kept");
+        assert_eq!(
+            connect(None, Some("test2@windmill.dev")).await?["user"],
+            login.as_str()
+        );
+
+        // A disabled role must not stay reachable through a login that is a member of it.
+        authed(
+            client().post(format!("{roles_url}/{}", ids[2])),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({ "enabled": false }))
+        .send()
+        .await?
+        .error_for_status()?;
+        let can_login: bool =
+            sqlx::query_scalar("SELECT rolcanlogin FROM pg_roles WHERE rolname = $1")
+                .bind(&login)
+                .fetch_one(&db)
+                .await?;
+        assert!(!can_login, "{login} still logs in with a disabled role");
+        assert_eq!(
+            connect(None, Some("test2@windmill.dev")).await?["user"],
+            two["user"]
+        );
+        Ok::<_, anyhow::Error>(())
+    }
+    .await;
+
+    // Roles are cluster-wide, so they outlive this test's throwaway database.
+    for name in &names {
+        let logins: Vec<String> = sqlx::query_scalar(MEMBER_LOGINS)
+            .bind(name)
+            .fetch_all(&db)
+            .await
+            .unwrap_or_default();
+        for login in logins {
+            let _ = sqlx::query(&format!("DROP ROLE IF EXISTS \"{login}\""))
+                .execute(&db)
+                .await;
+        }
+        let _ = sqlx::query(&format!("DROP ROLE IF EXISTS \"{name}\""))
+            .execute(&db)
+            .await;
+    }
+    outcome
+}
diff --git a/backend/windmill-api-integration-tests/tests/groups.rs b/backend/windmill-api-integration-tests/tests/groups.rs
index 26e5caeea1..9928d1c060 100644
--- a/backend/windmill-api-integration-tests/tests/groups.rs
+++ b/backend/windmill-api-integration-tests/tests/groups.rs
@@ -497,6 +497,72 @@ async fn test_remove_user_from_instance_group_rederives_role(
     Ok(())
 }
 
+/// Clearing an instance group's role, or deleting a group whose role was cleared out from under
+/// its members, must take the instance-level role back from them.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_instance_group_role_revoked_on_clear_and_delete(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let global_base = format!("http://localhost:{port}/api/groups");
+    let email = "test2@windmill.dev";
+
+    let is_super_admin = || async {
+        sqlx::query_scalar::<_, bool>("SELECT super_admin FROM password WHERE email = $1")
+            .bind(email)
+            .fetch_one(&db)
+            .await
+    };
+
+    let resp = authed(client().post(format!("{global_base}/create")))
+        .json(&json!({ "name": "admins_grp" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "create: {}", resp.text().await?);
+    let resp = authed(client().post(format!("{global_base}/update/admins_grp")))
+        .json(&json!({ "new_summary": "", "instance_role": "superadmin" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "set role: {}", resp.text().await?);
+    let resp = authed(client().post(format!("{global_base}/adduser/admins_grp")))
+        .json(&json!({ "email": email }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "adduser: {}", resp.text().await?);
+    assert!(is_super_admin().await?, "group should grant superadmin");
+
+    let resp = authed(client().post(format!("{global_base}/update/admins_grp")))
+        .json(&json!({ "new_summary": "", "instance_role": null }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "update: {}", resp.text().await?);
+    assert!(
+        !is_super_admin().await?,
+        "clearing the group's role must revoke superadmin"
+    );
+
+    // A member left elevated while the group's stored role is already NULL.
+    sqlx::query(
+        "UPDATE password SET super_admin = true, role_source = 'instance_group' WHERE email = $1",
+    )
+    .bind(email)
+    .execute(&db)
+    .await?;
+
+    let resp = authed(client().delete(format!("{global_base}/delete/admins_grp")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "delete: {}", resp.text().await?);
+    assert!(
+        !is_super_admin().await?,
+        "deleting a role-cleared group must revoke superadmin"
+    );
+
+    Ok(())
+}
+
 /// An overwrite import that moves a member from a dropped group to a retained one must keep
 /// their workspace data.
 ///
diff --git a/backend/windmill-api-integration-tests/tests/jobs_authed.rs b/backend/windmill-api-integration-tests/tests/jobs_authed.rs
index c3da2f3fb9..2c5d2ee78e 100644
--- a/backend/windmill-api-integration-tests/tests/jobs_authed.rs
+++ b/backend/windmill-api-integration-tests/tests/jobs_authed.rs
@@ -702,3 +702,51 @@ async fn test_list_filtered_job_uuids_resolved_excludes_queue(
 
     Ok(())
 }
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_worker_is_draining_follows_the_job_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, permissioned_as, kind, tag, args)
+         VALUES ($1, 'test-workspace', 'test-user', 'u/test-user', 'script', 'deno', '{}'::jsonb)",
+    )
+    .bind(job)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag, running, started_at, worker)
+         VALUES ($1, 'test-workspace', now(), 'deno', true, now(), 'wk-drain-test')",
+    )
+    .bind(job)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO worker_ping (worker, worker_instance, ip, worker_group, wm_version)
+         VALUES ('wk-drain-test', 'host', 'NO IP', 'default', 'v0')",
+    )
+    .execute(&db)
+    .await?;
+
+    let url = format!("http://localhost:{port}/api/w/test-workspace/jobs/worker_is_draining/{job}");
+    let draining = || async {
+        let resp = authed(client().get(&url)).send().await?;
+        anyhow::Ok(resp.json::<bool>().await?)
+    };
+    assert!(!draining().await?);
+
+    windmill_common::worker::set_worker_draining_query("wk-drain-test", &db).await?;
+    assert!(draining().await?);
+
+    // A parked job keeps its last worker on the queue row without running on it.
+    sqlx::query("UPDATE v2_job_queue SET started_at = NULL WHERE id = $1")
+        .bind(job)
+        .execute(&db)
+        .await?;
+    assert!(!draining().await?);
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/operator_builder_apps.rs b/backend/windmill-api-integration-tests/tests/operator_builder_apps.rs
new file mode 100644
index 0000000000..7033d093f2
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/operator_builder_apps.rs
@@ -0,0 +1,570 @@
+use serde_json::json;
+use serial_test::serial;
+use sqlx::{Pool, Postgres};
+use windmill_common::workspaces::invalidate_operator_rights_cache;
+use windmill_test_utils::*;
+
+/// Every test here must be `#[serial]`: the rights cache is process-global and keyed by workspace id
+/// alone, so parallel tests under this same id read each other's rights.
+const WS: &str = "test-workspace";
+
+fn client(token: &str) -> reqwest::Client {
+    let mut headers = reqwest::header::HeaderMap::new();
+    headers.insert(
+        reqwest::header::AUTHORIZATION,
+        reqwest::header::HeaderValue::from_str(&format!("Bearer {token}")).unwrap(),
+    );
+    reqwest::ClientBuilder::new()
+        .default_headers(headers)
+        .build()
+        .unwrap()
+}
+
+async fn set_builder(db: &Pool<Postgres>, flows: bool, apps: bool) -> anyhow::Result<()> {
+    sqlx::query(
+        "UPDATE workspace_settings SET operator_settings = $1::text::jsonb WHERE workspace_id = $2",
+    )
+    .bind(format!(
+        r#"{{"builder_flows": {flows}, "builder_apps": {apps}}}"#
+    ))
+    .bind(WS)
+    .execute(db)
+    .await?;
+    // The rights are read through a process-global 60s cache keyed by workspace id.
+    invalidate_operator_rights_cache(WS);
+    Ok(())
+}
+
+async fn add_script(db: &Pool<Postgres>, hash: i64, path: &str, owner: &str) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema,
+             summary, description, lock, extra_perms)
+         VALUES ($1, $2, $3, 'x', 'bun', 'script', $4, '{}', '', '', '', '{}')",
+    )
+    .bind(WS)
+    .bind(hash)
+    .bind(path)
+    .bind(owner)
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// A full-code app is deployed multipart, the way the editor and the CLI use it.
+fn raw_app_form(app: serde_json::Value) -> reqwest::multipart::Form {
+    reqwest::multipart::Form::new()
+        .part(
+            "app",
+            reqwest::multipart::Part::text(app.to_string())
+                .mime_str("application/json")
+                .unwrap(),
+        )
+        .part(
+            "js",
+            reqwest::multipart::Part::text("console.log(1)").file_name("app.js"),
+        )
+}
+
+fn raw_app(path: &str, mode: &str, runnable_path: &str) -> reqwest::multipart::Form {
+    raw_app_form(json!({
+        "path": path,
+        "summary": "",
+        "value": {"files": {}, "runnables": {"r": {
+            "name": "r", "type": "runnableByPath", "runType": "script",
+            "path": runnable_path
+        }}},
+        "policy": {"execution_mode": mode, "triggerables_v2": {}}
+    }))
+}
+
+fn composition_flow(path: &str) -> serde_json::Value {
+    json!({
+        "path": path, "summary": "", "description": "", "schema": {},
+        "value": {"modules": [{
+            "id": "a",
+            "value": {"type": "script", "path": "u/operator/some_script", "input_transforms": {}}
+        }]}
+    })
+}
+
+/// The app half of the builder boundary, plus the proof that the two rights are independent: a
+/// gate reading "either" would authorize the kind its workspace never granted, which is the whole
+/// point of splitting them.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "permissions_test"))]
+#[serial]
+async fn test_operator_builder_apps_boundary(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let api = format!("http://localhost:{port}/api/w/{WS}");
+    let c = client("OPERATOR_TOKEN_1");
+
+    add_script(&db, 4241, "u/operator/some_script", "operator").await?;
+    // `permissions_test` gives the operator fixture no rights on `u/alice/**`.
+    add_script(&db, 4243, "u/alice/private", "alice").await?;
+    // A version shared with the operator, then archived, and a newer one at the same path that is
+    // not: the newer one is what runs.
+    add_script(&db, 4244, "u/alice/reused", "alice").await?;
+    sqlx::query(
+        "UPDATE script SET archived = true, extra_perms = '{\"u/operator\": false}',
+             created_at = now() - interval '1 day' WHERE hash = 4244",
+    )
+    .execute(&db)
+    .await?;
+    add_script(&db, 4245, "u/alice/reused", "alice").await?;
+
+    set_builder(&db, false, false).await?;
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app(
+            "u/operator/a0",
+            "publisher",
+            "u/operator/some_script",
+        ))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "an operator without the builder right must not create a full-code app"
+    );
+
+    set_builder(&db, true, true).await?;
+
+    // `*_raw_source` compiles caller-supplied sources with a bundler job on a worker. It sits
+    // beside `create_app_raw`, which builders MAY use, so it is the gate most likely to be opened
+    // by mistake later.
+    let resp = c
+        .post(format!("{api}/apps/create_raw_source"))
+        .json(&json!({
+            "path": "u/operator/a1", "summary": "",
+            "value": {"files": {"index.ts": "console.log(1)"}, "runnables": {}},
+            "policy": {"execution_mode": "publisher"}
+        }))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "a builder must not compile app sources on a worker"
+    );
+
+    // Low-code apps carry inline scripts, so they stay shut too.
+    let resp = c
+        .post(format!("{api}/apps/create"))
+        .json(&json!({
+            "path": "u/operator/a2", "summary": "",
+            "value": {"grid": []}, "policy": {"execution_mode": "publisher"}
+        }))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "a builder must not create a low-code app"
+    );
+
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app("u/operator/a3", "publisher", "u/alice/private"))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "a builder must not deploy an app referencing a runnable it cannot read"
+    );
+
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app("u/operator/a4", "viewer", "u/operator/some_script"))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "a builder must not deploy a viewer-mode app: the policy stops bounding what it can invoke"
+    );
+
+    // Storage strips a NUL, turning this key into `inlineScript`.
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app_form(json!({
+            "path": "u/operator/a_nul", "summary": "",
+            "value": {"files": {}, "runnables": {"r": {
+                "type": "inline",
+                "inline\u{0}Script": {"content": "x", "language": "bun"}
+            }}},
+            "policy": {"execution_mode": "publisher", "triggerables_v2": {}}
+        })))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        403,
+        "a NUL in a key must not hide an inline script: {}",
+        resp.text().await?
+    );
+
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app(
+            "u/operator/a5",
+            "publisher",
+            "u/operator/some_script",
+        ))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "a builder must be able to deploy a full-code app over readable runnables: {}",
+        resp.text().await?
+    );
+    let sandbox: Option<bool> = sqlx::query_scalar(
+        "SELECT (policy->>'sandbox')::boolean FROM app WHERE workspace_id = $1 AND path = $2",
+    )
+    .bind(WS)
+    .bind("u/operator/a5")
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        sandbox,
+        Some(true),
+        "a builder-authored app must be stored sandboxed"
+    );
+
+    // `execute_component` looks up `<component>:<path>` with an unrestricted component string, so
+    // a key with a second colon still resolves at run time and must not slip past validation.
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app_form(json!({
+            "path": "u/operator/a6", "summary": "",
+            "value": {"files": {}, "runnables": {}},
+            "policy": {"execution_mode": "publisher", "triggerables_v2": {
+                "x:y:script/u/alice/private": {"static_inputs": {}, "one_of_inputs": {}}
+            }}
+        })))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "a multi-colon triggerable key must not hide an unreadable runnable from validation"
+    );
+
+    // The two rights are independent.
+    set_builder(&db, true, false).await?;
+    let resp = c
+        .post(format!("{api}/flows/create"))
+        .json(&composition_flow("u/operator/flows_only"))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "flows-only must still create a flow: {}",
+        resp.text().await?
+    );
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app(
+            "u/operator/flows_only_app",
+            "publisher",
+            "u/operator/some_script",
+        ))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "flows-only must not deploy a full-code app"
+    );
+
+    set_builder(&db, false, true).await?;
+    let resp = c
+        .post(format!("{api}/flows/create"))
+        .json(&composition_flow("u/operator/apps_only"))
+        .send()
+        .await?;
+    assert!(
+        !resp.status().is_success(),
+        "apps-only must not create a flow"
+    );
+    let resp = c
+        .post(format!("{api}/apps/create_raw"))
+        .multipart(raw_app(
+            "u/operator/apps_only_app",
+            "publisher",
+            "u/operator/some_script",
+        ))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "apps-only must still deploy a full-code app: {}",
+        resp.text().await?
+    );
+
+    // The deploy panel saves access and frontend scopes through the settings-only endpoint.
+    for (body, expected) in [
+        (
+            json!({"policy": {"execution_mode": "anonymous", "triggerables_v2": {}}}),
+            200,
+        ),
+        (
+            json!({"policy": {"execution_mode": "publisher", "sandbox": false, "triggerables_v2": {}}}),
+            403,
+        ),
+        (
+            json!({"value": {"files": {}, "runnables": {}}, "policy": {"execution_mode": "publisher"}}),
+            403,
+        ),
+    ] {
+        let resp = c
+            .post(format!("{api}/apps/update/u/operator/apps_only_app"))
+            .json(&body)
+            .send()
+            .await?;
+        let status = resp.status();
+        assert_eq!(
+            status,
+            expected,
+            "settings update {body}: {}",
+            resp.text().await?
+        );
+    }
+    let sandbox: Option<bool> = sqlx::query_scalar(
+        "SELECT (policy->>'sandbox')::boolean FROM app WHERE workspace_id = $1 AND path = $2",
+    )
+    .bind(WS)
+    .bind("u/operator/apps_only_app")
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        sandbox,
+        Some(true),
+        "a settings update must not turn a builder app's sandbox off"
+    );
+
+    // The editor runs the runnables a draft names as whoever opens it, and its frontend code
+    // with their session unless the preview is sandboxed.
+    for (runnables, policy, expected) in [
+        (json!({}), json!({"sandbox": true}), 200),
+        (
+            json!({"a": {"type": "inline", "inlineScript": {"content": "x", "language": "bun"}}}),
+            json!({"sandbox": true}),
+            403,
+        ),
+        (json!({}), json!({"sandbox": false}), 403),
+        (
+            json!({}),
+            json!({"sandbox": true, "execution_mode": "viewer"}),
+            403,
+        ),
+        (json!({}), json!(null), 403),
+        (
+            json!({}),
+            json!({"sandbox": true, "on_behalf_of": "u/alice", "on_behalf_of_email": "alice@windmill.dev"}),
+            403,
+        ),
+        (
+            json!({}),
+            json!({"sandbox": true, "on_behalf_of": "u/operator"}),
+            200,
+        ),
+        (
+            json!({}),
+            json!({"sandbox": true, "triggerables": {
+                format!("{}script/u/operator/some_script", "a:".repeat(300)): {}
+            }}),
+            400,
+        ),
+        (
+            json!({"r": {"type": "runnableByPath", "runType": "script", "path": "u/operator/some_script"}}),
+            json!({"sandbox": true}),
+            200,
+        ),
+        (
+            json!({"r": {"type": "runnableByPath", "runType": "script", "path": "u/alice/private"}}),
+            json!({"sandbox": true}),
+            403,
+        ),
+        (
+            json!({"r": {"type": "runnableByPath", "runType": "script", "path": "u/alice/reused"}}),
+            json!({"sandbox": true}),
+            403,
+        ),
+        (
+            json!({"r": {"type": "path", "runType": "hubscript", "path": "hub/1/x/y"}}),
+            json!({"sandbox": true}),
+            403,
+        ),
+        (
+            json!({"r": {"type": "path", "runType": "script/u/alice", "path": "u/operator/some_script"}}),
+            json!({"sandbox": true}),
+            400,
+        ),
+        (
+            json!({"r": {"type": "path", "runType": "script", "path": ["u/alice/private"]}}),
+            json!({"sandbox": true}),
+            400,
+        ),
+        (
+            json!({"r": {"type": ["path"], "runType": "script", "path": "u/alice/private"}}),
+            json!({"sandbox": true}),
+            400,
+        ),
+        (
+            json!([{"type": "path", "runType": "script", "path": "u/alice/private"}]),
+            json!({"sandbox": true}),
+            400,
+        ),
+        (
+            json!({"r": {"type": "path", "runType": "script", "path": "u/operator/some_script",
+                "fields": {"x": {"type": "static", "value": {"type": "path", "path": "/srv/out"}}}}}),
+            json!({"sandbox": true}),
+            200,
+        ),
+        (
+            json!({}),
+            json!({"sandbox": true, "triggerables": {"x:rawscript/abc": {}}}),
+            403,
+        ),
+        (
+            json!({}),
+            json!({"sandbox": true, "triggerables": {"x:script/u/alice/private": {}}}),
+            403,
+        ),
+        (
+            json!({}),
+            json!({"sandbox": true, "triggerables_v2": {
+                "x:script/u/alice/private": {"static_inputs": {}, "one_of_inputs": {}},
+                "y:rawscript/abc": {"static_inputs": {}, "one_of_inputs": {}}
+            }}),
+            200,
+        ),
+    ] {
+        let resp = c
+            .post(format!("{api}/drafts/update/raw_app/u/operator/d1"))
+            .json(&json!({
+                "value": {"files": {}, "runnables": runnables, "summary": "", "policy": policy},
+                "force": true
+            }))
+            .send()
+            .await?;
+        let status = resp.status();
+        assert_eq!(
+            status,
+            expected,
+            "raw app draft {runnables} {policy}: {}",
+            resp.text().await?
+        );
+    }
+
+    // The component preview runs a deployed runnable for a builder; inline code and hub
+    // scripts are unreviewed code.
+    for (preview, expected) in [
+        (json!({"path": "script/u/operator/some_script"}), 200),
+        (json!({"path": "script/hub/1/x/y"}), 403),
+        (
+            json!({"raw_code": {"content": "x", "language": "bun"}}),
+            403,
+        ),
+    ] {
+        let mut body = json!({"component": "c", "args": {}, "force_viewer_static_fields": {}});
+        body.as_object_mut()
+            .unwrap()
+            .extend(preview.as_object().unwrap().clone());
+        let resp = c
+            .post(format!(
+                "{api}/apps_u/execute_component/u/operator/apps_only_app"
+            ))
+            .json(&body)
+            .send()
+            .await?;
+        let status = resp.status();
+        assert_eq!(
+            status,
+            expected,
+            "component preview {preview}: {}",
+            resp.text().await?
+        );
+    }
+
+    // Delete and redeploy each serve both kinds; builder rights cover only full-code apps.
+    let resp = client("SECRET_TOKEN")
+        .post(format!("{api}/apps/create"))
+        .json(&json!({
+            "path": "u/operator/low_code", "summary": "",
+            "value": {"grid": []}, "policy": {"execution_mode": "publisher"}
+        }))
+        .send()
+        .await?;
+    assert!(resp.status().is_success(), "{}", resp.text().await?);
+    let resp = c
+        .post(format!("{api}/apps/update_raw/u/operator/low_code"))
+        .multipart(raw_app_form(json!({
+            "policy": {"execution_mode": "publisher", "triggerables_v2": {}}
+        })))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        403,
+        "policy-only update of a low-code app: {}",
+        resp.text().await?
+    );
+    // Deployment history restores a full-code version with allow_kind_change set.
+    let resp = c
+        .post(format!("{api}/apps/update_raw/u/operator/apps_only_app"))
+        .multipart(raw_app_form(json!({
+            "value": {"files": {}, "runnables": {}},
+            "policy": {"execution_mode": "publisher", "triggerables_v2": {}},
+            "allow_kind_change": true
+        })))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "restore of a full-code version: {}",
+        resp.text().await?
+    );
+    for (path, expected) in [("low_code", 403), ("apps_only_app", 200)] {
+        let resp = c
+            .delete(format!("{api}/apps/delete/u/operator/{path}"))
+            .send()
+            .await?;
+        let status = resp.status();
+        assert_eq!(status, expected, "delete {path}: {}", resp.text().await?);
+    }
+
+    Ok(())
+}
+
+/// The readability check must not hold its RLS transaction while it takes a second connection,
+/// or a one-connection pool (`DATABASE_CONNECTIONS=1`) stalls every builder draft naming a script.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "permissions_test"))]
+#[serial]
+async fn test_operator_builder_app_check_fits_one_connection(
+    pool_opts: sqlx::postgres::PgPoolOptions,
+    connect_opts: sqlx::postgres::PgConnectOptions,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let db = pool_opts
+        .max_connections(1)
+        .acquire_timeout(std::time::Duration::from_secs(5))
+        .connect_with(connect_opts)
+        .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let api = format!("http://localhost:{}/api/w/{WS}", server.addr.port());
+    add_script(&db, 4241, "u/operator/some_script", "operator").await?;
+    set_builder(&db, false, true).await?;
+
+    let resp = client("OPERATOR_TOKEN_1")
+        .post(format!("{api}/drafts/update/raw_app/u/operator/d1"))
+        .json(&json!({
+            "value": {"files": {}, "summary": "", "runnables": {"r": {
+                "name": "r", "type": "runnableByPath", "runType": "script",
+                "path": "u/operator/some_script"
+            }}, "policy": {"sandbox": true, "triggerables_v2": {}}},
+            "force": true
+        }))
+        .send()
+        .await?;
+    let status = resp.status();
+    assert_eq!(status, 200, "{}", resp.text().await?);
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/settings.rs b/backend/windmill-api-integration-tests/tests/settings.rs
index 348d945a86..7fd60ed8e1 100644
--- a/backend/windmill-api-integration-tests/tests/settings.rs
+++ b/backend/windmill-api-integration-tests/tests/settings.rs
@@ -200,3 +200,81 @@ async fn test_alert_job_queue_waiting_in_global_settings(db: Pool<Postgres>) ->
 
     Ok(())
 }
+
+async fn read_secret_surfaces(
+    base: &str,
+    names: &[&str],
+) -> anyhow::Result<Vec<(String, u16, String)>> {
+    let mut paths = vec![
+        "instance_config".to_string(),
+        "instance_config/yaml".to_string(),
+    ];
+    #[cfg(feature = "enterprise")]
+    paths.push("list_global".to_string());
+    paths.extend(names.iter().map(|n| format!("global/{n}")));
+    let mut out = vec![];
+    for path in paths {
+        let resp = authed(client().get(format!("{base}/{path}")))
+            .send()
+            .await?;
+        let status = resp.status().as_u16();
+        out.push((path, status, resp.text().await?));
+    }
+    Ok(out)
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_server_secrets_follow_export_flag(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let secrets = [
+        ("jwt_secret", json!("planted-jwt-secret")),
+        ("rsa_keys", json!({"private_key": "planted-rsa-key"})),
+        (
+            "custom_instance_replication_pwd",
+            json!("planted-replication-pwd"),
+        ),
+        (
+            "external_instance_pg_state",
+            json!({"admin_pwd": "planted-pg-state"}),
+        ),
+    ];
+    for (name, value) in &secrets {
+        sqlx::query(
+            "INSERT INTO global_settings (name, value) VALUES ($1, $2)
+             ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
+        )
+        .bind(name)
+        .bind(value)
+        .execute(&db)
+        .await?;
+    }
+    let names: Vec<&str> = secrets.iter().map(|(n, _)| *n).collect();
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api/settings", server.addr.port());
+
+    // Default: a full export, so `get-config` and `pull` can migrate an instance.
+    std::env::remove_var("EXPORT_SERVER_SECRETS");
+    for (path, status, body) in read_secret_surfaces(&base, &names).await? {
+        assert_2xx(status, &body, &path);
+        assert!(
+            body.contains("planted-"),
+            "{path} dropped a server secret: {body}"
+        );
+    }
+
+    std::env::set_var("EXPORT_SERVER_SECRETS", "0");
+    let withheld = read_secret_surfaces(&base, &names).await;
+    std::env::remove_var("EXPORT_SERVER_SECRETS");
+    for (path, status, body) in withheld? {
+        if path.starts_with("global/") {
+            assert_eq!(status, 400, "GET {path} returned {status}");
+        } else {
+            assert_2xx(status, &body, &path);
+        }
+        assert!(
+            !body.contains("planted-"),
+            "{path} returned a server secret: {body}"
+        );
+    }
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/workspace_comparison.rs b/backend/windmill-api-integration-tests/tests/workspace_comparison.rs
index 11c731d75c..1aa2bc8df2 100644
--- a/backend/windmill-api-integration-tests/tests/workspace_comparison.rs
+++ b/backend/windmill-api-integration-tests/tests/workspace_comparison.rs
@@ -756,6 +756,13 @@ async fn test_compare_workspaces_trigger_and_schedule(db: Pool<Postgres>) -> any
     )
     .execute(&db)
     .await?;
+    // The scheduler's missed-occurrence counters only ever move on the enabled side.
+    sqlx::query(
+        "UPDATE schedule SET late_run_streak = 1, missed_occurrences = 2, last_missed_at = NOW()
+         WHERE workspace_id = 'test-workspace' AND path = 'f/sch/runtime_only'",
+    )
+    .execute(&db)
+    .await?;
 
     // ------ Schedule: config change (script_path) in fork. Should diff.
     sqlx::query!(
@@ -2537,7 +2544,10 @@ async fn test_rename_records_the_vacated_path(db: Pool<Postgres>) -> anyhow::Res
             .await?;
         let status = resp.status();
         let hash = resp.text().await?;
-        assert!(status.is_success(), "script deploy failed: {status} — {hash}");
+        assert!(
+            status.is_success(),
+            "script deploy failed: {status} — {hash}"
+        );
         parent_hash = Some(hash.trim().trim_matches('"').to_string());
     }
     let mut vacated = None;
diff --git a/backend/windmill-api-jobs/Cargo.toml b/backend/windmill-api-jobs/Cargo.toml
index d3e10205ac..dad6469947 100644
--- a/backend/windmill-api-jobs/Cargo.toml
+++ b/backend/windmill-api-jobs/Cargo.toml
@@ -15,6 +15,7 @@ enterprise = ["windmill-common/enterprise"]
 [dependencies]
 windmill-api-auth.workspace = true
 windmill-api-sse.workspace = true
+windmill-audit.workspace = true
 windmill-common = { workspace = true, default-features = false }
 windmill-queue.workspace = true
 axum.workspace = true
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index 1a750c38ba..c6c2a1fede 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -23,12 +23,17 @@ use std::sync::Arc;
 use tokio::sync::RwLock;
 use uuid::Uuid;
 use windmill_api_auth::{check_scopes, get_scope_tags, ApiAuthed};
+use windmill_audit::{
+    audit_oss::{audit_log_many, AuditAuthorable},
+    ActionKind,
+};
 use windmill_common::{
     db::{UserDB, UserDbWithAuthed},
     error::{self, Error},
     flow_conversations::{
         add_message_to_conversation_tx, message_attachments, MessageExtras, MessageType,
     },
+    flows::Retry,
     get_latest_flow_version_info_for_path,
     jobs::{
         check_tag_available_for_workspace_internal, format_result, script_path_to_payload,
@@ -122,9 +127,76 @@ pub async fn drop_unclaimable_run_lineage(
     Ok(())
 }
 
+/// Applies the run's `retry` policy by handing `push` a one-step-flow request, which it
+/// materializes as a native retryable `Script`.
+pub fn with_run_retry(
+    run_query: &RunJobQuery,
+    payload: JobPayload,
+    args: &PushArgs<'_>,
+    tag: &Option<String>,
+) -> error::Result<JobPayload> {
+    let Some(retry) = run_query.retry.as_deref() else {
+        return Ok(payload);
+    };
+    // Retry attempts are always pushed visible to the owner, which would leak a private run.
+    if run_query.invisible_to_owner.unwrap_or(false) {
+        return Err(Error::BadRequest(
+            "retry cannot be combined with invisible_to_owner".to_string(),
+        ));
+    }
+    let retry: Retry = serde_json::from_str(retry)
+        .map_err(|e| Error::BadRequest(format!("invalid retry policy: {e}")))?;
+    let JobPayload::ScriptHash {
+        hash,
+        path,
+        cache_ttl,
+        cache_ignore_s3_path,
+        language,
+        priority,
+        apply_preprocessor,
+        debouncing_settings,
+        concurrency_settings,
+        ..
+    } = payload
+    else {
+        return Err(Error::BadRequest(
+            "retry is only supported for workspace scripts".to_string(),
+        ));
+    };
+    // A failed attempt keeps its raw args and the retry re-push skips the preprocessor, so
+    // every retry would call `main` with un-preprocessed input.
+    if apply_preprocessor {
+        return Err(Error::BadRequest(
+            "retry is not supported for a script with a preprocessor unless skip_preprocessor is set"
+                .to_string(),
+        ));
+    }
+    Ok(JobPayload::SingleStepFlow {
+        path,
+        hash: Some(hash),
+        flow_version: None,
+        language: Some(language),
+        args: HashMap::from(args),
+        retry: Some(retry),
+        error_handler_path: None,
+        error_handler_args: None,
+        skip_handler: None,
+        cache_ttl,
+        cache_ignore_s3_path,
+        priority,
+        tag_override: tag.clone(),
+        trigger_path: None,
+        apply_preprocessor,
+        concurrency_settings,
+        debouncing_settings,
+    })
+}
+
 /// The jobs of `referenced` that `authed` cannot claim as its own run lineage: anything but the
 /// token's own job and that job's `parent_job`, `root_job` and `flow_innermost_root_job`, or for
-/// a workspace admin anything outside the workspace.
+/// a workspace admin anything outside the workspace. A restricted job token never gets the admin
+/// latitude: its flow-run routes trust this lineage (`job_in_same_flow_run`), so a claimed
+/// unrelated run would escape its scopes.
 pub async fn unclaimable_run_lineage(
     db: &DB,
     w_id: &str,
@@ -157,7 +229,8 @@ pub async fn unclaimable_run_lineage(
     if referenced.is_empty() {
         return Ok(referenced);
     }
-    let in_workspace = if authed.is_admin {
+    let restricted_job_token = authed.job_id.is_some() && authed.scopes.is_some();
+    let in_workspace = if authed.is_admin && !restricted_job_token {
         sqlx::query_scalar!(
             "SELECT id FROM v2_job WHERE id = ANY($1) AND workspace_id = $2",
             &referenced,
@@ -172,6 +245,27 @@ pub async fn unclaimable_run_lineage(
     Ok(referenced)
 }
 
+/// `WM_END_USER_EMAIL` of a run started through a `/jobs/run*` route. `WM_EMAIL` names the
+/// runnable's `on_behalf_of` identity when it has one, so this is the only place the caller's
+/// address reaches the job. A job's own `WM_TOKEN` passes on the end user of that job, and a run
+/// a trigger fired has no end user.
+pub async fn run_end_user_email(
+    db: &DB,
+    w_id: &str,
+    authed: &ApiAuthed,
+    trigger: Option<&TriggerMetadata>,
+) -> error::Result<Option<String>> {
+    if trigger.is_some() {
+        return Ok(None);
+    }
+    match authed.job_id {
+        Some(job_id) => Ok(windmill_common::auth::get_job_perms(db, &job_id, w_id)
+            .await?
+            .and_then(|p| p.end_user_email)),
+        None => Ok(Some(authed.email.clone())),
+    }
+}
+
 #[cfg(feature = "enterprise")]
 pub async fn check_license_key_valid() -> error::Result<()> {
     use windmill_common::ee_oss::LICENSE_KEY_VALID;
@@ -193,11 +287,15 @@ pub async fn check_license_key_valid() -> error::Result<()> {
 pub async fn cancel_jobs(
     jobs: Vec<Uuid>,
     db: &DB,
-    username: &str,
+    author: &(impl AuditAuthorable + Sync),
     w_id: &str,
     force_cancel: bool,
 ) -> error::JsonResult<Vec<Uuid>> {
+    let username = author.username();
     let mut uuids = vec![];
+    // A job that completed before its turn is reported back like the others but was not
+    // cancelled, so it gets no audit entry.
+    let mut audited = vec![];
     tracing::info!("Cancelling jobs: {:?}", jobs);
     let mut tx = db.begin().await?;
     let trivial_jobs =  sqlx::query!("INSERT INTO v2_job_completed AS cj
@@ -243,7 +341,7 @@ pub async fn cancel_jobs(
         }
         match tokio::time::timeout(tokio::time::Duration::from_secs(5), async move {
             let tx = db.begin().await?;
-            let (tx, _) = cancel_job(
+            let (tx, cancelled) = cancel_job(
                 username,
                 None,
                 job_id.clone(),
@@ -255,13 +353,14 @@ pub async fn cancel_jobs(
             )
             .await?;
             tx.commit().await?;
-            Ok::<_, anyhow::Error>(())
+            Ok::<_, anyhow::Error>(cancelled)
         })
         .await
         {
             Ok(result) => match result {
-                Ok(_) => {
+                Ok(cancelled) => {
                     uuids.push(job_id);
+                    audited.extend(cancelled);
                 }
                 Err(e) => {
                     tracing::error!("Failed to cancel job {:?}: {:?}", job_id, e);
@@ -276,8 +375,27 @@ pub async fn cancel_jobs(
         }
     }
 
+    audited.extend(trivial_jobs.iter().copied());
     uuids.extend(trivial_jobs);
 
+    // The cancels are committed by now: failing here would report them as not done.
+    if let Err(e) = audit_log_many(
+        db,
+        author,
+        if force_cancel {
+            "jobs.force_cancel"
+        } else {
+            "jobs.cancel"
+        },
+        ActionKind::Delete,
+        w_id,
+        &audited.iter().map(|id| id.to_string()).collect::<Vec<_>>(),
+    )
+    .await
+    {
+        tracing::error!("Failed to write audit entries for cancelled jobs in {w_id}: {e:#}");
+    }
+
     Ok(Json(uuids))
 }
 
@@ -825,6 +943,7 @@ pub async fn handle_chat_conversation_messages(
         tx,
         memory_id,
         Some(job_id),
+        job_id,
         &user_message,
         MessageType::User,
         None,
@@ -865,6 +984,7 @@ pub async fn run_flow<'c>(
         chat_input_enabled,
         early_return,
         labels,
+        job_token_scopes,
         ..
     } = flow_version_info;
 
@@ -914,6 +1034,8 @@ pub async fn run_flow<'c>(
         )
     };
 
+    let end_user_email = run_end_user_email(db, w_id, authed, trigger.as_ref()).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(db, authed).await?;
     let (uuid, mut tx) = push(
         &db,
         tx,
@@ -924,6 +1046,7 @@ pub async fn run_flow<'c>(
             version,
             apply_preprocessor,
             labels,
+            job_token_scopes,
         },
         push_args,
         authed.display_username(),
@@ -947,9 +1070,10 @@ pub async fn run_flow<'c>(
         None,
         push_authed.as_ref(),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(trigger),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
@@ -1115,6 +1239,7 @@ pub async fn push_script_job_by_path_into_queue<'c>(
     let tag = run_query.tag.clone().or(tag);
     let push_args = PushArgs { args: &args.args, extra: args.extra };
     check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
+    let job_payload = with_run_retry(&run_query, job_payload, &push_args, &tag)?;
 
     let return_tx = tx_o.is_some();
 
@@ -1141,6 +1266,8 @@ pub async fn push_script_job_by_path_into_queue<'c>(
         )
     };
 
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, trigger.as_ref()).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -1173,9 +1300,10 @@ pub async fn push_script_job_by_path_into_queue<'c>(
         },
         push_authed.as_ref(),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(trigger),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
diff --git a/backend/windmill-api-jobs/src/job_metrics.rs b/backend/windmill-api-jobs/src/job_metrics.rs
index abb95693f5..ddbe5a047a 100644
--- a/backend/windmill-api-jobs/src/job_metrics.rs
+++ b/backend/windmill-api-jobs/src/job_metrics.rs
@@ -173,10 +173,33 @@ struct JobProgressSetRequest {
 }
 
 async fn set_job_progress(
+    authed: windmill_api_auth::ApiAuthed,
     Extension(db): Extension<DB>,
     Path((w_id, job_id)): Path<(String, Uuid)>,
     Json(JobProgressSetRequest { percent, flow_job_id }): Json<JobProgressSetRequest>,
 ) -> error::JsonResult<()> {
+    // A restricted job token reaches this route without a scope only for its own job
+    // (`is_own_job_runtime_route`), so the flow it reports progress to must be its own too.
+    if let (Some(flow_job_id), Some(token_job), Some(_)) =
+        (flow_job_id, authed.job_id, &authed.scopes)
+    {
+        let own_flow = sqlx::query_scalar!(
+            "SELECT $2 IN (parent_job, root_job, flow_innermost_root_job) FROM v2_job
+            WHERE id = $1 AND workspace_id = $3",
+            token_job,
+            flow_job_id,
+            &w_id
+        )
+        .fetch_optional(&db)
+        .await?
+        .flatten()
+        .unwrap_or(false);
+        if !own_flow {
+            return Err(error::Error::PermissionDenied(format!(
+                "flow job {flow_job_id} is not this job's flow"
+            )));
+        }
+    }
     // If flow_job_id exists, than we should modify flow_status of corresponding module
     // Individual jobs and flows are handled differently
     if let Some(flow_job_id) = flow_job_id {
diff --git a/backend/windmill-api-jobs/src/jobs_export.rs b/backend/windmill-api-jobs/src/jobs_export.rs
index 6389134031..b2b69367bc 100644
--- a/backend/windmill-api-jobs/src/jobs_export.rs
+++ b/backend/windmill-api-jobs/src/jobs_export.rs
@@ -112,6 +112,8 @@ pub struct ExportableQueuedJob {
     pub preprocessed: Option<bool>,
     pub args: Option<sqlx::types::Json<Box<RawValue>>>,
     pub labels: Option<Vec<String>>,
+    #[serde(default)]
+    pub job_token_scopes: Option<Vec<String>>,
     pub pre_run_error: Option<String>,
 
     // v2_job_queue columns (excluding workspace_id and id/created_at/tag/priority)
@@ -276,6 +278,7 @@ pub async fn export_queued_jobs(
             v2_job.preprocessed,
             v2_job.args as "args: _",
             v2_job.labels,
+            job_perms.job_token_scopes as "job_token_scopes?",
             v2_job.pre_run_error,
 
             v2_job_queue.started_at,
@@ -298,6 +301,7 @@ pub async fn export_queued_jobs(
             concurrency_key.key as "concurrency_key?"
         FROM v2_job_queue
         INNER JOIN v2_job ON v2_job.id = v2_job_queue.id
+        LEFT JOIN job_perms ON job_perms.job_id = v2_job_queue.id
         LEFT JOIN v2_job_runtime ON v2_job_runtime.id = v2_job_queue.id
         LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id
         LEFT JOIN concurrency_key ON concurrency_key.job_id = v2_job_queue.id
@@ -445,6 +449,23 @@ pub async fn import_queued_jobs(
         ));
     }
 
+    // Imported rows bypass `push`, so nothing would cap their tokens: a restricted job token
+    // could otherwise queue arbitrary jobs that run with its owner's full permissions.
+    if authed.job_id.is_some() && authed.scopes.is_some() {
+        return Err(error::Error::PermissionDenied(
+            "A restricted job token cannot import queued jobs".to_string(),
+        ));
+    }
+    // An imported job gets no `job_perms` row, so its token would be minted without the
+    // restriction it was queued with.
+    if let Some(job) = jobs.iter().find(|job| job.job_token_scopes.is_some()) {
+        return Err(error::Error::BadRequest(format!(
+            "Queued job {} restricts its job token and cannot be imported; run it again on \
+             this instance instead",
+            job.id
+        )));
+    }
+
     let mut tx = user_db.begin(&authed).await?;
 
     for job in jobs {
@@ -697,7 +718,8 @@ pub async fn delete_jobs(
     let mut conversation_ids: Vec<Uuid> = sqlx::query_scalar!(
         "DELETE FROM flow_conversation_message m
          USING flow_conversation c
-         WHERE m.conversation_id = c.id AND c.workspace_id = $1 AND m.job_id = ANY($2)
+         WHERE m.conversation_id = c.id AND c.workspace_id = $1
+           AND COALESCE(m.turn_job_id, m.job_id) = ANY($2)
          RETURNING m.conversation_id",
         &w_id,
         &job_ids
diff --git a/backend/windmill-api-jobs/src/query.rs b/backend/windmill-api-jobs/src/query.rs
index 857b2e02e2..96d8ca3698 100644
--- a/backend/windmill-api-jobs/src/query.rs
+++ b/backend/windmill-api-jobs/src/query.rs
@@ -26,6 +26,34 @@ fn not_in_nullable(col: &str, quoted: &[String]) -> String {
     )
 }
 
+/// Narrows a job list to the top-level runs of deployed scripts and flows at an `exact`
+/// path, or at or under a `prefix` on the `/` boundary (`ScopePathFilter::allows`).
+///
+/// Top-level only because every `runnable_path` index on `v2_job` is partial on
+/// `parent_job IS NULL`. Deployed kinds only because a preview's `runnable_path` is
+/// whatever its caller sent.
+pub fn and_where_root_run_at_paths(sqlb: &mut SqlBuilder, exact: &[String], prefix: &[String]) {
+    let mut clauses = Vec::new();
+    let equal: Vec<_> = exact.iter().chain(prefix).map(|p| quote(p)).collect();
+    if !equal.is_empty() {
+        clauses.push(format!("v2_job.runnable_path IN ({})", equal.join(", ")));
+    }
+    for p in prefix {
+        let pattern = format!("{}/%", escape_ilike_pattern(p));
+        clauses.push(format!("v2_job.runnable_path LIKE {}", quote(&pattern)));
+    }
+    if clauses.is_empty() {
+        sqlb.and_where("false");
+        return;
+    }
+    sqlb.and_where_is_null("v2_job.parent_job")
+        .and_where(
+            "v2_job.kind IN ('script', 'script_hub', 'unassigned_script', 'flow', \
+             'unassigned_flow', 'singlestepflow', 'unassigned_singlestepflow')",
+        )
+        .and_where(format!("({})", clauses.join(" OR ")));
+}
+
 pub fn filter_list_queue_query(
     mut sqlb: SqlBuilder,
     lq: &ListQueueQuery,
diff --git a/backend/windmill-api-jobs/src/types.rs b/backend/windmill-api-jobs/src/types.rs
index f37040bd11..f50cb61451 100644
--- a/backend/windmill-api-jobs/src/types.rs
+++ b/backend/windmill-api-jobs/src/types.rs
@@ -52,6 +52,8 @@ pub struct RunJobQuery {
     pub trigger_external_id: Option<String>,
     pub service_name: Option<String>,
     pub suspended_mode: Option<bool>,
+    /// A JSON-encoded `Retry` policy for a script run; see `with_run_retry`.
+    pub retry: Option<String>,
 }
 
 impl RunJobQuery {
diff --git a/backend/windmill-api-schedule/src/lib.rs b/backend/windmill-api-schedule/src/lib.rs
index 7a523c89fa..b8ee9ded91 100644
--- a/backend/windmill-api-schedule/src/lib.rs
+++ b/backend/windmill-api-schedule/src/lib.rs
@@ -1487,11 +1487,13 @@ async fn set_default_error_handler(
         }
     };
 
-    if let Some(value_content) = value {
-        windmill_api_settings::set_global_setting_internal(&db, key, value_content).await?;
+    if let Some(value_content) = value.clone() {
+        windmill_api_settings::set_global_setting_internal(&db, key.clone(), value_content).await?;
     } else {
         windmill_api_settings::delete_global_setting(&db, key.as_str()).await?;
     }
+    windmill_audit::instance_config::audit_setting_write(&db, &authed, &key, value.as_ref(), None)
+        .await?;
 
     if payload.override_existing {
         // The rewrite and its history rows go in one transaction: on separate
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index bce67755bb..4f4c962759 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -382,7 +382,8 @@ async fn list_scripts(
             r#"SELECT DISTINCT ON (path)
                       path,
                       value as "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-                      created_at
+                      created_at,
+                      email IS NULL as "legacy!"
                FROM draft
                WHERE workspace_id = $1
                  AND typ = 'script'
@@ -463,9 +464,10 @@ async fn list_scripts(
                 inherited_labels: None,
                 is_draft: true,
                 draft_path,
-                // Synthesized rows are the authed user's own draft (single-user case).
+                // A legacy (`email IS NULL`) row belongs to nobody: naming the caller would
+                // route every discard to their own (absent) row and leave it undeletable.
                 draft_users: Some(sqlx::types::Json(vec![DraftUserRef {
-                    username: Some(authed.username.clone()),
+                    username: (!row.legacy).then(|| authed.username.clone()),
                 }])),
             });
         }
@@ -897,6 +899,7 @@ async fn is_noop_deploy_against_parent(
     ns: &NewScript,
     parent: &Script<ScriptRunnableSettingsHandle>,
     resolved_on_behalf_of: Option<&str>,
+    resolved_job_token_scopes: Option<&[String]>,
     db: &DB,
 ) -> Result<bool> {
     if parent.archived || parent.deleted {
@@ -950,6 +953,8 @@ async fn is_noop_deploy_against_parent(
         // caller-intent flag (auto-resolve parent), not script state
         auto_parent: _,
         labels,
+        // resolved against the deployed value into `resolved_job_token_scopes`, compared below
+        job_token_scopes: _,
         // caller-intent flag (preserve user drafts on CLI/git-sync deploys);
         // transient, never persisted, does not change what the script *is*
         skip_draft_deletion: _,
@@ -1023,6 +1028,9 @@ async fn is_noop_deploy_against_parent(
     if resolved_on_behalf_of != parent.on_behalf_of.as_deref() {
         return Ok(false);
     }
+    if resolved_job_token_scopes != parent.job_token_scopes.as_deref() {
+        return Ok(false);
+    }
     // Both of a dbt script's derived fields are compared as they WOULD BE STORED,
     // not as they arrived: the schema comes from the descriptor and the clients
     // cannot derive it (`windmill-parser-wasm` has no dbt arm), so they send the
@@ -1490,6 +1498,37 @@ async fn create_script_internal<'c>(
         parent_adopted_from_retired_path = ns.parent_hash.is_some();
     }
 
+    // Absent keeps the previous version's value, read once the parent is settled (a rename
+    // adopts its source head above), so a client unaware of the setting cannot drop a
+    // restriction by redeploying or renaming.
+    let resolved_job_token_scopes: Option<Vec<String>> = match (&ns.job_token_scopes, &ns.parent_hash) {
+        (Some(Some(scopes)), _) => {
+            windmill_common::min_version::MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES
+                .assert()
+                .await?;
+            Some(windmill_common::scopes::validate_job_token_scopes(scopes)?)
+        }
+        (Some(None), _) => None,
+        (None, Some(parent_hash)) => sqlx::query_scalar!(
+            "SELECT job_token_scopes FROM script WHERE hash = $1 AND workspace_id = $2",
+            parent_hash.0,
+            &w_id
+        )
+        .fetch_optional(&db)
+        .await?
+        .flatten(),
+        (None, None) => sqlx::query_scalar!(
+            "SELECT job_token_scopes FROM script WHERE path = $1 AND workspace_id = $2 \
+             AND deleted = false ORDER BY created_at DESC LIMIT 1",
+            &ns.path,
+            &w_id
+        )
+        .fetch_optional(&db)
+        .await?
+        .flatten(),
+    };
+    ns.job_token_scopes = Some(resolved_job_token_scopes.clone());
+
     // Before hashing, so the hash and the no-op check see the schema that gets stored.
     // `{}` counts as absent: an agent filling every tool argument sends it for "none".
     let schema_absent = ns.schema.as_ref().is_none_or(|s| {
@@ -1618,8 +1657,14 @@ async fn create_script_internal<'c>(
             // CLI pushes must not produce phantom commits on the downstream
             // git repository.
             if skip_if_noop
-                && is_noop_deploy_against_parent(&ns, &ps, resolved_on_behalf_of.as_deref(), &db)
-                    .await?
+                && is_noop_deploy_against_parent(
+                    &ns,
+                    &ps,
+                    resolved_on_behalf_of.as_deref(),
+                    resolved_job_token_scopes.as_deref(),
+                    &db,
+                )
+                .await?
             {
                 tracing::info!(
                     workspace_id = %w_id,
@@ -2195,8 +2240,8 @@ async fn create_script_internal<'c>(
          content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, \
          envs, concurrent_limit, concurrency_time_window_s, cache_ttl, \
          dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
-         delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels, on_behalf_of, on_behalf_of_email) \
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40, $41)",
+         delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels, on_behalf_of, on_behalf_of_email, job_token_scopes) \
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40, $41, $42)",
         &w_id,
         &hash.0,
         ns.path,
@@ -2240,9 +2285,14 @@ async fn create_script_internal<'c>(
         ns.labels.as_deref() as Option<&[String]>,
         resolved_on_behalf_of,
         legacy_on_behalf_of_email,
+        resolved_job_token_scopes.as_deref() as Option<&[String]>,
     )
     .execute(&mut *tx)
     .await?;
+    windmill_common::scopes::log_job_token_scopes_deploy(
+        "script",
+        resolved_job_token_scopes.as_deref(),
+    );
 
     // A lock that is not left to a dependency job queues none, so this is the only place its hash
     // can be recorded. `try_skip_relock` treats a missing hash for an imported script as changed,
@@ -2952,6 +3002,7 @@ async fn create_script_internal<'c>(
             None,
             None,
             None,
+            None,
         )
         .await?;
 
@@ -3075,6 +3126,7 @@ async fn create_script_internal<'c>(
                     None,
                     None,
                     None,
+                    None,
                 )
                 .await?;
                 tracing::info!("pushed auto-build binary job {job_id} for {script_path}");
@@ -4214,12 +4266,6 @@ async fn delete_script_by_path(
 
     check_scopes(&authed, || format!("scripts:write:{}", path))?;
 
-    if path == "u/admin/hub_sync" && w_id == "admins" {
-        return Err(Error::BadRequest(
-            "Cannot delete the global setup app".to_string(),
-        ));
-    }
-
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
         AuditAuthorable::username(&authed),
@@ -4393,12 +4439,6 @@ async fn delete_scripts_bulk(
 
     require_admin(authed.is_admin, &authed.username)?;
 
-    if request.paths.contains(&"u/admin/hub_sync".to_string()) && w_id == "admins" {
-        return Err(Error::BadRequest(
-            "Cannot delete the global setup app".to_string(),
-        ));
-    }
-
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
         AuditAuthorable::username(&authed),
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 71cbcc8460..1359e8c142 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -29,6 +29,12 @@ mod log_cleanup;
 mod storage_usage;
 
 use windmill_api_auth::{require_devops_role, require_super_admin, ApiAuthed};
+use windmill_audit::{
+    audit_oss::audit_log,
+    instance_config::{audit_setting_write, InstanceConfigAuditor},
+    ActionKind,
+};
+use windmill_common::hub_resource_types::{self, SyncSource};
 use windmill_common::utils::HTTP_CLIENT_PERMISSIVE as HTTP_CLIENT;
 use windmill_common::DB;
 
@@ -57,10 +63,10 @@ use windmill_common::{
     error::{self, pg_error_message, JsonResult, Result},
     get_database_url,
     global_settings::{
-        ACCENT_COLOR_SETTING, AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING,
-        AUTOMATE_USERNAME_CREATION_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING,
-        DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
-        EXTERNAL_INSTANCE_PG_SETTING,
+        ACCENT_COLOR_SETTING, AI_CONFIG_SETTING, API_BASE_URL_SETTING,
+        APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
+        CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
+        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS, EXTERNAL_INSTANCE_PG_SETTING,
         GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
         HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
         INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
@@ -829,7 +835,28 @@ pub async fn set_global_setting(
     Json(value): Json<Value>,
 ) -> error::Result<()> {
     require_super_admin(&db, &authed).await?;
-    set_global_setting_internal(&db, key, value.value.unwrap_or(serde_json::Value::Null)).await
+    let value = value.value.unwrap_or(serde_json::Value::Null);
+    set_global_setting_internal(&db, key.clone(), value.clone()).await?;
+    audit_setting_write(&db, &authed, &key, Some(&value), None).await
+}
+
+async fn audit_instance_action(
+    db: &DB,
+    authed: &ApiAuthed,
+    operation: &str,
+    action_kind: ActionKind,
+    parameters: Option<std::collections::HashMap<&str, &str>>,
+) -> error::Result<()> {
+    audit_log(
+        db,
+        authed,
+        operation,
+        action_kind,
+        "global",
+        Some(&authed.email),
+        parameters,
+    )
+    .await
 }
 
 pub async fn set_global_setting_internal(
@@ -1173,26 +1200,22 @@ async fn run_setting_pre_write_hook(
                 }
             }
         }
-        GITHUB_APP_WEBHOOK_BASE_URL_SETTING => {
-            // A bad value here yields a webhook GitHub can never deliver to, and the
+        GITHUB_APP_WEBHOOK_BASE_URL_SETTING | API_BASE_URL_SETTING => {
+            // A bad webhook base yields a webhook GitHub can never deliver to, and the
             // failure only shows up much later as "falling back to polling" on a
-            // repository — so reject it at the boundary instead.
+            // repository; a bad API base puts an unreachable URL in front of every user.
+            // So reject both at the boundary instead.
             match value {
                 // Clearing (delete row) is handled by the caller; allow it through.
                 serde_json::Value::Null => {}
                 serde_json::Value::String(s) if s.trim().is_empty() => {}
                 serde_json::Value::String(s) => {
-                    windmill_common::global_settings::validate_webhook_base_url(s).map_err(
-                        |e| {
-                            error::Error::BadRequest(format!(
-                                "{GITHUB_APP_WEBHOOK_BASE_URL_SETTING}: {e}"
-                            ))
-                        },
-                    )?;
+                    windmill_common::global_settings::validate_webhook_base_url(s)
+                        .map_err(|e| error::Error::BadRequest(format!("{key}: {e}")))?;
                 }
                 _ => {
                     return Err(error::Error::BadRequest(format!(
-                        "{GITHUB_APP_WEBHOOK_BASE_URL_SETTING} must be a URL string"
+                        "{key} must be a URL string"
                     )));
                 }
             }
@@ -1235,7 +1258,7 @@ async fn get_instance_config(
     authed: ApiAuthed,
 ) -> JsonResult<InstanceConfig> {
     require_super_admin(&db, &authed).await?;
-    let config = InstanceConfig::from_db(&db)
+    let config = InstanceConfig::from_db_for_api(&db)
         .await
         .map_err(|e| error::Error::internal_err(e.to_string()))?;
     Ok(Json(config))
@@ -1246,7 +1269,7 @@ async fn get_instance_config_yaml(
     authed: ApiAuthed,
 ) -> error::Result<Response> {
     require_super_admin(&db, &authed).await?;
-    let config = InstanceConfig::from_db(&db)
+    let config = InstanceConfig::from_db_for_api(&db)
         .await
         .map_err(|e| error::Error::internal_err(e.to_string()))?;
     let yaml = config
@@ -1305,13 +1328,15 @@ async fn set_instance_config(
                 run_setting_pre_write_hook(&db, key, value).await?;
             }
         }
+        let auditor = InstanceConfigAuditor { db: &db, author: &authed, source: None };
+        // The external-instance write removes its own key from the diff.
         windmill_common::external_instance_pg::write_external_instance_pg_from_diff(
             &db,
             &mut settings_diff,
+            &auditor,
         )
         .await?;
-
-        instance_config::apply_settings_diff(&db, &settings_diff)
+        instance_config::apply_settings_diff(&db, &settings_diff, &auditor)
             .await
             .map_err(|e| error::Error::internal_err(e.to_string()))?;
 
@@ -1343,9 +1368,13 @@ async fn set_instance_config(
             .collect();
         let configs_diff =
             instance_config::diff_worker_configs(&current_wc, &desired_wc, ApplyMode::Merge);
-        instance_config::apply_configs_diff(&db, &configs_diff)
-            .await
-            .map_err(|e| error::Error::internal_err(e.to_string()))?;
+        instance_config::apply_configs_diff(
+            &db,
+            &configs_diff,
+            &InstanceConfigAuditor { db: &db, author: &authed, source: None },
+        )
+        .await
+        .map_err(|e| error::Error::internal_err(e.to_string()))?;
     }
 
     Ok(())
@@ -1386,6 +1415,11 @@ pub async fn get_global_setting(
     {
         require_super_admin(&db, &authed).await?;
     }
+    if instance_config::is_withheld_server_secret(&key) {
+        return Err(error::Error::BadRequest(format!(
+            "{key} is a server secret and this server does not export it (EXPORT_SERVER_SECRETS=false)"
+        )));
+    }
     let value = sqlx::query!("SELECT value FROM global_settings WHERE name = $1", key)
         .fetch_optional(&db)
         .await?
@@ -1428,7 +1462,10 @@ async fn list_global_settings(
     require_super_admin(&db, &authed).await?;
     let settings = sqlx::query_as!(GlobalSetting, "SELECT name, value FROM global_settings")
         .fetch_all(&db)
-        .await?;
+        .await?
+        .into_iter()
+        .filter(|s| !instance_config::is_withheld_server_secret(&s.name))
+        .collect();
 
     Ok(Json(settings))
 }
@@ -1575,6 +1612,14 @@ pub async fn renew_license_key(
             }
         )));
     } else {
+        audit_instance_action(
+            &db,
+            &authed,
+            "settings.renew_license_key",
+            ActionKind::Update,
+            None,
+        )
+        .await?;
         return Ok("Renewed license key".to_string());
     }
 }
@@ -1804,6 +1849,14 @@ async fn refresh_custom_instance_user_pwd(
     require_super_admin(&db, &authed).await?;
     windmill_common::utils::refresh_custom_instance_user_pwd(&db).await?;
     windmill_common::utils::refresh_custom_instance_replication_user_pwd(&db).await?;
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.refresh_custom_instance_user_pwd",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(()))
 }
 
@@ -1962,7 +2015,8 @@ async fn setup_custom_instance_pg_database(
     windmill_common::datatable_roles::lock_instance_databases_governance(&mut tx, [dbname.trim()])
         .await?;
     let mut logs = CustomInstanceDbLogs::default();
-    let result = setup_custom_instance_pg_database_inner(authed, &db, &dbname, &mut logs).await;
+    let result =
+        setup_custom_instance_pg_database_inner(authed.clone(), &db, &dbname, &mut logs).await;
     let success = result.is_ok();
     let error = result.err().map(|e| e.to_string());
     let status = CustomInstanceDb {
@@ -1990,6 +2044,20 @@ async fn setup_custom_instance_pg_database(
     .fetch_one(&mut *tx)
     .await?;
     tx.commit().await?;
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.setup_custom_instance_pg_database",
+        ActionKind::Create,
+        Some(
+            [
+                ("dbname", dbname.as_str()),
+                ("success", if success { "true" } else { "false" }),
+            ]
+            .into(),
+        ),
+    )
+    .await?;
     let status: CustomInstanceDb = serde_json::from_value(saved).map_err(to_anyhow)?;
 
     Ok(Json(status))
@@ -2168,6 +2236,14 @@ async fn drop_custom_instance_pg_database(
     require_super_admin(&db, &authed).await?;
 
     windmill_common::drop_custom_instance_database(&db, &dbname).await?;
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.drop_custom_instance_pg_database",
+        ActionKind::Delete,
+        Some([("dbname", dbname.as_str())].into()),
+    )
+    .await?;
 
     Ok(format!("Database '{}' dropped successfully", dbname))
 }
@@ -2212,6 +2288,14 @@ pub async fn migrate_secrets_to_vault(
 
     let report = windmill_common::secret_backend::migrate_secrets_to_vault(&db, &settings).await?;
 
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.migrate_secrets_to_vault",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(report))
 }
 
@@ -2233,6 +2317,14 @@ pub async fn migrate_secrets_to_database(
     let report =
         windmill_common::secret_backend::migrate_secrets_to_database(&db, &settings).await?;
 
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.migrate_secrets_to_database",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(report))
 }
 
@@ -2266,6 +2358,14 @@ pub async fn migrate_secrets_to_azure_kv(
     let report =
         windmill_common::secret_backend::migrate_secrets_to_azure_kv(&db, &settings).await?;
 
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.migrate_secrets_to_azure_kv",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(report))
 }
 
@@ -2283,6 +2383,14 @@ pub async fn migrate_secrets_from_azure_kv(
     let report =
         windmill_common::secret_backend::migrate_secrets_from_azure_kv(&db, &settings).await?;
 
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.migrate_secrets_from_azure_kv",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(report))
 }
 
@@ -2307,6 +2415,14 @@ pub async fn migrate_secrets_to_aws_sm(
 ) -> JsonResult<SecretMigrationReport> {
     require_super_admin(&db, &authed).await?;
     let report = windmill_common::secret_backend::migrate_secrets_to_aws_sm(&db, &settings).await?;
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.migrate_secrets_to_aws_sm",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(report))
 }
 
@@ -2320,6 +2436,14 @@ pub async fn migrate_secrets_from_aws_sm(
     require_super_admin(&db, &authed).await?;
     let report =
         windmill_common::secret_backend::migrate_secrets_from_aws_sm(&db, &settings).await?;
+    audit_instance_action(
+        &db,
+        &authed,
+        "settings.migrate_secrets_from_aws_sm",
+        ActionKind::Update,
+        None,
+    )
+    .await?;
     Ok(Json(report))
 }
 
@@ -2342,95 +2466,6 @@ pub async fn get_jwks() -> JsonResult<JwksResponse> {
     Ok(Json(JwksResponse { keys: vec![] }))
 }
 
-#[derive(serde::Deserialize, serde::Serialize)]
-struct CachedResourceType {
-    #[allow(dead_code)]
-    id: i64,
-    name: String,
-    schema: Option<serde_json::Value>,
-    #[allow(dead_code)]
-    app: String,
-    description: Option<String>,
-    /// Doubly optional, and read through a wrapping deserializer: this struct also
-    /// decodes the on-disk cache, where an absent key means "written before the
-    /// column, leave the stored extension alone" and an explicit null means the hub
-    /// dropped it. Plain serde folds both into `None`.
-    #[serde(
-        default,
-        deserialize_with = "windmill_common::more_serde::double_option"
-    )]
-    format_extension: Option<Option<String>>,
-    /// Doubly optional like `format_extension`: no key leaves the stored name alone, an explicit
-    /// null (the hub naming nothing) clears it.
-    #[serde(
-        default,
-        deserialize_with = "windmill_common::more_serde::double_option"
-    )]
-    display_name: Option<Option<String>>,
-}
-
-#[derive(serde::Deserialize)]
-struct HubResourceTypeRaw {
-    id: i64,
-    name: String,
-    schema: Option<String>,
-    app: String,
-    description: Option<String>,
-    #[serde(default)]
-    format_extension: Option<String>,
-    #[serde(
-        default,
-        deserialize_with = "windmill_common::more_serde::double_option"
-    )]
-    display_name: Option<Option<String>>,
-}
-
-async fn fetch_resource_types_from_hub() -> error::Result<Vec<CachedResourceType>> {
-    let response = HTTP_CLIENT
-        .get(format!(
-            "{}/resource_types/list",
-            windmill_common::DEFAULT_HUB_BASE_URL
-        ))
-        .header("Accept", "application/json")
-        .send()
-        .await
-        .map_err(|e| error::Error::InternalErr(format!("Failed to fetch from hub: {}", e)))?;
-
-    if !response.status().is_success() {
-        return Err(error::Error::InternalErr(format!(
-            "Hub returned status {}",
-            response.status()
-        )));
-    }
-
-    let raw_types: Vec<HubResourceTypeRaw> = response
-        .json()
-        .await
-        .map_err(|e| error::Error::InternalErr(format!("Failed to parse hub response: {}", e)))?;
-
-    Ok(raw_types
-        .into_iter()
-        .filter_map(|rt| {
-            let schema = match rt.schema {
-                Some(s) => match serde_json::from_str(&s) {
-                    Ok(v) => Some(v),
-                    Err(_) => return None,
-                },
-                None => None,
-            };
-            Some(CachedResourceType {
-                id: rt.id,
-                name: rt.name,
-                schema,
-                app: rt.app,
-                description: rt.description,
-                format_extension: Some(rt.format_extension),
-                display_name: rt.display_name,
-            })
-        })
-        .collect())
-}
-
 #[derive(serde::Deserialize)]
 struct SyncResourceTypesQuery {
     name: Option<String>,
@@ -2443,118 +2478,45 @@ async fn sync_cached_resource_types(
 ) -> error::Result<String> {
     require_super_admin(&db, &authed).await?;
 
-    use windmill_common::worker::HUB_RT_CACHE_DIR;
-    let cache_path = format!("{}/resource_types.json", *HUB_RT_CACHE_DIR);
+    let outcome = hub_resource_types::sync(&db).await?;
 
-    // Manual sync is hub-first so it lands newly-published hub types on demand. The
-    // on-disk cache is only a fallback for when the hub is unreachable (airgapped
-    // installs / network error); refreshing it is left to the daily cache-rt cron and
-    // the startup sync in main.rs, which own the offline path.
-    let (resource_types, from_hub) = match fetch_resource_types_from_hub().await {
-        Ok(types) => {
-            tracing::info!("Fetched {} resource types live from the hub", types.len());
-            (types, true)
-        }
-        Err(hub_err) => {
-            tracing::warn!(
-                "Live hub fetch failed ({hub_err}), falling back to on-disk cache at {cache_path}"
-            );
-            match tokio::fs::read_to_string(&cache_path).await {
-                Ok(content) => {
-                    let parsed = serde_json::from_str::<Vec<CachedResourceType>>(&content)
-                        .map_err(|e| {
-                            error::Error::InternalErr(format!(
-                                "Failed to parse cached resource types: {}",
-                                e
-                            ))
-                        })?;
-                    (parsed, false)
-                }
-                Err(_) => return Err(hub_err),
-            }
-        }
-    };
-
-    let mut synced_count = 0;
-
-    for rt in &resource_types {
-        // A name too long for the column counts as absent, leaving the stored one alone: one bad
-        // entry must not fail the upsert and end the rest of the sync.
-        let display_name = match &rt.display_name {
-            Some(Some(name)) if name.chars().count() > 100 => None,
-            other => other.clone(),
+    if !outcome.changed.is_empty() {
+        let source = match outcome.source {
+            SyncSource::Hub => "hub",
+            SyncSource::ImageCache => "image_cache",
         };
-        let exists: Option<bool> = sqlx::query_scalar!(
-            "SELECT EXISTS(SELECT 1 FROM resource_type WHERE workspace_id = 'admins' AND name = $1 AND schema IS NOT DISTINCT FROM $2 AND description IS NOT DISTINCT FROM $3 AND ($5 IS NOT TRUE OR format_extension IS NOT DISTINCT FROM $4) AND ($7 IS NOT TRUE OR display_name IS NOT DISTINCT FROM $6))",
-            &rt.name,
-            rt.schema.as_ref(),
-            rt.description.as_deref(),
-            rt.format_extension.clone().flatten(),
-            rt.format_extension.is_some(),
-            display_name.clone().flatten(),
-            display_name.is_some(),
+        let changed = outcome.changed.join(", ");
+        audit_log(
+            &db,
+            &authed,
+            "resource_types.sync",
+            ActionKind::Update,
+            "admins",
+            None,
+            Some([("source", source), ("changed", changed.as_str())].into()),
         )
-        .fetch_one(&db)
         .await?;
-
-        if exists.unwrap_or(false) {
-            continue;
-        }
-
-        sqlx::query!(
-            // Whether the payload carried the key at all is what decides: present
-            // (even as null) is authoritative and may clear, absent means a cache
-            // written before the column and must leave the stored value alone.
-            "INSERT INTO resource_type (workspace_id, name, schema, description, format_extension, display_name, edited_at)
-             VALUES ('admins', $1, $2, $3, $4, $6, now())
-             ON CONFLICT (workspace_id, name) DO UPDATE
-             SET schema = EXCLUDED.schema, description = EXCLUDED.description,
-                 -- A fileset is a set of files, so it cannot also be one file.
-                 -- Create and update reject the pair; this writer bypasses both, so
-                 -- it declines the extension rather than persisting the forbidden
-                 -- combination onto a same-named local fileset.
-                 format_extension = CASE
-                     WHEN resource_type.is_fileset THEN NULL
-                     WHEN $5 THEN EXCLUDED.format_extension
-                     ELSE resource_type.format_extension END,
-                 display_name = CASE WHEN $7 THEN EXCLUDED.display_name ELSE resource_type.display_name END,
-                 edited_at = now()",
-            &rt.name,
-            rt.schema.as_ref(),
-            rt.description.as_deref(),
-            rt.format_extension.clone().flatten(),
-            rt.format_extension.is_some(),
-            display_name.clone().flatten(),
-            display_name.is_some(),
-        )
-        .execute(&db)
-        .await?;
-
-        synced_count += 1;
     }
 
     // If a specific type was requested and is still absent after syncing, surface an
     // explicit not-found instead of a silent "Synced 0". Word it by source so the
     // cache-fallback path does not claim it checked the hub.
     if let Some(name) = name.as_deref() {
-        if !resource_types.iter().any(|rt| rt.name == name) {
-            let source = if from_hub {
-                "on the hub"
-            } else {
-                "in the cached resource types (hub unreachable)"
+        if !outcome.listed.iter().any(|listed| listed == name) {
+            let source = match outcome.source {
+                SyncSource::Hub => "on the hub",
+                SyncSource::ImageCache => "in the cached resource types (hub unavailable)",
             };
             return Err(error::Error::NotFound(format!(
-                "resource type '{}' not found {}",
-                name, source
+                "resource type '{name}' not found {source}"
             )));
         }
     }
 
-    Ok(format!(
-        "Synced {} resource types ({} unchanged)",
-        synced_count,
-        resource_types.len() - synced_count
-    ))
+    Ok(match outcome.source {
+        SyncSource::Hub => outcome.summary(),
+        SyncSource::ImageCache => format!("{}, the hub being unavailable", outcome.summary()),
+    })
 }
 
 #[cfg(test)]
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index ac9defcd53..46bd6825e8 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -490,7 +490,7 @@ async fn list_user_usage(
             "
     SELECT usr.email, usage.executions
         FROM usr, LATERAL (
-            SELECT COALESCE(SUM(c.duration_ms + 1000)/1000 , 0)::BIGINT executions
+            SELECT COALESCE(SUM(COALESCE((c.extras->>'wac_last_segment_ms')::bigint, c.duration_ms) + 1000)/1000 , 0)::BIGINT executions
                 FROM v2_job_completed c JOIN v2_job j USING (id)
                 WHERE j.workspace_id = $1
                 AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow')
diff --git a/backend/windmill-api-workers/src/lib.rs b/backend/windmill-api-workers/src/lib.rs
index 0102f1b033..8ebee2a967 100644
--- a/backend/windmill-api-workers/src/lib.rs
+++ b/backend/windmill-api-workers/src/lib.rs
@@ -41,6 +41,7 @@ pub fn global_service() -> Router {
         .route("/queue_metrics", get(get_queue_metrics))
         .route("/queue_metrics_series", get(get_queue_metrics_series))
         .route("/queue_status", get(get_queue_status))
+        .route("/runnable_stats", get(get_runnable_stats))
         .route("/queue_counts", get(get_queue_counts))
         .route("/queue_running_counts", get(get_queue_running_counts))
         .route(
@@ -86,6 +87,7 @@ struct WorkerPing {
     job_isolation: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     native_mode: Option<bool>,
+    draining: bool,
 }
 
 // #[derive(Serialize, Deserialize)]
@@ -118,7 +120,7 @@ async fn list_worker_pings(
         WorkerPing,
         "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,
         CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,
-        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode
+        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation, native_mode, draining
         FROM worker_ping
         WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)
         ORDER BY ping_at desc LIMIT $2 OFFSET $3",
@@ -298,6 +300,81 @@ async fn get_queue_metrics(
     Ok(Json(queue_metrics))
 }
 
+#[derive(Deserialize)]
+struct RunnableStatsQuery {
+    window_secs: Option<i64>,
+    worker_group: Option<String>,
+    workspace: Option<String>,
+    order_by: Option<String>,
+    limit: Option<i64>,
+}
+
+#[derive(Serialize)]
+struct RunnableStats {
+    workspace_id: String,
+    runnable_path: String,
+    worker_group: String,
+    job_count: i64,
+    total_duration_ms: i64,
+    max_memory_peak: i32,
+    sum_memory_peak: i64,
+    memory_sample_count: i64,
+    total_cpu_ms: i64,
+}
+
+async fn get_runnable_stats(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Query(query): Query<RunnableStatsQuery>,
+) -> JsonResult<Vec<RunnableStats>> {
+    require_devops_role(&db, &authed).await?;
+
+    let window = query.window_secs.unwrap_or(24 * 3600).clamp(
+        3600,
+        windmill_common::runnable_job_stats::RETENTION_DAYS * 24 * 3600,
+    );
+    // Rows are hourly buckets keyed by their start, so the bucket the window begins in
+    // is included whole.
+    let from_hour = (chrono::Utc::now().timestamp() - window) / 3600 * 3600;
+    let order_by = match query.order_by.as_deref() {
+        Some("max_memory") => "max_memory",
+        Some("cpu") => "cpu",
+        _ => "total_duration",
+    };
+
+    let rows = sqlx::query_as!(
+        RunnableStats,
+        r#"
+        SELECT workspace_id, runnable_path, worker_group,
+            SUM(job_count)::bigint AS "job_count!",
+            SUM(total_duration_ms)::bigint AS "total_duration_ms!",
+            MAX(max_memory_peak) AS "max_memory_peak!",
+            SUM(sum_memory_peak)::bigint AS "sum_memory_peak!",
+            SUM(memory_sample_count)::bigint AS "memory_sample_count!",
+            SUM(total_cpu_ms)::bigint AS "total_cpu_ms!"
+        FROM runnable_job_stats
+        WHERE hour >= $1
+            AND ($2::text IS NULL OR worker_group = $2)
+            AND ($3::text IS NULL OR workspace_id = $3)
+        GROUP BY workspace_id, runnable_path, worker_group
+        ORDER BY CASE $4::text
+            WHEN 'max_memory' THEN MAX(max_memory_peak)::numeric
+            WHEN 'cpu' THEN SUM(total_cpu_ms)
+            ELSE SUM(total_duration_ms)
+        END DESC, workspace_id, runnable_path, worker_group
+        LIMIT $5
+        "#,
+        from_hour,
+        query.worker_group,
+        query.workspace,
+        order_by,
+        query.limit.unwrap_or(100).clamp(1, 1000),
+    )
+    .fetch_all(&db)
+    .await?;
+    Ok(Json(rows))
+}
+
 #[derive(Deserialize)]
 struct QueueMetricsSeriesQuery {
     window_secs: Option<i64>,
diff --git a/backend/windmill-api-workspaces/src/datatable_acl.rs b/backend/windmill-api-workspaces/src/datatable_acl.rs
index ebab6214ce..efaa712481 100644
--- a/backend/windmill-api-workspaces/src/datatable_acl.rs
+++ b/backend/windmill-api-workspaces/src/datatable_acl.rs
@@ -683,6 +683,9 @@ pub(crate) struct CatalogFacts {
     pub(crate) former_owner: Option<FormerOwnerDefaults>,
     /// For a revoke: each grant it takes back.
     pub(crate) revoked_grants: Vec<RevokedGrant>,
+    /// For a grant on what a schema holds: the role cannot reach the schema yet, so the grant
+    /// would give it nothing it can use.
+    pub(crate) lacks_schema_usage: bool,
 }
 
 /// A grant a revoke takes back, as the catalog records it: what `source` gave on `object` (the
@@ -1526,7 +1529,24 @@ async fn build_plan(
             )));
         }
     }
-    let facts = CatalogFacts { other_pg_roles, existing_objects, former_owner, revoked_grants };
+    let lacks_schema_usage = match (&change, target) {
+        (AclChange::Grant { scope, .. }, AclTarget::Schema { schema })
+            if !matches!(scope, GrantScope::Target) =>
+        {
+            !has_schema_usage(client, schema, &pg_role).await?
+        }
+        (AclChange::Grant { .. }, AclTarget::Table { schema, .. }) => {
+            !has_schema_usage(client, schema, &pg_role).await?
+        }
+        _ => false,
+    };
+    let facts = CatalogFacts {
+        other_pg_roles,
+        existing_objects,
+        former_owner,
+        revoked_grants,
+        lacks_schema_usage,
+    };
     let mut plan =
         crate::datatable_acl_oss::plan_statements(target, &change, dbname, &pg_role, &facts)?;
     if matches!(change, AclChange::SetOwner { .. }) {
@@ -1540,6 +1560,27 @@ async fn build_plan(
     Ok(plan)
 }
 
+/// Whether `pg_role` may look into `schema`, directly or through a role it inherits from.
+async fn has_schema_usage(
+    client: &tokio_postgres::Client,
+    schema: &str,
+    pg_role: &str,
+) -> Result<bool> {
+    Ok(client
+        .query_one(
+            "SELECT has_schema_privilege($1::name, $2::text, 'USAGE')",
+            &[&pg_role, &schema],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read the role's privileges on schema {schema}: {}",
+                pg_error_message(&e)
+            ))
+        })?
+        .get(0))
+}
+
 /// Postgres only hands an object to a role that could have created it: a table to one with
 /// `CREATE` on its schema, a schema to one with `CREATE` on the database.
 async fn missing_owner_privilege(
diff --git a/backend/windmill-api-workspaces/src/datatable_migrations.rs b/backend/windmill-api-workspaces/src/datatable_migrations.rs
index f762fda175..e63e69d4d5 100644
--- a/backend/windmill-api-workspaces/src/datatable_migrations.rs
+++ b/backend/windmill-api-workspaces/src/datatable_migrations.rs
@@ -17,6 +17,7 @@ use crate::workspaces::{
 
 use axum::{
     extract::{Extension, Path, Query},
+    http::StatusCode,
     routing::{delete, get, post},
     Json, Router,
 };
@@ -235,6 +236,7 @@ async fn run_datatable_migration_job(
     args.insert("database".to_string(), database_arg.clone());
     let push_args = PushArgs { extra: None, args: &args };
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(db, authed).await?;
     let (uuid, mut tx) = push(
         db,
         PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into()),
@@ -278,6 +280,7 @@ async fn run_datatable_migration_job(
         None,
         None,
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
@@ -401,6 +404,12 @@ async fn connection_identity(client: &tokio_postgres::Client) -> Option<(String,
     })
 }
 
+const MIGRATION_LOCK_KEY: &str = "hashtext('windmill_datatable_migrations')::int8";
+
+/// How long a run, rollback or edit waits for the one ahead of it. A migration may run for
+/// longer than any request should wait, so past this the caller is told to retry.
+const MIGRATION_LOCK_WAIT_SECS: u64 = 30;
+
 /// Open a connection to a data table's own database and hold the session-level
 /// advisory lock that serializes migration runs/rollbacks. The lock is released
 /// when the returned client is dropped, so callers must keep it in scope for the
@@ -426,18 +435,85 @@ async fn lock_datatable_migration_runs(
             tracing::error!("Datatable connection error: {}", e);
         }
     });
-    client
-        .batch_execute("SELECT pg_advisory_lock(hashtext('windmill_datatable_migrations')::int8)")
-        .await
-        .map_err(|e| {
-            Error::internal_err(format!(
-                "Failed to acquire migration lock: {}",
-                pg_error_message(&e)
-            ))
-        })?;
+    hold_migration_lock(&client, datatable_name, MIGRATION_LOCK_WAIT_SECS).await?;
     Ok(client)
 }
 
+async fn hold_migration_lock(
+    client: &tokio_postgres::Client,
+    datatable_name: &str,
+    wait_secs: u64,
+) -> Result<()> {
+    // A session whose client vanished without closing the socket otherwise keeps the lock for
+    // the server's keepalive default, two hours on Linux. `SET` rather than startup `options`,
+    // which PgBouncer rejects. Behind a pooler they only cover the pooler's own connection to
+    // the server: there, as on a server refusing them, the bounded wait below is the recovery.
+    if let Err(e) = client
+        .batch_execute(
+            "SET tcp_keepalives_idle = 60; SET tcp_keepalives_interval = 10; \
+             SET tcp_keepalives_count = 6",
+        )
+        .await
+    {
+        tracing::debug!(
+            "Could not set server keepalives on the migration lock connection: {}",
+            pg_error_message(&e)
+        );
+    }
+    let locked = client
+        .batch_execute(&format!(
+            "SET lock_timeout = '{wait_secs}s'; \
+             SELECT pg_advisory_lock({MIGRATION_LOCK_KEY}); \
+             RESET lock_timeout"
+        ))
+        .await;
+    match locked {
+        Ok(()) => Ok(()),
+        Err(e) if e.code() == Some(&SqlState::LOCK_NOT_AVAILABLE) => {
+            // The key as `pg_locks` splits it: high half in `classid`, low half in `objid`.
+            let holder = client
+                .query_opt(
+                    &format!(
+                        "SELECT pid FROM pg_locks
+                         WHERE locktype = 'advisory' AND granted AND objsubid = 1
+                           AND database = (SELECT oid FROM pg_database WHERE datname = current_database())
+                           AND ((classid::bigint << 32) | objid::bigint) = {MIGRATION_LOCK_KEY}"
+                    ),
+                    &[],
+                )
+                .await
+                .ok()
+                .flatten()
+                .map(|row| row.get::<_, i32>(0));
+            let held_by = match holder {
+                Some(pid) => format!(
+                    " The lock is held by backend pid {pid}: if nothing is running, a lost \
+                     connection left that session behind, and \
+                     `SELECT pg_terminate_backend({pid})` on the data table's database releases it."
+                ),
+                None => String::new(),
+            };
+            Err(Error::Generic(
+                StatusCode::CONFLICT,
+                format!(
+                    "Another migration run, rollback or edit on the database of data table \
+                     '{datatable_name}' was still in progress after {wait_secs}s. \
+                     Retry once it is done.{held_by}"
+                ),
+            ))
+        }
+        Err(e) => Err(Error::internal_err(format!(
+            "Failed to acquire migration lock: {}",
+            pg_error_message(&e)
+        ))),
+    }
+}
+
+/// Whether `e` is the lock wait running out, as opposed to the database being unreachable.
+fn is_migration_lock_busy(e: &Error) -> bool {
+    matches!(e, Error::Generic(StatusCode::CONFLICT, _))
+}
+
 /// Read the versions recorded as applied in a data table's `_wm_migrations`,
 /// scoped to that data table, using an existing connection. An absent table
 /// (`42P01`) means nothing has been migrated yet.
@@ -1358,7 +1434,13 @@ async fn delete_datatable_migration(
     };
     let lock_client = lock_datatable_migration_runs(&db, &w_id, &datatable_name)
         .await
-        .map_err(unreachable)?;
+        .map_err(|e| {
+            if is_migration_lock_busy(&e) {
+                e
+            } else {
+                unreachable(e)
+            }
+        })?;
     let applied = read_applied_versions_on_client(&lock_client, &datatable_name)
         .await
         .map_err(unreachable)?;
@@ -1533,7 +1615,13 @@ async fn upsert_datatable_migration(
             };
             let client = lock_datatable_migration_runs(&db, &w_id, &datatable_name)
                 .await
-                .map_err(unreachable)?;
+                .map_err(|e| {
+                    if is_migration_lock_busy(&e) {
+                        e
+                    } else {
+                        unreachable(e)
+                    }
+                })?;
             let applied = read_applied_versions_on_client(&client, &datatable_name)
                 .await
                 .map_err(unreachable)?;
@@ -2041,6 +2129,32 @@ pub(crate) async fn clone_datatable_migrations(
 mod tests {
     use super::*;
 
+    // The holder is found by reassembling the key from the two halves `pg_locks` shows.
+    #[sqlx::test(migrations = false)]
+    async fn a_held_migration_lock_is_reported_with_its_holder(pool: DB) {
+        let mut config: tokio_postgres::Config =
+            std::env::var("DATABASE_URL").unwrap().parse().unwrap();
+        config.dbname(pool.connect_options().get_database().unwrap());
+        let (holder, connection) = config.connect(tokio_postgres::NoTls).await.unwrap();
+        tokio::spawn(connection);
+        let (waiter, connection) = config.connect(tokio_postgres::NoTls).await.unwrap();
+        tokio::spawn(connection);
+        hold_migration_lock(&holder, "main", 1).await.unwrap();
+        let holder_pid = holder
+            .query_one("SELECT pg_backend_pid()", &[])
+            .await
+            .unwrap()
+            .get::<_, i32>(0);
+
+        let busy = hold_migration_lock(&waiter, "main", 1).await.unwrap_err();
+
+        assert!(is_migration_lock_busy(&busy), "{busy:?}");
+        assert!(
+            busy.to_string().contains(&format!("pid {holder_pid}:")),
+            "{busy}"
+        );
+    }
+
     #[test]
     fn validate_migration_name_accepts_safe_names() {
         for name in ["initial", "add_index_to_customers", "fix-bug_2", "ABC123"] {
diff --git a/backend/windmill-api-workspaces/src/remote_deploy.rs b/backend/windmill-api-workspaces/src/remote_deploy.rs
index 3e701cbf14..a0f922a607 100644
--- a/backend/windmill-api-workspaces/src/remote_deploy.rs
+++ b/backend/windmill-api-workspaces/src/remote_deploy.rs
@@ -25,11 +25,11 @@ use axum::{
 };
 use chrono::{DateTime, Utc};
 use lazy_static::lazy_static;
-use magic_crypt::MagicCrypt256;
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 use windmill_api_auth::{is_effectively_unscoped, ApiAuthed, Tokened};
 use windmill_audit::{audit_oss::audit_log, ActionKind};
+use windmill_common::variables::WorkspaceCrypt;
 use windmill_common::{
     auth::hash_token,
     error::{error_source_chain, Error, Result},
@@ -676,8 +676,8 @@ async fn proxy(
 pub(crate) async fn reencrypt_tokens(
     conn: &mut sqlx::PgConnection,
     w_id: &str,
-    old: &MagicCrypt256,
-    new: &MagicCrypt256,
+    old: &WorkspaceCrypt,
+    new: &WorkspaceCrypt,
 ) -> Result<()> {
     let rows = sqlx::query!(
         "SELECT email, token FROM remote_deploy_token
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 81fead981b..3bfcef5c96 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -744,13 +744,15 @@ async fn is_premium(
 
 #[derive(Serialize)]
 struct BillableSeatsResponse {
-    /// Both omitted when the seats counted are another workspace's: a fork member need not be a
+    /// All three omitted when the seats counted are another workspace's: a fork member need not be a
     /// member of the billing root, so the root's headcount is not theirs to read. The total is,
     /// since it is the divisor of the quota their own executions draw on.
     #[serde(skip_serializing_if = "Option::is_none")]
     developers: Option<i64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     operators: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    service_accounts: Option<i64>,
     seats: i64,
 }
 
@@ -780,6 +782,7 @@ async fn get_billable_seats(
     Ok(Json(BillableSeatsResponse {
         developers: own.then_some(counted.developers),
         operators: own.then_some(counted.operators),
+        service_accounts: own.then_some(counted.service_accounts),
         seats: counted.seats,
     }))
 }
@@ -6314,8 +6317,8 @@ async fn set_encryption_key(
 async fn reencrypt_git_sync_secrets(
     conn: &mut sqlx::PgConnection,
     w_id: &str,
-    old: &magic_crypt::MagicCrypt256,
-    new: &magic_crypt::MagicCrypt256,
+    old: &windmill_common::variables::WorkspaceCrypt,
+    new: &windmill_common::variables::WorkspaceCrypt,
 ) -> Result<()> {
     let Some((mut credentials, mut git_sync)) =
         sqlx::query_as::<_, (serde_json::Value, Option<serde_json::Value>)>(
@@ -7637,7 +7640,7 @@ async fn clone_scripts(
             dedicated_worker, ws_error_handler_muted, priority, timeout,
             delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,
             visible_to_runner_only, auto_kind, codebase, has_preprocessor,
-            on_behalf_of, on_behalf_of_email, assets, modules
+            on_behalf_of, on_behalf_of_email, assets, modules, job_token_scopes
         )
         SELECT
             $1, hash, path, parent_hashes, summary, description, content,
@@ -7669,7 +7672,7 @@ async fn clone_scripts(
                         UNION ALL
                         SELECT 1 FROM password p WHERE p.email = on_behalf_of
                           AND p.super_admin))
-            END, on_behalf_of_email, assets, modules
+            END, on_behalf_of_email, assets, modules, job_token_scopes
         FROM script
         WHERE workspace_id = $2"#,
         target_workspace_id,
@@ -8027,7 +8030,8 @@ async fn clone_flows(
             workspace_id, path, summary, description, value, edited_by, edited_at,
             archived, schema, extra_perms, dependency_job, tag,
             ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,
-            concurrency_key, versions, on_behalf_of, on_behalf_of_email, lock_error_logs
+            concurrency_key, versions, on_behalf_of, on_behalf_of_email, lock_error_logs,
+            job_token_scopes
         )
         SELECT $2, path, summary, description, value, edited_by, edited_at,
                archived, schema, extra_perms, NULL, tag,
@@ -8053,7 +8057,7 @@ async fn clone_flows(
                            UNION ALL
                            SELECT 1 FROM password p WHERE p.email = on_behalf_of
                              AND p.super_admin))
-               END, on_behalf_of_email, lock_error_logs
+               END, on_behalf_of_email, lock_error_logs, job_token_scopes
         FROM flow
         WHERE workspace_id = $1",
         source_workspace_id,
@@ -10509,7 +10513,7 @@ async fn edit_workspace(
 pub(crate) async fn archive_workspace_impl(
     db: &DB,
     w_id: &str,
-    username: &str,
+    authed: &ApiAuthed,
     // When archiving a dev workspace, its parent prod. The pairing teardown (clear is_dev + drop the
     // prod's lock) is folded into the same transaction as `deleted = true` so it's atomic with the
     // archive — a later failure can't strand a half-archived dev that's still flagged/locked.
@@ -10623,7 +10627,7 @@ pub(crate) async fn archive_workspace_impl(
         let axum::Json(canceled_jobs) = windmill_api_jobs::cancel_jobs(
             jobs_to_cancel,
             db,
-            username,
+            authed,
             w_id,
             false, // force_cancel
         )
@@ -10683,7 +10687,7 @@ async fn archive_workspace(
     // dev workspace, which only applies to a workspace that is itself a dev (`dev_lock_parent`): a
     // root archived out from under its dev is the pre-existing shape and not this pairing's to police.
     let (schedules_count, canceled_count, deleted_tokens_count) =
-        archive_workspace_impl(&db, &w_id, &authed.username, dev_lock_parent.as_deref()).await?;
+        archive_workspace_impl(&db, &w_id, &authed, dev_lock_parent.as_deref()).await?;
 
     // Audit log
     let mut tx = db.begin().await?;
@@ -11604,10 +11608,13 @@ struct ChangeOperatorSettings {
     /// withdraw or grant the right on every push.
     ///
     /// `builder_flows` lets every operator of this workspace compose flows out of already-deployed
-    /// runnables, and makes each of them consume a full author seat instead of half of one.
+    /// runnables, `builder_apps` full-code apps. Either makes each operator consume a full author
+    /// seat instead of half of one.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     builder_flows: Option<bool>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    builder_apps: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     manage_schedules: Option<bool>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     manage_triggers: Option<bool>,
@@ -11622,9 +11629,10 @@ async fn update_operator_settings(
     require_admin(authed.is_admin, &authed.username)?;
 
     // Every operator of the workspace turns into a full seat, which an offline license may not
-    // cover. It is a no-op delta when the right is already on.
+    // cover. Either right costs the same seat, so this prices "any", and it is a no-op delta when
+    // one of them is already on.
     #[cfg(feature = "enterprise")]
-    if settings.builder_flows == Some(true) {
+    if settings.builder_flows == Some(true) || settings.builder_apps == Some(true) {
         if let Some(msg) =
             windmill_common::ee_oss::check_seat_cap_for_operator_builder(&db, &w_id).await?
         {
@@ -14046,6 +14054,12 @@ const TRIGGER_COMPARE_IGNORE: &[&str] = &[
     "last_server_ping",
     "extra_perms",
     "permissioned_as",
+    // Schedule counters the scheduler bumps as occurrences are missed. A fork's
+    // schedules are disabled so theirs stay at the defaults, and no deploy carries
+    // them across: compared, a parent schedule that ever ran late differs forever.
+    "late_run_streak",
+    "missed_occurrences",
+    "last_missed_at",
     // Server-managed fields that the merge feature treats as workspace-local
     // (regenerated by the deploy handler): GCP `subscription_id` is rewritten
     // to `windmill_<workspace_id>_<path>` in `CreateUpdate` mode, and Azure's
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 8ca98f66d1..2f0d4deb13 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -408,8 +408,8 @@ pub(crate) async fn change_workspace_id(
     info!("Duplicating flow table rows");
     sqlx::query!(
         "INSERT INTO flow
-            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs)
-        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs
+            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs, job_token_scopes)
+        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs, job_token_scopes
             FROM flow WHERE workspace_id = $2",
         &rw.new_id,
         &old_id
@@ -944,7 +944,7 @@ pub(crate) async fn change_workspace_id(
     // Note: schedules were already moved to new workspace, so this will find 0 schedules
     info!("Archiving old workspace");
     let (_schedules_count, canceled_count, _deleted_tokens_count) =
-        archive_workspace_impl(&db, &old_id, &authed.username, None).await?;
+        archive_workspace_impl(&db, &old_id, &authed, None).await?;
 
     // The old id stays live between the commit above and the archive, and a fork copy created for
     // it in that window registers under it. Creation checks the workspace is live under the fork
@@ -1299,6 +1299,13 @@ pub(crate) async fn delete_workspace(
     .execute(&mut *tx)
     .await?;
 
+    sqlx::query!(
+        "DELETE FROM runnable_job_stats WHERE workspace_id = $1",
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     // If this workspace is itself a dev workspace, deleting it dissolves the pairing, so also drop
     // the parent prod's reserved dev_workspace_lock (mirrors detach_dev_workspace) — otherwise prod
     // stays locked against direct deploy/forking with no dev workspace left to make changes in.
@@ -1670,13 +1677,12 @@ pub async fn drop_forked_datatable_databases(
             match parent_pg.connect(Some(&db)).await {
                 Ok((client, connection)) => {
                     let join_handle = tokio::spawn(async move { connection.await });
-                    if let Err(e) = client
-                        .execute(&format!("DROP DATABASE \"{}\"", db_to_drop), &[])
-                        .await
-                    {
+                    if let Err(e) = drop_database_with_sessions(&client, db_to_drop).await {
                         errors.push(format!(
                             "Could not drop database '{}' for datatable://{}: {}",
-                            db_to_drop, dt_name, e
+                            db_to_drop,
+                            dt_name,
+                            windmill_common::error::pg_error_message(&e)
                         ));
                     }
                     drop(client);
@@ -1695,6 +1701,44 @@ pub async fn drop_forked_datatable_databases(
     Ok(Json(errors))
 }
 
+/// Drops `dbname`, whose name the caller validated, along with the sessions still connected to
+/// it: a worker keeps an idle connection to a database it ran a job on, and a plain
+/// `DROP DATABASE` fails for as long as one exists.
+async fn drop_database_with_sessions(
+    client: &tokio_postgres::Client,
+    dbname: &str,
+) -> std::result::Result<(), tokio_postgres::Error> {
+    let version = client
+        .query_one("SELECT current_setting('server_version_num')::int", &[])
+        .await?
+        .get::<_, i32>(0);
+    if version >= 130000 {
+        client
+            .execute(&format!("DROP DATABASE \"{dbname}\" WITH (FORCE)"), &[])
+            .await?;
+        return Ok(());
+    }
+    // No `FORCE` before 13. The drop below waits a few seconds for the sessions to exit, and
+    // reports the ones this role was not allowed to terminate.
+    if let Err(e) = client
+        .execute(
+            "SELECT pg_terminate_backend(pid) FROM pg_stat_activity
+             WHERE datname = $1 AND pid <> pg_backend_pid()",
+            &[&dbname],
+        )
+        .await
+    {
+        tracing::warn!(
+            "Failed to terminate connections to '{dbname}': {}",
+            windmill_common::error::pg_error_message(&e)
+        );
+    }
+    client
+        .execute(&format!("DROP DATABASE \"{dbname}\""), &[])
+        .await?;
+    Ok(())
+}
+
 /// Drop this fork workspace's ducklake namespaces: the `wm_fork_*` metadata schema in each
 /// lake's catalog database, plus (best effort) the fork's `__wm_forks/<wid>/…` data files in
 /// the workspace storage. Driven by the `fork_ducklake_namespace` registry written at first
@@ -2265,3 +2309,47 @@ async fn workspace_is_fork(db: &DB, w_id: &str) -> Result<bool> {
     .await?
     .unwrap_or(false))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::drop_database_with_sessions;
+
+    #[sqlx::test(migrations = false)]
+    async fn a_database_is_dropped_under_a_connected_session(pool: sqlx::PgPool) {
+        let mut config: tokio_postgres::Config =
+            std::env::var("DATABASE_URL").unwrap().parse().unwrap();
+        let test_db = pool.connect_options().get_database().unwrap().to_string();
+        let (client, connection) = config
+            .dbname(&test_db)
+            .connect(tokio_postgres::NoTls)
+            .await
+            .unwrap();
+        tokio::spawn(connection);
+        // The test database's name already fills an identifier.
+        let held_db = format!("held_{}", &test_db[test_db.len().saturating_sub(40)..]);
+        client
+            .execute(&format!("CREATE DATABASE \"{held_db}\""), &[])
+            .await
+            .unwrap();
+        let (_session, connection) = config
+            .dbname(&held_db)
+            .connect(tokio_postgres::NoTls)
+            .await
+            .unwrap();
+        tokio::spawn(connection);
+
+        drop_database_with_sessions(&client, &held_db)
+            .await
+            .unwrap();
+
+        let left = client
+            .query_one(
+                "SELECT count(*) FROM pg_database WHERE datname = $1",
+                &[&held_db],
+            )
+            .await
+            .unwrap()
+            .get::<_, i64>(0);
+        assert_eq!(left, 0);
+    }
+}
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index ad7f12453c..b3aea64f72 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -20,7 +20,7 @@ benchmark = []
 embedding = ["windmill-api-embeddings/embedding"]
 parquet = ["dep:datafusion", "windmill-common/parquet", "windmill-object-store/parquet", "windmill-worker?/parquet", "windmill-indexer?/parquet", "windmill-api-users/parquet", "windmill-api-settings/parquet", "windmill-api-workspaces/parquet", "windmill-api-npm-proxy/parquet", "dep:aws-sigv4", "dep:aws-sdk-config", "dep:quick-xml"]
 prometheus = ["windmill-common/prometheus", "windmill-queue/prometheus", "dep:prometheus", "windmill-worker?/prometheus", "windmill-api-scripts/prometheus"]
-openidconnect = ["dep:openidconnect", "windmill-common/openidconnect", "windmill-store/openidconnect"]
+openidconnect = ["dep:openidconnect", "dep:rsa", "dep:p256", "dep:tokio-rustls", "windmill-common/openidconnect", "windmill-store/openidconnect"]
 # The service log search handler reads the columnar store, so tantivy alone is
 # not enough for this crate to build on its own.
 tantivy = ["dep:windmill-indexer", "parquet"]
@@ -141,6 +141,8 @@ samael = { workspace = true, optional = true }
 libxml = { workspace = true, optional = true }
 async-recursion.workspace = true
 rsa = { workspace = true, optional = true}
+p256 = { workspace = true, optional = true }
+tokio-rustls = { workspace = true, optional = true }
 uuid.workspace = true
 datafusion = { workspace = true, optional = true}
 openidconnect = { workspace = true, optional = true}
@@ -189,4 +191,7 @@ flate2.workspace = true
 strum = { workspace = true, optional = true }
 dashmap.workspace = true
 
+[dev-dependencies]
+rcgen.workspace = true
+
 [build-dependencies]
diff --git a/backend/windmill-api/openapi-deref.json b/backend/windmill-api/openapi-deref.json
index 3cba2b7da6..4016222d30 100644
--- a/backend/windmill-api/openapi-deref.json
+++ b/backend/windmill-api/openapi-deref.json
@@ -5424,6 +5424,10 @@
                     "is_past_due": {
                       "type": "boolean"
                     },
+                    "is_canceled": {
+                      "type": "boolean",
+                      "description": "the team plan was canceled this month; it stays premium until the month ends, capped at max_tolerated_executions"
+                    },
                     "max_tolerated_executions": {
                       "type": "number"
                     }
@@ -34989,7 +34993,7 @@
           },
           "exponential": {
             "type": "object",
-            "description": "Retry with exponential backoff (delay doubles each time)",
+            "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
             "properties": {
               "attempts": {
                 "type": "integer",
@@ -35002,7 +35006,7 @@
               "seconds": {
                 "type": "integer",
                 "minimum": 1,
-                "description": "Initial delay in seconds"
+                "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
               },
               "random_factor": {
                 "type": "integer",
@@ -47926,7 +47930,7 @@
           },
           "exponential": {
             "type": "object",
-            "description": "Retry with exponential backoff (delay doubles each time)",
+            "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
             "properties": {
               "attempts": {
                 "type": "integer",
@@ -47939,7 +47943,7 @@
               "seconds": {
                 "type": "integer",
                 "minimum": 1,
-                "description": "Initial delay in seconds"
+                "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
               },
               "random_factor": {
                 "type": "integer",
diff --git a/backend/windmill-api/openapi-deref.yaml b/backend/windmill-api/openapi-deref.yaml
index d5a14a717d..d541144231 100644
--- a/backend/windmill-api/openapi-deref.yaml
+++ b/backend/windmill-api/openapi-deref.yaml
@@ -5286,6 +5286,9 @@ paths:
                     type: string
                   is_past_due:
                     type: boolean
+                  is_canceled:
+                    type: boolean
+                    description: the team plan was canceled this month; it stays premium until the month ends, capped at max_tolerated_executions
                   max_tolerated_executions:
                     type: number
                 required:
@@ -11722,9 +11725,7 @@ paths:
                                           description: Seconds to wait between retries
                                     exponential:
                                       type: object
-                                      description: >-
-                                        Retry with exponential backoff (delay
-                                        doubles each time)
+                                      description: 'Retry with exponential backoff: the n-th retry waits multiplier × seconds^n'
                                       properties:
                                         attempts:
                                           type: integer
@@ -11735,7 +11736,7 @@ paths:
                                         seconds:
                                           type: integer
                                           minimum: 1
-                                          description: Initial delay in seconds
+                                          description: Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too
                                         random_factor:
                                           type: integer
                                           minimum: 0
@@ -23269,7 +23270,7 @@ paths:
                           description: Seconds to wait between retries
                     exponential:
                       type: object
-                      description: Retry with exponential backoff (delay doubles each time)
+                      description: 'Retry with exponential backoff: the n-th retry waits multiplier × seconds^n'
                       properties:
                         attempts:
                           type: integer
@@ -23280,7 +23281,7 @@ paths:
                         seconds:
                           type: integer
                           minimum: 1
-                          description: Initial delay in seconds
+                          description: Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too
                         random_factor:
                           type: integer
                           minimum: 0
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index d9aeb63707..433d7c00be 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.821.0
+  version: 1.830.0
   title: Windmill API
 
   contact:
@@ -1765,6 +1765,12 @@ paths:
                   type: string
                 cluster:
                   $ref: "#/components/schemas/DatatableRoleCluster"
+                take_over:
+                  type: boolean
+                  description: >
+                    manage a Postgres role of that name that already exists on the cluster,
+                    replacing its password, instead of refusing it. A role with cluster-wide
+                    attributes or memberships is refused either way
       responses:
         "200":
           description: the created role
@@ -1772,6 +1778,8 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/InstanceDatatableRole"
+        "409":
+          description: a Postgres role of that name already exists on the cluster and take_over was not set
 
   /settings/datatable_roles/{id}:
     post:
@@ -1911,7 +1919,7 @@ paths:
 
   /settings/instance_ui:
     get:
-      summary: get the instance-wide announcement banner and accent color
+      summary: get the instance-wide announcement banner, accent color and API base url
       description: |
         Readable by any authenticated user; every page load reads it. Each value
         is the raw stored setting, or null when unset.
@@ -1920,7 +1928,7 @@ paths:
         - setting
       responses:
         "200":
-          description: the instance_banner and accent_color settings
+          description: the instance_banner, accent_color and api_base_url settings
           content:
             application/json:
               schema:
@@ -1928,6 +1936,7 @@ paths:
                 properties:
                   instance_banner: {}
                   accent_color: {}
+                  api_base_url: {}
 
   /settings_u/ruff_config:
     get:
@@ -4492,6 +4501,12 @@ paths:
                     description: >-
                       Omitted when the seats counted are another workspace's, as they are for a
                       fork resolving to its billing root.
+                  service_accounts:
+                    type: integer
+                    description: >-
+                      Enabled service accounts, half a seat each like operators. Omitted when the
+                      seats counted are another workspace's, as they are for a fork resolving to
+                      its billing root.
                   seats:
                     type: integer
                 required:
@@ -4529,6 +4544,9 @@ paths:
                     type: string
                   is_past_due:
                     type: boolean
+                  is_canceled:
+                    type: boolean
+                    description: the team plan was canceled this month; it stays premium until the month ends, capped at max_tolerated_executions
                   max_tolerated_executions:
                     type: number
                 required:
@@ -5550,6 +5568,9 @@ paths:
                   type: boolean
                 default_role:
                   type: string
+                  description: >-
+                    The id of one of `roles`, `admin` (the default), or `$none` for no default
+                    role: a connection that names no role then holds its viewer's roles only.
                 roles:
                   type: array
                   items:
@@ -7418,6 +7439,72 @@ paths:
                 items:
                   $ref: "#/components/schemas/TruncatedToken"
 
+  /oidc/signing_status:
+    get:
+      summary: what signs OIDC tokens and the keys the JWKS serves (ee only, superadmin)
+      operationId: getOidcSigningStatus
+      tags:
+        - oidc
+      responses:
+        "200":
+          description: OIDC signing status
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - mode
+                  - keys
+                properties:
+                  mode:
+                    type: string
+                    enum: [database, file, external]
+                  keys:
+                    type: array
+                    items:
+                      type: object
+                      required:
+                        - alg
+                        - state
+                        - source
+                      properties:
+                        kid:
+                          type: string
+                        alg:
+                          type: string
+                        state:
+                          type: string
+                          enum: [pending, active, retired, published]
+                        source:
+                          type: string
+                          enum: [signer, database, file, publish_dir]
+                  signer:
+                    type: object
+                    description: set when an external signer is configured
+                    required:
+                      - breaker
+                      - max_rps
+                      - current_rps
+                    properties:
+                      last_refresh_success:
+                        type: string
+                        format: date-time
+                      last_refresh_error:
+                        type: string
+                      breaker:
+                        type: string
+                        enum: [closed, open, half_open]
+                      max_rps:
+                        type: number
+                      current_rps:
+                        type: number
+                      keys_from_store:
+                        type: boolean
+                        description: the keys served are those stored by the last accepted listing, the signer has not answered this server yet
+                      tls_files_error:
+                        type: string
+                        description: why the mTLS files on disk are not the ones in use
+
   /w/{workspace}/oidc/token/{audience}:
     post:
       summary: get OIDC token (ee only)
@@ -10907,6 +10994,37 @@ paths:
                     description: "`saved` only, upsert or delete: where the write landed. Differs from the URL path when the item had moved away from it; the editor follows it there. Absent when a delete found nothing to remove and the caller cannot read the path it moved to."
                 required: [status, current_timestamp]
 
+  /w/{workspace}/drafts/delete_for_user/{kind}/{path}:
+    post:
+      summary: delete another user's draft, or every draft at a path (admin only)
+      description: Delete the draft a given user holds at a path, or, without `username`, every draft at that path (the legacy ownerless one and the caller's own included). Workspace admins / superadmins only, and only for script, flow, app and raw_app drafts. Unlike a discard of one's own draft through `drafts/update`, this returns 404 when nothing was deleted.
+      operationId: deleteDraftForUser
+      tags:
+        - draft
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: kind
+          in: path
+          required: true
+          schema:
+            $ref: "#/components/schemas/UserDraftItemKind"
+        - $ref: "#/components/parameters/ScriptPath"
+        - name: username
+          in: query
+          required: false
+          description: Workspace username of the draft owner. Omit to delete every user's draft at the path.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: draft(s) deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+        "404":
+          description: no matching draft at that path
+
   /w/{workspace}/drafts/move/{kind}/{path}:
     post:
       summary: move the current user's draft-only item to another path
@@ -11995,6 +12113,7 @@ paths:
         - $ref: "#/components/parameters/WorkerTag"
         - $ref: "#/components/parameters/CacheTtl"
         - $ref: "#/components/parameters/NewJobId"
+        - $ref: "#/components/parameters/RunRetry"
         - name: invisible_to_owner
           description: make the run invisible to the the script owner (default false)
           in: query
@@ -15999,6 +16118,7 @@ paths:
         - $ref: "#/components/parameters/WorkerTag"
         - $ref: "#/components/parameters/CacheTtl"
         - $ref: "#/components/parameters/NewJobId"
+        - $ref: "#/components/parameters/RunRetry"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
           description: make the run invisible to the the script owner (default false)
@@ -16527,6 +16647,31 @@ paths:
                 required:
                   - database_length
 
+  /w/{workspace}/jobs/oldest:
+    get:
+      summary: get the creation date of the oldest job
+      operationId: getOldestJob
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: all_workspaces
+          description: consider jobs from all workspaces (only valid if request come from the `admins` workspace)
+          in: query
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: creation date of the oldest job, absent when there is none
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  created_at:
+                    type: string
+                    format: date-time
+
   /w/{workspace}/jobs/completed/count:
     get:
       summary: get completed count
@@ -17278,6 +17423,27 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/jobs/worker_is_draining/{id}:
+    get:
+      summary: whether the worker running this job is draining
+      description: |
+        True once the worker running the job has received its shutdown signal. The worker
+        still waits for the job to finish, so a long-running job can poll this to exit early.
+        False when the job is not currently running on a worker.
+      operationId: workerIsDraining
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+      responses:
+        "200":
+          description: whether the worker running this job is draining
+          content:
+            application/json:
+              schema:
+                type: boolean
+
   /w/{workspace}/jobs_u/get_logs/{id}:
     get:
       summary: get job logs
@@ -23458,6 +23624,54 @@ paths:
                     - id
                     - values
 
+  /workers/runnable_stats:
+    get:
+      summary: get resource usage per runnable and worker group over a time window (require devops role)
+      operationId: getRunnableStats
+      tags:
+        - worker
+      parameters:
+        - name: window_secs
+          in: query
+          required: false
+          description: how far back to read, in seconds (defaults to one day, capped at the 30-day retention)
+          schema:
+            type: integer
+        - name: worker_group
+          in: query
+          required: false
+          description: only the jobs run by this worker group
+          schema:
+            type: string
+        - name: workspace
+          in: query
+          required: false
+          description: only the jobs of this workspace
+          schema:
+            type: string
+        - name: order_by
+          in: query
+          required: false
+          description: "what the rows are ranked by, descending (default: total_duration)"
+          schema:
+            type: string
+            enum: [total_duration, max_memory, cpu]
+        - name: limit
+          in: query
+          required: false
+          description: number of rows to return (default 100, at most 1000)
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: resource usage per runnable and worker group, heaviest first
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/RunnableStats"
+
   /workers/queue_metrics_series:
     get:
       summary: get the queue metrics of a time window, as a bounded line per tag
@@ -25165,9 +25379,12 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/TablePreviewS3ResourcePath"
+        - $ref: "#/components/parameters/TablePreviewFilters"
       responses:
         "200":
-          description: Parquet Preview
+          description: >
+            Parquet Preview: `columns`, `column_types` (Arrow type names) and `rows`.
           content:
             application/json: {}
 
@@ -25192,6 +25409,13 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/TablePreviewS3ResourcePath"
+        - name: csv_separator
+          in: query
+          schema:
+            type: string
+        - $ref: "#/components/parameters/TablePreviewCsvHasHeader"
+        - $ref: "#/components/parameters/TablePreviewFilters"
       responses:
         "200":
           description: Table count
@@ -25240,13 +25464,20 @@ paths:
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/TablePreviewS3ResourcePath"
         - name: csv_separator
           in: query
           schema:
             type: string
+        - $ref: "#/components/parameters/TablePreviewCsvHasHeader"
+        - $ref: "#/components/parameters/TablePreviewFilters"
       responses:
         "200":
-          description: Csv Preview
+          description: >
+            Csv Preview: `columns`, `column_types` (Arrow type names), `rows`, and the
+            `csv_separator` the file was read with, guessed from its first bytes when
+            none is given.
+            A `.jsonl` or `.ndjson` file is read as newline-delimited JSON.
           content:
             application/json: {}
 
@@ -27606,6 +27837,28 @@ components:
       required: true
       schema:
         type: string
+    TablePreviewS3ResourcePath:
+      name: s3_resource_path
+      description: Read the file from this object storage resource instead of the workspace storage.
+      in: query
+      schema:
+        type: string
+    TablePreviewCsvHasHeader:
+      name: csv_has_header
+      description: Whether the first CSV line names the columns. Defaults to true.
+      in: query
+      schema:
+        type: boolean
+    TablePreviewFilters:
+      name: filters
+      description: >
+        JSON object, column name to filter. A number column takes an optional comparison
+        operator and a number (`>=10`), a boolean column a boolean, and any other column a
+        case-insensitive substring, or `=value` for an exact match. A `search_term` without
+        a `search_col` matches any column, case-insensitively.
+      in: query
+      schema:
+        type: string
     HubPublishFolder:
       name: folder
       in: query
@@ -27788,6 +28041,12 @@ components:
       in: query
       schema:
         type: string
+    RunRetry:
+      name: retry
+      description: JSON-encoded retry policy (same shape as a schedule's retry) re-running the job when it fails. The returned id is the first attempt's; each retry is a job of its own, recorded as a child of the first attempt. Not supported for hub scripts, with invisible_to_owner, or for a script whose preprocessor would run.
+      in: query
+      schema:
+        type: string
     NewJobId:
       name: job_id
       description:
@@ -28478,6 +28737,8 @@ components:
       $ref: "../../openflow.openapi.yaml#/components/schemas/AiTransform"
     ProviderConfig:
       $ref: "../../openflow.openapi.yaml#/components/schemas/ProviderConfig"
+    ProviderTransform:
+      $ref: "../../openflow.openapi.yaml#/components/schemas/ProviderTransform"
     MemoryConfig:
       $ref: "../../openflow.openapi.yaml#/components/schemas/MemoryConfig"
     FlowModuleValue:
@@ -28498,6 +28759,8 @@ components:
       $ref: "../../openflow.openapi.yaml#/components/schemas/BranchAll"
     AiAgent:
       $ref: "../../openflow.openapi.yaml#/components/schemas/AiAgent"
+    AiDecision:
+      $ref: "../../openflow.openapi.yaml#/components/schemas/AiDecision"
     Identity:
       $ref: "../../openflow.openapi.yaml#/components/schemas/Identity"
     FlowStatus:
@@ -29462,6 +29725,8 @@ components:
           togetherai,
           aws_bedrock,
           customai,
+          typesafe,
+          cloudflare,
         ]
 
     GitSyncObjectType:
@@ -30150,6 +30415,12 @@ components:
           items:
             type: string
           default: []
+        job_token_scopes:
+          type: array
+          nullable: true
+          items:
+            type: string
+          description: "Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job."
         inherited_labels:
           type: array
           items:
@@ -30307,6 +30578,12 @@ components:
           type: array
           items:
             type: string
+        job_token_scopes:
+          type: array
+          nullable: true
+          items:
+            type: string
+          description: "Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it."
         skip_draft_deletion:
           type: boolean
           description: "When true (set by the CLI / git sync), deploying this script does not delete an existing user draft at the same path."
@@ -31642,6 +31919,7 @@ components:
             - "resource_types.create"
             - "resource_types.update"
             - "resource_types.delete"
+            - "resource_types.sync"
             - "schedule.create"
             - "schedule.setenabled"
             - "schedule.edit"
@@ -34473,6 +34751,11 @@ components:
           type: boolean
         cluster:
           $ref: "#/components/schemas/DatatableRoleCluster"
+        in_use:
+          type: boolean
+          description: >-
+            Whether any data table, in any workspace, lets someone connect as this role. Only set
+            in a data table's available_roles.
 
     DatatableRoleTenants:
       type: object
@@ -34502,6 +34785,7 @@ components:
           type: boolean
         default_role:
           type: string
+          description: A role id, `admin`, or `$none` when the data table has no default role.
         roles:
           type: array
           items:
@@ -35780,6 +36064,45 @@ components:
               `u/<username>`, `g/<groupname>`, or an email that exists in this
               workspace.
 
+    RunnableStats:
+      type: object
+      description: >
+        Resource usage of the jobs of one runnable on one worker group. Memory and CPU are
+        only known for jobs run as a subprocess; memory is the peak of the job's main process.
+      properties:
+        workspace_id:
+          type: string
+        runnable_path:
+          type: string
+          description: path of the script or flow step; `<adhoc>` gathers previews and other runs without a stable path
+        worker_group:
+          type: string
+        job_count:
+          type: integer
+        total_duration_ms:
+          type: integer
+        max_memory_peak:
+          type: integer
+          description: highest peak memory of a job, in kB
+        sum_memory_peak:
+          type: integer
+          description: sum of the peak memory of the jobs that have one, in kB
+        memory_sample_count:
+          type: integer
+          description: number of jobs that have a peak memory reading
+        total_cpu_ms:
+          type: integer
+      required:
+        - workspace_id
+        - runnable_path
+        - worker_group
+        - job_count
+        - total_duration_ms
+        - max_memory_peak
+        - sum_memory_peak
+        - memory_sample_count
+        - total_cpu_ms
+
     WorkerPing:
       type: object
       properties:
@@ -35828,6 +36151,9 @@ components:
           type: string
         native_mode:
           type: boolean
+        draining:
+          type: boolean
+          description: the worker received its shutdown signal and exits once its current job is done
       required:
         - worker
         - worker_instance
@@ -36165,6 +36491,12 @@ components:
           items:
             type: string
           default: []
+        job_token_scopes:
+          type: array
+          nullable: true
+          items:
+            type: string
+          description: "Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job."
         inherited_labels:
           type: array
           items:
@@ -36211,6 +36543,12 @@ components:
               type: array
               items:
                 type: string
+            job_token_scopes:
+              type: array
+              nullable: true
+              items:
+                type: string
+              description: "Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it."
           required:
             - path
     # Like OpenFlowWPath but `path` is optional: on update the flow is identified by
@@ -36247,6 +36585,12 @@ components:
               type: array
               items:
                 type: string
+            job_token_scopes:
+              type: array
+              nullable: true
+              items:
+                type: string
+              description: "Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it."
 
     FlowPreview:
       type: object
@@ -37772,6 +38116,9 @@ components:
         builder_flows:
           type: boolean
           description: Whether operators can compose flows out of existing runnables (consumes a full seat). Omitting the field leaves the stored value unchanged.
+        builder_apps:
+          type: boolean
+          description: Whether operators can compose full-code apps out of existing runnables (consumes a full seat). Omitting the field leaves the stored value unchanged.
         manage_schedules:
           type: boolean
           description: Whether operators can create, edit and delete schedules. Granted unless withdrawn; omitting the field leaves the stored value unchanged.
diff --git a/backend/windmill-api/src/agent_runs.rs b/backend/windmill-api/src/agent_runs.rs
index d2e76dcca0..76f729e7e0 100644
--- a/backend/windmill-api/src/agent_runs.rs
+++ b/backend/windmill-api/src/agent_runs.rs
@@ -29,7 +29,7 @@ use crate::db::{ApiAuthed, DB};
 use crate::jobs::{handle_chat_conversation_messages, set_flow_memory_id, RunJobQuery};
 
 /// The id the agent's step carries in the run, as the editor's chat names it. A token scoped to
-/// `jobs:run:agents:<path>` reads its runs back by it (`require_job_within_run_scope`).
+/// `jobs:run:agents:<path>` reads its runs back by it (`require_job_within_read_scope`).
 const AGENT_NODE_ID: &str = "__wm_agent_root";
 
 /// A turn of the agent's chat when `memory_id` names a conversation, a single run otherwise.
@@ -84,6 +84,7 @@ pub(crate) async fn run_agent(
     )?;
 
     let push_authed = authed.clone().into();
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, mut tx) = push(
         &db,
         PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into()),
@@ -118,6 +119,7 @@ pub(crate) async fn run_agent(
         None,
         authed.trigger_or_fallback(None),
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index 855cd29987..cf7447ceba 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -40,6 +40,7 @@ use windmill_ai::proxy::{
     fim::maybe_transform_fim_request, proxy_execution_mode, ProxyBuildArgs, ProxyExecutionMode,
     ProxyRequest,
 };
+use windmill_ai::retry::send_with_retries;
 use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::db::UserDB;
 use windmill_common::error::{to_anyhow, Error, Result};
@@ -246,6 +247,12 @@ struct AIStandardResource {
     /// Custom HTTP headers to include in AI requests
     #[serde(default)]
     headers: HashMap<String, String>,
+    /// The API token of a `cloudflare` resource, which names it `token` rather than `api_key`.
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    token: Option<String>,
+    /// The account of a `cloudflare` resource, which its Workers AI URL is built from.
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    account_id: Option<String>,
 }
 
 #[derive(Deserialize, Debug)]
@@ -293,10 +300,21 @@ async fn resolve_provider_credentials(
             // Skip get_base_url for Bedrock - it uses SDK directly, not HTTP
             let base_url = if matches!(provider, AIProvider::AWSBedrock) {
                 String::new()
+            } else if *provider == AIProvider::Cloudflare && resource.base_url.is_none() {
+                let account_id = if let Some(account_id) = resource.account_id {
+                    Some(resolve_var(account_id, db, w_id, user_db.as_ref(), authed).await?)
+                } else {
+                    None
+                };
+                windmill_ai::ai_providers::cloudflare_workers_ai_base_url(account_id.as_deref())?
             } else {
                 provider.get_base_url(resource.base_url, db).await?
             };
-            let api_key = if let Some(api_key) = resource.api_key {
+            let api_key = match provider {
+                AIProvider::Cloudflare => resource.api_key.or(resource.token),
+                _ => resource.api_key,
+            };
+            let api_key = if let Some(api_key) = api_key {
                 Some(resolve_var(api_key, db, w_id, user_db.as_ref(), authed).await?)
             } else {
                 None
@@ -486,9 +504,10 @@ async fn assume_bedrock_role(
 ) -> Result<windmill_ai::ai_bedrock::AssumedRoleCredentials> {
     #[cfg(all(feature = "enterprise", feature = "openidconnect", feature = "private"))]
     {
-        use windmill_common::oidc_oss::{generate_id_token, WorkspaceClaim};
+        use windmill_common::oidc_oss::{generate_id_token, OidcCaller, WorkspaceClaim};
 
         let id_token = generate_id_token(
+            OidcCaller::Bedrock,
             Some(db),
             WorkspaceClaim { workspace: w_id.to_string() },
             windmill_ai::ai_bedrock::AWS_OIDC_AUDIENCE,
@@ -1170,15 +1189,11 @@ async fn global_proxy(
         }
     };
 
-    let response = request.send().await.map_err(to_anyhow)?;
+    let response = send_with_retries(request).await;
 
     audit_global_ai_request(&db, &authed).await?;
 
-    if response.error_for_status_ref().is_err() {
-        let err_msg = response.text().await.unwrap_or("".to_string());
-        return Err(Error::AIError(err_msg));
-    }
-
+    let response = response?;
     let status_code = response.status();
     let headers = response.headers().clone();
     let stream = response.bytes_stream();
@@ -1238,8 +1253,8 @@ async fn proxy(
         .get("X-Resource-Value")
         .map(|v| {
             let invalid = |e: String| Error::BadRequest(format!("Invalid X-Resource-Value: {e}"));
-            let decoded =
-                urlencoding::decode(v.to_str().unwrap_or("")).map_err(|e| invalid(e.to_string()))?;
+            let decoded = urlencoding::decode(v.to_str().unwrap_or(""))
+                .map_err(|e| invalid(e.to_string()))?;
             let value = serde_json::from_str::<serde_json::Value>(&decoded)
                 .map_err(|e| invalid(e.to_string()))?;
             check_scopes(&authed, || "resources:write".to_string())?;
@@ -1558,7 +1573,7 @@ async fn proxy(
         }
     };
 
-    let response = request.send().await.map_err(to_anyhow)?;
+    let response = send_with_retries(request).await;
 
     let mut tx = db.begin().await?;
 
@@ -1574,11 +1589,7 @@ async fn proxy(
     .await?;
     tx.commit().await?;
 
-    if response.error_for_status_ref().is_err() {
-        let err_msg = response.text().await.unwrap_or("".to_string());
-        return Err(Error::AIError(err_msg));
-    }
-
+    let response = response?;
     let status_code = response.status();
     let headers = response.headers().clone();
     let is_sse = is_sse_response(&headers);
diff --git a/backend/windmill-api/src/ai_evals/run.rs b/backend/windmill-api/src/ai_evals/run.rs
index 42c2fcb2f2..57e75b3f9f 100644
--- a/backend/windmill-api/src/ai_evals/run.rs
+++ b/backend/windmill-api/src/ai_evals/run.rs
@@ -760,6 +760,7 @@ async fn push_run_flow(
 
     let path = subject.path.clone();
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(db, authed).await?;
     let (uuid, tx) = push(
         db,
         tx,
@@ -790,6 +791,7 @@ async fn push_run_flow(
         None,
         authed.trigger_or_fallback(None),
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
diff --git a/backend/windmill-api/src/ai_sessions.rs b/backend/windmill-api/src/ai_sessions.rs
index 65a8137c4e..9e980a54f4 100644
--- a/backend/windmill-api/src/ai_sessions.rs
+++ b/backend/windmill-api/src/ai_sessions.rs
@@ -24,7 +24,7 @@ use axum::{
     Extension, Json, Router,
 };
 use futures::{StreamExt, TryStreamExt};
-use magic_crypt::{MagicCrypt256, MagicCryptTrait};
+use magic_crypt::MagicCryptTrait;
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
 use std::sync::Arc;
@@ -35,7 +35,7 @@ use windmill_api_workspaces::ai_session_backups::{
 use windmill_api_workspaces::workspaces::sessions_retention_days;
 use windmill_common::error::{Error, JsonResult, Result};
 use windmill_common::utils::calculate_hash;
-use windmill_common::variables::{crypt_from_key_with_suffix, get_workspace_key};
+use windmill_common::variables::{crypt_from_key_with_suffix, get_workspace_key, WorkspaceCrypt};
 use windmill_object_store::object_store_reexports::{
     ObjectStore, ObjectStoreError, Path as ObjectPath, PutPayload,
 };
@@ -135,7 +135,7 @@ enum Read {
 /// The user's prefix in the workspace storage, plus what reads and writes it.
 struct Backend {
     store: Arc<dyn ObjectStore>,
-    mc: MagicCrypt256,
+    mc: WorkspaceCrypt,
     prefix: String,
     /// Name the storage and the generation the objects are under, for the browser's sync
     /// state: a row recorded against another storage or generation is stale, a removal is
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index f01275c953..2c2179d830 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -56,7 +56,10 @@ use std::str;
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::{
-    apps::{AppScriptId, ListAppQuery, APP_WORKSPACED_ROUTE},
+    apps::{
+        app_value_has_inline_script, app_value_runnable_paths, AppScriptId, ListAppQuery,
+        APP_WORKSPACED_ROUTE,
+    },
     auth::{APP_EMBED_TOKEN_LABEL_PREFIX, RAW_APP_SDK_TOKEN_LABEL_PREFIX, TOKEN_PREFIX_LEN},
     cache::{self, future::FutureCachedExt},
     db::{DbWithOptAuthed, UserDB},
@@ -75,7 +78,8 @@ use windmill_common::{
     variables::{build_crypt, build_crypt_with_key_suffix, encrypt},
     worker::{to_raw_value, CLOUD_HOSTED},
     workspaces::{
-        check_deploy_rules, check_user_against_rule, ProtectionRuleKind, RuleCheckResult,
+        check_deploy_rules, check_operator_can_build, check_user_against_rule,
+        operator_builder_rights, BuilderKind, ProtectionRuleKind, RuleCheckResult,
     },
     HUB_BASE_URL,
 };
@@ -749,7 +753,7 @@ async fn list_apps(
     // Append the authed user's `app`/`raw_app` drafts at paths with no deployed app;
     // see scripts.rs.
     if lq.include_draft_only.unwrap_or(false)
-        && !authed.is_operator
+        && (!authed.is_operator || operator_builder_rights(&db, &w_id).await?.apps)
         && offset == 0
         && lq.path_start.is_none()
         && lq.path_exact.is_none()
@@ -764,6 +768,7 @@ async fn list_apps(
                       path,
                       value as "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
                       created_at,
+                      email IS NULL as "legacy!",
                       typ::text as "typ!"
                FROM draft
                WHERE workspace_id = $1
@@ -813,9 +818,9 @@ async fn list_apps(
                 inherited_labels: None,
                 is_draft: true,
                 draft_path,
-                // Synthesized rows are the authed user's own draft.
+                // Owned by nobody when legacy; see scripts.rs.
                 draft_users: Some(sqlx::types::Json(vec![DraftUserRef {
-                    username: Some(authed.username.clone()),
+                    username: (!row.legacy).then(|| authed.username.clone()),
                 }])),
             });
         }
@@ -978,7 +983,14 @@ async fn get_raw_app_data(
             // the opaque, sandboxed wrapper (incl. under a cross-origin-isolated
             // / COEP `require-corp` embedder).
             .header("X-Content-Type-Options", "nosniff")
-            .header("Cross-Origin-Resource-Policy", "cross-origin");
+            .header("Cross-Origin-Resource-Policy", "cross-origin")
+            // The secret names one app version, whose bundle is written once at deploy,
+            // so the URL's content never changes. `private`: the URL is a capability, so
+            // shared caches must not keep serving it after the app is deleted.
+            .header(
+                http::header::CACHE_CONTROL,
+                "private, max-age=31536000, immutable",
+            );
         Ok(res.body(body).unwrap())
     } else {
         return Err(Error::NotFound("File not found".to_string()));
@@ -1732,11 +1744,14 @@ async fn mint_preview_sdk_token(
     Path(w_id): Path<String>,
     Json(req): Json<PreviewSdkTokenRequest>,
 ) -> Result<String> {
-    if authed.is_operator {
-        return Err(Error::NotAuthorized(
-            "Operators cannot preview raw apps".to_string(),
-        ));
-    }
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Apps,
+        "preview raw apps",
+    )
+    .await?;
     check_scopes(&authed, || format!("apps:write:{}", req.path))?;
     let (token, _expiration) =
         mint_raw_app_sdk_token(&db, &w_id, &req.path, &authed, &req.scopes, job_id).await?;
@@ -2094,18 +2109,23 @@ async fn get_id_from_secret(
     prefix: Option<&str>,
 ) -> Result<i64> {
     let mc = build_crypt(db, w_id).await?;
-    let decrypted = mc
-        .decrypt_bytes_to_bytes(&(hex::decode(secret)?))
-        .map_err(|e| Error::internal_err(e.to_string()))?;
-    let mut bytes = str::from_utf8(&decrypted).map_err(to_anyhow)?;
-    if let Some(prefix) = prefix {
-        if !bytes.starts_with(prefix) {
-            return Err(Error::BadRequest("Invalid secret".to_string()));
-        }
-        bytes = bytes.strip_prefix(prefix).unwrap_or("");
+    id_from_secret(&mc, &secret, prefix)
+        .ok_or_else(|| Error::BadRequest("Invalid secret".to_string()))
+}
+
+/// The secret comes from the URL of unauthenticated routes, so every way it can be invalid
+/// must produce the same response: a caller must never learn why a secret was rejected.
+fn id_from_secret(
+    mc: &magic_crypt::MagicCrypt256,
+    secret: &str,
+    prefix: Option<&str>,
+) -> Option<i64> {
+    let decrypted = mc.decrypt_bytes_to_bytes(&hex::decode(secret).ok()?).ok()?;
+    let plaintext = String::from_utf8(decrypted).ok()?;
+    match prefix {
+        Some(prefix) => plaintext.strip_prefix(prefix)?.parse().ok(),
+        None => plaintext.parse().ok(),
     }
-    let id: i64 = bytes.parse().map_err(to_anyhow)?;
-    Ok(id)
 }
 
 async fn get_public_resource(
@@ -2254,6 +2274,260 @@ async fn store_raw_app_file<'a>(
 
     Ok(())
 }
+/// A builder app write is held to one set of rules whether it deploys or saves a draft: the
+/// editor previews a draft as whoever opens it, and an admin may deploy it as it stands. A deploy
+/// fills in what a draft must state, since it stores the policy it checked.
+#[derive(Clone, Copy, PartialEq)]
+pub(crate) enum BuilderAppWrite {
+    Deploy,
+    Draft,
+}
+
+/// The half of the builder-app check that needs no DB (see `docs/operator-builder-rights.md`).
+/// Returns every runnable the app can invoke, as `(is_flow, path)`, from both the policy's
+/// triggerables and the value's path runnables: they are not the same list.
+fn check_operator_composed_app(
+    write: BuilderAppWrite,
+    raw_app: bool,
+    value: Option<&RawValue>,
+    policy: Option<&mut Policy>,
+) -> Result<Vec<(bool, String)>> {
+    let verb = if write == BuilderAppWrite::Deploy {
+        "deploy"
+    } else {
+        "save"
+    };
+    if !raw_app {
+        return Err(Error::PermissionDenied(
+            "Operators with builder rights can only author full-code apps".to_string(),
+        ));
+    }
+    let mut referenced: Vec<(bool, String)> = Vec::new();
+    if let Some(value) = value {
+        // The text stored, NULs stripped: a stripped NUL can rename a key into one this reads.
+        let value: serde_json::Value =
+            serde_json::from_str(&strip_json_nul(value.get())).map_err(to_anyhow)?;
+        if app_value_has_inline_script(&value) {
+            return Err(Error::PermissionDenied(format!(
+                "Operators with builder rights cannot {verb} an app carrying inline scripts"
+            )));
+        }
+        referenced.extend(app_value_runnable_paths(&value)?);
+    }
+    let Some(policy) = policy else {
+        return Err(match write {
+            BuilderAppWrite::Deploy => Error::BadRequest(
+                "Operators with builder rights must deploy an app with its policy".to_string(),
+            ),
+            BuilderAppWrite::Draft => Error::PermissionDenied(
+                "Operators with builder rights can only save sandboxed apps".to_string(),
+            ),
+        });
+    };
+    // Every deploy of a draft rebuilds `triggerables_v2` from the runnables, so a draft's copy,
+    // stale since the last deploy, must not block autosave. A deploy path that skips the rebuild
+    // must stop exempting it here.
+    if write == BuilderAppWrite::Draft {
+        policy.triggerables_v2 = None;
+    }
+    referenced.extend(checked_policy_runnable_paths(policy)?);
+    match (policy.sandbox, write) {
+        (Some(true), _) => {}
+        (None, BuilderAppWrite::Deploy) => policy.sandbox = Some(true),
+        _ => {
+            return Err(Error::PermissionDenied(format!(
+                "Operators with builder rights can only {verb} sandboxed apps"
+            )))
+        }
+    }
+
+    // Viewer mode would make the triggerables collected above non-exhaustive (see the docs), and
+    // the deploy panel shows it as members-only, so an admin deploying a draft would not see it.
+    // Pin an omitted mode on deploy: `update_app_internal` resolves it to the deployed app's, so a
+    // redeploy over an admin's viewer-mode app would otherwise inherit `Viewer`.
+    match policy.stated_execution_mode() {
+        Some(ExecutionMode::Viewer) => {
+            return Err(Error::PermissionDenied(format!(
+                "Operators with builder rights cannot {verb} an app that runs as its viewer"
+            )))
+        }
+        None if write == BuilderAppWrite::Deploy => {
+            policy.set_execution_mode(ExecutionMode::Publisher)
+        }
+        _ => {}
+    }
+
+    referenced.sort();
+    referenced.dedup();
+    refuse_hub_runnables(&referenced)?;
+    Ok(referenced)
+}
+
+/// The runnables a builder app's policy authorizes, as `(is_flow, path)`; refuses a policy that
+/// pins inline code.
+fn checked_policy_runnable_paths(policy: &Policy) -> Result<Vec<(bool, String)>> {
+    // A `rawscript/<sha>` triggerable is the deployed app's authorization to run caller-supplied
+    // `raw_code` hashing to it: pinning one hands a builder arbitrary code execution through an
+    // app whose value passed the inline-script check. A composition-only app has none.
+    fn pins_raw_script<T>(map: &Option<HashMap<String, T>>) -> bool {
+        map.iter()
+            .flat_map(|m| m.keys())
+            .any(|k| k.starts_with("rawscript/") || k.contains(":rawscript/"))
+    }
+    if pins_raw_script(&policy.triggerables) || pins_raw_script(&policy.triggerables_v2) {
+        return Err(Error::PermissionDenied(
+            "Operators with builder rights cannot save or deploy an app whose policy pins inline code"
+                .to_string(),
+        ));
+    }
+    // `execute_component` looks up `{component}:{path}` with an unrestricted component, so every
+    // colon is a possible split (`a:b:script/x` resolves for `component = "a:b"`): check every
+    // suffix that parses as a runnable. That copies a key once per colon, so bound the key first:
+    // a 255-char path plus a component name is far below the cap.
+    const MAX_KEY_LEN: usize = 512;
+    let keys = || {
+        policy
+            .triggerables
+            .iter()
+            .flat_map(|t| t.keys())
+            .chain(policy.triggerables_v2.iter().flat_map(|t| t.keys()))
+    };
+    if keys().any(|k| k.len() > MAX_KEY_LEN) {
+        return Err(Error::BadRequest(format!(
+            "App policy triggerable keys must be at most {MAX_KEY_LEN} bytes"
+        )));
+    }
+    Ok(keys()
+        .flat_map(|key| {
+            std::iter::once(key.as_str())
+                .chain(key.match_indices(':').map(|(i, _)| &key[i + 1..]))
+                .filter_map(|candidate| {
+                    candidate
+                        .strip_prefix("script/")
+                        .map(|p| (false, p.to_string()))
+                        .or_else(|| {
+                            candidate
+                                .strip_prefix("flow/")
+                                .map(|p| (true, p.to_string()))
+                        })
+                })
+                .collect::<Vec<_>>()
+        })
+        .collect())
+}
+
+fn refuse_hub_runnables(referenced: &[(bool, String)]) -> Result<()> {
+    for (_, path) in referenced {
+        if path.starts_with("hub/") {
+            return Err(Error::PermissionDenied(format!(
+                "Operators with builder rights cannot reference the hub runnable {path}. Deploy it to the workspace first."
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Runs on every app write by an operator with builder rights, from inside the create/update
+/// internals so both raw-app endpoints are covered by one check.
+///
+/// `execute_component` resolves the runnable it picks with the root DB handle, so a path the
+/// builder cannot read would still run, and in a `Viewer` app it would run as whoever opened it.
+/// RLS on this transaction is the check; refusing `Viewer` above is what makes it exhaustive.
+pub(crate) async fn validate_operator_composed_app(
+    authed: &ApiAuthed,
+    db: &DB,
+    user_db: &UserDB,
+    w_id: &str,
+    write: BuilderAppWrite,
+    raw_app: bool,
+    value: Option<&RawValue>,
+    policy: Option<&mut Policy>,
+) -> Result<()> {
+    // A deploy resets the run identity to its builder (unless they are in `wm_deployers`, see
+    // docs/operator-builder-rights.md); a draft keeps whatever it names, which an admin's
+    // one-click draft deploy preserves without showing it.
+    if let (BuilderAppWrite::Draft, Some(policy)) = (write, policy.as_deref()) {
+        let names_another = policy
+            .on_behalf_of
+            .as_deref()
+            .is_some_and(|p| p != username_to_permissioned_as(&authed.username))
+            || policy
+                .on_behalf_of_email
+                .as_deref()
+                .is_some_and(|e| e != authed.email);
+        if names_another {
+            return Err(Error::PermissionDenied(
+                "Operators with builder rights cannot save an app that runs as someone else"
+                    .to_string(),
+            ));
+        }
+    }
+    let referenced = check_operator_composed_app(write, raw_app, value, policy)?;
+    require_runnables_readable(authed, db, user_db, w_id, referenced).await
+}
+
+async fn require_runnables_readable(
+    authed: &ApiAuthed,
+    db: &DB,
+    user_db: &UserDB,
+    w_id: &str,
+    referenced: Vec<(bool, String)>,
+) -> Result<()> {
+    if referenced.is_empty() {
+        return Ok(());
+    }
+    // Each script version carries its own grants, and a path reused after its versions were
+    // archived starts with none. Check the version a run would pick, found without RLS, not
+    // whichever version the caller happens to see. Resolved before the transaction opens so no
+    // request holds two pool connections at once.
+    let mut hashes = Vec::with_capacity(referenced.len());
+    for (is_flow, path) in &referenced {
+        hashes.push(if *is_flow {
+            None
+        } else {
+            windmill_common::get_latest_script_hash(db, path, w_id).await?
+        });
+    }
+    let mut tx = user_db.clone().begin(authed).await?;
+    for ((is_flow, path), hash) in referenced.into_iter().zip(hashes) {
+        let readable = if is_flow {
+            sqlx::query_scalar!(
+                "SELECT EXISTS(SELECT 1 FROM flow WHERE workspace_id = $1 AND path = $2)",
+                w_id,
+                path,
+            )
+            .fetch_one(&mut *tx)
+            .await?
+            .unwrap_or(false)
+        } else {
+            match hash {
+                Some(hash) => sqlx::query_scalar!(
+                    "SELECT EXISTS(SELECT 1 FROM script WHERE workspace_id = $1 AND hash = $2)",
+                    w_id,
+                    hash,
+                )
+                .fetch_one(&mut *tx)
+                .await?
+                .unwrap_or(false),
+                None => false,
+            }
+        };
+        // One message for every cause: telling "no runnable version" apart from "not readable"
+        // would reveal that a path the caller cannot read exists.
+        if !readable {
+            return Err(Error::PermissionDenied(if is_flow {
+                format!("Flow {path} does not exist or is not readable by you")
+            } else {
+                format!(
+                    "Script {path} does not exist, is not readable by you, or has not finished deploying"
+                )
+            }));
+        }
+    }
+    tx.commit().await?;
+    Ok(())
+}
+
 macro_rules! process_app_multipart {
     ($authed:expr, $user_db:expr, $db:expr, $w_id:expr, $path:expr, $multipart:expr, $internal_fn:expr) => {
         async {
@@ -2330,11 +2604,14 @@ async fn create_app_raw<'a>(
     Path(w_id): Path<String>,
     multipart: Multipart,
 ) -> Result<(StatusCode, String)> {
-    if authed.is_operator {
-        return Err(Error::NotAuthorized(
-            "Operators cannot create apps for security reasons".to_string(),
-        ));
-    }
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Apps,
+        "create apps",
+    )
+    .await?;
 
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
@@ -2511,6 +2788,19 @@ async fn create_app_internal<'a>(
     if raw_app {
         validate_raw_app_path_keys(&app.value.0)?;
     }
+    if authed.is_operator {
+        validate_operator_composed_app(
+            &authed,
+            &db,
+            &user_db,
+            w_id,
+            BuilderAppWrite::Deploy,
+            raw_app,
+            Some(&app.value.0),
+            Some(&mut app.policy),
+        )
+        .await?;
+    }
     if *CLOUD_HOSTED {
         let nb_apps =
             sqlx::query_scalar!("SELECT COUNT(*) FROM app WHERE workspace_id = $1", &w_id)
@@ -2755,6 +3045,7 @@ async fn create_app_internal<'a>(
         None,
         None,
         None,
+        None,
     )
     .await?;
     tracing::info!("Pushed app dependency job {}", dependency_job_uuid);
@@ -2816,13 +3107,23 @@ async fn delete_app(
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, path)): Path<(String, StripPath)>,
 ) -> Result<String> {
-    if authed.is_operator {
-        return Err(Error::NotAuthorized(
-            "Operators cannot delete apps for security reasons".to_string(),
-        ));
-    }
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Apps,
+        "delete apps",
+    )
+    .await?;
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:write:{}", path))?;
+    // One endpoint deletes both kinds, and builder rights only cover full-code apps.
+    if authed.is_operator && deployed_app_kind(&user_db, &authed, &w_id, path).await? != Some(true)
+    {
+        return Err(Error::PermissionDenied(
+            "Operators with builder rights can only delete full-code apps".to_string(),
+        ));
+    }
 
     if path == "g/all/setup_app" && w_id == "admins" {
         return Err(Error::BadRequest(
@@ -3010,13 +3311,20 @@ async fn update_app(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ns): Json<EditApp>,
 ) -> JsonResult<AppDeployed> {
-    if authed.is_operator {
-        return Err(Error::NotAuthorized(
-            "Operators cannot update apps for security reasons".to_string(),
-        ));
-    }
-    // create_app_internal(authed, user_db, db, &w_id, &mut app).await?;
     let path = path.to_path();
+    // The deploy panel saves a deployed full-code app's access and frontend scopes here. A
+    // builder may change those settings; the app itself only through `update_app_raw`.
+    if authed.is_operator {
+        check_operator_can_build(&db, &w_id, true, BuilderKind::Apps, "update apps").await?;
+        if ns.value.is_some()
+            || deployed_app_kind(&user_db, &authed, &w_id, path).await? != Some(true)
+        {
+            return Err(Error::PermissionDenied(
+                "Operators with builder rights can only change the settings of full-code apps"
+                    .to_string(),
+            ));
+        }
+    }
     check_scopes(&authed, || format!("apps:write:{}", path))?;
 
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
@@ -3033,8 +3341,10 @@ async fn update_app(
 
     let opath = path.to_string();
     let db2 = db.clone();
+    // Settings-only for an operator, of an app checked above to be full-code.
+    let raw_app = authed.is_operator;
     let (new_tx, npath, v_id) =
-        update_app_internal(authed, db, user_db, &w_id, path, false, ns, None).await?;
+        update_app_internal(authed, db, user_db, &w_id, path, raw_app, ns, None).await?;
     new_tx.commit().await?;
 
     tally_app_rename(&db2, &w_id, &opath, &npath, v_id).await;
@@ -3063,6 +3373,10 @@ async fn update_app_raw_source(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ns): Json<EditApp>,
 ) -> JsonResult<AppDeployed> {
+    // Stays closed to operators even with builder rights, unlike `create_app_raw`/`update_app_raw`
+    // next to it: this path compiles caller-supplied sources with a bundler job on a worker, which
+    // is arbitrary code execution. Builders lose nothing: the browser and the CLI both bundle
+    // locally and deploy through the multipart endpoints.
     if authed.is_operator {
         return Err(Error::NotAuthorized(
             "Operators cannot update apps for security reasons".to_string(),
@@ -3223,6 +3537,7 @@ async fn create_app_raw_source(
     Path(w_id): Path<String>,
     Json(mut app): Json<CreateApp>,
 ) -> Result<(StatusCode, String)> {
+    // Closed to builders too, for the reason on `update_app_raw_source`.
     if authed.is_operator {
         return Err(Error::NotAuthorized(
             "Operators cannot create apps for security reasons".to_string(),
@@ -3388,11 +3703,14 @@ async fn update_app_raw<'a>(
     Path((w_id, path)): Path<(String, StripPath)>,
     multipart: Multipart,
 ) -> JsonResult<AppDeployed> {
-    if authed.is_operator {
-        return Err(Error::NotAuthorized(
-            "Operators cannot update apps for security reasons".to_string(),
-        ));
-    }
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Apps,
+        "update apps",
+    )
+    .await?;
 
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
@@ -3408,6 +3726,14 @@ async fn update_app_raw<'a>(
 
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:write:{}", path))?;
+    // `update_app_internal` only compares kinds when a new value is deployed, so a
+    // policy-only update would otherwise let a builder rewrite a low-code app's policy.
+    if authed.is_operator && deployed_app_kind(&user_db, &authed, &w_id, path).await? != Some(true)
+    {
+        return Err(Error::PermissionDenied(
+            "Operators with builder rights can only update full-code apps".to_string(),
+        ));
+    }
     let opath = path.to_string();
     let db2 = db.clone();
     let (npath, v_id) = process_app_multipart!(
@@ -3475,6 +3801,23 @@ async fn update_app_internal<'a>(
         }
     }
 
+    if authed.is_operator {
+        // Restoring a full-code version always sends allow_kind_change. A builder converts
+        // nothing, so drop it and let the locked kind check below refuse an actual conversion.
+        ns.allow_kind_change = None;
+        validate_operator_composed_app(
+            &authed,
+            &db,
+            &user_db,
+            w_id,
+            BuilderAppWrite::Deploy,
+            raw_app,
+            ns.value.as_ref().map(|v| v.0.as_ref()),
+            ns.policy.as_mut(),
+        )
+        .await?;
+    }
+
     // Resolved on the (non-RLS) pool before the RLS transaction opens, for the reason
     // `create_app` states, with the same known, accepted rename race (see
     // `resolve_on_behalf_of`). Submitting a policy is how a deployer claims the app's execution
@@ -3896,6 +4239,7 @@ async fn update_app_internal<'a>(
         None,
         None,
         None,
+        None,
     )
     .await?;
     tracing::info!("Pushed app dependency job {}", dependency_job_uuid);
@@ -4049,10 +4393,55 @@ lazy_static! {
     ///   change or deletion, which don't bump the version — see
     ///   `invalidate_app_policy_cache` and `process_notify_event`);
     /// - the entry is within its TTL (backstop for a missed event or a restart).
-    static ref APP_POLICY_CACHE: cache::Cache<(String, String), (Option<i64>, Arc<Policy>, std::time::Instant)> =
+    static ref APP_POLICY_CACHE: cache::Cache<(String, String), (Option<i64>, Arc<DeployedPolicy>, std::time::Instant)> =
         cache::Cache::new(1000);
 }
 
+/// What `execute_component` runs a deployed app against.
+struct DeployedPolicy {
+    policy: Policy,
+    /// Runnable id -> argument -> context property (`username`, `email`, `groups`,
+    /// `workspace`, `author`), for every `ctx` field the app's runnables declare. Read
+    /// from the deployed app rather than taken from the request, which only says what
+    /// the browser chose to send: a runnable filters rows on these. A deploy that
+    /// changes them under an unchanged policy evicts nothing, so a caller still naming
+    /// the replaced version keeps the previous declarations until the entry's TTL.
+    ctx_inputs: HashMap<String, HashMap<String, String>>,
+}
+
+async fn deployed_ctx_inputs(
+    db: &DB,
+    w_id: &str,
+    path: &str,
+) -> Result<HashMap<String, HashMap<String, String>>> {
+    let runnables = sqlx::query_scalar::<_, Option<sqlx::types::Json<serde_json::Value>>>(
+        "SELECT app_version.value -> 'runnables' FROM app
+        JOIN app_version ON app_version.id = app.versions[array_upper(app.versions, 1)]
+        WHERE app.path = $1 AND app.workspace_id = $2",
+    )
+    .bind(path)
+    .bind(w_id)
+    .fetch_optional(db)
+    .await?
+    .flatten();
+    let Some(serde_json::Value::Object(runnables)) = runnables.map(|r| r.0) else {
+        return Ok(HashMap::new());
+    };
+    Ok(runnables
+        .into_iter()
+        .filter_map(|(id, runnable)| {
+            let ctx_inputs: HashMap<String, String> = runnable
+                .get("fields")?
+                .as_object()?
+                .iter()
+                .filter(|(_, f)| f.get("type").and_then(|t| t.as_str()) == Some("ctx"))
+                .filter_map(|(arg, f)| Some((arg.clone(), f.get("ctx")?.as_str()?.to_string())))
+                .collect();
+            (!ctx_inputs.is_empty()).then_some((id, ctx_inputs))
+        })
+        .collect())
+}
+
 /// Backstop time-to-live for an [`APP_POLICY_CACHE`] entry — the maximum a policy
 /// change can go unreflected if its invalidation event is never consumed.
 const APP_POLICY_CACHE_TTL: std::time::Duration = std::time::Duration::from_secs(300);
@@ -4105,7 +4494,7 @@ async fn execute_component(
         _ => {}
     };
 
-    let arc_policy: Arc<Policy>;
+    let arc_policy: Arc<DeployedPolicy>;
     let policy_triggerables_default = Default::default();
     // Preview mode means the request was issued from the editor; the editing
     // user is already trusted by the policy check, so client-supplied `tag`
@@ -4130,10 +4519,26 @@ async fn execute_component(
         let authed = opt_authed.as_ref().ok_or_else(|| {
             Error::NotAuthorized("App component preview requires authentication".to_string())
         })?;
+        // A builder testing the app it is composing only ever previews a deployed runnable
+        // (`path`), confined below to what it may read. Inline `raw_code`, which an `id` also
+        // requires, is authoring code, so it stays closed to every operator. So is a hub
+        // path, which `require_path_read_access_for_preview` admits for everyone and
+        // `get_payload_tag_from_prefixed_path` then downloads and enqueues: it is exactly the
+        // unreviewed code the composition check refuses in a flow.
+        let previews_hub = payload.path.as_deref().is_some_and(|p| {
+            p.strip_prefix("script/")
+                .or_else(|| p.strip_prefix("flow/"))
+                .unwrap_or(p)
+                .starts_with("hub/")
+        });
         if authed.is_operator {
-            return Err(Error::NotAuthorized(
-                "Operators cannot run preview jobs for security reasons".to_string(),
-            ));
+            let msg = "Operators cannot run preview jobs for security reasons".to_string();
+            if !operator_builder_rights(&db, &w_id).await?.apps {
+                return Err(Error::NotAuthorized(msg));
+            }
+            if payload.raw_code.is_some() || previews_hub {
+                return Err(Error::PermissionDenied(msg));
+            }
         }
         check_scopes(authed, || format!("jobs:run"))?;
         if let Some(p) = payload.path.as_deref() {
@@ -4172,7 +4577,7 @@ async fn execute_component(
     //    - The policy and triggerables are fetched from the database.
     //    - In case of inline script, if an entry exists in the `app_script` table, push
     //      an `AppScript` job payload, as in (.1) otherwise.
-    let (policy, policy_triggerables) = match payload {
+    let (policy, policy_triggerables, ctx_inputs) = match payload {
         // 1. "preview" mode.
         ExecuteApp {
             force_viewer_static_fields: Some(static_inputs),
@@ -4191,6 +4596,7 @@ async fn execute_component(
                 sensitive_inputs: force_viewer_sensitive_inputs.unwrap_or_default(),
                 tag: None,
             },
+            None,
         ),
         // 2. "run" mode.
         _ => {
@@ -4220,9 +4626,12 @@ async fn execute_component(
                 .map(|(_, p, _)| p);
             let policy = if let Some(p) = fresh {
                 arc_policy = p;
-                &*arc_policy
+                &arc_policy.policy
             } else {
-                arc_policy = Arc::new(policy_fut.await?);
+                arc_policy = Arc::new(DeployedPolicy {
+                    policy: policy_fut.await?,
+                    ctx_inputs: deployed_ctx_inputs(&db, &w_id, path).await?,
+                });
                 APP_POLICY_CACHE.insert(
                     cache_key,
                     (
@@ -4231,7 +4640,7 @@ async fn execute_component(
                         std::time::Instant::now(),
                     ),
                 );
-                &*arc_policy
+                &arc_policy.policy
             };
 
             // Caller-supplied inline code (`raw_code`), with or without an
@@ -4293,7 +4702,11 @@ async fn execute_component(
                 })
                 .ok_or_else(|| Error::BadRequest(format!("Path {path} forbidden by policy")))?;
 
-            (policy, policy_triggerables)
+            (
+                policy,
+                policy_triggerables,
+                arc_policy.ctx_inputs.get(&payload.component),
+            )
         }
     };
 
@@ -4371,6 +4784,7 @@ async fn execute_component(
     let (mut args, job_id) = build_args(
         policy,
         policy_triggerables,
+        ctx_inputs,
         payload.args,
         opt_authed.as_ref(),
         &user_db,
@@ -4490,6 +4904,10 @@ async fn execute_component(
     let app_trigger =
         (!is_preview).then(|| TriggerMetadata::new(Some(path.to_string()), JobTriggerKind::App));
 
+    let scope_ceiling = match opt_authed.as_ref() {
+        Some(authed) => windmill_api_auth::caller_scope_ceiling(&db, authed).await?,
+        None => None,
+    };
     let (uuid, mut tx) = push(
         &db,
         tx,
@@ -4525,6 +4943,7 @@ async fn execute_component(
         end_user_email,
         app_trigger,
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
@@ -5483,6 +5902,10 @@ impl AppLoadCountQuery {
                 search_col: self.search_col,
                 search_term: self.search_term,
                 storage: self.storage,
+                s3_resource_path: None,
+                csv_separator: None,
+                csv_has_header: None,
+                filters: None,
             },
         )
     }
@@ -5516,6 +5939,9 @@ impl AppLoadPreviewQuery {
                 search_term: self.search_term,
                 storage: self.storage,
                 csv_separator: self.csv_separator,
+                s3_resource_path: None,
+                csv_has_header: None,
+                filters: None,
             },
         )
     }
@@ -5603,7 +6029,9 @@ async fn app_load_table_count(
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp =
-        crate::job_helpers_oss::load_table_count_internal(job_authed, &db, &w_id, file_key, inner)
+        crate::job_helpers_oss::load_table_count_internal(
+            job_authed, &db, None, &w_id, file_key, inner,
+        )
             .await?;
     Ok(Json(resp).into_response())
 }
@@ -5622,7 +6050,7 @@ async fn app_load_parquet_preview(
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp = crate::job_helpers_oss::load_preview_internal(
-        job_authed, &db, &w_id, file_key, inner, true,
+        job_authed, &db, None, &w_id, file_key, inner, true,
     )
     .await?;
     Ok(Json(resp).into_response())
@@ -5642,7 +6070,7 @@ async fn app_load_csv_preview(
     let job_authed =
         app_s3_on_behalf_and_provenance(&db, &path, &w_id, &opt_authed, &file_query).await?;
     let resp = crate::job_helpers_oss::load_preview_internal(
-        job_authed, &db, &w_id, file_key, inner, false,
+        job_authed, &db, None, &w_id, file_key, inner, false,
     )
     .await?;
     Ok(Json(resp).into_response())
@@ -5787,6 +6215,54 @@ fn policy_granted_viewer(authed: &ApiAuthed) -> ApiAuthed {
     ApiAuthed { scopes: None, ..authed.clone() }
 }
 
+/// The value of an app context property for this run. Everything about the viewer comes
+/// from `authed`, the session the request authenticated with; an anonymous run has none
+/// and gets `null`.
+async fn ctx_value(
+    prop: &str,
+    policy: &Policy,
+    authed: Option<&ApiAuthed>,
+    w_id: &str,
+    db: &DB,
+) -> Result<Box<RawValue>> {
+    let value = match prop {
+        "username" => authed.map(|a| serde_json::to_value(a.display_username())),
+        "email" => authed.map(|a| serde_json::to_value(&a.email)),
+        "workspace" => Some(serde_json::to_value(w_id)),
+        "groups" => authed.map(|a| serde_json::to_value(&a.groups)),
+        // Same rule as `get_on_behalf_of`: the stored address, derived only when absent.
+        "author" => {
+            let author = match (
+                policy.on_behalf_of_email.as_deref(),
+                policy.on_behalf_of.as_deref(),
+            ) {
+                (Some(email), _) => Some(email.to_string()),
+                (None, Some(permissioned_as)) => Some(
+                    windmill_common::users::get_email_from_permissioned_as(
+                        permissioned_as,
+                        w_id,
+                        db,
+                    )
+                    .await?,
+                ),
+                (None, None) => None,
+            };
+            Some(serde_json::to_value(&author))
+        }
+        _ => {
+            return Err(Error::BadRequest(format!(
+                "context variable {} not allowed",
+                prop
+            )))
+        }
+    };
+    Ok(to_raw_value(
+        &value.unwrap_or(Ok(serde_json::Value::Null)).map_err(|e| {
+            Error::internal_err(format!("failed to serialize ctx variable {}: {}", prop, e))
+        })?,
+    ))
+}
+
 async fn build_args(
     policy: &Policy,
     PolicyTriggerableInputs {
@@ -5796,6 +6272,7 @@ async fn build_args(
         sensitive_inputs,
         ..
     }: &PolicyTriggerableInputs,
+    ctx_inputs: Option<&HashMap<String, String>>,
     mut args: HashMap<String, Box<RawValue>>,
     authed: Option<&ApiAuthed>,
     user_db: &UserDB,
@@ -5805,6 +6282,16 @@ async fn build_args(
     let mut job_id: Option<Uuid> = None;
     let mut safe_args = HashMap::<String, Box<RawValue>>::new();
 
+    // Before anything reads `args`: a context input the runnable declares is never taken
+    // from the request, or a viewer could name someone else as themselves.
+    for (k, prop) in ctx_inputs.into_iter().flatten() {
+        args.remove(k);
+        safe_args.insert(
+            k.to_string(),
+            ctx_value(prop, policy, authed, w_id, db).await?,
+        );
+    }
+
     // tracing::error!("{:?}", allow_user_resources);
     for k in allow_user_resources.iter() {
         if let Some(arg_val) = args.get(k) {
@@ -5896,47 +6383,9 @@ async fn build_args(
 
         if arg_str.starts_with("\"$ctx:") {
             let prop = arg_str.trim_start_matches("\"$ctx:").trim_end_matches("\"");
-            let value = match prop {
-                "username" => authed
-                    .as_ref()
-                    .map(|a| serde_json::to_value(a.display_username())),
-                "email" => authed.as_ref().map(|a| serde_json::to_value(&a.email)),
-                "workspace" => Some(serde_json::to_value(&w_id)),
-                "groups" => authed.as_ref().map(|a| serde_json::to_value(&a.groups)),
-                // Same rule as `get_on_behalf_of`: the stored address, derived only when absent.
-                "author" => {
-                    let author = match (
-                        policy.on_behalf_of_email.as_deref(),
-                        policy.on_behalf_of.as_deref(),
-                    ) {
-                        (Some(email), _) => Some(email.to_string()),
-                        (None, Some(permissioned_as)) => Some(
-                            windmill_common::users::get_email_from_permissioned_as(
-                                permissioned_as,
-                                w_id,
-                                db,
-                            )
-                            .await?,
-                        ),
-                        (None, None) => None,
-                    };
-                    Some(serde_json::to_value(&author))
-                }
-                _ => {
-                    return Err(Error::BadRequest(format!(
-                        "context variable {} not allowed",
-                        prop
-                    )))
-                }
-            };
             safe_args.insert(
                 k.to_string(),
-                to_raw_value(&value.unwrap_or(Ok(serde_json::Value::Null)).map_err(|e| {
-                    Error::internal_err(format!(
-                        "failed to serialize ctx variable for {}: {}",
-                        k, e
-                    ))
-                })?),
+                ctx_value(prop, policy, authed, w_id, db).await?,
             );
         } else if !arg_str.contains("\"$var:") && !arg_str.contains("\"$res:") {
             safe_args.insert(k.to_string(), v);
@@ -6331,6 +6780,127 @@ mod embed_token_tests {
     }
 }
 
+#[cfg(test)]
+mod operator_app_tests {
+    use super::{check_operator_composed_app, BuilderAppWrite, Policy};
+    use windmill_common::error::Result;
+    use windmill_common::worker::to_raw_value;
+
+    fn builder_policy(triggerables_v2: serde_json::Value) -> Policy {
+        serde_json::from_value(serde_json::json!({
+            "execution_mode": "publisher",
+            "triggerables_v2": triggerables_v2,
+        }))
+        .unwrap()
+    }
+
+    fn path_runnable(path: &str, run_type: &str) -> serde_json::Value {
+        serde_json::json!({"files": {}, "runnables": {
+            "a": {"name": "a", "type": "runnableByPath", "path": path, "runType": run_type}
+        }})
+    }
+
+    fn composed_app(value: serde_json::Value, policy: &mut Policy) -> Result<Vec<(bool, String)>> {
+        let value = to_raw_value(&value);
+        check_operator_composed_app(BuilderAppWrite::Deploy, true, Some(&value), Some(policy))
+    }
+
+    #[test]
+    fn operator_app_check_forces_the_sandbox_and_refuses_code() {
+        let clean = serde_json::json!({"files": {}, "runnables": {
+            "a": {"name": "a", "type": "runnableByPath", "path": "f/x/s", "runType": "script"}
+        }});
+
+        // A composition-only app goes through, sandboxed whether or not it asked to be.
+        let mut policy = builder_policy(
+            serde_json::json!({"a:script/f/x/s": {"static_inputs": {}, "one_of_inputs": {}}}),
+        );
+        let referenced = composed_app(clean.clone(), &mut policy).unwrap();
+        assert_eq!(policy.sandbox, Some(true));
+        // The runnables the policy authorizes are handed back for the caller to authorize.
+        assert_eq!(referenced, vec![(false, "f/x/s".to_string())]);
+
+        // A hub reference is unreviewed code, refused like it is in a flow.
+        let mut policy = builder_policy(
+            serde_json::json!({"a:script/hub/1/x": {"static_inputs": {}, "one_of_inputs": {}}}),
+        );
+        assert!(composed_app(clean.clone(), &mut policy).is_err());
+
+        let mut policy = builder_policy(serde_json::json!({}));
+        policy.sandbox = Some(false);
+        assert!(composed_app(clean.clone(), &mut policy).is_err());
+
+        // An inline script is refused even with no `language`, which the locking traversal skips.
+        let mut policy = builder_policy(serde_json::json!({}));
+        assert!(composed_app(
+            serde_json::json!({"runnables": {"a": {"inlineScript": {"content": "x"}}}}),
+            &mut policy
+        )
+        .is_err());
+
+        // A `rawscript/<sha>` triggerable is what authorizes caller-supplied `raw_code` on the
+        // deployed app, so pinning one would be arbitrary code execution behind a clean value.
+        for key in ["rawscript/abc", "a:rawscript/abc"] {
+            let mut policy = builder_policy(
+                serde_json::json!({ key: {"static_inputs": {}, "one_of_inputs": {}} }),
+            );
+            assert!(
+                composed_app(clean.clone(), &mut policy).is_err(),
+                "{key} must be refused"
+            );
+        }
+
+        // What the deployed bundle actually asks to run comes from the value's `runnableByPath`
+        // entries, which are a separate surface from the policy: both are reported.
+        let mut policy = builder_policy(serde_json::json!({}));
+        assert_eq!(
+            composed_app(path_runnable("f/x/s", "script"), &mut policy).unwrap(),
+            vec![(false, "f/x/s".to_string())]
+        );
+        let mut policy = builder_policy(serde_json::json!({}));
+        assert_eq!(
+            composed_app(path_runnable("f/x/f", "flow"), &mut policy).unwrap(),
+            vec![(true, "f/x/f".to_string())]
+        );
+        let mut policy = builder_policy(serde_json::json!({}));
+        assert!(composed_app(path_runnable("hub/1/x", "hubscript"), &mut policy).is_err());
+
+        // `execute_component` looks up `<component>:<path>` with an unrestricted component, so a
+        // second colon must not hide the path from validation: `x:y:script/hub/…` resolves at run
+        // time for `component = "x:y"`.
+        let mut policy = builder_policy(
+            serde_json::json!({"x:y:script/hub/123/foo": {"static_inputs": {}, "one_of_inputs": {}}}),
+        );
+        assert!(composed_app(clean.clone(), &mut policy).is_err());
+        let mut policy = builder_policy(
+            serde_json::json!({"x:y:script/f/x/s": {"static_inputs": {}, "one_of_inputs": {}}}),
+        );
+        assert_eq!(
+            composed_app(clean.clone(), &mut policy).unwrap(),
+            vec![(false, "f/x/s".to_string())]
+        );
+
+        // `Viewer` mode makes `execute_component` accept any script/flow path, triggerables or
+        // not, and run it as the viewer, so the checks above would stop binding.
+        let mut policy: Policy = serde_json::from_value(serde_json::json!({
+            "execution_mode": "viewer", "triggerables_v2": {}
+        }))
+        .unwrap();
+        assert!(composed_app(clean.clone(), &mut policy).is_err());
+
+        // Low-code apps stay closed.
+        let value = to_raw_value(&clean);
+        let mut policy = builder_policy(serde_json::json!({}));
+        assert!(check_operator_composed_app(
+            BuilderAppWrite::Deploy,
+            false,
+            Some(&value),
+            Some(&mut policy)
+        )
+        .is_err());
+    }
+}
+
 #[cfg(test)]
 mod policy_tests {
     /// `execution_mode` is optional in the OpenAPI schema the API clients and the
@@ -6353,6 +6923,39 @@ mod policy_tests {
     }
 }
 
+#[cfg(test)]
+mod app_secret_tests {
+    use super::{id_from_secret, BUNDLE_SECRET_PREFIX};
+    use magic_crypt::MagicCryptTrait;
+
+    #[test]
+    fn every_invalid_secret_is_rejected_alike() {
+        let mc = magic_crypt::new_magic_crypt!("workspace-key", 256);
+        let other = magic_crypt::new_magic_crypt!("another-key", 256);
+        let valid = hex::encode(mc.encrypt_str_to_bytes("42"));
+        assert_eq!(id_from_secret(&mc, &valid, None), Some(42));
+        let bundle = hex::encode(mc.encrypt_str_to_bytes(format!("{BUNDLE_SECRET_PREFIX}7")));
+        assert_eq!(
+            id_from_secret(&mc, &bundle, Some(BUNDLE_SECRET_PREFIX)),
+            Some(7)
+        );
+
+        let mut tampered = mc.encrypt_str_to_bytes("42");
+        *tampered.last_mut().unwrap() ^= 1;
+        for bad in [
+            "not hex".to_string(),
+            hex::encode(&tampered),
+            hex::encode(other.encrypt_str_to_bytes("42")),
+            hex::encode(mc.encrypt_bytes_to_bytes(&[0xff, 0xfe])),
+            hex::encode(mc.encrypt_str_to_bytes("not a number")),
+            valid.clone(),
+        ] {
+            let prefix = (bad == valid).then_some(BUNDLE_SECRET_PREFIX);
+            assert_eq!(id_from_secret(&mc, &bad, prefix), None, "{bad}");
+        }
+    }
+}
+
 #[cfg(test)]
 mod raw_app_file_key_tests {
     use super::validate_raw_app_path_keys;
diff --git a/backend/windmill-api/src/apps_raw_bundle.rs b/backend/windmill-api/src/apps_raw_bundle.rs
index f50f94f8eb..61dc4b861d 100644
--- a/backend/windmill-api/src/apps_raw_bundle.rs
+++ b/backend/windmill-api/src/apps_raw_bundle.rs
@@ -148,6 +148,7 @@ pub(crate) async fn bundle_raw_app_sources(
     args.insert("runnables".to_string(), runnables.to_owned());
 
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(db, authed).await?;
     let (uuid, tx) = push(
         db,
         tx,
@@ -191,6 +192,7 @@ pub(crate) async fn bundle_raw_app_sources(
         None,
         authed.trigger_or_fallback(None),
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
diff --git a/backend/windmill-api/src/apps_raw_bundler.ts b/backend/windmill-api/src/apps_raw_bundler.ts
index 6663a0f83e..965a9289b5 100644
--- a/backend/windmill-api/src/apps_raw_bundler.ts
+++ b/backend/windmill-api/src/apps_raw_bundler.ts
@@ -6,7 +6,7 @@
  * The build itself is `wmill app bundle`, the same one `wmill app push` runs, so
  * an app deployed through the API is compiled exactly as the CLI and the editor
  * compile it — entry point, virtual `wmill` module, `/ui/` shared-UI resolution
- * and the Svelte/Vue plugins included. Reimplementing any of that here would be
+ * and the Svelte plugin included. Reimplementing any of that here would be
  * a third bundler to keep in step with the other two.
  */
 declare const __wmillAppPolicy: {
diff --git a/backend/windmill-api/src/concurrency_groups.rs b/backend/windmill-api/src/concurrency_groups.rs
index c94608ac7e..aab73c81d9 100644
--- a/backend/windmill-api/src/concurrency_groups.rs
+++ b/backend/windmill-api/src/concurrency_groups.rs
@@ -56,6 +56,7 @@ async fn get_concurrency_key(
         .get_authed(Some(job.workspace_id.clone()), &token)
         .await
         .ok_or_else(not_found)?;
+    windmill_api_auth::check_job_token_scope(&authed_in_workspace, || "jobs:read".to_string())?;
 
     require_job_read_access(
         &db,
diff --git a/backend/windmill-api/src/drafts.rs b/backend/windmill-api/src/drafts.rs
index 7b2268e38f..e6b6db6919 100644
--- a/backend/windmill-api/src/drafts.rs
+++ b/backend/windmill-api/src/drafts.rs
@@ -15,15 +15,16 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 use windmill_api_flows::flows::validate_operator_flow;
+use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::{
     db::UserDB,
     error::{Error, Result},
     flows::FlowValue,
     user_drafts::{DraftUserRef, UserDraftItemKind, ENCRYPTED_DRAFT_PREFIX},
     users::resolve_username_to_email,
-    utils::{check_proper_path, strip_json_nul},
+    utils::{check_proper_path, require_admin, strip_json_nul},
     variables::{build_crypt, encrypt},
-    workspaces::operator_can_build_flows,
+    workspaces::{operator_builder_rights, BuilderKind},
 };
 
 pub fn workspaced_service() -> Router {
@@ -32,6 +33,10 @@ pub fn workspaced_service() -> Router {
         .route("/get/{kind}/{*path}", get(get_draft_for_user))
         .route("/get_own/{kind}/{*path}", get(get_own_draft))
         .route("/update/{kind}/{*path}", post(update_draft))
+        .route(
+            "/delete_for_user/{kind}/{*path}",
+            post(delete_draft_for_user),
+        )
         .route("/move/{kind}/{*path}", post(move_draft))
         .route("/migrate_legacy/{kind}/{*path}", post(migrate_legacy_draft))
 }
@@ -107,7 +112,7 @@ async fn list_drafts(
     // Without builder rights an operator has no drafts of their own (they can't write any, see
     // `require_can_write_path`), so this list is always empty for them. They can still READ some
     // collaborators' drafts via `/drafts/get`.
-    if authed.is_operator && !operator_can_build_flows(&db, &w_id).await? {
+    if authed.is_operator && !operator_builder_rights(&db, &w_id).await?.any() {
         return Ok(Json(vec![]));
     }
     let all_users = query.all_users.unwrap_or(false);
@@ -496,6 +501,31 @@ async fn update_draft(
         }
     }
 
+    // A raw-app draft carries the app value and its policy side by side.
+    if authed.is_operator && kind == UserDraftItemKind::RawApp {
+        if let Some(value) = &req.value {
+            let draft: serde_json::Value = serde_json::from_str(&strip_json_nul(value.0.get()))
+                .map_err(|e| Error::BadRequest(format!("Invalid app draft: {e}")))?;
+            let mut policy = draft
+                .get("policy")
+                .filter(|p| !p.is_null())
+                .map(|p| serde_json::from_value::<crate::apps::Policy>(p.clone()))
+                .transpose()
+                .map_err(|e| Error::BadRequest(format!("Invalid app draft policy: {e}")))?;
+            crate::apps::validate_operator_composed_app(
+                &authed,
+                &db,
+                &user_db,
+                &w_id,
+                crate::apps::BuilderAppWrite::Draft,
+                true,
+                Some(&value.0),
+                policy.as_mut(),
+            )
+            .await?;
+        }
+    }
+
     let applied = if let Some(value) = &req.value {
         // Secret variable values must never sit in `draft.value` in plaintext
         // (see `encrypt_secret_variable_value`).
@@ -884,9 +914,9 @@ async fn move_draft(
                  {attempted}. Reopen it, re-save to rewrite it cleanly, then retry."
             )
         } else if row.legacy {
-            // The home list synthesizes a draft-only row for the legacy draft with the
-            // caller's own name on it, so this is reachable from the row menu. Only an
-            // admin can claim or discard that row, and only from the drafts page.
+            // The home list surfaces the legacy draft as a draft-only row owned by nobody,
+            // so this is reachable from the row menu. It can be discarded (a write-gated
+            // legacy delete) or claimed by an admin, but never moved.
             format!(
                 "'{path}' is a legacy workspace draft with no owner, so it cannot be moved. \
                  A workspace admin can claim or discard it on the Review & deploy drafts page."
@@ -1000,6 +1030,85 @@ async fn migrate_legacy_draft(
     }
 }
 
+#[derive(Deserialize, Debug)]
+pub struct DeleteDraftForUserQuery {
+    /// Workspace username of the draft owner. Absent: every draft at the path,
+    /// the legacy ownerless one and the caller's own included.
+    pub username: Option<String>,
+}
+
+/// Delete ANOTHER user's draft at a path, or every draft there, for workspace
+/// admins (and superadmins, which carry `is_admin` in a workspace). Covers the
+/// kinds whose authors are visible to others (`shares_drafts_across_users`); the
+/// owner is named by workspace username, as on `/drafts/get`.
+async fn delete_draft_for_user(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, kind, path)): Path<(String, UserDraftItemKind, windmill_common::utils::StripPath)>,
+    Query(query): Query<DeleteDraftForUserQuery>,
+) -> Result<String> {
+    require_admin(authed.is_admin, &authed.username)?;
+    if !kind.shares_drafts_across_users() {
+        return Err(Error::NotFound(
+            "drafts for this item kind are private to their owner".to_string(),
+        ));
+    }
+    let path = path.to_path();
+    let username = query.username.as_deref();
+    let owner_email = match username {
+        Some(username) => Some(
+            resolve_username_to_email(&w_id, username, &db)
+                .await?
+                .ok_or_else(|| {
+                    Error::NotFound(format!("no user with username {username} in workspace"))
+                })?,
+        ),
+        None => None,
+    };
+
+    let mut tx = db.begin().await?;
+    let deleted = sqlx::query_scalar!(
+        r#"DELETE FROM draft
+           WHERE workspace_id = $1 AND path = $2 AND typ = $3
+             AND ($4::text IS NULL OR email = $4)
+           RETURNING 1 as "one!""#,
+        &w_id,
+        path,
+        kind as UserDraftItemKind,
+        owner_email.as_deref(),
+    )
+    .fetch_all(&mut *tx)
+    .await?
+    .len();
+    if deleted == 0 {
+        return Err(Error::NotFound(match username {
+            Some(username) => format!("no draft for {username} at {path}"),
+            None => format!("no draft at {path}"),
+        }));
+    }
+    audit_log(
+        &mut *tx,
+        &authed,
+        "drafts.delete_for_user",
+        ActionKind::Delete,
+        &w_id,
+        Some(path),
+        Some(
+            [
+                ("kind", kind.as_str()),
+                ("username", username.unwrap_or("*")),
+            ]
+            .into(),
+        ),
+    )
+    .await?;
+    tx.commit().await?;
+    Ok(match username {
+        Some(username) => format!("Deleted {username}'s draft at {path}"),
+        None => format!("Deleted {deleted} draft(s) at {path}"),
+    })
+}
+
 /// For variable-kind drafts with `variable.is_secret == true`, encrypt
 /// `variable.value` with the workspace crypt key and mark it
 /// `$encrypted:<base64>` so the secret never persists in plaintext at rest.
@@ -1161,14 +1270,21 @@ pub(crate) async fn require_can_write_path(
     if authed.is_admin {
         return Ok(());
     }
-    // Operators are read-only and never WRITE drafts, except a flow draft where the workspace
-    // granted the builder right: the kind has to be checked, or the right would open drafts of
-    // kinds it says nothing about. Read access is deliberately asymmetric:
+    // Operators are read-only and never WRITE drafts, except of a kind the workspace granted them
+    // the matching builder right for: a flows-only workspace must not get raw-app drafts through
+    // here. Read access is deliberately asymmetric:
     // `require_can_read_path` has no operator block, so an operator can still READ a draft they
     // can read via `/drafts/get`, mirroring their read access to deployed content. Intended.
     if authed.is_operator {
-        let granted =
-            matches!(kind, UserDraftItemKind::Flow) && operator_can_build_flows(db, w_id).await?;
+        let allowed = match kind {
+            UserDraftItemKind::Flow => Some(BuilderKind::Flows),
+            UserDraftItemKind::RawApp => Some(BuilderKind::Apps),
+            _ => None,
+        };
+        let granted = match allowed {
+            Some(kind) => operator_builder_rights(db, w_id).await?.has(kind),
+            None => false,
+        };
         if !granted {
             return Err(Error::PermissionDenied(
                 "operators cannot save drafts".to_string(),
diff --git a/backend/windmill-api/src/job_helpers_oss.rs b/backend/windmill-api/src/job_helpers_oss.rs
index eb8986a986..0d6f20cdfa 100644
--- a/backend/windmill-api/src/job_helpers_oss.rs
+++ b/backend/windmill-api/src/job_helpers_oss.rs
@@ -263,6 +263,10 @@ mod app_s3_display_stubs {
         pub search_col: Option<String>,
         pub search_term: Option<String>,
         pub storage: Option<String>,
+        pub s3_resource_path: Option<String>,
+        pub csv_separator: Option<String>,
+        pub csv_has_header: Option<bool>,
+        pub filters: Option<String>,
     }
 
     #[derive(Serialize)]
@@ -278,7 +282,10 @@ mod app_s3_display_stubs {
         pub search_col: Option<String>,
         pub search_term: Option<String>,
         pub storage: Option<String>,
+        pub s3_resource_path: Option<String>,
         pub csv_separator: Option<String>,
+        pub csv_has_header: Option<bool>,
+        pub filters: Option<String>,
     }
 
     pub async fn load_file_metadata_internal(
@@ -308,6 +315,7 @@ mod app_s3_display_stubs {
     pub async fn load_table_count_internal(
         _authed: OptJobAuthed,
         _db: &DB,
+        _user_db: Option<UserDB>,
         _w_id: &str,
         _file_key: String,
         _query: LoadCountQuery,
@@ -320,6 +328,7 @@ mod app_s3_display_stubs {
     pub async fn load_preview_internal(
         _authed: OptJobAuthed,
         _db: &DB,
+        _user_db: Option<UserDB>,
         _w_id: &str,
         _file_key: String,
         _query: LoadPreviewQuery,
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index 785c6ff935..2b93c6daeb 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -19,7 +19,7 @@ use serde_json::value::RawValue;
 use serde_json::Value;
 use sha2::{Digest, Sha256};
 use std::borrow::Cow;
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::str::FromStr;
 use std::sync::Arc;
 use std::time::Instant;
@@ -55,7 +55,8 @@ use windmill_common::workspace_dependencies::{
     RawWorkspaceDependencies, MIN_VERSION_WORKSPACE_DEPENDENCIES,
 };
 use windmill_common::workspaces::{
-    check_operator_can_build_flows, check_user_against_rule, ProtectionRuleKind, RuleCheckResult,
+    check_operator_can_build, check_user_against_rule, BuilderKind, ProtectionRuleKind,
+    RuleCheckResult,
 };
 use windmill_common::DYNAMIC_INPUT_CACHE;
 #[cfg(all(feature = "enterprise", feature = "instance_smtp"))]
@@ -292,6 +293,7 @@ pub fn workspaced_service() -> Router {
         )
         .route("/run/dynamic_select", post(run_dynamic_select))
         .route("/list", get(list_jobs))
+        .route("/oldest", get(get_oldest_job))
         .route("/asset_dispatch_edges", get(list_asset_dispatch_edges))
         .route(
             "/list_selected_job_groups",
@@ -377,6 +379,10 @@ pub fn workspaced_service() -> Router {
             "/wac_approval_urls/{job_id}/{step_key}",
             get(get_wac_approval_urls).layer(cors.clone()),
         )
+        .route(
+            "/worker_is_draining/{id}",
+            get(worker_is_draining).layer(cors.clone()),
+        )
         .route(
             "/result_by_id/{job_id}/{node_id}",
             get(get_result_by_id).layer(cors.clone()),
@@ -497,6 +503,28 @@ async fn get_result_by_id(
         view_token.as_deref(),
     )
     .await?;
+    // The node is resolved up through the enclosing flows, so a read path that admitted
+    // `flow_id` as a step must also admit the run it is a step of. A path-scoped
+    // `jobs:read` does not reach this route; a `jobs:run` scope beside it does.
+    if windmill_api_auth::scopes::job_read_confinement(authed.scopes.as_deref())
+        .is_some_and(|c| c.has_read_paths())
+    {
+        let top = sqlx::query_scalar::<_, Uuid>(
+            "WITH RECURSIVE chain(id, parent_job) AS (
+                SELECT id, parent_job FROM v2_job WHERE id = $1 AND workspace_id = $2
+                UNION ALL
+                SELECT j.id, j.parent_job FROM v2_job j
+                    JOIN chain c ON j.id = c.parent_job AND j.workspace_id = $2
+            )
+            SELECT id FROM chain WHERE parent_job IS NULL",
+        )
+        .bind(flow_id)
+        .bind(&w_id)
+        .fetch_optional(&db)
+        .await?
+        .ok_or_else(|| Error::NotFound(format!("Job {flow_id} not found")))?;
+        require_job_within_read_scope(&db, &authed, &w_id, &top).await?;
+    }
 
     let res =
         windmill_queue::get_result_by_id(db.clone(), w_id.clone(), flow_id, node_id, json_path)
@@ -590,6 +618,53 @@ async fn get_root_job(
     Ok(Json(res))
 }
 
+/// Whether the worker running this job has received its shutdown signal. A draining worker
+/// never interrupts its job, so a long-running script polls this to exit on its own terms.
+async fn worker_is_draining(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, id)): Path<(String, Uuid)>,
+) -> windmill_common::error::JsonResult<bool> {
+    // A job always may ask about itself. Anyone else must be able to see the job: the
+    // caller's row policies on v2_job decide, narrowed by the token's tag filter.
+    let draining = if authed.job_id == Some(id) {
+        sqlx::query_scalar!(
+            "SELECT wp.draining FROM v2_job_queue q JOIN worker_ping wp ON wp.worker = q.worker
+            WHERE q.id = $1 AND q.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL",
+            id,
+            w_id
+        )
+        .fetch_optional(&db)
+        .await?
+    } else {
+        let tags = get_scope_tags(&authed)
+            .map(|tags| tags.into_iter().map(str::to_string).collect::<Vec<_>>());
+        let mut tx = user_db.begin(&authed).await?;
+        let draining = sqlx::query_scalar!(
+            "SELECT wp.draining FROM v2_job j
+            JOIN v2_job_queue q ON q.id = j.id
+            JOIN worker_ping wp ON wp.worker = q.worker
+            WHERE j.id = $1 AND j.workspace_id = $2 AND q.running AND q.started_at IS NOT NULL
+            AND ($3::text[] IS NULL OR j.tag = ANY($3))",
+            id,
+            w_id,
+            tags.as_deref()
+        )
+        .fetch_optional(&mut *tx)
+        .await?;
+        tx.commit().await?;
+        draining
+    }
+    .unwrap_or(false);
+    windmill_common::feature_usage::log_feature_usage(
+        "worker_draining",
+        "check",
+        if draining { "draining" } else { "not_draining" },
+    );
+    Ok(Json(draining))
+}
+
 async fn compute_root_job_for_flow(db: &DB, w_id: &str, job_id: Uuid) -> error::Result<String> {
     let root_job = sqlx::query_scalar!(
             r#"SELECT COALESCE(root_job, flow_innermost_root_job, parent_job, id) as "root_job!" FROM v2_job WHERE id = $1 AND workspace_id = $2"#,
@@ -620,7 +695,7 @@ async fn cancel_job_api(
     // right to kill someone else's run. Anonymous callers are instead confined to
     // anonymous-created jobs by `cancel_job`'s `require_anonymous`.
     if let Some(authed) = opt_authed.as_ref() {
-        require_job_update_read_access(&db, &user_db, authed, &w_id, &id, None).await?;
+        require_job_cancel_access(&db, &user_db, authed, &w_id, &id).await?;
     }
 
     let tx = db.begin().await?;
@@ -689,7 +764,15 @@ async fn cancel_persistent_script_api(
     Json(CancelJob { reason }): Json<CancelJob>,
 ) -> error::Result<()> {
     let audit_author: AuditAuthor = match opt_authed {
-        Some(authed) => (&authed).into(),
+        Some(authed) => {
+            let path = script_path.to_path();
+            if !windmill_api_auth::scopes::job_cancel_path_confinement(authed.scopes.as_deref())
+                .is_none_or(|c| windmill_api_auth::scopes::cancel_confinement_admits(&c, path))
+            {
+                return Err(Error::NotFound(format!("Script {path} not found")));
+            }
+            (&authed).into()
+        }
         None => {
             return Err(Error::BadRequest(format!(
                 "Cancelling persistent script require to be logged in and member of {w_id}"
@@ -782,7 +865,7 @@ async fn force_cancel(
     // caller who can only see an inner step kill a root flow hidden from them.
     if let Some(authed) = opt_authed.as_ref() {
         let target = force_cancel_target(&db, &w_id, id).await?;
-        require_job_update_read_access(&db, &user_db, authed, &w_id, &target, None).await?;
+        require_job_cancel_access(&db, &user_db, authed, &w_id, &target).await?;
     }
 
     let tx = db.begin().await?;
@@ -1705,6 +1788,22 @@ pub(crate) async fn require_job_read_access(
     job_id: &Uuid,
     created_by: &str,
     view_token: Option<&str>,
+) -> error::Result<()> {
+    require_job_access(
+        db, user_db, authed, w_id, job_id, created_by, view_token, true,
+    )
+    .await
+}
+
+async fn require_job_access(
+    db: &DB,
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    job_id: &Uuid,
+    created_by: &str,
+    view_token: Option<&str>,
+    read_confined: bool,
 ) -> error::Result<()> {
     // Tag scope (`if_jobs:filter_tags:`) is an orthogonal hard restriction on a
     // scoped token: it must never read a job outside its allowed tags, regardless of
@@ -1729,10 +1828,12 @@ pub(crate) async fn require_job_read_access(
         }
     }
 
-    // A path-scoped `jobs:run` token is likewise hard-restricted to the runnables it
-    // may start, ahead of every grant below — the token is handed out to run one thing,
-    // so it must not read jobs of anything else merely because its owner could.
-    require_job_within_run_scope(db, authed, w_id, job_id).await?;
+    // A path-scoped `jobs:run` or `jobs:read` token is likewise hard-restricted to the
+    // runnables it names, ahead of every grant below — the token is handed out for one
+    // thing, so it must not read jobs of anything else merely because its owner could.
+    if read_confined {
+        require_job_within_read_scope(db, authed, w_id, job_id).await?;
+    }
 
     // Fast path: you can always read a job you launched. This is also load-bearing
     // for apps — a component job runs as the app policy's `permissioned_as`, but its
@@ -1880,24 +1981,41 @@ pub(crate) async fn require_job_read_access(
 /// could start an app's inline-script component but not read the run back — those jobs
 /// are `AppScript`/`Preview` kinds that no `jobs:run` scope can name.
 ///
-/// No-op — and no query — for every caller whose job reads are not run-confined (see
-/// `job_read_run_confinement`), which is all sessions, unscoped tokens and `jobs:read`
-/// tokens.
-async fn require_job_within_run_scope(
+/// A `jobs:read:<paths>` scope confines the same way, by path alone: the job, or one of
+/// its ancestors, must be a run of a deployed script, flow or agent at a named path.
+/// Only those kinds count, because a preview's `runnable_path` is whatever its caller
+/// sent and would otherwise let any preview pass for a named runnable.
+///
+/// No-op — and no query — for every caller whose job reads are not confined (see
+/// `job_read_confinement`), which is all sessions, unscoped tokens and tokens whose
+/// `jobs:read` names no path.
+async fn require_job_within_read_scope(
     db: &DB,
     authed: &ApiAuthed,
     w_id: &str,
     job_id: &Uuid,
 ) -> error::Result<()> {
     let Some(confinement) =
-        windmill_api_auth::scopes::job_read_run_confinement(authed.scopes.as_deref())
+        windmill_api_auth::scopes::job_read_confinement(authed.scopes.as_deref())
     else {
         return Ok(());
     };
+    // A job whose token is restricted by `job_token_scopes` still reads its own flow run
+    // (step results, user state), which the route check lets through whatever the
+    // scopes. A read path names what else it may read, not a fence around its own run.
+    if let Some(own_job) = authed.job_id {
+        if confinement.has_read_paths()
+            && windmill_api_auth::auth::job_in_same_flow_run(db, own_job, *job_id).await
+        {
+            return Ok(());
+        }
+    }
     // `scope_kind` is the runnable kind a `jobs:run:<kind>:<path>` scope can name, or
-    // NULL for a job no such scope reaches directly (previews, dependency jobs,
-    // flow-inlined scripts) — those are still readable as a step of a matching flow,
-    // through their ancestors. A `singlestepflow` wraps either a script or a flow, so it
+    // NULL for a job no such scope reaches directly (previews, flow-inlined scripts) —
+    // those are still readable as a step of a matching flow, through their ancestors.
+    // A dependency job's path is the one its `jobs:run:dependencies:<path>` check
+    // admitted, but it is filed under `dependencies`, so it never passes for a run of
+    // the deployed runnable at that path. A `singlestepflow` wraps either a script or a flow, so it
     // projects onto the wrapped runnable the same way the batch-rerun query does. An agent
     // run is a preview of the one-step flow `agent_runs::agent_step_flow` builds, filed under the
     // agent's path (`<path>.chat` for a chat turn); the editor's own runs of it look the same,
@@ -1916,6 +2034,7 @@ async fn require_job_within_run_scope(
                     WHEN a.agent THEN 'agents'
                     WHEN j.kind IN ('script', 'script_hub', 'unassigned_script') THEN 'scripts'
                     WHEN j.kind IN ('flow', 'unassigned_flow') THEN 'flows'
+                    WHEN j.kind IN ('dependencies', 'flowdependencies') THEN 'dependencies'
                     WHEN j.kind IN ('singlestepflow', 'unassigned_singlestepflow') THEN
                         CASE WHEN COALESCE(
                                 (SELECT m->'value'->>'type'
@@ -1941,13 +2060,7 @@ async fn require_job_within_run_scope(
     let in_scope =
         chain.iter().any(
             |job| match (job.runnable_path.as_deref(), job.scope_kind.as_deref()) {
-                (Some(runnable_path), Some(kind))
-                    if windmill_api_auth::scopes::run_confinement_admits(
-                        &confinement,
-                        kind,
-                        runnable_path,
-                    ) =>
-                {
+                (Some(runnable_path), Some(kind)) if confinement.admits(kind, runnable_path) => {
                     true
                 }
                 _ => job.launched_by_app.as_deref().is_some_and(&runs_app),
@@ -1961,6 +2074,73 @@ async fn require_job_within_run_scope(
     }
 }
 
+/// The `ids` a path-scoped `jobs:cancel:<paths>` token may cancel; all of them for
+/// every caller whose cancels are not path-confined (see `job_cancel_path_confinement`).
+///
+/// A job is admitted when it, or any of its `parent_job` ancestors, is a run of a
+/// deployed script, flow or agent whose path the scope names: cancelling a flow's step
+/// is within a scope on the flow. Only those kinds count, because a preview's
+/// `runnable_path` is whatever its caller sent and would otherwise let any preview
+/// impersonate an in-scope runnable. Agent runs are previews filed under the agent's
+/// path, recognized the same way `require_job_within_read_scope` does.
+async fn filter_jobs_within_cancel_scope(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    ids: Vec<Uuid>,
+) -> error::Result<Vec<Uuid>> {
+    let Some(confinement) =
+        windmill_api_auth::scopes::job_cancel_path_confinement(authed.scopes.as_deref())
+    else {
+        return Ok(ids);
+    };
+    let chain = sqlx::query!(
+        r#"WITH RECURSIVE chain(origin, id, parent_job) AS (
+                SELECT id, id, parent_job FROM v2_job WHERE id = ANY($1) AND workspace_id = $2
+                UNION ALL
+                SELECT c.origin, j.id, j.parent_job FROM v2_job j
+                    JOIN chain c ON j.id = c.parent_job AND j.workspace_id = $2
+            )
+            SELECT c.origin AS "origin!",
+                CASE WHEN a.agent THEN regexp_replace(j.runnable_path, '\.chat$', '')
+                    ELSE j.runnable_path END AS "runnable_path!"
+            FROM chain c JOIN v2_job j ON j.id = c.id,
+            LATERAL (SELECT j.kind = 'flowpreview'
+                AND j.raw_flow->'modules'->1 IS NULL
+                AND j.raw_flow->'modules'->0->>'id' = '__wm_agent_root' AS agent) a
+            WHERE j.workspace_id = $2 AND j.runnable_path IS NOT NULL
+                AND (a.agent OR j.kind IN ('script', 'script_hub', 'unassigned_script', 'flow',
+                    'unassigned_flow', 'singlestepflow', 'unassigned_singlestepflow'))"#,
+        &ids,
+        w_id,
+    )
+    .fetch_all(db)
+    .await?;
+    let admitted: HashSet<Uuid> = chain
+        .into_iter()
+        .filter(|r| {
+            windmill_api_auth::scopes::cancel_confinement_admits(&confinement, &r.runnable_path)
+        })
+        .map(|r| r.origin)
+        .collect();
+    Ok(ids.into_iter().filter(|id| admitted.contains(id)).collect())
+}
+
+async fn require_job_within_cancel_scope(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    job_id: Uuid,
+) -> error::Result<()> {
+    if filter_jobs_within_cancel_scope(db, authed, w_id, vec![job_id])
+        .await?
+        .is_empty()
+    {
+        return Err(Error::NotFound(format!("Job {job_id} not found")));
+    }
+    Ok(())
+}
+
 /// Self + every `parent_job` ancestor (intermediate sub-flows up to the top-level
 /// root) of `job_id`, resolved via the root DB (flow lineage is not sensitive).
 /// Falls back to `[job_id]` if the row is absent so callers still run their probe.
@@ -2156,6 +2336,41 @@ async fn require_job_update_read_access(
     require_job_read_access(db, user_db, authed, w_id, job_id, &created_by, view_token).await
 }
 
+/// The per-job check of the cancel routes. A `jobs:cancel` grant stands on its own, like
+/// `jobs:write`: its paths confine it (`filter_jobs_within_cancel_scope`), not the
+/// token's `jobs:run` scopes, which bound what a run token may read. Intersecting the two
+/// would not hold anyway, since the token can mint itself a child holding only the
+/// cancel scope.
+async fn require_job_cancel_access(
+    db: &DB,
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    job_id: &Uuid,
+) -> error::Result<()> {
+    let created_by = sqlx::query_scalar!(
+        "SELECT created_by FROM v2_job WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        w_id,
+    )
+    .fetch_optional(db)
+    .await?
+    .ok_or_else(|| Error::NotFound(format!("Job {job_id} not found")))?;
+    let read_confined = !windmill_api_auth::scopes::has_job_cancel_grant(authed.scopes.as_deref());
+    require_job_access(
+        db,
+        user_db,
+        authed,
+        w_id,
+        job_id,
+        &created_by,
+        None,
+        read_confined,
+    )
+    .await?;
+    require_job_within_cancel_scope(db, authed, w_id, *job_id).await
+}
+
 /// Whether a validated approval token should grant the job-read bypass. The token alone
 /// is sufficient unless the current approval step has `user_auth_required`, in which case
 /// only an authorized approver may read the job (and thus its args/flow inputs).
@@ -2286,7 +2501,7 @@ async fn get_job(
         // an approval link for a job must not let a scoped token read one outside the
         // runnables it may start.
         if let Some(authed) = opt_authed.as_ref() {
-            require_job_within_run_scope(&db, authed, &w_id, &id).await?;
+            require_job_within_read_scope(&db, authed, &w_id, &id).await?;
         }
     } else {
         require_opt_authed_job_read_access(
@@ -3204,6 +3419,7 @@ fn flow_tree_entry_label(
         "forloopflow" => " forloop",
         "whileloopflow" => " whileloop",
         "aiagent" => " ai-agent",
+        "aidecision" => " ai-decision",
         _ => "",
     };
 
@@ -4260,6 +4476,17 @@ struct ListableQueuedJob {
     pub workspace_id: String,
 }
 
+/// Narrows a job list to what a path-scoped `jobs:read:<paths>` token may read: the
+/// top-level runs of the runnables it names. A step is read by id, under its flow. No-op
+/// for every caller whose lists are not path-filtered (see `job_list_path_filter`).
+fn confine_list_to_read_scope(sqlb: &mut SqlBuilder, authed: &ApiAuthed) {
+    if let windmill_api_auth::ScopePathFilter::Restricted { exact, prefix } =
+        windmill_api_auth::scopes::job_list_path_filter(authed.scopes.as_deref())
+    {
+        and_where_root_run_at_paths(sqlb, &exact, &prefix);
+    }
+}
+
 async fn list_queue_jobs(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -4281,7 +4508,7 @@ async fn list_queue_jobs(
         "null as args"
     };
 
-    let sql = list_queue_jobs_query(
+    let mut sqlb = list_queue_jobs_query(
         &w_id,
         &lq,
         &[
@@ -4311,8 +4538,9 @@ async fn list_queue_jobs(
         pagination,
         false,
         get_scope_tags(&authed),
-    )
-    .sql()?;
+    );
+    confine_list_to_read_scope(&mut sqlb, &authed);
+    let sql = sqlb.sql()?;
     let mut tx = user_db.begin(&authed).await?;
     let jobs = sqlx::query_as::<_, ListableQueuedJob>(&sql)
         .fetch_all(&mut *tx)
@@ -4372,14 +4600,40 @@ async fn cancel_selection(
     let force_cancel = query.force_cancel.unwrap_or(false);
     let mut cancelled = Vec::new();
     for (workspace_id, ids) in jobs_by_workspace {
-        let Json(mut w_cancelled) = cancel_jobs(
-            ids,
-            &db,
-            authed.username.as_str(),
-            workspace_id.as_str(),
-            force_cancel,
-        )
-        .await?;
+        let ids =
+            if windmill_api_auth::scopes::job_cancel_path_confinement(authed.scopes.as_deref())
+                .is_some()
+            {
+                // Checked on the job the cancel actually kills: a force cancel reaches the
+                // highest queued ancestor.
+                let mut targets = Vec::with_capacity(ids.len());
+                for id in ids {
+                    let target = if force_cancel {
+                        force_cancel_target(&db, &workspace_id, id).await?
+                    } else {
+                        id
+                    };
+                    targets.push((id, target));
+                }
+                let admitted: HashSet<Uuid> = filter_jobs_within_cancel_scope(
+                    &db,
+                    &authed,
+                    &workspace_id,
+                    targets.iter().map(|(_, t)| *t).collect(),
+                )
+                .await?
+                .into_iter()
+                .collect();
+                targets
+                    .into_iter()
+                    .filter(|(_, t)| admitted.contains(t))
+                    .map(|(id, _)| id)
+                    .collect()
+            } else {
+                ids
+            };
+        let Json(mut w_cancelled) =
+            cancel_jobs(ids, &db, &authed, workspace_id.as_str(), force_cancel).await?;
         cancelled.append(&mut w_cancelled);
     }
 
@@ -4567,6 +4821,41 @@ async fn count_completed_jobs(
         ))
 }
 
+#[derive(Deserialize)]
+struct OldestJobQuery {
+    all_workspaces: Option<bool>,
+}
+
+#[derive(Serialize)]
+struct OldestJob {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    created_at: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+/// Where the job history starts, whatever the caller may see of it: a client scanning the
+/// runs backwards in time windows needs a bound that row-level visibility cannot make slow.
+async fn get_oldest_job(
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Query(q): Query<OldestJobQuery>,
+) -> error::JsonResult<OldestJob> {
+    let created_at = if w_id == "admins" && q.all_workspaces.unwrap_or(false) {
+        // One index probe per workspace: a plain min() over the table has no index to walk.
+        sqlx::query_scalar(
+            "SELECT min(o.created_at) FROM workspace w CROSS JOIN LATERAL \
+             (SELECT min(created_at) AS created_at FROM v2_job WHERE workspace_id = w.id) o",
+        )
+        .fetch_one(&db)
+        .await?
+    } else {
+        sqlx::query_scalar("SELECT min(created_at) FROM v2_job WHERE workspace_id = $1")
+            .bind(&w_id)
+            .fetch_one(&db)
+            .await?
+    };
+    Ok(Json(OldestJob { created_at }))
+}
+
 lazy_static::lazy_static! {
     /// 0 keeps the connection-wide statement_timeout.
     static ref LIST_JOBS_STATEMENT_TIMEOUT_SECS: u64 =
@@ -4666,7 +4955,7 @@ async fn list_jobs(
     }
 
     let sqlc = if lq.running.is_none() {
-        Some(list_completed_jobs_query(
+        let mut sqlc = list_completed_jobs_query(
             &w_id,
             Some(per_page),
             0,
@@ -4674,7 +4963,9 @@ async fn list_jobs(
             cj_fields_ref,
             true,
             get_scope_tags(&authed),
-        ))
+        );
+        confine_list_to_read_scope(&mut sqlc, &authed);
+        Some(sqlc)
     } else {
         None
     };
@@ -4701,6 +4992,7 @@ async fn list_jobs(
             true,
             get_scope_tags(&authed),
         );
+        confine_list_to_read_scope(&mut sqlq, &authed);
 
         if let Some(sqlc) = sqlc {
             format!("{} UNION ALL {}", &sqlq.subquery()?, &sqlc.subquery()?,)
@@ -5124,6 +5416,11 @@ async fn get_approval_info(
             "Must be logged in or provide a valid approval token".to_string(),
         ));
     }
+    // Nothing below goes through `require_job_read_access`, and an approval token is no
+    // way around a scoped token's confinement.
+    if let Some(authed) = opt_authed.as_ref() {
+        require_job_within_read_scope(&db, authed, &w_id, &job_id).await?;
+    }
 
     // Fetch job info
     #[derive(sqlx::FromRow)]
@@ -5356,8 +5653,17 @@ async fn get_approval_info(
     // Possession of view rights over this approval is sufficient to mint a
     // share-read-link token for the flow: it only grants read (no resume), and only to
     // an authenticated workspace member, so it never widens what the approver can do.
-    let hmac = generate_view_token(&w_id, row.id, VIEW_TOKEN_DOMAIN, &db).await?;
-    let view_token = Some(format!("{}.{hmac}", row.id));
+    // Not for a token whose reads are confined: the link would outlive it and serve any
+    // member, which is why `job_view_token` is refused to it too.
+    let confined = opt_authed.as_ref().is_some_and(|authed| {
+        windmill_api_auth::scopes::job_read_confinement(authed.scopes.as_deref()).is_some()
+    });
+    let view_token = if confined {
+        None
+    } else {
+        let hmac = generate_view_token(&w_id, row.id, VIEW_TOKEN_DOMAIN, &db).await?;
+        Some(format!("{}.{hmac}", row.id))
+    };
 
     Ok(Json(ApprovalInfo {
         flow_id: row.id,
@@ -5819,7 +6125,7 @@ pub async fn get_suspended_job_flow(
     // resume secret must not let a scoped token read a flow it may not run. Anonymous
     // approvers are unaffected.
     if let Some(authed) = authed.as_ref() {
-        require_job_within_run_scope(&db, authed, &w_id, &flow_id).await?;
+        require_job_within_read_scope(&db, authed, &w_id, &flow_id).await?;
     }
 
     let flow = GetQuery::new()
@@ -6003,7 +6309,7 @@ pub async fn get_flow_user_state(
     // Reachable by a `jobs:run` token (it is one of the by-id routes a run needs), so
     // apply the same run-scope confinement as the other single-job reads. RLS below
     // still governs which jobs the owner's identity can see at all.
-    require_job_within_run_scope(&db, &authed, &w_id, &job_id).await?;
+    require_job_within_read_scope(&db, &authed, &w_id, &job_id).await?;
     let mut tx = user_db.begin(&authed).await?;
     let r = sqlx::query_scalar!(
         r#"
@@ -7193,6 +7499,7 @@ pub async fn restart_flow(
 
     let tx = PushIsolationLevel::Isolated(user_db, authed.clone().into());
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -7230,6 +7537,7 @@ pub async fn restart_flow(
         None,
         authed.trigger_or_fallback(None),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -7367,7 +7675,11 @@ pub async fn run_workflow_as_code(
     extra.insert(ENTRYPOINT_OVERRIDE.to_string(), to_raw_value(&entrypoint));
     let args = PushArgs { args: &task.args.unwrap_or_else(HashMap::new), extra: Some(extra) };
     check_tag_available_for_workspace(&db, &w_id, &run_query.tag, &args, &authed).await?;
-    check_scopes(&authed, || format!("jobs:run"))?;
+    // A job running its own task is its runtime, not a new run: a restricted job token keeps
+    // it (`is_own_job_runtime_route`), and the task inherits that job's restriction at push.
+    if authed.job_id != Some(job_id) {
+        check_scopes(&authed, || format!("jobs:run"))?;
+    }
     // The task becomes a child of `job_id`, runs its code and writes into its flow status, so
     // only that job itself (the SDK's `task` wrapper, on its `WM_TOKEN`) or an admin may push it.
     if authed.job_id != Some(job_id) && !authed.is_admin {
@@ -7512,6 +7824,8 @@ pub async fn run_workflow_as_code(
             )
         };
 
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, mut tx) = push(
         &db,
         tx,
@@ -7539,9 +7853,10 @@ pub async fn run_workflow_as_code(
         None,
         push_authed.as_ref(),
         false,
+        end_user_email,
         None,
         None,
-        None,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
@@ -7825,6 +8140,8 @@ pub async fn run_wait_result_job_by_path_get(
             )
         };
 
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -7852,9 +8169,10 @@ pub async fn run_wait_result_job_by_path_get(
         None,
         push_authed.as_ref(),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(None),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -7973,6 +8291,8 @@ pub async fn run_wait_result_script_by_path_internal(
             )
         };
 
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -8000,9 +8320,10 @@ pub async fn run_wait_result_script_by_path_internal(
         None,
         push_authed.as_ref(),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(None),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -8055,6 +8376,7 @@ pub async fn run_wait_result_script_by_hash(
         timeout,
         has_preprocessor,
         labels,
+        job_token_scopes,
         runnable_settings:
             ScriptRunnableSettingsInline { concurrency_settings, debouncing_settings },
         ..
@@ -8088,6 +8410,8 @@ pub async fn run_wait_result_script_by_hash(
         )
     };
 
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -8105,6 +8429,7 @@ pub async fn run_wait_result_script_by_hash(
             apply_preprocessor: !run_query.skip_preprocessor.unwrap_or(false)
                 && has_preprocessor.unwrap_or(false),
             labels,
+            job_token_scopes,
         },
         push_args,
         authed.display_username(),
@@ -8128,9 +8453,10 @@ pub async fn run_wait_result_script_by_hash(
         None,
         push_authed.as_ref(),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(None),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -8268,6 +8594,11 @@ pub async fn stream_job(
     run_query: RunJobQuery,
     is_get: bool,
 ) -> error::Result<Response> {
+    if run_query.retry.is_some() {
+        return Err(error::Error::BadRequest(
+            "retry is only supported when running a script asynchronously".to_string(),
+        ));
+    }
     let args = if is_get {
         let payload_as_args = run_query.payload_as_args()?;
 
@@ -8650,6 +8981,8 @@ async fn run_preview_script(
     let push_args = PushArgs { extra, args: &preview_args };
     check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -8697,9 +9030,10 @@ async fn run_preview_script(
         None,
         Some(&authed.clone().into()),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(None),
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -8735,6 +9069,7 @@ async fn run_inline_preview_script(
     if let Some(job_id) = job_id {
         register_potential_assets_on_inline_execution(job_id, &w_id, &preview);
     }
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
     let utils = get_worker_internal_server_inline_utils()?;
     let result = utils.run_inline_preview_script.as_ref()(RunInlinePreviewScriptFnParams {
         content: preview.content,
@@ -8745,6 +9080,7 @@ async fn run_inline_preview_script(
         created_by: authed.display_username().to_string(),
         permissioned_as: username_to_permissioned_as(&authed.username),
         permissioned_as_email: authed.email.clone(),
+        end_user_email,
         lang: preview.language,
         job_dir: "".to_string(),
         worker_name: "".to_string(),
@@ -8784,7 +9120,8 @@ async fn run_inline_script_by_path(
         token,
         db,
         w_id,
-        InlineScriptTarget::Path(script_path.to_path().to_string()),
+        // Resolved to a version by `run_inline_script_inner`.
+        InlineScriptTarget::Path { path: script_path.to_path().to_string(), hash: 0 },
         body.args,
         Some(user_db),
     )
@@ -8847,6 +9184,43 @@ async fn run_inline_script_inner(
     args: Option<HashMap<String, Box<JsonRawValue>>>,
     user_db: Option<UserDB>,
 ) -> error::Result<Response> {
+    // An inline run executes with the caller's own token, so it cannot honour a script's
+    // `job_token_scopes`: such a script only runs as a job. A path is resolved here, once, and
+    // the version checked is the version run.
+    let (target, restricted) = match target {
+        InlineScriptTarget::Path { path, .. } => {
+            let authed_ref = authed.to_authed_ref();
+            let info = get_latest_deployed_hash_for_path(
+                user_db
+                    .as_ref()
+                    .map(|db| UserDbWithAuthed { db: db.clone(), authed: &authed_ref }),
+                db.clone(),
+                &w_id,
+                &path,
+            )
+            .await?;
+            let restricted = info.job_token_scopes.is_some();
+            (
+                InlineScriptTarget::Path { path, hash: info.hash },
+                restricted,
+            )
+        }
+        InlineScriptTarget::Hash(hash) => {
+            let restricted = windmill_common::get_script_info_for_hash(None, &db, &w_id, hash)
+                .await?
+                .job_token_scopes
+                .is_some();
+            (InlineScriptTarget::Hash(hash), restricted)
+        }
+    };
+    if restricted {
+        return Err(Error::BadRequest(
+            "This script restricts its job token (job_token_scopes) and cannot be run inline; \
+             run it as a job instead"
+                .to_string(),
+        ));
+    }
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
     let utils = get_worker_internal_server_inline_utils()?;
     let authed_owned: windmill_common::db::Authed = authed.clone().into();
     let result = utils.run_inline_script.as_ref()(RunInlineScriptFnParams {
@@ -8858,6 +9232,7 @@ async fn run_inline_script_inner(
         created_by: authed.display_username().to_string(),
         permissioned_as: username_to_permissioned_as(&authed.username),
         permissioned_as_email: authed.email.clone(),
+        end_user_email,
         job_dir: "".to_string(),
         worker_name: "".to_string(),
         worker_dir: "".to_string(),
@@ -9033,6 +9408,8 @@ async fn run_bundle_preview_script(
 
             // tracing::info!("is_tar 1: {is_tar}");
             // hmap.insert("")
+            let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
+            let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
             let (uuid, ntx) = push(
                 &db,
                 ltx,
@@ -9076,9 +9453,10 @@ async fn run_bundle_preview_script(
                 None,
                 Some(&authed.clone().into()),
                 false,
-                None,
+                end_user_email,
                 authed.trigger_or_fallback(None),
                 None,
+                scope_ceiling.as_deref(),
             )
             .await?;
             job_id = Some(uuid);
@@ -9155,13 +9533,23 @@ pub struct RunDependenciesResponse {
     pub dependencies: String,
 }
 
+/// The path comes from the request body: one carrying scope syntax (`,`, `:`, `*`) could
+/// put a granted path beside an ungranted one, so it needs a grant covering every path.
+fn check_dependencies_scope(authed: &ApiAuthed, path: &str) -> error::Result<()> {
+    if windmill_common::auth::is_scope_literal_path(path) {
+        check_scopes(authed, || format!("jobs:run:dependencies:{path}"))
+    } else {
+        check_scopes(authed, || "jobs:run:dependencies".to_string())
+    }
+}
+
 async fn push_dependencies_job(
     authed: &ApiAuthed,
     db: &DB,
     w_id: &str,
     req: RunDependenciesRequest,
 ) -> error::Result<Uuid> {
-    check_scopes(authed, || format!("jobs:run"))?;
+    check_dependencies_scope(authed, &req.entrypoint)?;
     if authed.is_operator {
         return Err(error::Error::NotAuthorized(
             "Operators cannot run dependencies jobs for security reasons".to_string(),
@@ -9198,6 +9586,7 @@ async fn push_dependencies_job(
     req.temp_script_refs
         .map(|v| hm.insert("temp_script_refs".to_owned(), to_raw_value(&v)));
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(db, authed).await?;
     let (uuid, tx) = push(
         db,
         PushIsolationLevel::IsolatedRoot(db.clone()),
@@ -9232,6 +9621,7 @@ async fn push_dependencies_job(
         None,
         None,
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -9282,8 +9672,15 @@ async fn push_flow_dependencies_job(
     w_id: &str,
     req: RunFlowDependenciesRequest,
 ) -> error::Result<Uuid> {
-    check_scopes(authed, || format!("jobs:run"))?;
-    check_operator_can_build_flows(db, w_id, authed.is_operator, "run dependencies jobs").await?;
+    check_dependencies_scope(authed, &req.path)?;
+    check_operator_can_build(
+        db,
+        w_id,
+        authed.is_operator,
+        BuilderKind::Flows,
+        "run dependencies jobs",
+    )
+    .await?;
     // The dependency job locks whatever inline code this request carries, on a worker. A
     // composition-only flow has none, so validating here costs a builder nothing and keeps the
     // lock step from becoming the way to run code the write path refuses.
@@ -9330,6 +9727,7 @@ async fn push_flow_dependencies_job(
     req.temp_script_refs
         .map(|v| args_map.insert("temp_script_refs".to_string(), to_raw_value(&v)));
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(db, authed).await?;
     let (uuid, tx) = push(
         db,
         PushIsolationLevel::IsolatedRoot(db.clone()),
@@ -9360,6 +9758,7 @@ async fn push_flow_dependencies_job(
         None,
         None,
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -9414,6 +9813,7 @@ async fn add_batch_jobs(
 ) -> error::JsonResult<Vec<Uuid>> {
     require_super_admin(&db, &authed).await?;
 
+    let mut job_token_scopes: Option<Vec<String>> = None;
     let (
         hash,
         path,
@@ -9445,11 +9845,13 @@ async fn add_batch_jobs(
                         dedicated_worker,
                         timeout,
                         runnable_settings,
+                        job_token_scopes: script_job_token_scopes,
                         .. // TODO: consider on_behalf_of_email and created_by for batch jobs
                     } = get_latest_deployed_hash_for_path(Some(db_authed), db.clone(), &w_id, &path)
                     .await?
                     .prefetch_cached(&db)
                     .await?;
+                job_token_scopes = script_job_token_scopes;
                 (
                     Some(script_hash),
                     Some(path),
@@ -9496,7 +9898,7 @@ async fn add_batch_jobs(
             } else if let Some(path) = batch_info.path {
                 let mut tx = user_db.clone().begin(&authed).await?;
                 let value_json = sqlx::query!(
-                        "SELECT coalesce(flow_version_lite.value, flow_version.value) as \"value!: sqlx::types::Json<Box<RawValue>>\" FROM flow
+                        "SELECT coalesce(flow_version_lite.value, flow_version.value) as \"value!: sqlx::types::Json<Box<RawValue>>\", flow.job_token_scopes FROM flow
                         LEFT JOIN flow_version
                             ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]
                         LEFT JOIN flow_version_lite
@@ -9507,6 +9909,7 @@ async fn add_batch_jobs(
                     .fetch_optional(&mut *tx)
                     .await?
                     .ok_or_else(|| Error::internal_err(format!("not found flow at path {:?}", path)))?;
+                job_token_scopes = value_json.job_token_scopes;
                 let value =
                     serde_json::from_str::<FlowValue>(value_json.value.get()).map_err(|err| {
                         Error::internal_err(format!(
@@ -9519,6 +9922,11 @@ async fn add_batch_jobs(
                     "Path is required if no value is not provided"
                 ))?
             };
+            if windmill_common::scopes::validate_flow_step_job_token_scopes(&value)? {
+                windmill_common::min_version::MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES
+                    .assert()
+                    .await?;
+            }
             add_virtual_items_if_necessary(&mut value.modules);
             let flow_status = FlowStatus::new(&value);
             (
@@ -9562,7 +9970,8 @@ async fn add_batch_jobs(
     let language = language.unwrap_or(ScriptLang::Deno);
 
     let tag = if let Some(dedicated_worker) = dedicated_worker {
-        if dedicated_worker && path.is_some() {
+        // Same rule as `push`: a dedicated worker would run it with its own unscoped token.
+        if dedicated_worker && path.is_some() && job_token_scopes.is_none() {
             windmill_common::worker::dedicated_worker_tag(&w_id, &path.clone().unwrap())
         } else {
             format!("{}", language.as_str())
@@ -9630,8 +10039,8 @@ async fn add_batch_jobs(
     .await?;
 
     sqlx::query!(
-            "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id)
-            SELECT unnest($1::uuid[]), $2, $3, $4, $5, $6, $7, $8",
+            "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, job_token_scopes)
+            SELECT unnest($1::uuid[]), $2, $3, $4, $5, $6, $7, $8, $9",
             &uuids,
             authed.email,
             authed.username,
@@ -9640,6 +10049,7 @@ async fn add_batch_jobs(
             &[],
             &[],
             w_id,
+            job_token_scopes.as_deref() as Option<&[String]>,
         )
         .execute(&mut *tx)
         .await?;
@@ -9685,11 +10095,25 @@ async fn run_preview_flow_job(
     Query(run_query): Query<RunJobQuery>,
     Json(raw_flow): Json<PreviewFlow>,
 ) -> error::Result<(StatusCode, String)> {
-    check_operator_can_build_flows(&db, &w_id, authed.is_operator, "run preview jobs").await?;
+    check_operator_can_build(
+        &db,
+        &w_id,
+        authed.is_operator,
+        BuilderKind::Flows,
+        "run preview jobs",
+    )
+    .await?;
     // Flow preview runs an arbitrary, request-supplied flow definition; require the broad
     // jobs:run scope so a narrowly-scoped token cannot escape its scope. See run_preview_script.
     check_scopes(&authed, || format!("jobs:run"))?;
     require_path_read_access_for_preview(&authed, &raw_flow.path)?;
+    // Step restrictions apply to a preview as they do to a deployed run, so they are checked
+    // the same way: an invalid entry or an older worker would leave a step unrestricted.
+    if windmill_common::scopes::validate_flow_step_job_token_scopes(&raw_flow.value)? {
+        windmill_common::min_version::MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES
+            .assert()
+            .await?;
+    }
     // A builder must be able to test what it composes, but the submitted value is not the stored
     // one: without this the preview is a way to run inline code the write path refuses.
     if authed.is_operator {
@@ -9732,6 +10156,8 @@ async fn run_preview_flow_job(
     check_tag_available_for_workspace(&db, &w_id, &tag, &PushArgs::from(&flow_args), &authed)
         .await?;
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
     let (uuid, mut tx) = push(
         &db,
         tx,
@@ -9763,9 +10189,10 @@ async fn run_preview_flow_job(
         None,
         Some(&authed.clone().into()),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(None),
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
 
@@ -9989,6 +10416,7 @@ async fn run_dynamic_select(
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
@@ -10035,6 +10463,7 @@ async fn run_dynamic_select(
         None,
         authed.trigger_or_fallback(None),
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -10110,6 +10539,7 @@ pub async fn run_job_by_hash_inner(
         delete_after_use,
         delete_after_secs,
         labels,
+        job_token_scopes,
         ..
     } = script_info;
 
@@ -10142,24 +10572,30 @@ pub async fn run_job_by_hash_inner(
         )
     };
 
+    let job_payload = JobPayload::ScriptHash {
+        hash: ScriptHash(hash),
+        path: path,
+        concurrency_settings,
+        debouncing_settings,
+        cache_ttl,
+        cache_ignore_s3_path,
+        language,
+        dedicated_worker,
+        priority,
+        apply_preprocessor: !run_query.skip_preprocessor.unwrap_or(false)
+            && has_preprocessor.unwrap_or(false),
+        labels,
+        job_token_scopes,
+    };
+    let job_payload = with_run_retry(&run_query, job_payload, &push_args, &tag)?;
+
+    let end_user_email = run_end_user_email(&db, &w_id, &authed, trigger.as_ref()).await?;
+    let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
     let (uuid, tx) = push(
         &db,
         tx,
         &w_id,
-        JobPayload::ScriptHash {
-            hash: ScriptHash(hash),
-            path: path,
-            concurrency_settings,
-            debouncing_settings,
-            cache_ttl,
-            cache_ignore_s3_path,
-            language,
-            dedicated_worker,
-            priority,
-            apply_preprocessor: !run_query.skip_preprocessor.unwrap_or(false)
-                && has_preprocessor.unwrap_or(false),
-            labels,
-        },
+        job_payload,
         push_args,
         authed.display_username(),
         email,
@@ -10182,9 +10618,10 @@ pub async fn run_job_by_hash_inner(
         None,
         push_authed.as_ref(),
         false,
-        None,
+        end_user_email,
         authed.trigger_or_fallback(trigger),
         run_query.suspended_mode,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -11145,7 +11582,7 @@ async fn list_completed_jobs(
         "null as args"
     };
 
-    let sql = list_completed_jobs_query(
+    let mut sqlb = list_completed_jobs_query(
         &w_id,
         Some(per_page),
         offset,
@@ -11185,8 +11622,9 @@ async fn list_completed_jobs(
         ],
         false,
         get_scope_tags(&authed),
-    )
-    .sql()?;
+    );
+    confine_list_to_read_scope(&mut sqlb, &authed);
+    let sql = sqlb.sql()?;
     let mut tx = user_db.begin(&authed).await?;
     let jobs = sqlx::query_as::<_, ListableCompletedJob>(&sql)
         .fetch_all(&mut *tx)
@@ -11365,7 +11803,7 @@ async fn get_completed_job_result(
         // confinement that gate carries — re-apply it, as `get_job` does for the
         // approval token. Anonymous approval access is untouched.
         if let Some(authed) = opt_authed.as_ref() {
-            require_job_within_run_scope(&db, authed, &w_id, &id).await?;
+            require_job_within_read_scope(&db, authed, &w_id, &id).await?;
         }
     } else {
         require_opt_authed_job_read_access(
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index 1cd2b4101c..92291bd1ea 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -149,6 +149,8 @@ pub mod oauth2_oss;
 #[cfg(feature = "private")]
 pub mod oidc_ee;
 mod oidc_oss;
+#[cfg(all(feature = "enterprise", feature = "openidconnect", feature = "private"))]
+pub mod oidc_signer_tools_ee;
 mod path_autocomplete;
 mod raw_apps;
 mod resources;
diff --git a/backend/windmill-api/src/live_migrations.rs b/backend/windmill-api/src/live_migrations.rs
index 334ee340a8..a620807902 100644
--- a/backend/windmill-api/src/live_migrations.rs
+++ b/backend/windmill-api/src/live_migrations.rs
@@ -8,7 +8,9 @@
 
 use sqlx::{PgConnection, Postgres};
 use tokio::task::JoinHandle;
-use windmill_common::{db::DB, error::Error};
+use windmill_common::{
+    db::DB, error::Error, global_settings::SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING,
+};
 
 use crate::db::CustomMigrator;
 use sqlx::migrate::Migrate;
@@ -160,7 +162,11 @@ async fn run_background_migrations(db: &DB) -> Result<(), Error> {
         return Ok(());
     }
 
-    for step in [AUDIT_OPERATION_INDEX, RETIRE_LEGACY_AUDIT] {
+    for step in [
+        RETIRE_LEGACY_HUB_SYNC,
+        AUDIT_OPERATION_INDEX,
+        RETIRE_LEGACY_AUDIT,
+    ] {
         if background_migration_done(&mut conn, step).await? {
             continue;
         }
@@ -171,6 +177,7 @@ async fn run_background_migrations(db: &DB) -> Result<(), Error> {
             let run = match step {
                 AUDIT_OPERATION_INDEX => create_audit_operation_index(&mut conn).await,
                 RETIRE_LEGACY_AUDIT => retire_legacy_audit_table(&mut conn).await,
+                RETIRE_LEGACY_HUB_SYNC => retire_legacy_hub_sync(&mut conn).await,
                 _ => unreachable!("background migration {step} has no step function"),
             };
             match run {
@@ -192,6 +199,7 @@ async fn run_background_migrations(db: &DB) -> Result<(), Error> {
 
 const AUDIT_OPERATION_INDEX: &str = "audit_partitioned_workspace_operation_index";
 const RETIRE_LEGACY_AUDIT: &str = "retire_legacy_audit_table";
+const RETIRE_LEGACY_HUB_SYNC: &str = "retire_legacy_hub_sync_script";
 
 // Short on purpose: a statement waiting for its lock is also a wait for every audit insert
 // queued behind it.
@@ -371,6 +379,70 @@ async fn retire_legacy_audit_table(conn: &mut PgConnection) -> Result<(), Error>
     Ok(())
 }
 
+/// The hash the migrations gave `u/admin/hub_sync`; they rewrote its content in place.
+const LEGACY_HUB_SYNC_HASH: i64 = -28028598712388162;
+
+/// `u/admin/hub_sync` and the schedules running it synced resource types before servers did
+/// it themselves (`windmill_common::hub_resource_types`). Retired only while the script is
+/// still the version Windmill created: a copy someone edited is theirs to keep running.
+async fn retire_legacy_hub_sync(conn: &mut PgConnection) -> Result<(), Error> {
+    let mut tx = conn.begin().await?;
+    let latest: Option<i64> = sqlx::query_scalar(
+        "SELECT hash FROM script
+         WHERE workspace_id = 'admins' AND path = 'u/admin/hub_sync' AND archived = false
+         ORDER BY created_at DESC LIMIT 1",
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    if latest != Some(LEGACY_HUB_SYNC_HASH) {
+        return Ok(());
+    }
+
+    let schedules: Vec<(String, bool, serde_json::Value)> = sqlx::query_as(
+        "SELECT path, enabled, jsonb_build_object('row', to_jsonb(s)) FROM schedule s
+         WHERE workspace_id = 'admins' AND script_path = 'u/admin/hub_sync' AND NOT is_flow",
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    // An enabled schedule hands over to the server's daily sync in the transaction that deletes
+    // it, so the instance never has both syncs running, nor neither.
+    if schedules.iter().any(|(_, enabled, _)| *enabled) {
+        let inserted = sqlx::query(
+            "INSERT INTO global_settings (name, value) VALUES ($1, 'true'::jsonb)
+             ON CONFLICT (name) DO NOTHING",
+        )
+        .bind(SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING)
+        .execute(&mut *tx)
+        .await?
+        .rows_affected();
+        if inserted > 0 {
+            tracing::info!(
+                "u/admin/hub_sync ran on an enabled schedule: turned on {SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING}"
+            );
+        }
+    }
+    for (path, _, row) in schedules {
+        windmill_queue::schedule::clear_schedule(&mut tx, &path, "admins").await?;
+        sqlx::query("DELETE FROM schedule WHERE workspace_id = 'admins' AND path = $1")
+            .bind(&path)
+            .execute(&mut *tx)
+            .await?;
+        windmill_common::trashbin::move_to_trash(
+            &mut *tx, "admins", "schedule", &path, row, "system",
+        )
+        .await?;
+        tracing::info!("Deleted schedule {path}, which ran u/admin/hub_sync");
+    }
+    sqlx::query(
+        "UPDATE script SET archived = true WHERE workspace_id = 'admins' AND path = 'u/admin/hub_sync'",
+    )
+    .execute(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    tracing::info!("Archived u/admin/hub_sync: servers sync resource types themselves");
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -412,4 +484,80 @@ mod tests {
         assert_eq!(seen, 2);
         Ok(())
     }
+
+    async fn insert_legacy_hub_sync_schedule(db: &DB, enabled: bool) -> anyhow::Result<()> {
+        sqlx::query(
+            "INSERT INTO schedule (workspace_id, path, edited_by, email, permissioned_as, schedule, timezone, script_path, is_flow, enabled)
+             VALUES ('admins', 'g/all/hub_sync', 'admin', 'admin@windmill.dev', 'u/admin', '0 0 0 * * *', 'Etc/UTC', 'u/admin/hub_sync', false, $1)",
+        )
+        .bind(enabled)
+        .execute(db)
+        .await?;
+        Ok(())
+    }
+
+    async fn schedules_and_live_versions(db: &DB) -> anyhow::Result<(i64, i64)> {
+        Ok(sqlx::query_as(
+            "SELECT (SELECT count(*) FROM schedule WHERE workspace_id = 'admins'),
+                    (SELECT count(*) FROM script WHERE path = 'u/admin/hub_sync' AND NOT archived)",
+        )
+        .fetch_one(db)
+        .await?)
+    }
+
+    async fn daily_sync_setting(db: &DB) -> anyhow::Result<Option<serde_json::Value>> {
+        Ok(
+            sqlx::query_scalar("SELECT value FROM global_settings WHERE name = $1")
+                .bind(SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING)
+                .fetch_optional(db)
+                .await?,
+        )
+    }
+
+    #[sqlx::test(migrations = "../migrations")]
+    async fn retire_legacy_hub_sync_spares_an_edited_script(db: DB) -> anyhow::Result<()> {
+        insert_legacy_hub_sync_schedule(&db, true).await?;
+        sqlx::query(
+            "INSERT INTO script (workspace_id, hash, path, content, created_by, language, summary, description, schema, lock, created_at)
+             SELECT workspace_id, 42, path, content || '// edited', 'admin', language, summary, description, schema, lock, now() + interval '1 minute'
+             FROM script WHERE workspace_id = 'admins' AND path = 'u/admin/hub_sync'",
+        )
+        .execute(&db)
+        .await?;
+
+        retire_legacy_hub_sync(&mut *db.acquire().await?).await?;
+        assert_eq!(schedules_and_live_versions(&db).await?, (1, 2));
+        assert_eq!(daily_sync_setting(&db).await?, None);
+
+        // Unedited, the enabled schedule hands over to the server's daily sync.
+        sqlx::query("DELETE FROM script WHERE hash = 42")
+            .execute(&db)
+            .await?;
+        retire_legacy_hub_sync(&mut *db.acquire().await?).await?;
+        assert_eq!(schedules_and_live_versions(&db).await?, (0, 0));
+        assert_eq!(
+            daily_sync_setting(&db).await?,
+            Some(serde_json::json!(true))
+        );
+        Ok(())
+    }
+
+    #[sqlx::test(migrations = "../migrations")]
+    async fn retire_legacy_hub_sync_leaves_the_daily_sync_off_without_an_enabled_schedule(
+        db: DB,
+    ) -> anyhow::Result<()> {
+        for disabled_schedule in [true, false] {
+            sqlx::query("UPDATE script SET archived = false WHERE path = 'u/admin/hub_sync'")
+                .execute(&db)
+                .await?;
+            if disabled_schedule {
+                insert_legacy_hub_sync_schedule(&db, false).await?;
+            }
+
+            retire_legacy_hub_sync(&mut *db.acquire().await?).await?;
+            assert_eq!(schedules_and_live_versions(&db).await?, (0, 0));
+            assert_eq!(daily_sync_setting(&db).await?, None);
+        }
+        Ok(())
+    }
 }
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index 1962710578..73b1fd1792 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -2024,7 +2024,7 @@ You should get the schema of the script or flow before creating the schedule to
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2037,7 +2037,7 @@ You should get the schema of the script or flow before creating the schedule to
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
@@ -2231,7 +2231,7 @@ You should get the schema of the script or flow before updating the schedule to
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2244,7 +2244,7 @@ You should get the schema of the script or flow before updating the schedule to
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index 472c7bbec9..8f3962da13 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -372,7 +372,8 @@ impl McpBackend for WindmillBackend {
         token: &str,
         workspace_id: &str,
     ) -> BackendResult<ApiAuthed> {
-        self.auth_cache
+        let authed = self
+            .auth_cache
             .get_authed(Some(workspace_id.to_string()), token)
             .await
             .ok_or_else(|| {
@@ -383,7 +384,11 @@ impl McpBackend for WindmillBackend {
                     ),
                     None,
                 )
-            })
+            })?;
+        // Job token scopes never include MCP scopes, so a restricted job token gets none.
+        windmill_api_auth::check_job_token_scope(&authed, || "mcp:all".to_string())
+            .map_err(|e| ErrorData::invalid_params(e.to_string(), None))?;
+        Ok(authed)
     }
 
     async fn runnable_list_fingerprint(&self, workspace_id: &str) -> BackendResult<String> {
diff --git a/backend/windmill-api/src/mcp_tools.rs b/backend/windmill-api/src/mcp_tools.rs
index e1931873a9..1e07f374de 100644
--- a/backend/windmill-api/src/mcp_tools.rs
+++ b/backend/windmill-api/src/mcp_tools.rs
@@ -23,14 +23,12 @@ async fn with_deadline<T>(
     what: &str,
     fut: impl std::future::Future<Output = Result<T>>,
 ) -> Result<T> {
-    tokio::time::timeout(MCP_DEADLINE, fut)
-        .await
-        .map_err(|_| {
-            Error::ExecutionErr(format!(
-                "MCP server did not answer within {}s ({what})",
-                MCP_DEADLINE.as_secs()
-            ))
-        })?
+    tokio::time::timeout(MCP_DEADLINE, fut).await.map_err(|_| {
+        Error::ExecutionErr(format!(
+            "MCP server did not answer within {}s ({what})",
+            MCP_DEADLINE.as_secs()
+        ))
+    })?
 }
 
 /// Connect to the MCP server described by the `mcp` resource at `path`.
@@ -65,8 +63,9 @@ async fn connect_mcp_client(
     let resource_value = not_found_if_none(resource_value_o, "Resource", path)?
         .ok_or_else(|| Error::BadRequest(format!("Empty resource value for {}", path)))?;
 
-    let mcp_resource = serde_json::from_str::<windmill_mcp::McpResource>(resource_value.0.get())
-        .map_err(|e| Error::BadRequest(format!("Failed to parse MCP resource: {}", e)))?;
+    let mut mcp_resource =
+        serde_json::from_str::<windmill_mcp::McpResource>(resource_value.0.get())
+            .map_err(|e| Error::BadRequest(format!("Failed to parse MCP resource: {}", e)))?;
 
     #[cfg(feature = "oauth2")]
     {
@@ -126,6 +125,15 @@ async fn connect_mcp_client(
         None
     };
 
+    // Header secrets go through the same permissioned path as the token.
+    for value in mcp_resource.headers.iter_mut().flatten().map(|(_, v)| v) {
+        if let Some(var_path) = value.strip_prefix("$var:") {
+            check_scopes(authed, || format!("variables:read:{}", var_path))?;
+            let db_authed = DbWithOptAuthed::from_authed(authed, db.clone(), Some(user_db.clone()));
+            *value = get_value_internal(&db_authed, w_id, var_path, false).await?;
+        }
+    }
+
     windmill_mcp::McpClient::from_resource(mcp_resource, token)
         .await
         .map_err(|e| Error::ExecutionErr(format!("Failed to connect to MCP server: {}", e)))
diff --git a/backend/windmill-api/src/offboarding.rs b/backend/windmill-api/src/offboarding.rs
index 26eb06c8e8..b7f83dfd96 100644
--- a/backend/windmill-api/src/offboarding.rs
+++ b/backend/windmill-api/src/offboarding.rs
@@ -891,8 +891,8 @@ async fn offboard_user_from_workspace<'c>(
     let flows_reassigned = sqlx::query_scalar!(
         r#"WITH inserted AS (
             INSERT INTO flow
-                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs)
-            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs
+                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs, job_token_scopes)
+            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs, job_token_scopes
                 FROM flow
                 WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3
             RETURNING 1
diff --git a/backend/windmill-api/src/runnables.rs b/backend/windmill-api/src/runnables.rs
index 2cee0efe33..7e64b48a1a 100644
--- a/backend/windmill-api/src/runnables.rs
+++ b/backend/windmill-api/src/runnables.rs
@@ -34,7 +34,7 @@ use std::collections::HashMap;
 use windmill_common::{
     db::UserDB,
     error::{Error, JsonResult},
-    workspaces::operator_can_build_flows,
+    workspaces::{operator_builder_rights, OperatorBuilderRights},
 };
 use windmill_types::scripts::ScriptHash;
 use windmill_types::user_drafts::DraftUserRef;
@@ -371,7 +371,8 @@ fn draft_branch_sql(kind: &str) -> String {
         "SELECT '{kind}' as kind, o.path, o.summary, o.workspace_id, '{{}}'::jsonb as extra_perms, \
                 false as starred, false as archived, \
                 true as is_draft, true as draft_only, o.draft_path, \
-                json_build_array(json_build_object('username', $2::text)) as draft_users, \
+                json_build_array(json_build_object('username', \
+                    CASE WHEN o.legacy THEN NULL ELSE $2::text END)) as draft_users, \
                 NULL::text[] as labels, NULL::text[] as inherited_labels, \
                 NULL::bool as ws_error_handler_muted, o.created_at as edited_at, \
                 NULL::bigint as hash, o.language, o.script_kind, o.auto_kind, \
@@ -380,6 +381,7 @@ fn draft_branch_sql(kind: &str) -> String {
                 o.created_at as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.draft_path, o.path)) as sort_name, 0::bigint as tiebreak \
          FROM ( \
              SELECT DISTINCT ON (d.path) d.workspace_id, d.path, d.created_at, \
+                    d.email IS NULL as legacy, \
                     COALESCE(d.value->>'summary', '') as summary, \
                     NULLIF(NULLIF(d.value->>'{typed_path}', ''), d.path) as draft_path, \
                     {kind_cols} \
@@ -572,9 +574,14 @@ async fn list_runnables(
     // Draft-only rows are the caller's own work in progress: never archived, so they
     // have no place in the archived view, and carrying no labels of their own they are
     // out of scope of a label filter (as in the per-kind endpoints). Operators don't
-    // see other people's drafts and have none of their own, except a builder's flows.
+    // see other people's drafts and have none of their own, except of what they may build.
+    let builder = if authed.is_operator {
+        operator_builder_rights(&db, &w_id).await?
+    } else {
+        OperatorBuilderRights::default()
+    };
     let include_drafts = q.include_draft_only.unwrap_or(false)
-        && (!authed.is_operator || operator_can_build_flows(&db, &w_id).await?)
+        && (!authed.is_operator || builder.any())
         && !show_archived
         && q.label.as_ref().filter(|s| !s.is_empty()).is_none();
     let draft_extras_for = |kind: &str| -> Vec<String> {
@@ -660,7 +667,10 @@ async fn list_runnables(
                             keyset: Option<&str>,
                             limit: Option<usize>|
      -> Option<String> {
-        if !include_drafts || !kinds.contains(&kind) || (authed.is_operator && kind != "flow") {
+        if !include_drafts
+            || !kinds.contains(&kind)
+            || (authed.is_operator && !operator_drafts_kind(builder, kind))
+        {
             return None;
         }
         // `fav` is ignored: with no favorite join there is nothing to filter on, and the
@@ -988,6 +998,15 @@ async fn count_runnables_by_owner(
     Ok(Json(RunnableCountsResponse { counts }))
 }
 
+/// Whether an operator with `builder` rights can have drafts of a `/list` kind.
+fn operator_drafts_kind(builder: OperatorBuilderRights, kind: &str) -> bool {
+    match kind {
+        "flow" => builder.flows,
+        "app" => builder.apps,
+        _ => false,
+    }
+}
+
 /// Adds the caller's draft-only rows to `counts`, in the same shape `/list`
 /// returns them so a badge never disagrees with the rows behind it.
 ///
@@ -1008,13 +1027,21 @@ async fn add_draft_counts(
     if !q.include_draft_only.unwrap_or(false) {
         return Ok(());
     }
-    // An operator has no drafts of their own, except a builder's flows.
+    // An operator has no drafts of their own, except of what they may build.
+    let builder_kinds: Vec<&str>;
     let kinds: &[&str] = if !authed.is_operator {
         kinds
-    } else if kinds.contains(&"flow") && operator_can_build_flows(db, w_id).await? {
-        &["flow"]
     } else {
-        return Ok(());
+        let builder = operator_builder_rights(db, w_id).await?;
+        builder_kinds = kinds
+            .iter()
+            .copied()
+            .filter(|k| operator_drafts_kind(builder, k))
+            .collect();
+        if builder_kinds.is_empty() {
+            return Ok(());
+        }
+        &builder_kinds
     };
     // $1 = workspace, $2 = the caller's email.
     let mut binds: Vec<String> = vec![];
diff --git a/backend/windmill-api/src/static_assets.rs b/backend/windmill-api/src/static_assets.rs
index 66dc4da9df..e469e91249 100644
--- a/backend/windmill-api/src/static_assets.rs
+++ b/backend/windmill-api/src/static_assets.rs
@@ -100,6 +100,21 @@ fn serve_path(path: &str, original_path: &str, query: Option<&str>) -> Response<
                 res = res.header("X-Robots-Tag", "noindex, nofollow");
             }
 
+            // The raw-app preview shell evaluates whatever js is posted to it, so it is
+            // only ever served opaque-origin, with the deployed app wrapper's exact flags
+            // (`get_raw_app_data`). Matched on the embedded file, not the request path,
+            // so `//ui_builder/...` is covered. A sandboxed app's editor preview loads it
+            // as served, framed with the same flags (`RAW_APP_SANDBOX_FLAGS` in the
+            // frontend); an unsandboxed one loads a same-origin blob: copy.
+            if path == "ui_builder/app-preview.html" {
+                res = res.header(
+                    header::CONTENT_SECURITY_POLICY,
+                    "sandbox allow-scripts allow-forms allow-popups \
+                     allow-popups-to-escape-sandbox allow-downloads allow-modals \
+                     allow-top-navigation",
+                );
+            }
+
             // Add Content-Security-Policy header for static assets when policy is set
             if !CSP_POLICY.is_empty() {
                 if let Ok(header_value) = HeaderValue::try_from(CSP_POLICY.as_str()) {
diff --git a/backend/windmill-api/src/token.rs b/backend/windmill-api/src/token.rs
index a1a9206196..ab22f2d15b 100644
--- a/backend/windmill-api/src/token.rs
+++ b/backend/windmill-api/src/token.rs
@@ -193,13 +193,18 @@ lazy_static! {
                 ScopeOption {
                     value: "jobs:read".to_string(),
                     label: "Read".to_string(),
-                    requires_resource_path: false,
+                    requires_resource_path: true,
                 },
                 ScopeOption {
                     value: "jobs:write".to_string(),
                     label: "Write".to_string(),
                     requires_resource_path: false,
                 },
+                ScopeOption {
+                    value: "jobs:cancel".to_string(),
+                    label: "Cancel".to_string(),
+                    requires_resource_path: true,
+                },
                 ScopeOption {
                     value: "jobs:run:scripts".to_string(),
                     label: "Run scripts".to_string(),
@@ -210,6 +215,11 @@ lazy_static! {
                     label: "Run flows".to_string(),
                     requires_resource_path: true,
                 },
+                ScopeOption {
+                    value: "jobs:run:dependencies".to_string(),
+                    label: "Generate dependency locks".to_string(),
+                    requires_resource_path: true,
+                },
             ],
         }];
 
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index a7f9aeda89..5b26cf57b8 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -198,6 +198,7 @@ async fn set_password(
     Extension(db): Extension<DB>,
     Extension(argon2): Extension<Arc<Argon2<'_>>>,
     authed: ApiAuthed,
+    Tokened { token }: Tokened,
     OptJobAuthed { job_id, .. }: OptJobAuthed,
     Json(ep): Json<EditPassword>,
 ) -> Result<String> {
@@ -206,7 +207,15 @@ async fn set_password(
     // (GHSA-hfh4-cx4h-3fcr).
     forbid_elevated_job_token(&db, &authed.email, job_id).await?;
     let email = authed.email.clone();
-    crate::users_oss::set_password(db, argon2, authed, &email, ep).await
+    let res = crate::users_oss::set_password(db.clone(), argon2, authed, &email, ep).await?;
+    sqlx::query!(
+        "DELETE FROM token WHERE email = $1 AND label = 'session' AND token_hash != $2",
+        &email,
+        windmill_common::auth::hash_token(&token)
+    )
+    .execute(&db)
+    .await?;
+    Ok(res)
 }
 
 async fn set_password_of_user(
@@ -219,7 +228,14 @@ async fn set_password_of_user(
 ) -> Result<String> {
     require_super_admin(&db, &authed).await?;
     forbid_superadmin_job_token(&db, &authed.email, job_id).await?;
-    crate::users_oss::set_password(db, argon2, authed, &email, ep).await
+    let res = crate::users_oss::set_password(db.clone(), argon2, authed, &email, ep).await?;
+    sqlx::query!(
+        "DELETE FROM token WHERE email = $1 AND label = 'session'",
+        &email
+    )
+    .execute(&db)
+    .await?;
+    Ok(res)
 }
 
 #[derive(Deserialize)]
@@ -665,8 +681,8 @@ async fn update_username_in_workpsace<'c>(
     // ---- flows ----
     sqlx::query!(
         r#"INSERT INTO flow
-            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)
-        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at
+            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, job_token_scopes)
+        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, job_token_scopes
             FROM flow
             WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3"#,
         new_username,
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index ea79aaa572..3c3e965248 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -119,6 +119,8 @@ struct ScriptMetadata {
     pub debouncing_settings: DebouncingSettings,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub labels: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub job_token_scopes: Option<Vec<String>>,
     #[serde(skip_serializing_if = "is_empty_extra_perms")]
     pub extra_perms: serde_json::Value,
 }
@@ -906,6 +908,7 @@ pub(crate) async fn tarball_workspace(
                     .then_some(true),
                 modules: script.modules,
                 labels: script.labels,
+                job_token_scopes: script.job_token_scopes,
                 // Same opt-in contract as flow/app: the tarball only surfaces
                 // ACLs when `?preserve_extra_perms=true`. Passing `Null` lets the
                 // `is_empty_extra_perms` skip-serializer drop the field entirely.
@@ -966,7 +969,7 @@ pub(crate) async fn tarball_workspace(
 
     {
         let flows = sqlx::query_as::<_, Flow>(
-             "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of, flow.labels, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
+             "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of, flow.labels, flow.job_token_scopes, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
              FROM flow
              LEFT JOIN flow_version ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]
              WHERE flow.workspace_id = $1 AND flow.archived = false",
diff --git a/backend/windmill-audit/Cargo.toml b/backend/windmill-audit/Cargo.toml
index 6e4fc3fd12..8c26615664 100644
--- a/backend/windmill-audit/Cargo.toml
+++ b/backend/windmill-audit/Cargo.toml
@@ -20,4 +20,7 @@ chrono.workspace = true
 serde_json.workspace = true
 tracing.workspace = true
 windmill-common = { workspace = true, default-features = false }
-lazy_static.workspace = true
\ No newline at end of file
+lazy_static.workspace = true
+
+[dev-dependencies]
+tracing-subscriber.workspace = true
\ No newline at end of file
diff --git a/backend/windmill-audit/src/audit_oss.rs b/backend/windmill-audit/src/audit_oss.rs
index da36ada468..02b075af9d 100644
--- a/backend/windmill-audit/src/audit_oss.rs
+++ b/backend/windmill-audit/src/audit_oss.rs
@@ -88,6 +88,21 @@ pub async fn audit_log<'c, E: sqlx::Executor<'c, Database = Postgres>>(
     Ok(())
 }
 
+/// AUTHORIZATION: records entries, checks nothing. The caller must have authorized `author`
+/// for the operation on every resource in `w_id` before calling.
+#[cfg(not(feature = "private"))]
+pub async fn audit_log_many<'c, E: sqlx::Executor<'c, Database = Postgres>>(
+    _db: E,
+    _author: &impl AuditAuthorable,
+    _operation: &str,
+    _action_kind: ActionKind,
+    _w_id: &str,
+    _resources: &[String],
+) -> Result<()> {
+    // Implementation is not open source as Audit logs is a Windmill Enterprise Edition feature
+    Ok(())
+}
+
 #[cfg(not(feature = "private"))]
 pub async fn list_audit(
     _tx: Transaction<'_, Postgres>,
diff --git a/backend/windmill-audit/src/instance_config.rs b/backend/windmill-audit/src/instance_config.rs
new file mode 100644
index 0000000000..977e0fe6c6
--- /dev/null
+++ b/backend/windmill-audit/src/instance_config.rs
@@ -0,0 +1,148 @@
+//! Audit entries for writes to instance settings and worker group configs, whichever way
+//! they arrive: an API request, or a declarative sync that no user request stands behind.
+
+use std::collections::HashMap;
+
+use windmill_common::{
+    audit::AuditAuthor, error::Result, instance_config::ConfigWriteObserver,
+    users::SUPERADMIN_SYNC_EMAIL, DB,
+};
+
+use crate::{
+    audit_oss::{audit_log, AuditAuthorable},
+    ActionKind,
+};
+
+/// The declarative writer behind an entry, recorded as its `source` parameter.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DeclarativeSource {
+    /// `windmill sync-config <file>`
+    SyncConfig,
+    /// The Kubernetes operator's ConfigMap sync.
+    Operator,
+}
+
+impl DeclarativeSource {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            DeclarativeSource::SyncConfig => "sync-config",
+            DeclarativeSource::Operator => "operator",
+        }
+    }
+}
+
+/// Who a declarative sync's writes are attributed to. It runs on direct database
+/// credentials, so there is no user to name.
+pub fn declarative_sync_author() -> AuditAuthor {
+    AuditAuthor {
+        username: "instance_config_sync".to_string(),
+        email: SUPERADMIN_SYNC_EMAIL.to_string(),
+        username_override: None,
+        token_prefix: None,
+    }
+}
+
+fn parameters<'a>(
+    value: Option<&'a str>,
+    source: Option<DeclarativeSource>,
+) -> Option<HashMap<&'a str, &'a str>> {
+    let parameters: HashMap<&str, &str> = value
+        .map(|v| ("value", v))
+        .into_iter()
+        .chain(source.map(|s| ("source", s.as_str())))
+        .collect();
+    (!parameters.is_empty()).then_some(parameters)
+}
+
+/// A setting is recorded by name, with its value only when that is a boolean or a number.
+/// Any other shape can carry a credential (a registry URL, a webhook, a header map), and no
+/// list of secret-bearing settings stays complete as settings are added.
+///
+/// AUTHORIZATION: records a write, checks nothing. The caller must have established that
+/// `author` may change instance settings before performing the write this records.
+pub async fn audit_setting_write(
+    db: &DB,
+    author: &impl AuditAuthorable,
+    key: &str,
+    value: Option<&serde_json::Value>,
+    source: Option<DeclarativeSource>,
+) -> Result<()> {
+    let deleted = match value {
+        None | Some(serde_json::Value::Null) => true,
+        Some(serde_json::Value::String(s)) => s.trim().is_empty(),
+        Some(_) => false,
+    };
+    let recorded = match value {
+        Some(v @ (serde_json::Value::Bool(_) | serde_json::Value::Number(_))) => {
+            Some(v.to_string())
+        }
+        _ => None,
+    };
+    audit_log(
+        db,
+        author,
+        if deleted {
+            "global_settings.delete"
+        } else {
+            "global_settings.update"
+        },
+        if deleted {
+            ActionKind::Delete
+        } else {
+            ActionKind::Update
+        },
+        "global",
+        Some(key),
+        parameters(recorded.as_deref(), source),
+    )
+    .await
+}
+
+/// A worker group config is recorded by name only: its env vars and init script are free
+/// text that can carry a credential.
+///
+/// AUTHORIZATION: records a write, checks nothing. The caller must have established that
+/// `author` may change worker group configs before performing the write this records.
+pub async fn audit_worker_config_write(
+    db: &DB,
+    author: &impl AuditAuthorable,
+    group: &str,
+    deleted: bool,
+    source: Option<DeclarativeSource>,
+) -> Result<()> {
+    let (operation, action_kind) = if deleted {
+        ("worker_config.delete", ActionKind::Delete)
+    } else {
+        ("worker_config.update", ActionKind::Update)
+    };
+    audit_log(
+        db,
+        author,
+        operation,
+        action_kind,
+        "global",
+        Some(&format!("worker__{group}")),
+        parameters(None, source),
+    )
+    .await
+}
+
+/// Audits each write of an instance config apply as `author`'s.
+///
+/// AUTHORIZATION: as [`audit_setting_write`], for every write it is told of.
+pub struct InstanceConfigAuditor<'a, A> {
+    pub db: &'a DB,
+    pub author: &'a A,
+    /// `None` for a write made through the API.
+    pub source: Option<DeclarativeSource>,
+}
+
+impl<A: AuditAuthorable + Sync> ConfigWriteObserver for InstanceConfigAuditor<'_, A> {
+    async fn setting_written(&self, key: &str, value: Option<&serde_json::Value>) -> Result<()> {
+        audit_setting_write(self.db, self.author, key, value, self.source).await
+    }
+
+    async fn worker_config_written(&self, group: &str, deleted: bool) -> Result<()> {
+        audit_worker_config_write(self.db, self.author, group, deleted, self.source).await
+    }
+}
diff --git a/backend/windmill-audit/src/lib.rs b/backend/windmill-audit/src/lib.rs
index f1443fdb18..e9c71f1336 100644
--- a/backend/windmill-audit/src/lib.rs
+++ b/backend/windmill-audit/src/lib.rs
@@ -4,6 +4,7 @@ use sqlx::FromRow;
 #[cfg(feature = "private")]
 pub mod audit_ee;
 pub mod audit_oss;
+pub mod instance_config;
 
 #[derive(sqlx::Type, Serialize, Deserialize, Debug)]
 #[sqlx(type_name = "ACTION_KIND", rename_all = "lowercase")]
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 96fa7ceb63..e447baf563 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -8,7 +8,7 @@ edition.workspace = true
 default = []
 enterprise = ["dep:aws-config"]
 instance_config_schema = ["dep:schemars"]
-local_reports = ["dep:rsa", "dep:aes-gcm"]
+local_reports = ["dep:rsa"]
 private = ["dep:aws-sdk-rds", "dep:aws-sdk-secretsmanager", "dep:aws-config"]
 jemalloc = ["dep:tikv-jemalloc-ctl"]
 tantivy = []
@@ -22,7 +22,7 @@ smtp = ["dep:mail-send", "dep:rustls", "dep:tokio-rustls", "dep:rustls-native-ce
 scoped_cache = []
 cloud = []
 dev_override = []
-openidconnect = ["dep:openidconnect"]
+openidconnect = ["dep:openidconnect", "dep:rsa", "dep:p256"]
 python = ["dep:windmill-parser-py"]
 
 [lib]
@@ -33,6 +33,7 @@ path = "src/lib.rs"
 tar.workspace = true
 hmac.workspace = true
 sha2.workspace = true
+ryu-js.workspace = true
 sha1.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
@@ -115,9 +116,11 @@ pep440_rs.workspace = true
 systemstat.workspace = true
 size.workspace = true
 rsa = { workspace = true, optional = true }
+p256 = { workspace = true, optional = true }
 spki = { workspace = true }
 pkcs1 = { workspace = true }
-aes-gcm = { workspace = true, optional = true }
+aes-gcm.workspace = true
+hkdf.workspace = true
 
 semver.workspace = true
 croner.workspace = true
diff --git a/backend/windmill-common/src/apps.rs b/backend/windmill-common/src/apps.rs
index 36b2d9b704..1686c20d2b 100644
--- a/backend/windmill-common/src/apps.rs
+++ b/backend/windmill-common/src/apps.rs
@@ -18,6 +18,59 @@ lazy_static::lazy_static! {
     pub static ref APP_WORKSPACED_ROUTE: AtomicBool = AtomicBool::new(false);
 }
 
+/// Whether the app value carries an `inlineScript` anywhere.
+///
+/// Deliberately not built on [`traverse_app_inline_scripts`], which only reports a script whose
+/// `language` parses and stops descending as soon as it sees an `inlineScript` key. That is right
+/// for locking (nothing to lock without a language) and wrong for an authorization check, where
+/// the author picks the fields: this refuses the key itself, whatever it contains.
+pub fn app_value_has_inline_script(value: &Value) -> bool {
+    match value {
+        Value::Object(object) => {
+            object.contains_key("inlineScript") || object.values().any(app_value_has_inline_script)
+        }
+        Value::Array(array) => array.iter().any(app_value_has_inline_script),
+        _ => false,
+    }
+}
+
+/// Every workspace runnable the app value points a component at, as `(is_flow, path)`.
+///
+/// This is what the deployed bundle actually asks `execute_component` to run: it resolves a
+/// `runnable_id` against the stored `runnables` and sends `{runType}/{path}`. The policy's
+/// triggerables are a separate surface, so both have to be authorized. Anything not plain text
+/// is refused, never skipped: the editor compares `type` loosely (`["path"] == "path"`) and
+/// interpolates `path` (`["u/x"]` → `u/x`), so a skipped entry still runs.
+pub fn app_value_runnable_paths(value: &Value) -> error::Result<Vec<(bool, String)>> {
+    let bad = |msg: String| error::Error::BadRequest(msg);
+    let runnables = match value.get("runnables") {
+        None | Some(Value::Null) => return Ok(vec![]),
+        Some(Value::Object(runnables)) => runnables,
+        Some(_) => return Err(bad("App runnables must be an object".to_string())),
+    };
+    let mut out = Vec::new();
+    for (id, runnable) in runnables {
+        let Value::Object(runnable) = runnable else {
+            return Err(bad(format!("Runnable {id} must be an object")));
+        };
+        match runnable.get("type") {
+            Some(Value::String(t)) if t == "runnableByPath" || t == "path" => {}
+            None | Some(Value::String(_)) => continue,
+            Some(_) => return Err(bad(format!("Runnable {id} has a non-text type"))),
+        }
+        let Some(Value::String(path)) = runnable.get("path") else {
+            return Err(bad(format!("Runnable {id} must name its path as text")));
+        };
+        let is_flow = match runnable.get("runType") {
+            Some(Value::String(t)) if t == "flow" => true,
+            Some(Value::String(t)) if t == "script" || t == "hubscript" => false,
+            _ => return Err(bad(format!("Unsupported runType for runnable {path}"))),
+        };
+        out.push((is_flow, path.clone()));
+    }
+    Ok(out)
+}
+
 /// Traverse FlowValue while invoking provided by caller callback on leafs
 // #[async_recursion::async_recursion(?Send)]
 pub fn traverse_app_inline_scripts<
diff --git a/backend/windmill-common/src/auth.rs b/backend/windmill-common/src/auth.rs
index 86b7f173ac..17310bdbbc 100644
--- a/backend/windmill-common/src/auth.rs
+++ b/backend/windmill-common/src/auth.rs
@@ -362,6 +362,10 @@ pub struct JobPerms {
     pub groups: Vec<String>,
     pub folders: Vec<serde_json::Value>,
     pub end_user_email: Option<String>,
+    /// The job's effective scopes, stored on its `job_perms` row at push and minted into its
+    /// token.
+    #[serde(default)]
+    pub job_token_scopes: Option<Vec<String>>,
 }
 
 impl From<JobPerms> for Authed {
@@ -654,7 +658,9 @@ pub async fn get_job_perms<'a, E: sqlx::PgExecutor<'a>>(
 ) -> sqlx::Result<Option<JobPerms>> {
     sqlx::query_as!(
         JobPerms,
-        "SELECT email, username, is_admin, is_operator, groups, folders, end_user_email FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
+        "SELECT email, username, is_admin, is_operator, groups, folders, end_user_email,
+            job_token_scopes
+        FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
         job_id,
         w_id
     )
@@ -745,17 +751,29 @@ pub async fn create_token_for_owner(
     } else {
         get_job_perms(db, job_id, w_id).await
     };
-    let job_authed = match job_perms {
-        Ok(Some(jp)) => jp.into(),
-        _ => {
+    let (job_authed, job_token_scopes) = match job_perms {
+        Ok(Some(mut jp)) => {
+            let scopes = jp.job_token_scopes.take();
+            (jp.into(), scopes)
+        }
+        // A failed read must not mint as if the job had no row: that would drop its restriction.
+        Err(e) => {
+            return Err(Error::internal_err(format!(
+                "Could not read permissions for job {job_id}: {e:#}"
+            )))
+        }
+        // Push writes a job's `job_perms` row and its scopes in one statement, so a job with no
+        // row was never restricted.
+        Ok(None) => {
             tracing::warn!("Could not get permissions for job {job_id} from job_perms table, getting permissions directly...");
-            fetch_authed_from_permissioned_as(owner, email, w_id, db)
+            let authed = fetch_authed_from_permissioned_as(owner, email, w_id, db)
                 .await
                 .map_err(|e| {
                     Error::internal_err(format!(
                         "Could not get permissions directly for job {job_id}: {e:#}"
                     ))
-                })?
+                })?;
+            (authed, None)
         }
     };
 
@@ -766,7 +784,7 @@ pub async fn create_token_for_owner(
         Some(*job_id),
         Some(label.to_string()),
         audit_span,
-        None,
+        crate::scopes::job_token_jwt_scopes(job_token_scopes),
     )
     .await
 }
diff --git a/backend/windmill-common/src/client.rs b/backend/windmill-common/src/client.rs
index 48f3e0205b..985d3bbbfc 100644
--- a/backend/windmill-common/src/client.rs
+++ b/backend/windmill-common/src/client.rs
@@ -307,12 +307,13 @@ impl AuthedClient {
         workspace_id: &str,
         file_key: &str,
         storage: Option<String>,
+        max_bytes: Option<usize>,
     ) -> anyhow::Result<bytes::Bytes> {
         let mut query = vec![("file_key", file_key.to_string())];
         if let Some(storage) = storage {
             query.push(("storage", storage));
         }
-        let response = self
+        let mut response = self
             .force_client
             .as_ref()
             .unwrap_or(&HTTP_CLIENT)
@@ -331,6 +332,39 @@ impl AuthedClient {
             .context("Failed to send download_s3_file request")
             .map_err(|e| anyhow::anyhow!(e.to_string()))?;
 
+        if let Some(max_bytes) = max_bytes {
+            let size_error = || {
+                anyhow::anyhow!(
+                    "S3 file '{file_key}' exceeds maximum supported download size of {max_bytes} bytes"
+                )
+            };
+            if response
+                .content_length()
+                .is_some_and(|len| len > max_bytes as u64)
+            {
+                return Err(size_error());
+            }
+
+            let status = response.status();
+            let mut bytes = Vec::new();
+            // Content-Length may be absent (including for decoded compressed responses).
+            while let Some(chunk) = response
+                .chunk()
+                .await
+                .context("Failed to read response bytes")?
+            {
+                if chunk.len() > max_bytes - bytes.len() {
+                    return Err(size_error());
+                }
+                bytes.extend_from_slice(&chunk);
+            }
+            return if status == reqwest::StatusCode::OK {
+                Ok(bytes.into())
+            } else {
+                Err(anyhow::anyhow!(String::from_utf8_lossy(&bytes).into_owned()))
+            };
+        }
+
         match response.status().as_u16() {
             200u16 => Ok(response
                 .bytes()
@@ -341,6 +375,78 @@ impl AuthedClient {
     }
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::Duration;
+    use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+
+    async fn download_response(
+        response: &'static str,
+        max_bytes: Option<usize>,
+    ) -> anyhow::Result<bytes::Bytes> {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let client = AuthedClient::new(
+            format!("http://{}", listener.local_addr().unwrap()),
+            "test_ws".to_string(),
+            "test_token".to_string(),
+            Some(reqwest::Client::builder().no_proxy().build().unwrap()),
+        );
+        let server = tokio::spawn(async move {
+            let (socket, _) = listener.accept().await.unwrap();
+            let mut socket = BufReader::new(socket);
+            loop {
+                let mut line = String::new();
+                assert!(socket.read_line(&mut line).await.unwrap() > 0);
+                if line == "\r\n" {
+                    break;
+                }
+            }
+            socket
+                .get_mut()
+                .write_all(response.as_bytes())
+                .await
+                .unwrap();
+            // Keep incomplete bodies open so rejection must happen before EOF.
+            std::future::pending::<()>().await;
+        });
+        let result = tokio::time::timeout(
+            Duration::from_secs(5),
+            client.download_s3_file("test_ws", "image.png", None, max_bytes),
+        )
+        .await;
+        server.abort();
+        result.expect("download waited for the oversized body to finish")
+    }
+
+    #[tokio::test]
+    async fn download_s3_file_rejects_oversized_body_before_eof() {
+        for response in [
+            "HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n",
+            "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n4\r\nabcd\r\n1\r\ne\r\n",
+            "HTTP/1.1 500 Internal Server Error\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nerror\r\n",
+        ] {
+            let error = download_response(response, Some(4)).await.unwrap_err();
+            assert!(error.to_string().contains(
+                "S3 file 'image.png' exceeds maximum supported download size of 4 bytes"
+            ));
+        }
+    }
+
+    #[tokio::test]
+    async fn download_s3_file_accepts_body_at_limit() {
+        for response in [
+            "HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\nabcd",
+            "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n4\r\nabcd\r\n0\r\n\r\n",
+        ] {
+            assert_eq!(
+                download_response(response, Some(4)).await.unwrap(),
+                &b"abcd"[..]
+            );
+        }
+    }
+}
+
 #[inline]
 fn query_from_json_path(json_path: Option<String>) -> Vec<(&'static str, String)> {
     json_path
diff --git a/backend/windmill-common/src/datatable_roles.rs b/backend/windmill-common/src/datatable_roles.rs
index f355e733cb..522327040d 100644
--- a/backend/windmill-common/src/datatable_roles.rs
+++ b/backend/windmill-common/src/datatable_roles.rs
@@ -72,6 +72,11 @@ impl DatatableRoleCluster {
 /// created, renamed or dropped.
 pub const ADMIN_DATATABLE_ROLE: &str = "admin";
 
+/// Stands in a data table's `default_role` for "none": a connection that names no role then holds
+/// its viewer's roles only, and is refused without any. `$` is outside both the role-name charset
+/// and the catalog ids, and a server predating it refuses it as a role the data table lacks.
+pub const NO_DEFAULT_DATATABLE_ROLE: &str = "$none";
+
 /// The login the admin connection uses, and the role every created role is granted to — that
 /// membership is what later lets it `ALTER ... OWNER TO` a role and drop it.
 pub const CUSTOM_INSTANCE_USER: &str = "custom_instance_user";
@@ -121,8 +126,13 @@ fn is_reserved_role_name(name: &str) -> bool {
         || lower.starts_with("pg_")
         || lower.starts_with("windmill_")
         || lower.starts_with("custom_instance_")
+        || lower.starts_with(ROLE_SET_LOGIN_PREFIX)
 }
 
+/// Prefix of the logins Windmill creates for a connection made as several roles at once. Reserved,
+/// so no data table role can be created under, renamed to or taken over at such a name.
+pub const ROLE_SET_LOGIN_PREFIX: &str = "wm_set_";
+
 /// The charset is what makes every downstream interpolation safe: the name reaches Postgres as a
 /// quoted identifier, a `-- role <name>` annotation, and a `?role=` query parameter.
 pub fn validate_role_name(name: &str) -> Result<()> {
@@ -331,6 +341,12 @@ pub async fn converge_connect_grants_with(
 /// `CREATE ROLE <name> LOGIN PASSWORD ...; GRANT <name> TO custom_instance_user` on `cluster`. No
 /// privileges beyond that — an admin grants them through SQL or the ACL editor.
 ///
+/// A role of that name that already exists is refused with a 409, unless `take_over`: then its
+/// password is replaced and it is managed from here on like one created here. A role holding
+/// cluster-wide privileges, or inheriting another role's, is refused either way, since every tenant
+/// would get them. Returns whether an existing role was taken over: undoing a failed take-over
+/// must not drop a role that was there before.
+///
 /// On Windmill's own cluster the DDL runs on `tx`, so it commits with the catalog row. The external
 /// cluster is another server: the role is created there before `tx` commits, and callers MUST drop
 /// it again ([`drop_datatable_role`]) if `tx` then fails to commit.
@@ -343,8 +359,10 @@ pub async fn create_datatable_role(
     cluster: DatatableRoleCluster,
     name: &str,
     password: &str,
-) -> Result<()> {
-    crate::datatable_roles_oss::create_datatable_role(db, tx, cluster, name, password).await
+    take_over: bool,
+) -> Result<bool> {
+    crate::datatable_roles_oss::create_datatable_role(db, tx, cluster, name, password, take_over)
+        .await
 }
 
 /// Authorization: alters a cluster-wide Postgres login. Callers MUST restrict this to superadmin
@@ -406,6 +424,13 @@ pub async fn drop_datatable_role(
     crate::datatable_roles_oss::drop_datatable_role(db, tx, cluster, name).await
 }
 
+/// Drop the logins made for a connection as several roles at once that nobody has connected with
+/// for a month, on every cluster. They are made again on demand, so this only bounds how many
+/// exist. Safe to call from any server at any time: it serializes on the role catalog lock.
+pub async fn sweep_unused_role_set_logins(db: &DB) -> Result<()> {
+    crate::datatable_roles_oss::sweep_unused_role_set_logins(db).await
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/backend/windmill-common/src/datatable_roles_oss.rs b/backend/windmill-common/src/datatable_roles_oss.rs
index a97a936827..739f08d60b 100644
--- a/backend/windmill-common/src/datatable_roles_oss.rs
+++ b/backend/windmill-common/src/datatable_roles_oss.rs
@@ -29,7 +29,8 @@ pub(crate) use crate::datatable_roles_ee::{
     ensure_instance_db_grant_options_unchecked, forget_datatable_role_everywhere,
     insert_role_catalog_entry, read_role_catalog, read_role_catalog_tx,
     registered_instance_databases, rename_datatable_role, resolve_datatable_role_connection,
-    role_cluster, set_datatable_role_login, update_role_catalog_entry,
+    role_cluster, set_datatable_role_login, sweep_unused_role_set_logins,
+    update_role_catalog_entry,
 };
 
 #[cfg(not(all(feature = "private", feature = "enterprise")))]
@@ -125,7 +126,8 @@ mod ce {
         _cluster: DatatableRoleCluster,
         _name: &str,
         _password: &str,
-    ) -> Result<()> {
+        _take_over: bool,
+    ) -> Result<bool> {
         Err(unavailable())
     }
 
@@ -234,6 +236,11 @@ mod ce {
         }
     }
 
+    /// No roles, so no set login to sweep.
+    pub(crate) async fn sweep_unused_role_set_logins(_db: &DB) -> Result<()> {
+        Ok(())
+    }
+
     pub(crate) async fn forget_datatable_role_everywhere(
         _tx: &mut Tx<'_>,
         _role_id: &str,
diff --git a/backend/windmill-common/src/external_instance_pg.rs b/backend/windmill-common/src/external_instance_pg.rs
index c0b6203e40..72920a1874 100644
--- a/backend/windmill-common/src/external_instance_pg.rs
+++ b/backend/windmill-common/src/external_instance_pg.rs
@@ -198,7 +198,8 @@ pub async fn external_instance_database_usages<'c>(
 /// would be a login nothing can drop any more. Allowed on every edition, so a
 /// downgraded instance can still clear a setting it no longer uses.
 async fn ensure_external_instance_pg_removable(conn: &mut sqlx::PgConnection) -> Result<()> {
-    ensure_external_instance_pg_unused(conn, &format!("removing {EXTERNAL_INSTANCE_PG_SETTING}")).await
+    ensure_external_instance_pg_unused(conn, &format!("removing {EXTERNAL_INSTANCE_PG_SETTING}"))
+        .await
 }
 
 /// Refuse while Windmill has databases or data table roles on the cluster, or a workspace points
@@ -394,16 +395,21 @@ pub async fn write_external_instance_pg_setting(
 }
 
 /// [`write_external_instance_pg_setting`] for a settings diff: writes the key if the diff touches
-/// it, and takes it out of the diff so the generic apply does not write it again.
+/// it, and takes it out of the diff so the generic apply does not write it again. `observer` is
+/// told of the write here, since the generic apply no longer sees the key.
 ///
 /// Authorization: checks nothing. Callers MUST be superadmin, or the declarative instance config
 /// sync, which applies what the operator deployed.
 pub async fn write_external_instance_pg_from_diff(
     db: &DB,
     diff: &mut crate::instance_config::SettingsDiff,
+    observer: &impl crate::instance_config::ConfigWriteObserver,
 ) -> Result<()> {
     if let Some(value) = diff.upserts.remove(EXTERNAL_INSTANCE_PG_SETTING) {
         write_external_instance_pg_setting(db, Some(&value)).await?;
+        observer
+            .setting_written(EXTERNAL_INSTANCE_PG_SETTING, Some(&value))
+            .await?;
     }
     if let Some(i) = diff
         .deletes
@@ -412,6 +418,9 @@ pub async fn write_external_instance_pg_from_diff(
     {
         diff.deletes.remove(i);
         write_external_instance_pg_setting(db, None).await?;
+        observer
+            .setting_written(EXTERNAL_INSTANCE_PG_SETTING, None)
+            .await?;
     }
     Ok(())
 }
diff --git a/backend/windmill-common/src/flow_conversations.rs b/backend/windmill-common/src/flow_conversations.rs
index 5ee99d0681..bde4d5ccce 100644
--- a/backend/windmill-common/src/flow_conversations.rs
+++ b/backend/windmill-common/src/flow_conversations.rs
@@ -278,6 +278,8 @@ pub async fn add_message_to_conversation_tx(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     conversation_id: Uuid,
     job_id: Option<Uuid>,
+    // The flow run the user message started; retention deletes the turn's rows by it.
+    turn_job_id: Uuid,
     content: &str,
     message_type: MessageType,
     step_name: Option<&str>,
@@ -303,12 +305,13 @@ pub async fn add_message_to_conversation_tx(
 
     // Insert the message
     sqlx::query!(
-        "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+        "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, turn_job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)",
         conversation_id,
         message_type as MessageType,
         content,
         job_id,
+        turn_job_id,
         step_name,
         success,
         extras.and_then(|e| e.tool_arguments.as_deref()),
diff --git a/backend/windmill-common/src/flows.rs b/backend/windmill-common/src/flows.rs
index b392dda89a..222694aeac 100644
--- a/backend/windmill-common/src/flows.rs
+++ b/backend/windmill-common/src/flows.rs
@@ -357,6 +357,8 @@ fn check_module_value_is_composition_only(
                 }
             }
         }
+        // Runs no code: it sends its inputs to the decision model.
+        FlowModuleValue::AIDecision { tag, .. } => push_tag(tag),
     }
     Ok(())
 }
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index 9137dc364e..2bc303f5c2 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -9,6 +9,7 @@ pub const DEFAULT_TAGS_WORKSPACES_SETTING: &str = "default_tags_workspaces";
 pub const FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING: &str =
     "fork_workspace_tag_append_fork_suffix";
 pub const PREVIEW_TAGS_OVERRIDE_SETTING: &str = "preview_tags_override";
+pub const DEPENDENCY_JOB_TAG_SETTING: &str = "dependency_job_tag";
 pub const BASE_URL_SETTING: &str = "base_url";
 pub const WS_BASE_URL_SETTING: &str = "ws_base_url";
 pub const OAUTH_SETTING: &str = "oauths";
@@ -157,6 +158,7 @@ pub const SSO_GROUPS_CLAIM_SETTING: &str = "sso_groups_claim";
 pub const HUB_BASE_URL_SETTING: &str = "hub_base_url";
 pub const HUB_ACCESSIBLE_URL_SETTING: &str = "hub_accessible_url";
 pub const DISABLE_HUB_SETTING: &str = "disable_hub";
+pub const SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING: &str = "sync_hub_resource_types_daily";
 pub const CRITICAL_ERROR_CHANNELS_SETTING: &str = "critical_error_channels";
 pub const CRITICAL_ALERT_MUTE_UI_SETTING: &str = "critical_alert_mute_ui";
 pub const CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING: &str = "critical_alerts_on_db_oversize";
@@ -180,6 +182,12 @@ pub const GITHUB_ENTERPRISE_APP_SETTING: &str = "github_enterprise_app";
 /// `base_url` when unset; set it when the browser-facing URL is not reachable
 /// from GitHub and a separate ingress fronts the API for inbound webhooks.
 pub const GITHUB_APP_WEBHOOK_BASE_URL_SETTING: &str = "github_app_webhook_base_url";
+/// Base URL the UI shows for the endpoints external clients call (webhooks, HTTP
+/// routes, push trigger endpoints, the CLI), instead of the origin the UI is browsed on.
+/// For deployments that serve the API on a separate domain or behind a gateway.
+/// EE only. Readable by any authenticated user, like [`INSTANCE_BANNER_SETTING`]:
+/// every user is shown URLs built from it.
+pub const API_BASE_URL_SETTING: &str = "api_base_url";
 /// Instance-wide announcement rendered above every page of the app (maintenance
 /// windows, incidents). Readable by any authenticated user, unlike most settings:
 /// the banner exists to be shown to everyone, so it must never hold anything the
@@ -312,12 +320,17 @@ pub fn validate_accent_color(value: &serde_json::Value) -> Result<(), String> {
 pub struct InstanceUi {
     pub instance_banner: Option<serde_json::Value>,
     pub accent_color: Option<serde_json::Value>,
+    pub api_base_url: Option<serde_json::Value>,
 }
 
 pub async fn get_instance_ui(db: &Pool<Postgres>) -> error::Result<InstanceUi> {
     let rows = sqlx::query!(
         "SELECT name, value FROM global_settings WHERE name = ANY($1)",
-        &[INSTANCE_BANNER_SETTING, ACCENT_COLOR_SETTING] as &[&str]
+        &[
+            INSTANCE_BANNER_SETTING,
+            ACCENT_COLOR_SETTING,
+            API_BASE_URL_SETTING
+        ] as &[&str]
     )
     .fetch_all(db)
     .await?;
@@ -326,17 +339,22 @@ pub async fn get_instance_ui(db: &Pool<Postgres>) -> error::Result<InstanceUi> {
         match row.name.as_str() {
             INSTANCE_BANNER_SETTING => ui.instance_banner = Some(row.value),
             ACCENT_COLOR_SETTING => ui.accent_color = Some(row.value),
+            API_BASE_URL_SETTING => ui.api_base_url = Some(row.value),
             _ => {}
         }
     }
     Ok(ui)
 }
 
-/// Validate a [`GITHUB_APP_WEBHOOK_BASE_URL_SETTING`] value.
+const SHELL_ACTIVE_CHARS: [char; 16] = [
+    '$', '`', '\'', '"', '\\', ';', '&', '|', '<', '>', '(', ')', '{', '}', '*', '!',
+];
+
+/// Validate a [`GITHUB_APP_WEBHOOK_BASE_URL_SETTING`] or [`API_BASE_URL_SETTING`] value.
 ///
-/// The receiver path is appended to it verbatim, so anything that doesn't
-/// concatenate into a URL GitHub can POST to must be rejected at write time
-/// rather than silently producing an unreachable hook: a wrong scheme
+/// A path is appended to it verbatim, so anything that doesn't concatenate into a
+/// URL an external caller can reach must be rejected at write time rather than
+/// silently producing an unreachable hook or endpoint: a wrong scheme
 /// (`httpss://`), a missing host, embedded whitespace, or a query/fragment
 /// (appending a path after `?`/`#` keeps it inside the query/fragment).
 ///
@@ -352,7 +370,7 @@ pub fn validate_webhook_base_url(value: &str) -> Result<(), String> {
         url::Url::parse(value).map_err(|e| format!("must be an absolute http(s) URL: {e}"))?;
     if !url.username().is_empty() || url.password().is_some() {
         return Err(
-            "must not embed a username or password: the receiver URL is stored in workspace settings, where it is readable by workspace admins".to_string(),
+            "must not embed a username or password: the URL is readable by users who are not instance admins".to_string(),
         );
     }
     if !matches!(url.scheme(), "http" | "https") {
@@ -365,13 +383,21 @@ pub fn validate_webhook_base_url(value: &str) -> Result<(), String> {
     }
     if url.query().is_some() || url.fragment().is_some() {
         return Err(
-            "must not include a query string or fragment, since the webhook path is appended to it"
+            "must not include a query string or fragment, since a path is appended to it"
                 .to_string(),
         );
     }
     if value.chars().any(char::is_whitespace) {
         return Err("must not contain whitespace".to_string());
     }
+    // The UI pastes the URL into shell commands users copy, where double quotes
+    // do not stop `$(...)` or backticks from running.
+    if value.contains(SHELL_ACTIVE_CHARS) {
+        return Err(
+            "must not contain shell metacharacters, since it is shown inside commands users copy"
+                .to_string(),
+        );
+    }
     // Matches the sibling `base_url` / `hub_base_url` convention. The receiver
     // builder trims it anyway, so this is about keeping the stored value canonical
     // rather than about reachability.
@@ -430,8 +456,9 @@ pub const CANCEL_STRANDED_JOBS_AFTER_DAYS_SETTING: &str = "cancel_stranded_jobs_
 /// server keeps to itself, add it here.
 pub const AGENT_WORKER_BLOCKED_SETTINGS: &[&str] = &[
     // Instance identity / auth secrets — disclosure enables privilege escalation
-    // or impersonation.
+    // or impersonation. `rsa_keys` signs job OIDC tokens; only the server mints them.
     JWT_SECRET_SETTING,
+    "rsa_keys",
     OAUTH_SETTING,
     SMTP_SETTING,
     SCIM_TOKEN_SETTING,
@@ -1099,6 +1126,9 @@ mod tests {
             "https://hooks.example.com#",
             "https://user:password@hooks.example.com",
             "https://user@hooks.example.com",
+            "https://hooks.example.com/$(uname)",
+            "https://hooks.example.com/`uname`",
+            "https://hooks.example.com/a;b",
         ];
         for v in accept {
             assert!(
@@ -1143,6 +1173,7 @@ mod tests {
         // secrets. They must never be served by the agent-worker endpoint.
         for key in [
             JWT_SECRET_SETTING,
+            "rsa_keys",
             OAUTH_SETTING,
             SMTP_SETTING,
             SCIM_TOKEN_SETTING,
diff --git a/backend/windmill-common/src/hub_resource_types.rs b/backend/windmill-common/src/hub_resource_types.rs
new file mode 100644
index 0000000000..88de520094
--- /dev/null
+++ b/backend/windmill-common/src/hub_resource_types.rs
@@ -0,0 +1,578 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Keeps the `admins` workspace's resource types, which every workspace falls back to, in
+//! step with the hub. Servers run [`spawn_daily_sync`] once a superadmin turns it on,
+//! superadmins run [`sync`] on demand, and `windmill cache-rt` bakes the public hub's listing
+//! into the image for instances that cannot reach a hub.
+
+use std::collections::HashMap;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+
+use crate::{
+    error::{Error, Result},
+    global_settings::{
+        load_value_from_global_settings, DISABLE_HUB_SETTING, SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING,
+    },
+    utils::{get_license_id_or_uid, HTTP_CLIENT_PERMISSIVE, HUB_API_SECRET},
+    worker::HUB_RT_CACHE_DIR,
+    DB, DEFAULT_HUB_BASE_URL, HUB_BASE_URL,
+};
+
+const SYNC_INTERVAL: chrono::TimeDelta = chrono::TimeDelta::hours(24);
+const RETRY_INTERVAL: chrono::TimeDelta = chrono::TimeDelta::hours(1);
+const CHECK_INTERVAL: std::time::Duration = std::time::Duration::from_secs(600);
+const SYNC_LOCK_ID: i64 = 737_483_925;
+/// `background_task_state.name` of the sync's last attempt and last hub sync.
+const SYNC_STATE_TASK: &str = "hub_resource_type_sync";
+
+pub fn cache_path() -> String {
+    format!("{}/resource_types.json", *HUB_RT_CACHE_DIR)
+}
+
+/// A hub resource type with its schema parsed, as synced and as `cache-rt` stores it.
+///
+/// `format_extension` and `display_name` are doubly optional: no key (a cache written before
+/// the field) leaves the stored value alone, while an explicit null clears it. Plain serde
+/// folds both into `None`, hence the wrapping deserializer.
+#[derive(Deserialize, Serialize, Clone)]
+pub struct HubResourceType {
+    pub name: String,
+    pub schema: Option<serde_json::Value>,
+    pub description: Option<String>,
+    #[serde(
+        default,
+        deserialize_with = "crate::more_serde::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub format_extension: Option<Option<String>>,
+    #[serde(
+        default,
+        deserialize_with = "crate::more_serde::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub display_name: Option<Option<String>>,
+    /// Absent from hubs that do not publish filesets, which leaves the stored flag alone.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub is_fileset: Option<bool>,
+}
+
+/// An entry of the hub's `/resource_types/list`, whose schema is a JSON string.
+#[derive(Deserialize)]
+struct HubListing {
+    name: String,
+    schema: Option<String>,
+    description: Option<String>,
+    /// Absent from hubs predating the column, which do not publish file types either, so
+    /// the hub is authoritative for it whether or not it sends the key.
+    #[serde(default)]
+    format_extension: Option<String>,
+    #[serde(default, deserialize_with = "crate::more_serde::double_option")]
+    display_name: Option<Option<String>>,
+    #[serde(default)]
+    is_fileset: Option<bool>,
+}
+
+/// One hub's listing. A type whose schema does not parse is left out.
+pub async fn fetch(
+    hub_base_url: &str,
+    api_secret: Option<&str>,
+    uid: Option<&str>,
+) -> Result<Vec<HubResourceType>> {
+    // Permissive, so `ACCEPT_INVALID_CERTS` lets the sync reach a private hub behind a
+    // self-signed certificate.
+    let mut request = HTTP_CLIENT_PERMISSIVE
+        .get(format!("{hub_base_url}/resource_types/list"))
+        .header("Accept", "application/json");
+    if let Some(uid) = uid {
+        request = request.header("X-uid", uid);
+    }
+    if let Some(secret) = api_secret {
+        request = request.header("X-api-secret", secret);
+    }
+    let response = request.send().await.map_err(|e| {
+        Error::InternalErr(format!("Failed to reach the hub at {hub_base_url}: {e}"))
+    })?;
+    let status = response.status();
+    if status == reqwest::StatusCode::UNAUTHORIZED {
+        return Err(Error::InternalErr(format!(
+            "The hub at {hub_base_url} refused the request: check the Private Hub API secret"
+        )));
+    }
+    if !status.is_success() {
+        return Err(Error::InternalErr(format!(
+            "The hub at {hub_base_url} answered {status}"
+        )));
+    }
+    let listing: Vec<HubListing> = response.json().await.map_err(|e| {
+        Error::InternalErr(format!(
+            "Failed to parse the resource types listed by {hub_base_url}: {e}"
+        ))
+    })?;
+
+    Ok(listing
+        .into_iter()
+        .filter_map(|rt| {
+            let schema = match rt.schema.as_deref().map(serde_json::from_str).transpose() {
+                Ok(schema) => schema,
+                Err(e) => {
+                    tracing::warn!(
+                        "Skipping hub resource type {}: invalid schema: {e}",
+                        rt.name
+                    );
+                    return None;
+                }
+            };
+            Some(HubResourceType {
+                name: rt.name,
+                schema,
+                description: rt.description,
+                format_extension: Some(rt.format_extension),
+                display_name: rt.display_name,
+                is_fileset: rt.is_fileset,
+            })
+        })
+        .collect())
+}
+
+/// The listing of the hub this instance is configured with.
+async fn fetch_configured_hub(db: &DB) -> Result<Vec<HubResourceType>> {
+    let hub = (**HUB_BASE_URL.load()).clone();
+    let uid = get_license_id_or_uid(db).await.ok();
+    if hub == DEFAULT_HUB_BASE_URL {
+        return fetch(&hub, None, uid.as_deref()).await;
+    }
+    let secret = (**HUB_API_SECRET.load()).clone();
+    let types = fetch(&hub, secret.as_deref(), uid.as_deref()).await?;
+    if !types.is_empty() {
+        return Ok(types);
+    }
+    // A private hub that publishes no resource types of its own defers to the public one,
+    // which must not be sent the private hub's secret.
+    tracing::info!("The hub at {hub} lists no resource types, syncing the public hub's");
+    fetch(DEFAULT_HUB_BASE_URL, None, uid.as_deref()).await
+}
+
+#[derive(PartialEq, Debug)]
+struct ResourceTypeRow {
+    schema: Option<serde_json::Value>,
+    description: Option<String>,
+    format_extension: Option<String>,
+    is_fileset: bool,
+    display_name: Option<String>,
+}
+
+/// The row a synced type should end up as, given what `admins` already stores for it.
+fn target_row(rt: &HubResourceType, stored: Option<&ResourceTypeRow>) -> ResourceTypeRow {
+    let is_fileset = rt
+        .is_fileset
+        .unwrap_or_else(|| stored.is_some_and(|s| s.is_fileset));
+    // A fileset is a set of files, so it cannot also be one file. Create and update reject
+    // the pair; this writer bypasses both.
+    let format_extension = if is_fileset {
+        None
+    } else {
+        match &rt.format_extension {
+            Some(extension) => extension.clone(),
+            None => stored.and_then(|s| s.format_extension.clone()),
+        }
+    };
+    // A name too long for the column counts as absent: one bad entry must not fail the
+    // upsert and end the rest of the sync.
+    let display_name = match &rt.display_name {
+        Some(Some(name)) if name.chars().count() > 100 => {
+            tracing::warn!(
+                "Ignoring the display_name of resource type {}: longer than 100 characters",
+                rt.name
+            );
+            stored.and_then(|s| s.display_name.clone())
+        }
+        Some(name) => name.clone(),
+        None => stored.and_then(|s| s.display_name.clone()),
+    };
+    ResourceTypeRow {
+        schema: rt.schema.clone(),
+        description: rt.description.clone(),
+        format_extension,
+        is_fileset,
+        display_name,
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Debug)]
+pub enum SyncSource {
+    Hub,
+    ImageCache,
+}
+
+pub struct SyncOutcome {
+    pub source: SyncSource,
+    /// Every type the source listed, changed or not.
+    pub listed: Vec<String>,
+    /// The types this sync created or updated.
+    pub changed: Vec<String>,
+}
+
+impl SyncOutcome {
+    pub fn summary(&self) -> String {
+        let synced = self.changed.len();
+        let unchanged = self.listed.len() - synced;
+        match self.source {
+            SyncSource::Hub => {
+                format!("Synced {synced} resource types from the hub ({unchanged} unchanged)")
+            }
+            SyncSource::ImageCache => format!(
+                "Synced {synced} resource types from the image's cache ({unchanged} unchanged)"
+            ),
+        }
+    }
+}
+
+async fn apply(db: &DB, source: SyncSource, types: &[HubResourceType]) -> Result<SyncOutcome> {
+    let stored: HashMap<String, ResourceTypeRow> = sqlx::query_as::<
+        _,
+        (
+            String,
+            Option<serde_json::Value>,
+            Option<String>,
+            Option<String>,
+            bool,
+            Option<String>,
+        ),
+    >(
+        "SELECT name, schema, description, format_extension, is_fileset, display_name
+         FROM resource_type WHERE workspace_id = 'admins'",
+    )
+    .fetch_all(db)
+    .await?
+    .into_iter()
+    .map(
+        |(name, schema, description, format_extension, is_fileset, display_name)| {
+            (
+                name,
+                ResourceTypeRow { schema, description, format_extension, is_fileset, display_name },
+            )
+        },
+    )
+    .collect();
+
+    let mut changed = vec![];
+    for rt in types {
+        let current = stored.get(&rt.name);
+        let target = target_row(rt, current);
+        if current == Some(&target) {
+            continue;
+        }
+        sqlx::query(
+            "INSERT INTO resource_type
+                (workspace_id, name, schema, description, format_extension, is_fileset, display_name, edited_at)
+             VALUES ('admins', $1, $2, $3, $4, $5, $6, now())
+             ON CONFLICT (workspace_id, name) DO UPDATE
+             SET schema = EXCLUDED.schema, description = EXCLUDED.description,
+                 format_extension = EXCLUDED.format_extension, is_fileset = EXCLUDED.is_fileset,
+                 display_name = EXCLUDED.display_name, edited_at = now()",
+        )
+        .bind(&rt.name)
+        .bind(&target.schema)
+        .bind(&target.description)
+        .bind(&target.format_extension)
+        .bind(target.is_fileset)
+        .bind(&target.display_name)
+        .execute(db)
+        .await?;
+        changed.push(rt.name.clone());
+    }
+
+    Ok(SyncOutcome { source, listed: types.iter().map(|rt| rt.name.clone()).collect(), changed })
+}
+
+#[derive(Deserialize, Default)]
+struct SyncState {
+    last_attempt_at: Option<DateTime<Utc>>,
+    last_hub_sync_at: Option<DateTime<Utc>>,
+}
+
+async fn load_state(db: &DB) -> Result<SyncState> {
+    let value: Option<serde_json::Value> =
+        sqlx::query_scalar("SELECT value FROM background_task_state WHERE name = $1")
+            .bind(SYNC_STATE_TASK)
+            .fetch_optional(db)
+            .await?;
+    Ok(value
+        .and_then(|v| serde_json::from_value(v).ok())
+        .unwrap_or_default())
+}
+
+/// Merged into the stored state, so a writer only ever sets the keys it names.
+async fn record_state(db: &DB, patch: serde_json::Value) -> Result<()> {
+    sqlx::query(
+        "INSERT INTO background_task_state (name, value) VALUES ($1, $2)
+         ON CONFLICT (name) DO UPDATE
+         SET value = background_task_state.value || EXCLUDED.value, updated_at = now()",
+    )
+    .bind(SYNC_STATE_TASK)
+    .bind(patch)
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+async fn setting_enabled(db: &DB, name: &str) -> Result<bool> {
+    Ok(load_value_from_global_settings(db, name)
+        .await?
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false))
+}
+
+/// Syncs from the configured hub and records the attempt, successful or not.
+async fn sync_from_hub(db: &DB) -> Result<SyncOutcome> {
+    let attempted_at = Utc::now();
+    let result = match fetch_configured_hub(db).await {
+        Ok(types) => apply(db, SyncSource::Hub, &types).await,
+        Err(e) => Err(e),
+    };
+    let state = match &result {
+        Ok(_) => {
+            json!({ "last_attempt_at": attempted_at, "last_hub_sync_at": attempted_at, "last_error": null })
+        }
+        Err(e) => json!({ "last_attempt_at": attempted_at, "last_error": e.to_string() }),
+    };
+    record_state(db, state).await?;
+    result
+}
+
+/// Syncs from the configured hub, falling back to the image's cache when the hub is disabled
+/// or unreachable and the instance has never synced from a hub.
+pub async fn sync(db: &DB) -> Result<SyncOutcome> {
+    let hub_err = if setting_enabled(db, DISABLE_HUB_SETTING).await? {
+        Error::BadRequest("The hub is disabled on this instance".to_string())
+    } else {
+        match sync_from_hub(db).await {
+            Ok(outcome) => return Ok(outcome),
+            Err(e) => e,
+        }
+    };
+    match fall_back_to_image_cache(db, &cache_path()).await? {
+        Some(outcome) => {
+            tracing::warn!("Hub resource type sync failed, used the image's cache: {hub_err}");
+            Ok(outcome)
+        }
+        None => Err(hub_err),
+    }
+}
+
+/// The cache is the listing as of the image's build, so standing in for the hub on an
+/// instance that has synced from one would revert every type the hub has updated since.
+async fn fall_back_to_image_cache(db: &DB, path: &str) -> Result<Option<SyncOutcome>> {
+    if let Some(at) = load_state(db).await?.last_hub_sync_at {
+        tracing::info!(
+            "Not applying the image's cached resource types: synced from the hub at {at}"
+        );
+        return Ok(None);
+    }
+    sync_from_cache_file(db, path).await
+}
+
+/// Applies the listing baked into the image (`SYNC_CACHED_RT`), on every start and whether or
+/// not the instance has synced from a hub: it is how an instance that cannot reach the public
+/// hub, a private hub listing only its own types included, takes each new image's public types.
+/// `None` when the image carries no cache.
+pub async fn sync_from_image_cache(db: &DB) -> Result<Option<SyncOutcome>> {
+    sync_from_cache_file(db, &cache_path()).await
+}
+
+async fn sync_from_cache_file(db: &DB, path: &str) -> Result<Option<SyncOutcome>> {
+    let content = match tokio::fs::read_to_string(path).await {
+        Ok(content) => content,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+            tracing::info!("No cached resource types at {path}");
+            return Ok(None);
+        }
+        Err(e) => {
+            return Err(Error::InternalErr(format!(
+                "Failed to read cached resource types at {path}: {e}"
+            )))
+        }
+    };
+    let types: Vec<HubResourceType> = serde_json::from_str(&content).map_err(|e| {
+        Error::InternalErr(format!(
+            "Failed to parse cached resource types at {path}: {e}"
+        ))
+    })?;
+    Ok(Some(apply(db, SyncSource::ImageCache, &types).await?))
+}
+
+/// While `sync_hub_resource_types_daily` is on, syncs once a day, from whichever server first
+/// finds the sync due. Off by default: each sync overwrites local edits to the `admins` types
+/// the hub also defines. The state it reads lives in the database, so servers starting or
+/// restarting do not each sync again.
+pub fn spawn_daily_sync(db: DB, mut killpill_rx: tokio::sync::broadcast::Receiver<()>) {
+    tokio::spawn(async move {
+        // Leaves time for the hub URL and secret settings to load, and spreads out servers
+        // that start together.
+        let mut wait = std::time::Duration::from_secs(rand::random_range(30..90));
+        loop {
+            tokio::select! {
+                _ = tokio::time::sleep(wait) => {}
+                _ = killpill_rx.recv() => return,
+            }
+            if let Err(e) = sync_if_due(&db).await {
+                tracing::error!("Hub resource type sync: {e:#}");
+            }
+            wait = CHECK_INTERVAL;
+        }
+    });
+}
+
+async fn sync_if_due(db: &DB) -> Result<()> {
+    if !setting_enabled(db, SYNC_HUB_RESOURCE_TYPES_DAILY_SETTING).await?
+        || setting_enabled(db, DISABLE_HUB_SETTING).await?
+    {
+        return Ok(());
+    }
+    // A transaction-scoped lock: a dropped transaction rolls back and releases it, so a
+    // pass cut short cannot leave it held on a pooled connection. The transaction only
+    // owns the lock; the sync runs on other connections.
+    let mut lock_tx = db.begin().await?;
+    let locked: bool = sqlx::query_scalar("SELECT pg_try_advisory_xact_lock($1)")
+        .bind(SYNC_LOCK_ID)
+        .fetch_one(&mut *lock_tx)
+        .await?;
+    if !locked {
+        return Ok(());
+    }
+    let state = load_state(db).await?;
+    let now = Utc::now();
+    let due = state
+        .last_hub_sync_at
+        .is_none_or(|at| now - at >= SYNC_INTERVAL)
+        && state
+            .last_attempt_at
+            .is_none_or(|at| now - at >= RETRY_INTERVAL);
+    // Hub only. Falling back to the image's cache here would re-apply the same listing every
+    // hour on an instance that never reaches a hub, over any edit made since; the cache is
+    // applied at boot (`SYNC_CACHED_RT`) or on demand instead.
+    if due {
+        match sync_from_hub(db).await {
+            Ok(outcome) if outcome.changed.is_empty() => tracing::info!("{}", outcome.summary()),
+            Ok(outcome) => {
+                tracing::info!("{}: {}", outcome.summary(), outcome.changed.join(", "))
+            }
+            Err(e) => tracing::warn!("Hub resource type sync failed, retrying in an hour: {e}"),
+        }
+    }
+    lock_tx.rollback().await?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn hub_type(
+        format_extension: Option<Option<&str>>,
+        display_name: Option<Option<&str>>,
+        is_fileset: Option<bool>,
+    ) -> HubResourceType {
+        HubResourceType {
+            name: "t".to_string(),
+            schema: None,
+            description: None,
+            format_extension: format_extension.map(|e| e.map(str::to_string)),
+            display_name: display_name.map(|n| n.map(str::to_string)),
+            is_fileset,
+        }
+    }
+
+    fn stored(
+        format_extension: Option<&str>,
+        display_name: Option<&str>,
+        is_fileset: bool,
+    ) -> ResourceTypeRow {
+        ResourceTypeRow {
+            schema: None,
+            description: None,
+            format_extension: format_extension.map(str::to_string),
+            is_fileset,
+            display_name: display_name.map(str::to_string),
+        }
+    }
+
+    #[test]
+    fn absent_keys_keep_the_stored_values_and_nulls_clear_them() {
+        let current = stored(Some("csv"), Some("T"), false);
+        let kept = target_row(&hub_type(None, None, None), Some(&current));
+        assert_eq!(kept, current);
+        let cleared = target_row(&hub_type(Some(None), Some(None), None), Some(&current));
+        assert_eq!(cleared, stored(None, None, false));
+    }
+
+    #[test]
+    fn a_fileset_never_takes_a_format_extension() {
+        let local_fileset = stored(None, None, true);
+        let row = target_row(
+            &hub_type(Some(Some("csv")), None, None),
+            Some(&local_fileset),
+        );
+        assert_eq!(row, stored(None, None, true));
+        let row = target_row(&hub_type(Some(Some("csv")), None, Some(true)), None);
+        assert_eq!(row, stored(None, None, true));
+    }
+
+    #[sqlx::test(migrations = "../migrations")]
+    async fn only_sync_cached_rt_applies_the_image_cache_after_a_hub_sync(
+        db: DB,
+    ) -> anyhow::Result<()> {
+        let dir = tempfile::tempdir()?;
+        let path = dir.path().join("resource_types.json");
+        std::fs::write(
+            &path,
+            json!([{ "name": "cached_type", "schema": null, "description": "image copy" }])
+                .to_string(),
+        )?;
+        let path = path.to_str().unwrap();
+        let description = || {
+            sqlx::query_scalar::<_, Option<String>>(
+                "SELECT description FROM resource_type WHERE workspace_id = 'admins' AND name = 'cached_type'",
+            )
+            .fetch_one(&db)
+        };
+
+        assert!(fall_back_to_image_cache(&db, path).await?.is_some());
+        assert_eq!(description().await?.as_deref(), Some("image copy"));
+
+        record_state(&db, json!({ "last_hub_sync_at": Utc::now() })).await?;
+        sqlx::query(
+            "UPDATE resource_type SET description = 'hub copy' WHERE workspace_id = 'admins' AND name = 'cached_type'",
+        )
+        .execute(&db)
+        .await?;
+        assert!(fall_back_to_image_cache(&db, path).await?.is_none());
+        assert_eq!(description().await?.as_deref(), Some("hub copy"));
+
+        assert!(sync_from_cache_file(&db, path).await?.is_some());
+        assert_eq!(description().await?.as_deref(), Some("image copy"));
+        Ok(())
+    }
+
+    #[sqlx::test(migrations = "../migrations")]
+    async fn no_daily_sync_unless_turned_on(db: DB) -> anyhow::Result<()> {
+        sync_if_due(&db).await?;
+
+        let state: Option<serde_json::Value> =
+            sqlx::query_scalar("SELECT value FROM background_task_state WHERE name = $1")
+                .bind(SYNC_STATE_TASK)
+                .fetch_optional(&db)
+                .await?;
+        assert_eq!(state, None);
+        Ok(())
+    }
+}
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index fd790547b6..7c76fab2ee 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -267,6 +267,8 @@ pub struct GlobalSettings {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub disable_hub: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub sync_hub_resource_types_daily: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_build_binary_on_deploy: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub ai_sessions_instance_storage_fallback: Option<bool>,
@@ -275,10 +277,14 @@ pub struct GlobalSettings {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub auto_build_binary_tag: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub dependency_job_tag: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub ws_base_url: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub github_app_webhook_base_url: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_base_url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub email_domain: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub hub_base_url: Option<String>,
@@ -961,6 +967,9 @@ pub struct WorkerGroupConfig {
     pub autoscaling: Option<AutoscalingConfig>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub native_mode: Option<bool>,
+    /// Workers of the group pull no new job while this is set; queued jobs wait.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub paused: Option<bool>,
     /// Object store this group's dependency cache uses instead of the instance one. Same shape
     /// as the instance `object_store_cache_config`.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -1006,6 +1015,43 @@ pub struct ConfigsDiff {
     pub deletes: Vec<String>,
 }
 
+/// Told of each write an instance config apply makes, as soon as it has landed: the writes
+/// are not transactional, so an apply that fails midway must not leave the ones it did make
+/// unrecorded. The audit entry is the implementor's to write, as this crate sits below
+/// `windmill-audit`.
+pub trait ConfigWriteObserver: Sync {
+    /// `value` is `None` for a deleted setting.
+    fn setting_written(
+        &self,
+        key: &str,
+        value: Option<&serde_json::Value>,
+    ) -> impl std::future::Future<Output = crate::error::Result<()>> + Send;
+
+    fn worker_config_written(
+        &self,
+        group: &str,
+        deleted: bool,
+    ) -> impl std::future::Future<Output = crate::error::Result<()>> + Send;
+}
+
+impl ConfigWriteObserver for () {
+    async fn setting_written(
+        &self,
+        _key: &str,
+        _value: Option<&serde_json::Value>,
+    ) -> crate::error::Result<()> {
+        Ok(())
+    }
+
+    async fn worker_config_written(
+        &self,
+        _group: &str,
+        _deleted: bool,
+    ) -> crate::error::Result<()> {
+        Ok(())
+    }
+}
+
 /// Settings that must never be deleted by the operator or bulk API.
 pub const PROTECTED_SETTINGS: &[&str] = &[
     "ducklake_user_pg_pwd",
@@ -1017,12 +1063,44 @@ pub const PROTECTED_SETTINGS: &[&str] = &[
     "rsa_keys",
     "jwt_secret",
     "min_keep_alive_version",
+    // Deleting it would let a worker sign OIDC tokens with a local key again.
+    "oidc_external_signer",
 ];
 
+/// Secrets the server signs with or generated for itself. `jwt_secret` signs API and job
+/// tokens and `rsa_keys` signs job OIDC tokens, so reading either is enough to mint tokens
+/// for any user. Superadmin reads return them only while `server_secrets_exported()`.
+/// Withholding them from reads does not make them unwritable: the two signing keys are not
+/// in `HIDDEN_SETTINGS`, so config can still set them (an operator ConfigMap may set
+/// `jwt_secret`).
+pub const SERVER_SECRET_SETTINGS: &[&str] = &[
+    "jwt_secret",
+    "rsa_keys",
+    "custom_instance_replication_pwd",
+    "external_instance_pg_state",
+];
+
+/// Whether superadmin API reads (settings list, single-setting read, config export) return
+/// `SERVER_SECRET_SETTINGS`. On by default so `wmill instance get-config` and `pull` carry a
+/// full migration; `EXPORT_SERVER_SECRETS=false` withholds them from every API response, so a
+/// leaked superadmin token cannot take the signing keys. Fails closed: once set to a
+/// non-empty value, only `true`/`1`/`yes`/`on` keep exporting, so `0` or a typo withholds.
+/// Read per call: the flag is cheap and tests flip it in-process.
+pub fn server_secrets_exported() -> bool {
+    match std::env::var("EXPORT_SERVER_SECRETS") {
+        Ok(v) if !v.trim().is_empty() => matches!(
+            v.trim().to_ascii_lowercase().as_str(),
+            "true" | "1" | "yes" | "on"
+        ),
+        _ => true,
+    }
+}
+
+pub fn is_withheld_server_secret(name: &str) -> bool {
+    SERVER_SECRET_SETTINGS.contains(&name) && !server_secrets_exported()
+}
+
 /// Internal settings that are never exposed via the API or included in config exports.
-/// Note: jwt_secret is intentionally NOT hidden — it is included in YAML exports so that
-/// operators can set it via ConfigMap. It is protected from deletion (PROTECTED_SETTINGS)
-/// and from being set to empty/null, and its value is partially redacted in log output.
 pub const HIDDEN_SETTINGS: &[&str] = &[
     "uid",
     "min_keep_alive_version",
@@ -1040,6 +1118,8 @@ pub const HIDDEN_SETTINGS: &[&str] = &[
     "custom_instance_replication_pwd",
     // Same for the passwords and database registry Windmill keeps for the external cluster.
     "external_instance_pg_state",
+    // Written by servers that sign OIDC tokens with an external signer.
+    "oidc_external_signer",
 ];
 
 /// Top-level settings whose entire value is sensitive and must be fully redacted in logs.
@@ -1340,8 +1420,8 @@ pub fn diff_worker_configs(
 }
 
 /// Declaratively replace the global settings, rejecting a
-/// `github_app_webhook_base_url` or `http_route_default_allowed_origins` the
-/// API would reject.
+/// `github_app_webhook_base_url`, `api_base_url` or
+/// `http_route_default_allowed_origins` the API would reject.
 ///
 /// Every declarative writer (the `sync-config` CLI, the Kubernetes operator's
 /// ConfigMap sync) MUST go through this rather than calling
@@ -1359,34 +1439,44 @@ pub fn diff_worker_configs(
 /// AUTHORIZATION: replaces instance-wide settings and takes no authed context, so
 /// callers MUST have established superadmin or equivalent system authority (the CLI
 /// and the operator both run with direct instance credentials).
+///
+/// `observer` is what audits the sync: no user request stands behind these writes, so
+/// nothing else records them.
 pub async fn sync_global_settings_declarative(
     db: &sqlx::Pool<sqlx::Postgres>,
     current: &BTreeMap<String, serde_json::Value>,
     desired: &BTreeMap<String, serde_json::Value>,
+    observer: &impl ConfigWriteObserver,
 ) -> anyhow::Result<()> {
-    let webhook_key = crate::global_settings::GITHUB_APP_WEBHOOK_BASE_URL_SETTING;
-    // Non-string shapes are rejected rather than ignored: `as_str()` alone would let a
-    // bool/number/object through as if the key were absent, and the diff below would
-    // then persist it — where the HTTP path answers "must be a URL string".
-    match desired.get(webhook_key) {
-        None | Some(serde_json::Value::Null) => {}
-        Some(serde_json::Value::String(s)) if s.trim().is_empty() => {}
-        Some(serde_json::Value::String(s)) => crate::global_settings::validate_webhook_base_url(s)
-            .map_err(|e| anyhow::anyhow!("{webhook_key}: {e}"))?,
-        // Names the JSON kind rather than printing it: this is the last message on
-        // this path that could report submitted content, and an object or array could
-        // carry a secret into `sync-config` output and operator logs.
-        Some(other) => {
-            let kind = match other {
-                serde_json::Value::Bool(_) => "a boolean",
-                serde_json::Value::Number(_) => "a number",
-                serde_json::Value::Array(_) => "an array",
-                serde_json::Value::Object(_) => "an object",
-                _ => "a non-string value",
-            };
-            return Err(anyhow::anyhow!(
-                "{webhook_key} must be a URL string, got {kind}"
-            ));
+    for url_key in [
+        crate::global_settings::GITHUB_APP_WEBHOOK_BASE_URL_SETTING,
+        crate::global_settings::API_BASE_URL_SETTING,
+    ] {
+        // Non-string shapes are rejected rather than ignored: `as_str()` alone would let a
+        // bool/number/object through as if the key were absent, and the diff below would
+        // then persist it — where the HTTP path answers "must be a URL string".
+        match desired.get(url_key) {
+            None | Some(serde_json::Value::Null) => {}
+            Some(serde_json::Value::String(s)) if s.trim().is_empty() => {}
+            Some(serde_json::Value::String(s)) => {
+                crate::global_settings::validate_webhook_base_url(s)
+                    .map_err(|e| anyhow::anyhow!("{url_key}: {e}"))?
+            }
+            // Names the JSON kind rather than printing it: this is the last message on
+            // this path that could report submitted content, and an object or array could
+            // carry a secret into `sync-config` output and operator logs.
+            Some(other) => {
+                let kind = match other {
+                    serde_json::Value::Bool(_) => "a boolean",
+                    serde_json::Value::Number(_) => "a number",
+                    serde_json::Value::Array(_) => "an array",
+                    serde_json::Value::Object(_) => "an object",
+                    _ => "a non-string value",
+                };
+                return Err(anyhow::anyhow!(
+                    "{url_key} must be a URL string, got {kind}"
+                ));
+            }
         }
     }
 
@@ -1420,16 +1510,22 @@ pub async fn sync_global_settings_declarative(
         .map_err(|e| anyhow::anyhow!("{max_expiration_key}: {e}"))?;
 
     let mut diff = diff_global_settings(current, desired, ApplyMode::Replace);
-    crate::external_instance_pg::write_external_instance_pg_from_diff(db, &mut diff).await?;
-    apply_settings_diff(db, &diff).await?;
+    crate::external_instance_pg::write_external_instance_pg_from_diff(db, &mut diff, observer)
+        .await?;
+    apply_settings_diff(db, &diff, observer).await?;
 
     Ok(())
 }
 
-/// Apply a settings diff to the global_settings table.
+/// Apply a settings diff to the global_settings table, reporting each write to `observer`.
+///
+/// AUTHORIZATION: writes instance-wide settings, credentials included, and checks
+/// nothing; `observer` records and authorizes nothing. Callers MUST have established
+/// superadmin or equivalent system authority.
 pub async fn apply_settings_diff(
     db: &sqlx::Pool<sqlx::Postgres>,
     diff: &SettingsDiff,
+    observer: &impl ConfigWriteObserver,
 ) -> anyhow::Result<()> {
     for (key, value) in &diff.upserts {
         sqlx::query(
@@ -1452,6 +1548,7 @@ pub async fn apply_settings_diff(
                 format_setting_value(key, value)
             );
         }
+        observer.setting_written(key, Some(value)).await?;
     }
     for key in &diff.deletes {
         sqlx::query("DELETE FROM global_settings WHERE name = $1")
@@ -1466,6 +1563,7 @@ pub async fn apply_settings_diff(
         } else {
             tracing::info!("Deleted global setting: {key}");
         }
+        observer.setting_written(key, None).await?;
     }
     if diff.unchanged_count > 0 {
         tracing::info!("{} global setting(s) unchanged", diff.unchanged_count);
@@ -1473,10 +1571,16 @@ pub async fn apply_settings_diff(
     Ok(())
 }
 
-/// Apply a configs diff to the config table (worker__ prefix).
+/// Apply a configs diff to the config table (worker__ prefix), reporting each write to
+/// `observer`.
+///
+/// AUTHORIZATION: writes worker group configs, whose init scripts run on the workers, and
+/// checks nothing; `observer` records and authorizes nothing. Callers MUST have
+/// established superadmin or equivalent system authority.
 pub async fn apply_configs_diff(
     db: &sqlx::Pool<sqlx::Postgres>,
     diff: &ConfigsDiff,
+    observer: &impl ConfigWriteObserver,
 ) -> anyhow::Result<()> {
     for (group_name, config_value) in &diff.upserts {
         let db_key = format!("worker__{group_name}");
@@ -1489,6 +1593,7 @@ pub async fn apply_configs_diff(
         .execute(db)
         .await?;
         tracing::info!("Synced worker config: {db_key}");
+        observer.worker_config_written(group_name, false).await?;
     }
     for group_name in &diff.deletes {
         let db_key = format!("worker__{group_name}");
@@ -1497,6 +1602,7 @@ pub async fn apply_configs_diff(
             .execute(db)
             .await?;
         tracing::info!("Deleted worker config: {db_key}");
+        observer.worker_config_written(group_name, true).await?;
     }
     Ok(())
 }
@@ -1567,6 +1673,21 @@ pub fn resolve_env_refs(settings: &mut GlobalSettings) -> Result<(), String> {
 impl InstanceConfig {
     /// Read the full instance configuration from the database.
     pub async fn from_db(db: &sqlx::Pool<sqlx::Postgres>) -> anyhow::Result<Self> {
+        Self::read_from_db(db, true).await
+    }
+
+    /// The instance configuration as an API response may carry it: `from_db` without
+    /// `SERVER_SECRET_SETTINGS` unless `server_secrets_exported()`. It holds admin-entered
+    /// credentials (`license_key`, `scim_token`, SMTP and OAuth secrets), so callers must
+    /// have checked superadmin.
+    pub async fn from_db_for_api(db: &sqlx::Pool<sqlx::Postgres>) -> anyhow::Result<Self> {
+        Self::read_from_db(db, server_secrets_exported()).await
+    }
+
+    async fn read_from_db(
+        db: &sqlx::Pool<sqlx::Postgres>,
+        include_server_secrets: bool,
+    ) -> anyhow::Result<Self> {
         // Read global_settings table → flat map → deserialize into GlobalSettings
         let rows: Vec<(String, serde_json::Value)> =
             sqlx::query_as("SELECT name, value FROM global_settings")
@@ -1575,6 +1696,9 @@ impl InstanceConfig {
         let map: serde_json::Map<String, serde_json::Value> = rows
             .into_iter()
             .filter(|(name, _)| !HIDDEN_SETTINGS.contains(&name.as_str()))
+            .filter(|(name, _)| {
+                include_server_secrets || !SERVER_SECRET_SETTINGS.contains(&name.as_str())
+            })
             .collect();
         let global_settings: GlobalSettings =
             serde_json::from_value(serde_json::Value::Object(map))?;
@@ -1600,7 +1724,11 @@ impl InstanceConfig {
     ///
     /// Reads the current state, computes a diff, then applies upserts and
     /// deletes for both global settings and worker configs.
-    pub async fn sync_to_db(&self, db: &sqlx::Pool<sqlx::Postgres>) -> anyhow::Result<()> {
+    pub async fn sync_to_db(
+        &self,
+        db: &sqlx::Pool<sqlx::Postgres>,
+        observer: &impl ConfigWriteObserver,
+    ) -> anyhow::Result<()> {
         let desired_settings = self.global_settings.to_settings_map();
 
         // Current global settings
@@ -1610,7 +1738,8 @@ impl InstanceConfig {
                 .await?;
         let current_settings: BTreeMap<String, serde_json::Value> = rows.into_iter().collect();
 
-        sync_global_settings_declarative(db, &current_settings, &desired_settings).await?;
+        sync_global_settings_declarative(db, &current_settings, &desired_settings, observer)
+            .await?;
 
         // Worker configs
         let desired_configs: BTreeMap<String, serde_json::Value> = self
@@ -1638,7 +1767,7 @@ impl InstanceConfig {
 
         let configs_diff =
             diff_worker_configs(&current_configs, &desired_configs, ApplyMode::Replace);
-        apply_configs_diff(db, &configs_diff).await?;
+        apply_configs_diff(db, &configs_diff, observer).await?;
 
         Ok(())
     }
diff --git a/backend/windmill-common/src/item_digest.rs b/backend/windmill-common/src/item_digest.rs
new file mode 100644
index 0000000000..23110bcae7
--- /dev/null
+++ b/backend/windmill-common/src/item_digest.rs
@@ -0,0 +1,132 @@
+//! Content digests of deployed scripts and flows, reproducible with `wmill digest`
+//! (`cli/src/commands/digest/digest.ts`) from a `wmill sync` checkout pulled after the
+//! deployment's dependency jobs: they write the locks, and store loops and branches with
+//! their defaults filled in. The two implementations must hash the same bytes: change one
+//! only together with the other. Numbers hash as the doubles they parse to, which needs
+//! serde_json's `float_roundtrip` to parse them as exactly as JavaScript does.
+//!
+//! A digest is the lowercase hex SHA-256 of the canonical JSON (RFC 8785) of the item, with
+//! every object member whose value is null removed:
+//! - a script: `{"content", "lock", "modules", "codebase"}`, where `modules` is the
+//!   multi-file script's `{<relative path>: {"content", "lock"}}` and is left out when empty.
+//!   The language is not covered: a checkout only records it in the file extension;
+//! - a flow step's inline script: `{"content", "lock"}`;
+//! - a flow: its `value`. A flow whose value references code in `flow_node` has none, see
+//!   [`references_flow_nodes`].
+
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+
+use crate::flows::{Branch, FlowModule, FlowModuleValue, FlowValue, ToolValue};
+
+pub fn digest(value: &Value) -> String {
+    let mut out = String::new();
+    write_canonical(value, &mut out);
+    format!("{:x}", Sha256::digest(out.as_bytes()))
+}
+
+pub fn canonical_json(value: &Value) -> String {
+    let mut out = String::new();
+    write_canonical(value, &mut out);
+    out
+}
+
+fn write_canonical(value: &Value, out: &mut String) {
+    match value {
+        Value::Null => out.push_str("null"),
+        Value::Bool(b) => out.push_str(if *b { "true" } else { "false" }),
+        // RFC 8785 serializes every number as an IEEE double, the way ECMAScript prints it.
+        Value::Number(n) => {
+            let f = n.as_f64().unwrap_or(0.0);
+            out.push_str(ryu_js::Buffer::new().format(f))
+        }
+        Value::String(s) => out.push_str(&serde_json::to_string(s).unwrap_or_default()),
+        Value::Array(items) => {
+            out.push('[');
+            for (i, item) in items.iter().enumerate() {
+                if i > 0 {
+                    out.push(',');
+                }
+                write_canonical(item, out);
+            }
+            out.push(']');
+        }
+        Value::Object(members) => {
+            // RFC 8785 orders members by the UTF-16 code units of their names.
+            let mut members: Vec<_> = members.iter().filter(|(_, v)| !v.is_null()).collect();
+            members.sort_by(|(a, _), (b, _)| a.encode_utf16().cmp(b.encode_utf16()));
+            out.push('{');
+            for (i, (k, v)) in members.into_iter().enumerate() {
+                if i > 0 {
+                    out.push(',');
+                }
+                out.push_str(&serde_json::to_string(k).unwrap_or_default());
+                out.push(':');
+                write_canonical(v, out);
+            }
+            out.push('}');
+        }
+    }
+}
+
+/// Whether a flow value runs code stored outside it, in `flow_node` rows: an inline script
+/// step `{"type": "flowscript", "id"}`, or a loop's or branch's steps in a `*_node`. Its digest
+/// would not cover that code, and a checkout cannot reproduce it either, since the export
+/// carries the references. A value or step that does not parse runs nothing, so it counts as
+/// none.
+pub fn references_flow_nodes(value: &Value) -> bool {
+    let Ok(flow) = serde_json::from_value::<FlowValue>(value.clone()) else {
+        return false;
+    };
+    flow.modules
+        .iter()
+        .chain(flow.preprocessor_module.as_deref())
+        .chain(flow.failure_module.as_deref())
+        .any(module_references_flow_nodes)
+}
+
+fn module_references_flow_nodes(module: &FlowModule) -> bool {
+    module
+        .get_value()
+        .is_ok_and(|v| module_value_references_flow_nodes(&v))
+}
+
+fn module_value_references_flow_nodes(value: &FlowModuleValue) -> bool {
+    let any = |modules: &[FlowModule]| modules.iter().any(module_references_flow_nodes);
+    let branches = |branches: &[Branch]| {
+        branches
+            .iter()
+            .any(|b| b.modules_node.is_some() || any(&b.modules))
+    };
+    match value {
+        FlowModuleValue::FlowScript { .. } => true,
+        FlowModuleValue::ForloopFlow { modules, modules_node, .. }
+        | FlowModuleValue::WhileloopFlow { modules, modules_node, .. } => {
+            modules_node.is_some() || any(modules)
+        }
+        FlowModuleValue::BranchOne { branches: b, default, default_node } => {
+            default_node.is_some() || any(default) || branches(b)
+        }
+        FlowModuleValue::BranchAll { branches: b, .. } => branches(b),
+        FlowModuleValue::AIAgent { tools, .. } => tools.iter().any(|tool| match &tool.value {
+            ToolValue::FlowModule(v) => module_value_references_flow_nodes(v),
+            _ => false,
+        }),
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn canonical_form_follows_rfc_8785_without_nulls() {
+        let v = json!({"b": [1.0, 1e21, 0.1, -0.0, null], "a": null, "é": "\u{1f}\"\n", "\u{e000}": 1, "\u{1f600}": 2});
+        assert_eq!(
+            canonical_json(&v),
+            "{\"b\":[1,1e+21,0.1,0,null],\"é\":\"\\u001f\\\"\\n\",\"\u{1f600}\":2,\"\u{e000}\":1}"
+        );
+    }
+}
diff --git a/backend/windmill-common/src/job_provenance.rs b/backend/windmill-common/src/job_provenance.rs
index 63075b0c37..96db3b8a87 100644
--- a/backend/windmill-common/src/job_provenance.rs
+++ b/backend/windmill-common/src/job_provenance.rs
@@ -1,6 +1,7 @@
+use serde_json::Value;
 use uuid::Uuid;
 
-use crate::{db::DB, error::Result, jobs::JobKind, scripts::ScriptHash};
+use crate::{db::DB, error::Result, item_digest, jobs::JobKind, scripts::ScriptHash};
 
 /// Where a job's code comes from, as far as its chain of parents can prove it.
 pub struct JobProvenance {
@@ -28,7 +29,39 @@ pub struct JobProvenance {
     pub root_path: Option<String>,
     pub root_kind: JobKind,
     pub root_trigger_kind: Option<String>,
+    /// What triggered the root job, as recorded in `v2_job.trigger`.
+    pub root_trigger: Option<String>,
     pub root_version: Option<String>,
+    /// See [`item_digest`]. Only scripts, flows and flow steps' inline scripts have one.
+    pub digest: Option<String>,
+    pub root_digest: Option<String>,
+    /// The job's worker tag.
+    pub tag: String,
+    /// The group of the worker running the job, if it is running.
+    pub worker_group: Option<String>,
+    pub run_as_type: RunAsType,
+}
+
+/// What `permissioned_as` names.
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+pub enum RunAsType {
+    User,
+    ServiceAccount,
+    Group,
+    /// No member of the workspace: a superadmin outside it, a built-in identity
+    /// (`superadmin_secret@windmill.dev`, ...) or a user since removed.
+    NonMember,
+}
+
+impl RunAsType {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            RunAsType::User => "user",
+            RunAsType::ServiceAccount => "service_account",
+            RunAsType::Group => "group",
+            RunAsType::NonMember => "non_member",
+        }
+    }
 }
 
 #[derive(Debug, PartialEq, Eq)]
@@ -58,6 +91,8 @@ struct LineageJob {
     runnable_path: Option<String>,
     runnable_id: Option<i64>,
     trigger_kind: Option<String>,
+    trigger: Option<String>,
+    tag: String,
     permissioned_as: String,
     origin_verified: bool,
     current_version: bool,
@@ -66,6 +101,10 @@ struct LineageJob {
     restarted_from: Option<String>,
     app_stamped: bool,
     args_modules: bool,
+    worker_group: Option<String>,
+    run_as_type: Option<String>,
+    /// What the digest hashes, for the job and the root only.
+    digest_source: Option<Value>,
 }
 
 /// Reads any job of `w_id` regardless of the caller: authorize access to `job_id` first.
@@ -74,16 +113,17 @@ pub async fn job_provenance(db: &DB, job_id: &Uuid, w_id: &str) -> Result<Option
         LineageJob,
         r#"WITH RECURSIVE lineage AS (
             SELECT id, parent_job, kind, runnable_path, runnable_id, trigger_kind, trigger,
-                permissioned_as, args, 0 AS depth
+                tag, permissioned_as, args, 0 AS depth
             FROM v2_job WHERE id = $1 AND workspace_id = $2
           UNION ALL
             SELECT p.id, p.parent_job, p.kind, p.runnable_path, p.runnable_id, p.trigger_kind,
-                p.trigger, p.permissioned_as, p.args, l.depth + 1
+                p.trigger, p.tag, p.permissioned_as, p.args, l.depth + 1
             FROM v2_job p JOIN lineage l ON p.id = l.parent_job
             WHERE p.workspace_id = $2 AND l.depth < 100
         )
         SELECT id AS "id!", parent_job, kind AS "kind!: JobKind", runnable_path, runnable_id,
-            trigger_kind::text AS trigger_kind, permissioned_as AS "permissioned_as!",
+            trigger_kind::text AS trigger_kind, trigger, tag AS "tag!",
+            permissioned_as AS "permissioned_as!",
             -- A restart takes its flow version from the request, so a trusted flow path
             -- can carry another flow's code: the version must belong to that path.
             CASE kind
@@ -121,7 +161,30 @@ pub async fn job_provenance(db: &DB, job_id: &Uuid, w_id: &str) -> Result<Option
                 AS "app_stamped!",
             -- A preview's modules come from its args, which its parent may have taken from
             -- the caller.
-            COALESCE(jsonb_typeof(args->'_MODULES') = 'object', false) AS "args_modules!"
+            COALESCE(jsonb_typeof(args->'_MODULES') = 'object', false) AS "args_modules!",
+            CASE WHEN depth = 0 THEN (SELECT wp.worker_group FROM v2_job_queue q
+                JOIN worker_ping wp ON wp.worker = q.worker WHERE q.id = lineage.id)
+            END AS worker_group,
+            CASE WHEN depth = 0 THEN CASE
+                WHEN starts_with(permissioned_as, 'g/') THEN 'group'
+                ELSE (SELECT CASE WHEN u.is_service_account THEN 'service_account' ELSE 'user' END
+                    FROM usr u WHERE starts_with(permissioned_as, 'u/')
+                        AND u.username = substr(permissioned_as, 3) AND u.workspace_id = $2)
+            END END AS run_as_type,
+            -- The canonical item `item_digest` hashes, null members included.
+            CASE WHEN depth = 0 OR depth = max(depth) OVER () THEN CASE kind
+                WHEN 'script' THEN (SELECT jsonb_build_object('content', s.content,
+                        'lock', s.lock, 'codebase', s.codebase,
+                        'modules', (SELECT jsonb_object_agg(m.key, m.value - 'language')
+                            FROM jsonb_each(s.modules) m))
+                    FROM script s WHERE s.hash = runnable_id AND s.workspace_id = $2
+                        AND NOT s.deleted)
+                WHEN 'flow' THEN (SELECT fv.value FROM flow_version fv
+                    WHERE fv.id = runnable_id AND fv.workspace_id = $2)
+                WHEN 'flowscript' THEN (SELECT jsonb_build_object('content', n.code,
+                        'lock', n.lock)
+                    FROM flow_node n WHERE n.id = runnable_id AND n.workspace_id = $2)
+            END END AS digest_source
         FROM lineage ORDER BY depth"#,
         job_id,
         w_id
@@ -174,6 +237,15 @@ pub async fn job_provenance(db: &DB, job_id: &Uuid, w_id: &str) -> Result<Option
             }
         }
     }
+    let job = &lineage[0];
+    let digest = item_digest_of(job);
+    let root_digest = item_digest_of(root);
+    let run_as_type = match job.run_as_type.as_deref() {
+        Some("group") => RunAsType::Group,
+        Some("service_account") => RunAsType::ServiceAccount,
+        Some("user") => RunAsType::User,
+        _ => RunAsType::NonMember,
+    };
     Ok(Some(JobProvenance {
         deployed,
         latest: deployed && all_current,
@@ -186,7 +258,13 @@ pub async fn job_provenance(db: &DB, job_id: &Uuid, w_id: &str) -> Result<Option
         root_path: root.runnable_path.clone(),
         root_kind: root.kind,
         root_trigger_kind: root.trigger_kind.clone(),
+        root_trigger: root.trigger.clone(),
         root_version: version(root),
+        digest,
+        root_digest,
+        tag: job.tag.clone(),
+        worker_group: job.worker_group.clone(),
+        run_as_type,
     }))
 }
 
@@ -220,6 +298,14 @@ async fn restart_origin_is_current(db: &DB, origin: &Uuid, w_id: &str) -> Result
     Ok(current)
 }
 
+fn item_digest_of(job: &LineageJob) -> Option<String> {
+    let source = job.digest_source.as_ref()?;
+    if job.kind == JobKind::Flow && item_digest::references_flow_nodes(source) {
+        return None;
+    }
+    Some(item_digest::digest(source))
+}
+
 fn version(job: &LineageJob) -> Option<String> {
     match job.kind {
         JobKind::Script => job.runnable_id.map(|h| ScriptHash(h).to_string()),
diff --git a/backend/windmill-common/src/jobs.rs b/backend/windmill-common/src/jobs.rs
index 796d1c999a..75670fe874 100644
--- a/backend/windmill-common/src/jobs.rs
+++ b/backend/windmill-common/src/jobs.rs
@@ -136,6 +136,7 @@ pub async fn script_path_to_payload<'e>(
                 timeout,
                 has_preprocessor,
                 labels,
+                job_token_scopes,
                 ..
             } = script_info;
 
@@ -153,6 +154,7 @@ pub async fn script_path_to_payload<'e>(
                     debouncing_settings,
                     concurrency_settings,
                     labels,
+                    job_token_scopes,
                 },
                 tag,
                 delete_after_use,
@@ -203,7 +205,7 @@ pub async fn get_payload_tag_from_prefixed_path(
                 None,
             )
         } else {
-            let FlowVersionInfo { dedicated_worker, tag, version, labels, .. } =
+            let FlowVersionInfo { dedicated_worker, tag, version, labels, job_token_scopes, .. } =
                 get_latest_flow_version_info_for_path(None, &db, w_id, &path, true).await?;
             (
                 JobPayload::Flow {
@@ -212,6 +214,7 @@ pub async fn get_payload_tag_from_prefixed_path(
                     apply_preprocessor: false,
                     version,
                     labels,
+                    job_token_scopes,
                 },
                 tag,
                 None,
@@ -471,6 +474,8 @@ pub struct RunInlinePreviewScriptFnParams {
     pub created_by: String,
     pub permissioned_as: String,
     pub permissioned_as_email: String,
+    /// The caller's recorded end user: `job_perms.end_user_email` of the calling job.
+    pub end_user_email: Option<String>,
     pub base_internal_url: String,
     pub worker_name: String,
     pub conn: crate::worker::Connection,
@@ -481,7 +486,8 @@ pub struct RunInlinePreviewScriptFnParams {
 }
 
 pub enum InlineScriptTarget {
-    Path(String),
+    /// A script addressed by path, pinned to the version the caller resolved and checked.
+    Path { path: String, hash: i64 },
     Hash(i64),
 }
 
@@ -492,6 +498,8 @@ pub struct RunInlineScriptFnParams {
     pub created_by: String,
     pub permissioned_as: String,
     pub permissioned_as_email: String,
+    /// The caller's recorded end user: `job_perms.end_user_email` of the calling job.
+    pub end_user_email: Option<String>,
     pub base_internal_url: String,
     pub worker_name: String,
     pub conn: crate::worker::Connection,
@@ -550,9 +558,11 @@ pub static WORKER_INTERNAL_SERVER_INLINE_UTILS: OnceCell<WorkerInternalServerInl
 /// **Transaction contract:** call this inside a transaction. The conversation cleanup below
 /// locks rows to serialise itself against a concurrent delete, and on an autocommit
 /// connection that lock is released at statement end, silently restoring the race.
-/// A conversation is collected only once every message row of it has gone with a job; a
-/// row written with no job id (an MCP tool call, persisted under no job of its own) keeps
-/// its conversation and the agent's memory for it alive for as long as it exists.
+/// A message row goes with the flow run its turn started (`turn_job_id`), not with the step
+/// or tool job in `job_id`: those complete, and so expire, before the run, and deleting by
+/// them would drop a turn's answer while keeping its question. `job_id` is the fallback for
+/// rows written by a worker that predates `turn_job_id`. A conversation is collected once
+/// every message row of it has gone.
 pub async fn delete_jobs(conn: &mut sqlx::PgConnection, ids: &[uuid::Uuid]) -> error::Result<()> {
     sqlx::query!(
         "DELETE FROM dispatch_event WHERE producer_job_id = ANY($1)",
@@ -561,7 +571,8 @@ pub async fn delete_jobs(conn: &mut sqlx::PgConnection, ids: &[uuid::Uuid]) -> e
     .execute(&mut *conn)
     .await?;
     let mut conversation_ids: Vec<uuid::Uuid> = sqlx::query_scalar!(
-        "DELETE FROM flow_conversation_message WHERE job_id = ANY($1) RETURNING conversation_id",
+        "DELETE FROM flow_conversation_message WHERE COALESCE(turn_job_id, job_id) = ANY($1)
+         RETURNING conversation_id",
         ids
     )
     .fetch_all(&mut *conn)
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index c5c9bde0d3..58a477d7b9 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -75,6 +75,7 @@ pub mod flow_status;
 pub mod flows;
 pub mod folders;
 pub mod global_settings;
+pub mod hub_resource_types;
 pub mod guest_jwt;
 pub mod indexer;
 pub mod instance_config;
@@ -90,6 +91,7 @@ pub mod workspace_dependencies;
 #[cfg(feature = "private")]
 pub mod git_sync_ee;
 pub mod git_sync_oss;
+pub mod item_digest;
 pub mod job_provenance;
 pub mod jobs;
 pub mod jwt;
@@ -100,6 +102,8 @@ pub mod oauth2;
 pub mod oidc_ee;
 #[cfg(all(feature = "enterprise", feature = "openidconnect"))]
 pub mod oidc_oss;
+#[cfg(all(feature = "enterprise", feature = "openidconnect", feature = "private"))]
+pub mod oidc_signer_ee;
 #[cfg(feature = "private")]
 pub mod otel_ee;
 pub mod otel_oss;
@@ -122,10 +126,12 @@ pub mod query_builders;
 pub mod queue;
 pub mod queue_metrics;
 pub mod result_stream;
+pub mod runnable_job_stats;
 pub mod runnable_settings;
 pub mod runnables;
 pub mod schedule;
 pub mod schema;
+pub mod scopes;
 pub mod scripts;
 pub mod secret_backend;
 pub mod sensitive_log_masks;
@@ -151,6 +157,7 @@ pub mod wac;
 pub mod webhook;
 pub mod worker;
 pub mod worker_group_job_stats;
+pub mod workspace_crypt;
 pub mod workspaces;
 
 pub const DEFAULT_MAX_CONNECTIONS_SERVER: u32 = 50;
@@ -1067,6 +1074,18 @@ impl TokioPgConnection {
     }
 }
 
+/// Without these, a server that vanishes without closing the socket (a failover,
+/// a dropped route) leaves a query waiting on a read for the OS default of two
+/// hours. The server's kernel answers the probes, so a slow query is unaffected.
+pub fn set_pg_keepalive(config: &mut tokio_postgres::Config) {
+    config
+        .keepalives(true)
+        .keepalives_idle(std::time::Duration::from_secs(60))
+        .keepalives_interval(std::time::Duration::from_secs(10))
+        .keepalives_retries(6)
+        .tcp_user_timeout(std::time::Duration::from_secs(120));
+}
+
 impl PgDatabase {
     /// The role the connection logs in as, whichever way it authenticates.
     pub fn login_name(&self) -> &str {
@@ -1108,6 +1127,12 @@ impl PgDatabase {
         self.options.as_deref().filter(|o| !o.is_empty())
     }
 
+    fn uri_config(&self) -> Result<tokio_postgres::Config, error::Error> {
+        let mut config: tokio_postgres::Config = self.to_uri().parse().map_err(to_anyhow)?;
+        set_pg_keepalive(&mut config);
+        Ok(config)
+    }
+
     pub async fn connect(
         &self,
         main_db: Option<&DB>,
@@ -1225,18 +1250,51 @@ impl PgDatabase {
         }
     }
 
+    fn sslmode_requires_tls(&self) -> bool {
+        matches!(
+            self.sslmode.as_deref(),
+            Some("require") | Some("verify-ca") | Some("verify-full")
+        )
+    }
+
+    /// Asks the server to cancel what the connection behind `token` is running. Dropping a
+    /// connection does not: the server works on until it next writes to the client.
+    ///
+    /// The request goes out the way the connection was made: `token_auth` is set for one
+    /// authenticated with an access token, which is over TLS whatever the sslmode.
+    pub async fn cancel_query(
+        &self,
+        token: tokio_postgres::CancelToken,
+        token_auth: bool,
+    ) -> Result<(), error::Error> {
+        if token_auth || self.sslmode_requires_tls() {
+            let mut connector = native_tls::TlsConnector::builder();
+            Self::configure_pg_tls_verification(
+                &mut connector,
+                self.sslmode.as_deref(),
+                self.root_certificate_pem.as_deref(),
+                self.accept_invalid_certs,
+            )?;
+            let connector =
+                postgres_native_tls::MakeTlsConnector::new(connector.build().map_err(to_anyhow)?);
+            token.cancel_query(connector).await.map_err(to_anyhow)?;
+        } else {
+            token
+                .cancel_query(tokio_postgres::tls::NoTls)
+                .await
+                .map_err(to_anyhow)?;
+        }
+        Ok(())
+    }
+
     async fn connect_inner(
         &self,
     ) -> Result<(tokio_postgres::Client, TokioPgConnection), error::Error> {
         use native_tls::TlsConnector;
         use postgres_native_tls::MakeTlsConnector;
         use tokio_postgres::tls::NoTls;
-        let ssl_mode_is_require = matches!(
-            self.sslmode.as_deref(),
-            Some("require") | Some("verify-ca") | Some("verify-full")
-        );
 
-        if ssl_mode_is_require {
+        if self.sslmode_requires_tls() {
             tracing::info!("Creating new connection");
             let mut connector = TlsConnector::builder();
             Self::configure_pg_tls_verification(
@@ -1254,10 +1312,8 @@ impl PgDatabase {
 
             let (client, connection) = tokio::time::timeout(
                 std::time::Duration::from_secs(20),
-                tokio_postgres::connect(
-                    &self.to_uri(),
-                    MakeTlsConnector::new(connector.build().map_err(to_anyhow)?),
-                ),
+                self.uri_config()?
+                    .connect(MakeTlsConnector::new(connector.build().map_err(to_anyhow)?)),
             )
             .await
             .map_err(to_anyhow)?
@@ -1268,7 +1324,7 @@ impl PgDatabase {
             tracing::info!("Creating new connection");
             let (client, connection) = tokio::time::timeout(
                 std::time::Duration::from_secs(20),
-                tokio_postgres::connect(&self.to_uri(), NoTls),
+                self.uri_config()?.connect(NoTls),
             )
             .await
             .map_err(to_anyhow)?
@@ -1385,6 +1441,7 @@ impl PgDatabase {
         if let Some(options) = self.non_empty_options() {
             config.options(options);
         }
+        set_pg_keepalive(&mut config);
 
         let (client, connection) = tokio::time::timeout(
             std::time::Duration::from_secs(20),
@@ -2229,6 +2286,7 @@ pub struct ScriptHashInfo<SR> {
     pub on_behalf_of: Option<String>,
     pub created_by: String,
     pub labels: Option<Vec<String>>,
+    pub job_token_scopes: Option<Vec<String>>,
     #[sqlx(flatten)]
     pub runnable_settings: SR,
 }
@@ -2322,6 +2380,7 @@ impl ScriptHashInfo<ScriptRunnableSettingsHandle> {
             on_behalf_of: self.on_behalf_of,
             created_by: self.created_by,
             labels: self.labels,
+            job_token_scopes: self.job_token_scopes,
             runnable_settings: ScriptRunnableSettingsInline {
                 concurrency_settings: concurrency_settings.maybe_fallback(
                     self.runnable_settings.concurrency_key,
@@ -2686,6 +2745,7 @@ async fn get_script_info_for_hash_inner<'e, E: sqlx::PgExecutor<'e>>(
                 on_behalf_of,
                 created_by,
                 labels,
+                job_token_scopes,
                 path
             FROM script WHERE hash = $1 AND workspace_id = $2",
     )
@@ -2707,6 +2767,7 @@ pub struct FlowVersionInfo {
     pub edited_by: String,
     pub dedicated_worker: Option<bool>,
     pub labels: Option<Vec<String>>,
+    pub job_token_scopes: Option<Vec<String>>,
 }
 
 impl FlowVersionInfo {
@@ -2850,7 +2911,8 @@ pub fn get_flow_version_info_from_version<
                                     flow.dedicated_worker,
                                     flow.on_behalf_of,
                                     flow.edited_by,
-                                    flow.labels
+                                    flow.labels,
+                                    flow.job_token_scopes
                                 FROM
                                     flow_version
                                 INNER JOIN flow
@@ -2985,9 +3047,10 @@ pub async fn get_latest_hash_for_path<'c, E: sqlx::PgExecutor<'c>>(
     Option<jobs::OnBehalfOf>,
     Option<i64>,
     Option<Vec<String>>,
+    Option<Vec<String>>,
 )> {
     let r_o = sqlx::query!(
-            "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of, created_by, labels FROM script
+            "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of, created_by, labels, job_token_scopes FROM script
              WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)
              ORDER BY created_at DESC LIMIT 1",
             script_path,
@@ -3019,6 +3082,7 @@ pub async fn get_latest_hash_for_path<'c, E: sqlx::PgExecutor<'c>>(
         on_behalf_of,
         script.runnable_settings_handle,
         script.labels,
+        script.job_token_scopes,
     ))
 }
 
diff --git a/backend/windmill-common/src/log_context.rs b/backend/windmill-common/src/log_context.rs
index cdb1e27aea..c5cd191da8 100644
--- a/backend/windmill-common/src/log_context.rs
+++ b/backend/windmill-common/src/log_context.rs
@@ -49,6 +49,7 @@ pub struct LogContext {
 
     // Worker / job span (windmill-worker/src/worker.rs)
     pub worker: Option<String>,
+    pub worker_group: Option<String>,
     pub hostname: Option<String>,
     pub tag: Option<String>,
     pub job_id: Option<String>,
diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs
index 2ae666c14e..05b664b23d 100644
--- a/backend/windmill-common/src/min_version.rs
+++ b/backend/windmill-common/src/min_version.rs
@@ -19,6 +19,15 @@ pub const MIN_VERSION_SUPPORTS_BINARY_PREBUILD: VC = vc(1, 789, 0, "Auto-build b
 // dependency job asks bun for a v1 lockfile, and refuses to store one bun raised anyway.
 // Must name the release this ships in.
 pub const MIN_VERSION_SUPPORTS_BUN_LOCKFILE_V2: VC = vc(1, 794, 0, "Bun v2 lockfiles");
+// A worker that predates `job_token_scopes` mints the token of every job it pulls without
+// them, so a restriction set while one is live is silently ignored on the jobs it runs. Must
+// name the release this ships in.
+pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted job tokens");
+// Gates writing AES-256-GCM workspace ciphertext and the background pass that rewrites the
+// stored secret variables. Reading it ships one release earlier (1.831), so a rollback to
+// that release still reads every secret; below it, secrets written after the switch stay
+// unreadable until rolled forward. Only worker versions are seen here, not servers.
+pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption");
 pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing");
 pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage");
 pub const MIN_VERSION_SUPPORTS_SYNC_JOBS_DEBOUNCING: VC = vc(1, 602, 0, "Sync jobs debouncing");
diff --git a/backend/windmill-common/src/oidc_oss.rs b/backend/windmill-common/src/oidc_oss.rs
index a3826649e2..2945f8b87a 100644
--- a/backend/windmill-common/src/oidc_oss.rs
+++ b/backend/windmill-common/src/oidc_oss.rs
@@ -70,9 +70,17 @@ pub struct JobClaim {
     pub root_path: Option<String>,
     pub root_job_kind: String,
     pub root_trigger_kind: Option<String>,
+    pub root_trigger: Option<String>,
     pub latest: bool,
     pub version: Option<String>,
     pub root_version: Option<String>,
+    pub digest: Option<String>,
+    pub root_digest: Option<String>,
+    pub tag: String,
+    pub worker_group: Option<String>,
+    pub run_as_type: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub job_token_scopes: Option<Vec<String>>,
     pub jti: String,
 }
 
@@ -81,13 +89,26 @@ lazy_static::lazy_static! {
     static ref PRIVATE_KEY: RwLock<Option<String>> = RwLock::new(None);
 }
 
+#[cfg(not(feature = "private"))]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum OidcCaller {
+    JobMint,
+    S3Instance,
+    S3Workspace,
+    Vault,
+    Sqs,
+    Bedrock,
+}
+
 #[cfg(not(feature = "private"))]
 pub async fn generate_id_token<T: AdditionalClaims>(
+    _caller: OidcCaller,
     _db: Option<&DB>,
     _claim: T,
     _audience: &str,
     _identifier: String,
     _email: Option<String>,
+    _expires_in: Option<i64>,
 ) -> Result<WindmillIdToken> {
     Err(Error::internal_err(
         "Not implemented in Windmill's Open Source repository".to_string(),
diff --git a/backend/windmill-common/src/otel_oss.rs b/backend/windmill-common/src/otel_oss.rs
index 27c7101dc0..9dac8a07db 100644
--- a/backend/windmill-common/src/otel_oss.rs
+++ b/backend/windmill-common/src/otel_oss.rs
@@ -54,6 +54,19 @@ pub(crate) fn init_logs_bridge(_mode: &Mode, _hostname: &str, _env: &str) -> Opt
     None
 }
 
+#[cfg(not(feature = "private"))]
+pub(crate) fn init_logs_bridge_for_service(
+    _service: &str,
+    _hostname: &str,
+    _env: &str,
+) -> Option<EnvFilter> {
+    None
+}
+
+/// Export the log records still batched, for a process about to exit.
+#[cfg(not(feature = "private"))]
+pub async fn flush_otel_logs() {}
+
 #[cfg(all(feature = "otel", feature = "enterprise", not(feature = "private")))]
 pub(crate) fn init_otlp_tracer(
     _mode: &Mode,
@@ -76,6 +89,9 @@ pub fn add_root_flow_job_to_otlp(_queued_job: &QueuedJob, _success: bool) {}
 #[cfg(not(feature = "private"))]
 pub fn otel_incr_queue_push_count() {}
 
+#[cfg(not(feature = "private"))]
+pub fn otel_incr_oidc_signature_count(_caller: &'static str) {}
+
 #[cfg(not(feature = "private"))]
 pub fn otel_incr_queue_delete_count() {}
 
@@ -91,6 +107,9 @@ pub fn otel_incr_zombie_delete_count(_count: u64) {}
 #[cfg(not(feature = "private"))]
 pub fn otel_set_queue_count(_tag: &str, _count: i64) {}
 
+#[cfg(not(feature = "private"))]
+pub fn otel_set_queue_delay(_tag: &str, _delay_secs: f64) {}
+
 #[cfg(not(feature = "private"))]
 pub fn otel_set_queue_running_count(_tag: &str, _count: i64) {}
 
@@ -126,3 +145,36 @@ pub fn otel_set_health_status_phase(_phase: &str) {}
 
 #[cfg(not(feature = "private"))]
 pub fn otel_set_health_db_unresponsive(_unresponsive: bool) {}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_set_worker_memory(
+    _worker: &str,
+    _worker_group: &str,
+    _usage: Option<i64>,
+    _windmill_usage: Option<i64>,
+    _limit: Option<i64>,
+) {
+}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_add_worker_cpu(
+    _worker: &str,
+    _worker_group: &str,
+    _usage_secs: f64,
+    _periods: u64,
+    _throttled_periods: u64,
+    _throttled_secs: f64,
+) {
+}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_set_worker_occupancy_rate(
+    _worker: &str,
+    _worker_group: &str,
+    _window: &'static str,
+    _rate: f64,
+) {
+}
+
+#[cfg(not(feature = "private"))]
+pub fn otel_record_job_memory_peak(_tag: &str, _bytes: u64) {}
diff --git a/backend/windmill-common/src/runnable_job_stats.rs b/backend/windmill-common/src/runnable_job_stats.rs
new file mode 100644
index 0000000000..fa1b99e215
--- /dev/null
+++ b/backend/windmill-common/src/runnable_job_stats.rs
@@ -0,0 +1,288 @@
+//! Hourly resource rollup per runnable and worker group (`runnable_job_stats`).
+//!
+//! Workers accumulate completed jobs in memory and upsert periodically, so that the
+//! "heaviest scripts" view never has to aggregate `v2_job_completed`.
+//!
+//! What a row leaves out: executors that run in the worker process (SQL, native
+//! TypeScript, ...) have no CPU reading, and for memory report nothing or, for some SQL
+//! ones, the size of their result, as the job's `memory_peak` does. Memory is otherwise
+//! the peak of the job's main process only, and CPU counts that process and the children
+//! it waited for, and nothing for a job that was killed.
+//!
+//! Nothing here checks authorization: these functions write and prune every workspace's
+//! rows, and are for the worker's completion path and the server's monitor only. Reads
+//! go through the devops-gated API handler.
+
+use std::{collections::HashMap, sync::Mutex};
+
+use sqlx::{Pool, Postgres};
+
+use crate::{jobs::JobKind, worker_group_job_stats::get_current_hour};
+
+/// Every run without a stable path is counted under this one, per workspace and worker
+/// group: previews and other ad-hoc runs carry caller-chosen paths that would otherwise
+/// grow the table without bound.
+pub const ADHOC_RUNNABLE_PATH: &str = "<adhoc>";
+
+/// Also the furthest back the API reads.
+pub const RETENTION_DAYS: i64 = 30;
+
+#[derive(Debug, Default, Clone, Copy, PartialEq)]
+struct RunnableStats {
+    job_count: i32,
+    total_duration_ms: i64,
+    max_memory_peak: i32,
+    sum_memory_peak: i64,
+    memory_sample_count: i32,
+    total_cpu_ms: i64,
+}
+
+impl RunnableStats {
+    /// `mem_peak` is in kB and non-positive when the job had no reading.
+    fn add_job(&mut self, duration_ms: i64, mem_peak: i32, cpu_time_ms: Option<i64>) {
+        self.job_count += 1;
+        self.total_duration_ms += duration_ms;
+        if mem_peak > 0 {
+            self.max_memory_peak = self.max_memory_peak.max(mem_peak);
+            self.sum_memory_peak += mem_peak as i64;
+            self.memory_sample_count += 1;
+        }
+        self.total_cpu_ms += cpu_time_ms.unwrap_or(0).max(0);
+    }
+
+    fn merge(&mut self, other: &RunnableStats) {
+        self.job_count += other.job_count;
+        self.total_duration_ms += other.total_duration_ms;
+        self.max_memory_peak = self.max_memory_peak.max(other.max_memory_peak);
+        self.sum_memory_peak += other.sum_memory_peak;
+        self.memory_sample_count += other.memory_sample_count;
+        self.total_cpu_ms += other.total_cpu_ms;
+    }
+}
+
+/// (hour, workspace_id, runnable_path, worker_group)
+type StatsKey = (i64, String, String, String);
+
+lazy_static::lazy_static! {
+    static ref STATS: Mutex<HashMap<StatsKey, RunnableStats>> = Mutex::new(HashMap::new());
+}
+
+/// The path a job is rolled up under: its own for the kinds whose path names something
+/// deployed (a flow step's is `<flow path>/<step id>`), the ad-hoc bucket otherwise.
+pub fn stats_path(kind: JobKind, runnable_path: Option<&str>) -> &str {
+    match (kind, runnable_path) {
+        (
+            JobKind::Script
+            | JobKind::Script_Hub
+            | JobKind::FlowScript
+            | JobKind::FlowNode
+            | JobKind::AIAgent,
+            Some(path),
+        ) if !path.is_empty() => path,
+        _ => ADHOC_RUNNABLE_PATH,
+    }
+}
+
+pub fn accumulate_runnable_job_stats(
+    workspace_id: &str,
+    kind: JobKind,
+    runnable_path: Option<&str>,
+    worker_group: &str,
+    duration_ms: i64,
+    mem_peak: i32,
+    cpu_time_ms: Option<i64>,
+) {
+    let key = (
+        get_current_hour(),
+        workspace_id.to_string(),
+        stats_path(kind, runnable_path).to_string(),
+        worker_group.to_string(),
+    );
+    STATS
+        .lock()
+        .unwrap()
+        .entry(key)
+        .or_default()
+        .add_job(duration_ms, mem_peak, cpu_time_ms);
+}
+
+/// Counts the time spent on a round of a job that is not completing, without counting a
+/// job: a suspended workflow-as-code round replays its finished steps for free when it
+/// resumes, so the time they took would otherwise never reach the rollup. A row can
+/// therefore hold time and no job until the workflow completes.
+pub fn accumulate_runnable_round(
+    workspace_id: &str,
+    kind: JobKind,
+    runnable_path: Option<&str>,
+    worker_group: &str,
+    duration_ms: i64,
+    cpu_time_ms: Option<i64>,
+) {
+    let key = (
+        get_current_hour(),
+        workspace_id.to_string(),
+        stats_path(kind, runnable_path).to_string(),
+        worker_group.to_string(),
+    );
+    let mut stats = STATS.lock().unwrap();
+    let entry = stats.entry(key).or_default();
+    entry.total_duration_ms += duration_ms;
+    entry.total_cpu_ms += cpu_time_ms.unwrap_or(0).max(0);
+}
+
+pub async fn flush_runnable_job_stats(db: &Pool<Postgres>) -> Result<(), sqlx::Error> {
+    let drained: Vec<(StatsKey, RunnableStats)> = {
+        let mut stats = STATS.lock().unwrap();
+        if stats.is_empty() {
+            return Ok(());
+        }
+        stats.drain().collect()
+    };
+
+    let mut hours = Vec::with_capacity(drained.len());
+    let mut workspace_ids = Vec::with_capacity(drained.len());
+    let mut runnable_paths = Vec::with_capacity(drained.len());
+    let mut worker_groups = Vec::with_capacity(drained.len());
+    let mut job_counts = Vec::with_capacity(drained.len());
+    let mut durations = Vec::with_capacity(drained.len());
+    let mut max_peaks = Vec::with_capacity(drained.len());
+    let mut sum_peaks = Vec::with_capacity(drained.len());
+    let mut sample_counts = Vec::with_capacity(drained.len());
+    let mut cpus = Vec::with_capacity(drained.len());
+    for ((hour, workspace_id, runnable_path, worker_group), s) in &drained {
+        hours.push(*hour);
+        workspace_ids.push(workspace_id.clone());
+        runnable_paths.push(runnable_path.clone());
+        worker_groups.push(worker_group.clone());
+        job_counts.push(s.job_count);
+        durations.push(s.total_duration_ms);
+        max_peaks.push(s.max_memory_peak);
+        sum_peaks.push(s.sum_memory_peak);
+        sample_counts.push(s.memory_sample_count);
+        cpus.push(s.total_cpu_ms);
+    }
+
+    // The join drops rows of a workspace deleted since its jobs ran. The ORDER BY makes
+    // every worker lock the rows they share in one order: without it two concurrent
+    // flushes can deadlock, and the join is free to undo an ordering of the arrays.
+    let res = sqlx::query!(
+        r#"
+        INSERT INTO runnable_job_stats
+            (hour, workspace_id, runnable_path, worker_group, job_count, total_duration_ms,
+             max_memory_peak, sum_memory_peak, memory_sample_count, total_cpu_ms)
+        SELECT s.hour, s.workspace_id, s.runnable_path, s.worker_group, s.job_count,
+               s.total_duration_ms, s.max_memory_peak, s.sum_memory_peak,
+               s.memory_sample_count, s.total_cpu_ms
+        FROM UNNEST($1::bigint[], $2::text[], $3::text[], $4::text[], $5::int[], $6::bigint[],
+                    $7::int[], $8::bigint[], $9::int[], $10::bigint[])
+            AS s(hour, workspace_id, runnable_path, worker_group, job_count, total_duration_ms,
+                 max_memory_peak, sum_memory_peak, memory_sample_count, total_cpu_ms)
+        JOIN workspace w ON w.id = s.workspace_id
+        ORDER BY s.hour, s.workspace_id, s.runnable_path, s.worker_group
+        ON CONFLICT (hour, workspace_id, runnable_path, worker_group) DO UPDATE SET
+            job_count = runnable_job_stats.job_count + EXCLUDED.job_count,
+            total_duration_ms = runnable_job_stats.total_duration_ms + EXCLUDED.total_duration_ms,
+            max_memory_peak = GREATEST(runnable_job_stats.max_memory_peak, EXCLUDED.max_memory_peak),
+            sum_memory_peak = runnable_job_stats.sum_memory_peak + EXCLUDED.sum_memory_peak,
+            memory_sample_count = runnable_job_stats.memory_sample_count + EXCLUDED.memory_sample_count,
+            total_cpu_ms = runnable_job_stats.total_cpu_ms + EXCLUDED.total_cpu_ms
+        "#,
+        &hours,
+        &workspace_ids,
+        &runnable_paths,
+        &worker_groups,
+        &job_counts,
+        &durations,
+        &max_peaks,
+        &sum_peaks,
+        &sample_counts,
+        &cpus,
+    )
+    .execute(db)
+    .await;
+
+    if let Err(e) = res {
+        let mut stats = STATS.lock().unwrap();
+        for (key, s) in drained {
+            stats.entry(key).or_default().merge(&s);
+        }
+        return Err(e);
+    }
+    Ok(())
+}
+
+/// Also removes the rows of workspaces that no longer exist: a flush that overlaps a
+/// workspace's deletion still sees the workspace and can write after the deletion's own
+/// cleanup ran. Such a row is at most a couple of hours old, so only the last day is
+/// searched, which keeps both statements on a range of the primary key.
+pub async fn cleanup_old_runnable_job_stats(
+    db: &Pool<Postgres>,
+    retention_days: i64,
+) -> Result<u64, sqlx::Error> {
+    let current_hour = get_current_hour();
+    let expired = sqlx::query!(
+        "DELETE FROM runnable_job_stats WHERE hour < $1",
+        current_hour - retention_days * 24 * 3600
+    )
+    .execute(db)
+    .await?;
+    let orphaned = sqlx::query!(
+        "DELETE FROM runnable_job_stats s WHERE s.hour >= $1 \
+         AND NOT EXISTS (SELECT 1 FROM workspace w WHERE w.id = s.workspace_id)",
+        current_hour - 24 * 3600
+    )
+    .execute(db)
+    .await?;
+    Ok(expired.rows_affected() + orphaned.rows_affected())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_deployed_runnables_keep_their_path() {
+        assert_eq!(
+            stats_path(JobKind::Script, Some("f/etl/load")),
+            "f/etl/load"
+        );
+        assert_eq!(
+            stats_path(JobKind::FlowScript, Some("f/etl/flow/a")),
+            "f/etl/flow/a"
+        );
+        // A preview carries the path being edited, which is not a stable identity.
+        assert_eq!(
+            stats_path(JobKind::Preview, Some("f/etl/load")),
+            ADHOC_RUNNABLE_PATH
+        );
+        assert_eq!(
+            stats_path(JobKind::FlowPreview, Some("f/etl/flow")),
+            ADHOC_RUNNABLE_PATH
+        );
+        assert_eq!(
+            stats_path(JobKind::Dependencies, Some("f/etl/load")),
+            ADHOC_RUNNABLE_PATH
+        );
+        assert_eq!(stats_path(JobKind::Script, None), ADHOC_RUNNABLE_PATH);
+    }
+
+    #[test]
+    fn jobs_without_a_memory_reading_do_not_dilute_it() {
+        let mut s = RunnableStats::default();
+        s.add_job(1000, 2048, Some(700));
+        s.add_job(500, -3, None);
+        s.add_job(250, 0, Some(-5));
+        s.add_job(250, 1024, Some(50));
+        assert_eq!(
+            s,
+            RunnableStats {
+                job_count: 4,
+                total_duration_ms: 2000,
+                max_memory_peak: 2048,
+                sum_memory_peak: 3072,
+                memory_sample_count: 2,
+                total_cpu_ms: 750,
+            }
+        );
+    }
+}
diff --git a/backend/windmill-common/src/scopes.rs b/backend/windmill-common/src/scopes.rs
new file mode 100644
index 0000000000..35f4497fac
--- /dev/null
+++ b/backend/windmill-common/src/scopes.rs
@@ -0,0 +1,748 @@
+/*
+ * Author: Windmill Labs, Inc
+ * Copyright: Windmill Labs, Inc 2024
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+use itertools::Itertools;
+use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
+
+use crate::error::{Error, Result};
+
+/// Comprehensive scope system for JWT token authorization
+///
+/// Scopes follow the format: {domain}:{action}[:{resource}]
+/// Examples:
+/// - "jobs:read" - Read access to jobs
+/// - "scripts:write:f/folder/*" - Write access to scripts in a folder
+/// - "*" - Full access (superuser)
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ScopeDefinition {
+    pub domain: String,
+    pub action: String,
+    pub kind: Option<String>, // For jobs:run:kind (optional)
+    pub resource: Option<Vec<String>>,
+}
+
+impl ScopeDefinition {
+    pub fn new(
+        domain: &str,
+        action: &str,
+        kind: Option<&str>,
+        resource: Option<Vec<String>>,
+    ) -> Self {
+        Self {
+            domain: domain.to_string(),
+            action: action.to_string(),
+            kind: kind.map(|s| s.to_string()),
+            resource: resource,
+        }
+    }
+
+    pub fn from_scope_string(scope: &str) -> Result<Self> {
+        let parts: Vec<&str> = scope.split(':').collect();
+
+        let into_owned_vec = |resources: &str| -> Vec<String> {
+            let resources = resources
+                .split(",")
+                .collect_vec()
+                .into_iter()
+                .map(ToOwned::to_owned)
+                .collect_vec();
+
+            resources
+        };
+
+        match parts.len() {
+            2 => Ok(Self::new(parts[0], parts[1], None, None)), // domain:action
+            3 => {
+                if parts[0] == "jobs" && parts[1] == "run" {
+                    Ok(Self::new(parts[0], parts[1], Some(parts[2]), None))
+                } else {
+                    Ok(Self::new(
+                        parts[0],
+                        parts[1],
+                        None,
+                        Some(into_owned_vec(parts[2])),
+                    ))
+                }
+            }
+            4 => {
+                if parts[0] == "jobs" && parts[1] == "run" {
+                    Ok(Self::new(
+                        parts[0],
+                        parts[1],
+                        Some(parts[2]),
+                        Some(into_owned_vec(parts[3])),
+                    ))
+                } else {
+                    Err(Error::BadRequest(format!(
+                        "Invalid 4-part scope: {}",
+                        scope
+                    )))
+                }
+            }
+            _ => Err(Error::BadRequest(format!(
+                "Invalid scope format: {}",
+                scope
+            ))),
+        }
+    }
+
+    pub fn as_string(&self) -> String {
+        match (&self.kind, &self.resource) {
+            (Some(kind), Some(resource)) => {
+                format!(
+                    "{}:{}:{}:{}",
+                    self.domain,
+                    self.action,
+                    kind,
+                    resource.join(",")
+                )
+            }
+            (Some(kind), None) => {
+                format!("{}:{}:{}", self.domain, self.action, kind)
+            }
+            (None, Some(resource)) => {
+                format!("{}:{}:{}", self.domain, self.action, resource.join(","))
+            }
+            (None, None) => format!("{}:{}", self.domain, self.action),
+        }
+    }
+
+    pub fn includes(&self, other: &ScopeDefinition) -> bool {
+        if self.domain != other.domain {
+            return false;
+        }
+
+        match (self.action.as_str(), other.action.as_str()) {
+            (a, b) if (a == "write" && b == "read") || (a == b) => {}
+            // Apps only: `write` can rewrite the app and its policy, so it also covers
+            // running its components. Not general — `jobs:write` must not grant
+            // `jobs:run`. The resource check below still confines it to the same app.
+            ("write", "run") if self.domain == "apps" => {}
+            ("write", "cancel") if self.domain == "jobs" => {}
+            _ => return false,
+        }
+
+        if self.domain == "jobs" && self.action == "run" {
+            match (&self.kind, &other.kind) {
+                (Some(self_kind), Some(other_kind)) => {
+                    if self_kind != other_kind {
+                        return false;
+                    }
+                }
+                (Some(_), None) => {
+                    return false;
+                }
+                (None, _) => {
+                    return true;
+                }
+            }
+        }
+
+        match (&self.resource, &other.resource) {
+            (Some(self_resources), Some(other_resources)) => {
+                resources_match(self_resources, other_resources)
+            }
+            // A requirement naming no path is the whole domain, so only a grant that
+            // itself spans every path satisfies it. `*` is that grant — the scope UI
+            // accepts it as a resource path and `resources_match` already reads it as
+            // everything — while any listed path leaves the collection unauthorized.
+            (Some(self_resources), None) => self_resources.iter().any(|r| r == "*"),
+            (None, _) => true,
+        }
+    }
+}
+
+fn resources_match(scope_resources: &[String], accepted_resources: &[String]) -> bool {
+    if scope_resources.contains(&"*".to_string()) || accepted_resources.contains(&"*".to_string()) {
+        return true;
+    }
+
+    if scope_resources.len() <= 4 && accepted_resources.len() <= 4 {
+        return resources_match_small(scope_resources, accepted_resources);
+    }
+
+    resources_match_large(scope_resources, accepted_resources)
+}
+
+fn resources_match_small(scope_resources: &[String], accepted_resources: &[String]) -> bool {
+    for required in accepted_resources {
+        for scope_resource in scope_resources {
+            if resource_matches_pattern(scope_resource, required) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn resources_match_large(scope_resources: &[String], accepted_resources: &[String]) -> bool {
+    let mut exact_matches = HashSet::new();
+    let mut patterns = Vec::new();
+
+    for scope_resource in scope_resources {
+        if scope_resource.contains('*') {
+            patterns.push(scope_resource);
+        } else {
+            exact_matches.insert(scope_resource);
+        }
+    }
+
+    for accepted_resource in accepted_resources {
+        if exact_matches.contains(accepted_resource) {
+            return true;
+        }
+
+        for pattern in &patterns {
+            if resource_matches_pattern(pattern, accepted_resource) {
+                return true;
+            }
+        }
+    }
+
+    false
+}
+
+fn resource_matches_pattern(scope_resource: &str, accepted_resource: &str) -> bool {
+    if scope_resource == accepted_resource {
+        return true;
+    }
+
+    let matches_wildcard = |pattern: &str, resource: &str| -> bool {
+        if !pattern.ends_with("/*") {
+            return false;
+        }
+
+        let prefix = &pattern[..pattern.len() - 2];
+
+        if !resource.starts_with(prefix) {
+            return false;
+        }
+
+        // If the resource is exactly the prefix, it matches
+        if resource.len() == prefix.len() {
+            return true;
+        }
+
+        // If the resource is longer, the next character must be '/' for a valid match
+        // This prevents "u/user" from matching "u/use/*"
+        resource.chars().nth(prefix.len()) == Some('/')
+    };
+
+    // Check if either resource is a wildcard pattern and matches the other
+    matches_wildcard(scope_resource, accepted_resource)
+        || matches_wildcard(accepted_resource, scope_resource)
+}
+
+// ─────────────────────────────────────────────────────────────────
+// Route-level scope checking
+// ─────────────────────────────────────────────────────────────────
+
+/// Available scope domains (top-level API categories)
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ScopeDomain {
+    // Core resource domains
+    Jobs,
+    Scripts,
+    /// The `/data_metrics` catalog. Its own domain, NOT an alias of `Scripts`: a
+    /// `data_metrics:read` token must reach only this route, never the broader
+    /// `/scripts` routes (some of which do no further scope check).
+    DataMetrics,
+    Flows,
+    FlowConversations,
+    Apps,
+    Variables,
+    Resources,
+    Schedules,
+    Folders,
+    Users,
+    Groups,
+    Workspaces,
+
+    // Trigger domains
+    HttpTriggers,
+    WebsocketTriggers,
+    KafkaTriggers,
+    NatsTriggers,
+    MqttTriggers,
+    AmqpTriggers,
+    SqsTriggers,
+    GcpTriggers,
+    AzureTriggers,
+    PostgresTriggers,
+    EmailTriggers,
+
+    // Native trigger domains
+    NativeTriggers,
+    TriggersHistory,
+
+    // System domains
+    Audit,
+    Settings,
+    Workers,
+    ServiceLogs,
+    Configs,
+    OAuth,
+    AI,
+    AiEvals, // AI agent eval datasets
+
+    Indexer,
+    Teams,   // Microsoft Teams integration
+    GitSync, // Git synchronization
+
+    // Special domains
+    Capture,           // Webhook capture
+    Drafts,            // Draft resources
+    Favorites,         // User favorites
+    Inputs,            // Input templates
+    JobHelpers,        // Job helper functions
+    ConcurrencyGroups, // Concurrency groups
+    Oidc,              // OpenID Connect
+    Openapi,           // OpenAPI generation
+
+    // Additional domains
+    Acls,         // Granular access control lists
+    RawApps,      // Raw application data
+    AgentWorkers, // Agent workers management
+    Mcp,          // MCP
+    Docs,         // Self-hosted documentation search (read-only)
+}
+
+impl ScopeDomain {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Jobs => "jobs",
+            Self::Scripts => "scripts",
+            Self::DataMetrics => "data_metrics",
+            Self::Flows => "flows",
+            Self::FlowConversations => "flow_conversations",
+            Self::Apps => "apps",
+            Self::Variables => "variables",
+            Self::Resources => "resources",
+            Self::Schedules => "schedules",
+            Self::Folders => "folders",
+            Self::Users => "users",
+            Self::Groups => "groups",
+            Self::Workspaces => "workspaces",
+            Self::HttpTriggers => "http_triggers",
+            Self::WebsocketTriggers => "websocket_triggers",
+            Self::KafkaTriggers => "kafka_triggers",
+            Self::NatsTriggers => "nats_triggers",
+            Self::MqttTriggers => "mqtt_triggers",
+            Self::AmqpTriggers => "amqp_triggers",
+            Self::SqsTriggers => "sqs_triggers",
+            Self::GcpTriggers => "gcp_triggers",
+            Self::AzureTriggers => "azure_triggers",
+            Self::PostgresTriggers => "postgres_triggers",
+            Self::EmailTriggers => "email_triggers",
+            Self::NativeTriggers => "native_triggers",
+            Self::TriggersHistory => "triggers_history",
+            Self::Audit => "audit",
+            Self::Settings => "settings",
+            Self::Workers => "workers",
+            Self::ServiceLogs => "service_logs",
+            Self::Configs => "configs",
+            Self::OAuth => "oauth",
+            Self::AI => "ai",
+            Self::AiEvals => "ai_evals",
+            Self::Capture => "capture",
+            Self::Drafts => "drafts",
+            Self::Favorites => "favorites",
+            Self::Inputs => "inputs",
+            Self::JobHelpers => "job_helpers",
+            Self::ConcurrencyGroups => "concurrency_groups",
+            Self::Oidc => "oidc",
+            Self::Openapi => "openapi",
+            Self::Acls => "acls",
+            Self::RawApps => "raw_apps",
+            Self::AgentWorkers => "agent_workers",
+            Self::Indexer => "indexer",
+            Self::Teams => "teams",
+            Self::GitSync => "git_sync",
+            Self::Mcp => "mcp",
+            Self::Docs => "docs",
+        }
+    }
+
+    pub fn from_str(s: &str) -> Option<Self> {
+        match s {
+            "jobs" | "jobs_u" => Some(Self::Jobs),
+            "scripts" => Some(Self::Scripts),
+            // A distinct domain, not an alias of `scripts` (see the enum variant):
+            // a `data_metrics:read` token must not reach the broader /scripts routes.
+            "data_metrics" => Some(Self::DataMetrics),
+            "flows" => Some(Self::Flows),
+            "flow_conversations" => Some(Self::FlowConversations),
+            "apps" | "apps_u" => Some(Self::Apps),
+            "variables" => Some(Self::Variables),
+            "resources" => Some(Self::Resources),
+            "schedules" => Some(Self::Schedules),
+            "folders" => Some(Self::Folders),
+            "users" => Some(Self::Users),
+            "groups" => Some(Self::Groups),
+            "workspaces" => Some(Self::Workspaces),
+            "http_triggers" => Some(Self::HttpTriggers),
+            "websocket_triggers" => Some(Self::WebsocketTriggers),
+            "kafka_triggers" => Some(Self::KafkaTriggers),
+            "nats_triggers" => Some(Self::NatsTriggers),
+            "mqtt_triggers" => Some(Self::MqttTriggers),
+            "amqp_triggers" => Some(Self::AmqpTriggers),
+            "sqs_triggers" => Some(Self::SqsTriggers),
+            "gcp_triggers" => Some(Self::GcpTriggers),
+            "azure_triggers" => Some(Self::AzureTriggers),
+            "postgres_triggers" => Some(Self::PostgresTriggers),
+            "email_triggers" => Some(Self::EmailTriggers),
+            "audit" => Some(Self::Audit),
+            "settings" => Some(Self::Settings),
+            "workers" => Some(Self::Workers),
+            "service_logs" => Some(Self::ServiceLogs),
+            "configs" => Some(Self::Configs),
+            "oauth" => Some(Self::OAuth),
+            "ai" => Some(Self::AI),
+            "ai_evals" => Some(Self::AiEvals),
+            "indexer" | "srch" => Some(Self::Indexer),
+            "teams" => Some(Self::Teams),
+            "native_triggers" => Some(Self::NativeTriggers),
+            "triggers_history" => Some(Self::TriggersHistory),
+            "git_sync" | "github_app" => Some(Self::GitSync),
+            "capture" => Some(Self::Capture),
+            "drafts" => Some(Self::Drafts),
+            "favorites" => Some(Self::Favorites),
+            "inputs" => Some(Self::Inputs),
+            "job_helpers" => Some(Self::JobHelpers),
+            "concurrency_groups" => Some(Self::ConcurrencyGroups),
+            "oidc" => Some(Self::Oidc),
+            "openapi" => Some(Self::Openapi),
+            "acls" => Some(Self::Acls),
+            "raw_apps" => Some(Self::RawApps),
+            "agent_workers" => Some(Self::AgentWorkers),
+            "mcp" => Some(Self::Mcp),
+            "docs" => Some(Self::Docs),
+            _ => None,
+        }
+    }
+}
+
+/// Available scope actions
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ScopeAction {
+    Read,   // GET operations, list, view
+    Write,  // POST, PUT, PATCH, DELETE operations, create, update, delete
+    Run,    // Special action for running (scripts, flows, etc.)
+    Cancel, // Cancelling jobs (`CANCEL_PATH_ACTIONS`); covered by `jobs:write`
+}
+
+impl ScopeAction {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Read => "read",
+            Self::Write => "write",
+            Self::Run => "run",
+            Self::Cancel => "cancel",
+        }
+    }
+
+    pub fn from_str(s: &str) -> Option<Self> {
+        match s {
+            "read" => Some(Self::Read),
+            "write" => Some(Self::Write),
+            "delete" => Some(Self::Write),
+            "run" => Some(Self::Run),
+            "cancel" => Some(Self::Cancel),
+            _ => None,
+        }
+    }
+
+    /// Check if this action includes another action
+    /// Write includes Read
+    pub fn includes(&self, other: &ScopeAction) -> bool {
+        match (self, other) {
+            (ScopeAction::Write, ScopeAction::Read) => true,
+            (ScopeAction::Run, ScopeAction::Read) => true,
+            (ScopeAction::Write, ScopeAction::Cancel) => true,
+            (a, b) => a == b,
+        }
+    }
+}
+
+/// Whether `caller` grants at least everything `requested` grants (directional
+/// containment).
+///
+/// This is intentionally NOT `ScopeDefinition::includes`: that method answers
+/// "does this scope grant access to a required action" using OR semantics over
+/// resources (any overlap counts, and a `*` on either side matches), which is
+/// correct for access checks but unsafe for subset checks — it would let a
+/// token scoped to `scripts:read:f/team/a` mint `scripts:read:*` or
+/// `scripts:read:f/team/a,f/other/b`. Subset containment instead requires that
+/// EVERY requested resource is covered by SOME caller resource.
+pub fn scope_contains(caller: &ScopeDefinition, requested: &ScopeDefinition) -> bool {
+    if caller.domain != requested.domain {
+        return false;
+    }
+
+    // write subsumes read; otherwise the action must match exactly.
+    match (caller.action.as_str(), requested.action.as_str()) {
+        (c, r) if c == r || (c == "write" && r == "read") => {}
+        // Apps only: `write` covers `run` (see `ScopeDefinition::includes`), so an
+        // app-editor token can mint the narrower run-only credential.
+        ("write", "run") if caller.domain == "apps" => {}
+        ("write", "cancel") if caller.domain == "jobs" => {}
+        _ => return false,
+    }
+
+    if caller.domain == "jobs" && caller.action == "run" {
+        match (&caller.kind, &requested.kind) {
+            (Some(caller_kind), Some(requested_kind)) if caller_kind != requested_kind => {
+                return false
+            }
+            // Caller pinned to a kind, but the request covers any kind.
+            (Some(_), None) => return false,
+            _ => {}
+        }
+    }
+
+    match (&caller.resource, &requested.resource) {
+        // Caller is unrestricted on resources: covers everything.
+        (None, _) => true,
+        // Caller is resource-restricted but the request is not: broader, unless the
+        // caller lists `*` and so already spans every path. Kept in step with
+        // `ScopeDefinition::includes`, which accepts that same grant for a
+        // whole-collection read: what a token may exercise, it may also delegate.
+        (Some(caller_resources), None) => caller_resources.iter().any(|r| r == "*"),
+        (Some(caller_resources), Some(requested_resources)) => {
+            resource_set_contains(caller_resources, requested_resources)
+        }
+    }
+}
+
+/// Every resource in `requested` must be covered by some resource in `caller`.
+fn resource_set_contains(caller: &[String], requested: &[String]) -> bool {
+    if caller.iter().any(|r| r == "*") {
+        return true;
+    }
+    requested
+        .iter()
+        .all(|req| req != "*" && caller.iter().any(|c| resource_covers(c, req)))
+}
+
+/// Directional: does the single caller resource pattern cover `requested`?
+/// `caller` may be an exact path or a `<prefix>/*` subtree wildcard; `requested`
+/// may itself be a subtree wildcard, in which case the whole requested subtree
+/// must fall within the caller's subtree.
+fn resource_covers(caller: &str, requested: &str) -> bool {
+    if caller == requested {
+        return true;
+    }
+    let Some(prefix) = caller.strip_suffix("/*") else {
+        // An exact caller resource only covers itself (handled above).
+        return false;
+    };
+    let requested_base = requested.strip_suffix("/*").unwrap_or(requested);
+    requested_base == prefix
+        || (requested_base.starts_with(prefix)
+            && requested_base.as_bytes().get(prefix.len()) == Some(&b'/'))
+}
+
+/// Stands in for an empty set of job token scopes. A token with `scopes: Some([])` is
+/// unrestricted (an empty list is read as "no scopes defined"), so a job whose effective
+/// scopes are empty carries this entry instead: it does not parse, and an unparseable
+/// entry marks a token as scoped while granting nothing.
+pub const NO_API_ACCESS_SCOPE: &str = "no_api_access";
+
+/// Validates and normalizes a script or flow `job_token_scopes` setting. `[]` is valid and
+/// leaves the job only the runtime routes about itself.
+pub fn validate_job_token_scopes(scopes: &[String]) -> Result<Vec<String>> {
+    let mut normalized: Vec<String> = Vec::with_capacity(scopes.len());
+    for scope in scopes {
+        let scope = scope.trim();
+        // MCP scopes follow the MCP runtime's own grammar, and a list of only
+        // `if_jobs:filter_tags` entries reads as unscoped: neither can cap a job token.
+        if scope.starts_with("mcp:") || scope.starts_with("if_jobs:") {
+            return Err(Error::BadRequest(format!(
+                "Job token scopes cannot include '{scope}'"
+            )));
+        }
+        let parsed = ScopeDefinition::from_scope_string(scope)?;
+        if ScopeDomain::from_str(&parsed.domain).is_none()
+            || ScopeAction::from_str(&parsed.action).is_none()
+        {
+            return Err(Error::BadRequest(format!(
+                "Unknown job token scope '{scope}'"
+            )));
+        }
+        if !normalized.iter().any(|s| s == scope) {
+            normalized.push(scope.to_string());
+        }
+    }
+    Ok(normalized)
+}
+
+/// The scopes a pushed job's token is restricted to: what `ceiling` (the scopes of the job
+/// or token the push acts for) and `own` (the target's `job_token_scopes` setting) both
+/// grant. `None` on both sides means unrestricted.
+///
+/// Keeps every entry of either side contained by some entry of the other. Overlaps that
+/// neither side contains whole (two different globs) are dropped, which can only narrow.
+pub fn intersect_job_token_scopes(
+    ceiling: Option<&[String]>,
+    own: Option<&[String]>,
+) -> Option<Vec<String>> {
+    match (ceiling, own) {
+        (None, None) => None,
+        (Some(c), None) => Some(c.to_vec()),
+        (None, Some(o)) => Some(o.to_vec()),
+        (Some(c), Some(o)) => {
+            let parse = |scopes: &[String]| -> Vec<Option<ScopeDefinition>> {
+                scopes
+                    .iter()
+                    .map(|s| ScopeDefinition::from_scope_string(s).ok())
+                    .collect()
+            };
+            let (pc, po) = (parse(c), parse(o));
+            let mut out: Vec<String> = vec![];
+            let mut keep_covered =
+                |raw: &[String], parsed: &[Option<ScopeDefinition>], by: &[Option<ScopeDefinition>]| {
+                    for (s, p) in raw.iter().zip(parsed) {
+                        let Some(p) = p else { continue };
+                        if by.iter().flatten().any(|b| scope_contains(b, p))
+                            && !out.iter().any(|x| x == s)
+                        {
+                            out.push(s.clone());
+                        }
+                    }
+                };
+            keep_covered(o, &po, &pc);
+            keep_covered(c, &pc, &po);
+            Some(out)
+        }
+    }
+}
+
+/// Validates the `job_token_scopes` of every step and agent tool of a flow, returning whether
+/// any of them sets one.
+pub fn validate_flow_step_job_token_scopes(value: &crate::flows::FlowValue) -> Result<bool> {
+    let mut any = false;
+    let mut check = |module: &crate::flows::FlowModule| -> anyhow::Result<()> {
+        if let Some(scopes) = &module.job_token_scopes {
+            any = true;
+            validate_job_token_scopes(scopes)
+                .map_err(|e| anyhow::anyhow!("step {}: {e}", module.id))?;
+        }
+        Ok(())
+    };
+    let extra: Vec<crate::flows::FlowModule> = value
+        .failure_module
+        .iter()
+        .chain(value.preprocessor_module.iter())
+        .map(|m| (**m).clone())
+        .collect();
+    crate::flows::FlowModule::traverse_modules(&value.modules, &mut check)
+        .and_then(|()| crate::flows::FlowModule::traverse_modules(&extra, &mut check))
+        .map_err(|e| Error::BadRequest(e.to_string()))?;
+    Ok(any)
+}
+
+/// Counts a deploy of a script or flow that restricts its job token, keyed by which shape
+/// of restriction it picked, so take-up of the presets can be told from custom lists.
+pub fn log_job_token_scopes_deploy(kind: &'static str, scopes: Option<&[String]>) {
+    let Some(scopes) = scopes else { return };
+    let shape = match scopes {
+        [] => "no_api",
+        [only] if only == "oidc:write" => "oidc_only",
+        _ => "custom",
+    };
+    crate::feature_usage::log_feature_usage(
+        "job_token_scopes",
+        "deploy",
+        &format!("{kind}:{shape}"),
+    );
+}
+
+/// The cap a flow step or agent tool's own `job_token_scopes` puts on its jobs. A definition
+/// can reach the worker without the deploy-time validation (a raw flow), so a setting that
+/// does not validate restricts the step to no API access rather than being trusted as is.
+pub fn step_job_token_scopes(scopes: Option<&[String]>) -> Option<Vec<String>> {
+    scopes.map(|s| validate_job_token_scopes(s).unwrap_or_default())
+}
+
+/// The `scopes` claim of a job token minted from the job's effective scopes.
+pub fn job_token_jwt_scopes(effective: Option<Vec<String>>) -> Option<Vec<String>> {
+    match effective {
+        Some(s) if s.is_empty() => Some(vec![NO_API_ACCESS_SCOPE.to_string()]),
+        s => s,
+    }
+}
+
+#[cfg(test)]
+mod job_token_scopes_tests {
+    use super::*;
+
+    fn v(s: &[&str]) -> Vec<String> {
+        s.iter().map(|s| s.to_string()).collect()
+    }
+
+    #[test]
+    fn intersect_never_widens() {
+        assert_eq!(intersect_job_token_scopes(None, None), None);
+        let oidc = v(&["oidc:write"]);
+        assert_eq!(intersect_job_token_scopes(Some(&oidc), None), Some(oidc.clone()));
+        assert_eq!(intersect_job_token_scopes(None, Some(&oidc)), Some(oidc.clone()));
+        // A child setting asking for more than its parent holds gets only the common part.
+        assert_eq!(
+            intersect_job_token_scopes(
+                Some(&oidc),
+                Some(&v(&["oidc:write", "variables:read"]))
+            ),
+            Some(oidc.clone())
+        );
+        // Narrower entries win from either side.
+        assert_eq!(
+            intersect_job_token_scopes(
+                Some(&v(&["variables:write:f/a/*"])),
+                Some(&v(&["variables:read:f/a/b", "scripts:read"]))
+            ),
+            Some(v(&["variables:read:f/a/b"]))
+        );
+        assert_eq!(
+            intersect_job_token_scopes(Some(&v(&["jobs:run"])), Some(&v(&["oidc:write"]))),
+            Some(vec![])
+        );
+        // The empty-set marker grants nothing to intersect with.
+        assert_eq!(
+            intersect_job_token_scopes(Some(&v(&[NO_API_ACCESS_SCOPE])), Some(&oidc)),
+            Some(vec![])
+        );
+    }
+
+    #[test]
+    fn empty_effective_scopes_mint_a_scoped_token() {
+        assert_eq!(
+            job_token_jwt_scopes(Some(vec![])),
+            Some(v(&[NO_API_ACCESS_SCOPE]))
+        );
+        assert_eq!(job_token_jwt_scopes(None), None);
+    }
+
+    #[test]
+    fn validate_rejects_unusable_scopes() {
+        assert!(validate_job_token_scopes(&v(&["mcp:all"])).is_err());
+        assert!(validate_job_token_scopes(&v(&["if_jobs:filter_tags:a"])).is_err());
+        assert!(validate_job_token_scopes(&v(&["nope:write"])).is_err());
+        assert!(validate_job_token_scopes(&v(&["*"])).is_err());
+        assert_eq!(
+            validate_job_token_scopes(&v(&["oidc:write", " oidc:write"])).unwrap(),
+            v(&["oidc:write"])
+        );
+        // A step setting that skipped deploy validation restricts rather than widens.
+        assert_eq!(
+            step_job_token_scopes(Some(&v(&["if_jobs:filter_tags:bun"]))),
+            Some(vec![])
+        );
+    }
+}
diff --git a/backend/windmill-common/src/scripts.rs b/backend/windmill-common/src/scripts.rs
index 9726065c6f..87148f3f4c 100644
--- a/backend/windmill-common/src/scripts.rs
+++ b/backend/windmill-common/src/scripts.rs
@@ -28,7 +28,9 @@ use crate::utils::StripPath;
 /// `push`'s default (the language tag). Every relock of a script must use this, or a relock
 /// lands on a worker pool other than the one its deploy locked on and resolves packages
 /// differently.
-/// Dedicated workers are handled by `push`, which gives `dedicated_worker` precedence.
+/// Dedicated workers are handled by `push`, which gives `dedicated_worker` precedence. Below
+/// that, `push` replaces this result with the instance's `dependency_job_tag` setting when it is
+/// set, except for bunnative.
 pub fn dependency_job_tag(tag: Option<String>, language: &ScriptLang) -> Option<String> {
     if tag.as_ref().is_some_and(|x| x.contains("$args[")) {
         None
@@ -162,6 +164,7 @@ async fn prefetch_cached_script_inner(
         assets: script.assets,
         modules: script.modules,
         labels: script.labels,
+        job_token_scopes: script.job_token_scopes,
         inherited_labels: script.inherited_labels,
         runnable_settings: ScriptRunnableSettingsInline {
             concurrency_settings: concurrency_settings.maybe_fallback(
@@ -461,6 +464,7 @@ pub async fn deploy_relocked_version(
         modules,
         auto_parent: None,
         labels: s.labels,
+        job_token_scopes: Some(s.job_token_scopes.clone()),
         skip_draft_deletion: None,
     };
 
@@ -481,7 +485,7 @@ pub async fn deploy_relocked_version(
     dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
     delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
     codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels, \
-    lock_error_logs, created_at)
+    job_token_scopes, lock_error_logs, created_at)
 
     SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, \
             content, created_by, schema, is_template, extra_perms, $4::text, language, kind, tag, \
@@ -489,7 +493,7 @@ pub async fn deploy_relocked_version(
             dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
             delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
             codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, COALESCE($5::jsonb, modules), labels, \
-            $6::text, clock_timestamp()
+            job_token_scopes, $6::text, clock_timestamp()
 
     FROM script WHERE hash = $2 AND workspace_id = $3;
             ", new_hash, s.hash.0, w_id, lock, modules_json, lock_error_logs).execute(&mut **tx).await?;
diff --git a/backend/windmill-common/src/tracing_init.rs b/backend/windmill-common/src/tracing_init.rs
index b456e370fc..855e077004 100644
--- a/backend/windmill-common/src/tracing_init.rs
+++ b/backend/windmill-common/src/tracing_init.rs
@@ -44,6 +44,11 @@ lazy_static::lazy_static! {
 /// Use `tracing::info!(target: windmill_common::tracing_init::VERBOSE_TARGET, ...)` for logs that should be suppressed in quiet mode.
 pub const VERBOSE_TARGET: &str = "windmill_verbose";
 
+/// Target of audit events, so a log pipeline can route them without matching on content.
+/// It keeps the `windmill` prefix because that is what a `RUST_LOG` of `info` or `debug`
+/// is rewritten to filter on.
+pub const AUDIT_TARGET: &str = "windmill:audit";
+
 /// Prefix used by user scripts to emit a log line as an OTEL tracing event
 /// when `OTEL_JOB_LOGS=true`. Stripped before forwarding to the tracing layer.
 pub const OTEL_PREFIX: &str = "OTEL: ";
@@ -215,6 +220,28 @@ pub fn initialize_tracing(
     (_guard, meter_provider)
 }
 
+/// Tracing for a subcommand that writes to the instance without running a server
+/// (`sync-config`, the operator): stdout, plus the OTel logs bridge when OTel logs are
+/// enabled, which is how the audit events of its writes reach a collector. It writes no
+/// service log files, as nothing lists such a process to read them back.
+///
+/// Only audit events are exported. These processes log each setting they write with its
+/// value, masked by a list of known secret fields rather than by shape, and that is fit
+/// for the operator's own stdout but not for a collector.
+pub fn initialize_subcommand_tracing(service: &str, hostname: &str, environment: &str) {
+    let logs_bridge = crate::otel_oss::init_logs_bridge_for_service(service, hostname, environment);
+    tracing_subscriber::registry()
+        .with(logs_bridge.with_filter(Targets::new().with_target(AUDIT_TARGET, LevelFilter::INFO)))
+        .with(
+            tracing_subscriber::fmt::layer().with_filter(
+                EnvFilter::builder()
+                    .with_default_directive(LevelFilter::INFO.into())
+                    .from_env_lossy(),
+            ),
+        )
+        .init();
+}
+
 lazy_static::lazy_static! {
     pub static ref LOG_COUNTING_BY_MIN: Arc<RwLock<HashMap<String, LogCounter>>> = Arc::new(RwLock::new(HashMap::new()));
 }
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index af6bdfe2b3..116a15303e 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -281,6 +281,9 @@ pub fn sanitize_db_error(e: sqlx::Error) -> Error {
         return Error::from(e);
     };
     match db_err.code().as_deref() {
+        Some("23514") if db_err.constraint() == Some("variable_value_length") => {
+            Error::BadRequest("A field exceeds its maximum length".to_string())
+        }
         // check_violation — `proper_id` / `proper_name` and friends
         Some("23514") => Error::BadRequest(
             "Invalid path or name: it does not match the required format".to_string(),
diff --git a/backend/windmill-common/src/variables.rs b/backend/windmill-common/src/variables.rs
index 1feb4182ab..58766cf25b 100644
--- a/backend/windmill-common/src/variables.rs
+++ b/backend/windmill-common/src/variables.rs
@@ -12,11 +12,13 @@ use crate::scripts::ScriptHash;
 use crate::secret_backend::{get_secret_value, is_external_stored_value};
 use crate::utils::WarnAfterExt;
 use crate::worker::Connection;
+use crate::workspace_crypt::CipherFormat;
+pub use crate::workspace_crypt::WorkspaceCrypt;
 use crate::{worker::WORKER_GROUP, BASE_URL, DB};
 use chrono::{SecondsFormat, Utc};
-use magic_crypt::{MagicCrypt256, MagicCryptError, MagicCryptTrait};
 use quick_cache::sync::Cache;
 use serde::{Deserialize, Serialize};
+use std::sync::atomic::{AtomicBool, Ordering};
 
 lazy_static::lazy_static! {
     pub static ref SECRET_SALT: Option<String> = std::env::var("SECRET_SALT").ok();
@@ -211,7 +213,7 @@ pub struct CreateVariable {
     pub ws_specific: Option<bool>,
 }
 
-pub async fn build_crypt(db: &DB, w_id: &str) -> crate::error::Result<MagicCrypt256> {
+pub async fn build_crypt(db: &DB, w_id: &str) -> crate::error::Result<WorkspaceCrypt> {
     // Check cache first (300-second staleness)
     let cached_key_o = WORKSPACE_CRYPT_CACHE.get(w_id).and_then(|(ts, key)| {
         if ts > chrono::Utc::now().timestamp() - 300 {
@@ -235,7 +237,7 @@ pub async fn build_crypt(db: &DB, w_id: &str) -> crate::error::Result<MagicCrypt
         } else {
             key
         };
-        let ncrypt = magic_crypt::new_magic_crypt!(crypt_key, 256);
+        let ncrypt = WorkspaceCrypt::new(&crypt_key);
         WORKSPACE_CRYPT_CACHE.insert(
             w_id.to_string(),
             (chrono::Utc::now().timestamp(), ncrypt.clone()),
@@ -250,19 +252,19 @@ pub async fn build_crypt_with_key_suffix(
     db: &DB,
     w_id: &str,
     key_suffix: &str,
-) -> crate::error::Result<MagicCrypt256> {
+) -> crate::error::Result<WorkspaceCrypt> {
     let key = get_workspace_key(w_id, db).await?;
     Ok(crypt_from_key_with_suffix(&key, key_suffix))
 }
 
 /// The cipher `build_crypt_with_key_suffix` builds, from a key string in hand.
-pub fn crypt_from_key_with_suffix(key: &str, key_suffix: &str) -> MagicCrypt256 {
+pub fn crypt_from_key_with_suffix(key: &str, key_suffix: &str) -> WorkspaceCrypt {
     let crypt_key = if let Some(ref salt) = SECRET_SALT.as_ref() {
         format!("{}{}{}", key, salt, key_suffix)
     } else {
         format!("{}{}", key, key_suffix)
     };
-    magic_crypt::new_magic_crypt!(crypt_key, 256)
+    WorkspaceCrypt::new(&crypt_key)
 }
 
 pub async fn get_workspace_key(w_id: &str, db: &DB) -> crate::error::Result<String> {
@@ -371,25 +373,178 @@ pub async fn get_secret_value_as_admin(
     Ok(r)
 }
 
-pub fn encrypt(mc: &MagicCrypt256, value: &str) -> String {
-    mc.encrypt_str_to_base64(value)
+pub fn encrypt(mc: &WorkspaceCrypt, value: &str) -> String {
+    mc.encrypt_str(value)
 }
 
-pub fn decrypt(mc: &MagicCrypt256, value: String) -> error::Result<String> {
-    mc.decrypt_base64_to_string(value).map_err(|e| match e {
-        MagicCryptError::DecryptError(_) => error::Error::internal_err(
-            "Could not decrypt value. The value may have been encrypted with a different key."
-                .to_string(),
-        ),
-        _ => error::Error::internal_err(e.to_string()),
+const DECRYPT_FAILED: &str =
+    "Could not decrypt value. The value may have been encrypted with a different key.";
+
+/// Every failure returns the same message so responses carry no signal about why decryption
+/// failed (authentication, padding, base64, UTF-8); the kind of failure is only logged.
+pub fn decrypt(mc: &WorkspaceCrypt, value: String) -> error::Result<String> {
+    mc.decrypt_str(&value).map_err(|e| {
+        tracing::warn!("decryption failed: {e}");
+        error::Error::internal_err(DECRYPT_FAILED.to_string())
     })
 }
 
+static LEGACY_SECRET_UPGRADE_DONE: AtomicBool = AtomicBool::new(false);
+static LEGACY_SECRET_UPGRADE_RUNNING: AtomicBool = AtomicBool::new(false);
+const LEGACY_SECRET_UPGRADE_BATCH: i64 = 200;
+
+/// Whether this process still has to run [`upgrade_legacy_secret_variables`]: once new values
+/// are written in v2, until one pass has gone through every workspace.
+pub fn legacy_secret_upgrade_pending() -> bool {
+    CipherFormat::current() == CipherFormat::V2
+        && !LEGACY_SECRET_UPGRADE_DONE.load(Ordering::Relaxed)
+}
+
+/// Re-encrypt the secret variables still in the legacy format in v2, workspace by workspace.
+/// Idempotent, and emits no git-sync event: the plaintexts do not change.
+pub async fn upgrade_legacy_secret_variables(db: &DB) {
+    struct Running;
+    impl Drop for Running {
+        fn drop(&mut self) {
+            LEGACY_SECRET_UPGRADE_RUNNING.store(false, Ordering::Release);
+        }
+    }
+    if !legacy_secret_upgrade_pending()
+        || LEGACY_SECRET_UPGRADE_RUNNING.swap(true, Ordering::AcqRel)
+    {
+        return;
+    }
+    // Cleared on drop, so a pass that panics does not stop every later one in this process.
+    let _running = Running;
+    upgrade_legacy_secret_variables_pass(db).await;
+}
+
+async fn upgrade_legacy_secret_variables_pass(db: &DB) {
+    let workspaces: Vec<String> = match sqlx::query_scalar("SELECT id FROM workspace ORDER BY id")
+        .fetch_all(db)
+        .await
+    {
+        Ok(w) => w,
+        Err(e) => {
+            tracing::error!("secret encryption upgrade: listing workspaces failed: {e:#}");
+            return;
+        }
+    };
+    tracing::info!(
+        "secret encryption upgrade: re-encrypting legacy secret variables of {} workspaces in AES-256-GCM",
+        workspaces.len()
+    );
+    let (mut upgraded, mut skipped, mut failed_workspaces) = (0, 0, 0);
+    for w_id in workspaces {
+        match upgrade_workspace_secret_variables(db, &w_id).await {
+            Ok((u, s)) => {
+                if u > 0 || s > 0 {
+                    tracing::info!(
+                        "secret encryption upgrade: workspace {w_id}: {u} re-encrypted, {s} skipped"
+                    );
+                }
+                upgraded += u;
+                skipped += s;
+            }
+            Err(e) => {
+                failed_workspaces += 1;
+                tracing::error!("secret encryption upgrade: workspace {w_id} failed: {e:#}");
+            }
+        }
+    }
+    tracing::info!(
+        "secret encryption upgrade: done, {upgraded} re-encrypted, {skipped} skipped, {failed_workspaces} workspaces failed"
+    );
+    if failed_workspaces == 0 {
+        LEGACY_SECRET_UPGRADE_DONE.store(true, Ordering::Relaxed);
+    }
+}
+
+/// The number of values re-encrypted and of values skipped as they do not decrypt.
+async fn upgrade_workspace_secret_variables(db: &DB, w_id: &str) -> error::Result<(usize, usize)> {
+    let (mut upgraded, mut skipped) = (0, 0);
+    let mut after = String::new();
+    loop {
+        let mut tx = db.begin().await?;
+        // Shared, so a rotation (which locks the key row for update and rewrites every secret)
+        // never interleaves with a batch, and the key read here is the one the values are under.
+        let key: Option<String> = sqlx::query_scalar(
+            "SELECT key FROM workspace_key WHERE workspace_id = $1 AND kind = 'cloud' FOR SHARE",
+        )
+        .bind(w_id)
+        .fetch_optional(&mut *tx)
+        .await?;
+        let Some(key) = key else {
+            return Ok((upgraded, skipped));
+        };
+        let mc = crypt_from_key_with_suffix(&key, "");
+        let rows: Vec<(String, String)> = sqlx::query_as(
+            "SELECT path, value FROM variable WHERE workspace_id = $1 AND is_secret AND path > $2 \
+             ORDER BY path LIMIT $3",
+        )
+        .bind(w_id)
+        .bind(&after)
+        .bind(LEGACY_SECRET_UPGRADE_BATCH)
+        .fetch_all(&mut *tx)
+        .await?;
+        let last_page = (rows.len() as i64) < LEGACY_SECRET_UPGRADE_BATCH;
+        for (path, value) in rows {
+            if value.is_empty() || is_external_stored_value(&value) || mc.is_v2(&value) {
+                after = path;
+                continue;
+            }
+            match mc.upgrade(&value) {
+                Some(new_value) => {
+                    // In a savepoint, so a value the update rejects (v2 is up to 44 chars longer
+                    // than CBC, which a column narrower than 15040 cannot hold) is skipped
+                    // without losing the batch.
+                    let mut sp = sqlx::Acquire::begin(&mut tx).await?;
+                    // Only over the value it was computed from, so a write racing it wins.
+                    match sqlx::query(
+                        "UPDATE variable SET value = $1 \
+                         WHERE workspace_id = $2 AND path = $3 AND value = $4",
+                    )
+                    .bind(new_value)
+                    .bind(w_id)
+                    .bind(&path)
+                    .bind(&value)
+                    .execute(&mut *sp)
+                    .await
+                    {
+                        Ok(r) => {
+                            sp.commit().await?;
+                            upgraded += r.rows_affected() as usize;
+                        }
+                        Err(e) => {
+                            sp.rollback().await?;
+                            tracing::warn!(
+                                "secret encryption upgrade: secret variable {path} of workspace {w_id} could not be stored re-encrypted, leaving it as is: {e}"
+                            );
+                            skipped += 1;
+                        }
+                    }
+                }
+                None => {
+                    tracing::warn!(
+                        "secret encryption upgrade: secret variable {path} of workspace {w_id} does not decrypt, leaving it as is"
+                    );
+                    skipped += 1;
+                }
+            }
+            after = path;
+        }
+        tx.commit().await?;
+        if last_page {
+            return Ok((upgraded, skipped));
+        }
+    }
+}
+
 pub const WM_SCHEDULED_FOR: &str = "WM_SCHEDULED_FOR";
 
 lazy_static::lazy_static! {
     pub static ref CUSTOM_ENVS_CACHE: Cache<String, (i64, Vec<(String, String)>)> = Cache::new(100);
-    pub static ref WORKSPACE_CRYPT_CACHE: Cache<String, (i64, MagicCrypt256)> = Cache::new(1000);
+    pub static ref WORKSPACE_CRYPT_CACHE: Cache<String, (i64, WorkspaceCrypt)> = Cache::new(1000);
 
 }
 
@@ -595,7 +750,7 @@ pub async fn get_reserved_variables(
     ContextualVariable {
         name: "WM_END_USER_EMAIL".to_string(),
         value: end_user_email.unwrap_or_else(|| "".to_string()),
-        description: "Email of the end user that executed the current script, propagated to flow steps. Only set when the run was triggered from an app (empty otherwise).".to_string(),
+        description: "Email of the end user that executed the current script, even when it runs on behalf of another identity, propagated to flow steps and child jobs. Set for app and API runs (for a webhook, the owner of the token it was called with), empty for runs fired by a schedule or by a trigger such as an HTTP route or Kafka.".to_string(),
         is_custom: false,
     },
     ContextualVariable {
@@ -746,7 +901,39 @@ pub async fn get_variable_or_self_as<T: Authable + Sync>(
 
 #[cfg(test)]
 mod tests {
-    use super::{can_bind_as_prologue_const, escape_js_single_quoted, is_valid_js_identifier};
+    use super::{
+        can_bind_as_prologue_const, decrypt, escape_js_single_quoted, is_valid_js_identifier,
+        DECRYPT_FAILED,
+    };
+    use crate::error::Error;
+    use crate::workspace_crypt::WorkspaceCrypt;
+    use base64::Engine;
+    use magic_crypt::MagicCryptTrait;
+
+    #[test]
+    fn decrypt_failures_all_return_the_same_message() {
+        let mc = WorkspaceCrypt::new("workspace-key");
+        let legacy = magic_crypt::new_magic_crypt!("workspace-key", 256);
+        let other = WorkspaceCrypt::new("another-key");
+        let b64 = base64::engine::general_purpose::STANDARD;
+        let v2 = mc.upgrade(&legacy.encrypt_str_to_base64("secret")).unwrap();
+        let mut tampered = b64.decode(v2).unwrap();
+        *tampered.last_mut().unwrap() ^= 1;
+        let failures = [
+            "not base64 at all!".to_string(),
+            legacy.encrypt_bytes_to_base64(&[0xff, 0xfe, 0xfd]),
+            other.encrypt_str_to_base64("secret"),
+            b64.encode(&tampered),
+        ];
+        for value in failures {
+            match decrypt(&mc, value.clone()) {
+                Err(Error::InternalErrLoc { message, .. }) => {
+                    assert_eq!(message, DECRYPT_FAILED, "for {value:?}")
+                }
+                other => panic!("expected the uniform decrypt error for {value:?}, got {other:?}"),
+            }
+        }
+    }
 
     #[test]
     fn is_valid_js_identifier_gates_prologue_injection() {
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index ca1745a34d..58223c5d4a 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -450,6 +450,7 @@ lazy_static::lazy_static! {
     pub static ref DEFAULT_TAGS_WORKSPACES: arc_swap::ArcSwap<Option<Vec<String>>> = arc_swap::ArcSwap::from_pointee(None);
     pub static ref FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX: AtomicBool = AtomicBool::new(false);
     pub static ref PREVIEW_TAGS_OVERRIDE: AtomicBool = AtomicBool::new(false);
+    pub static ref DEPENDENCY_JOB_TAG: arc_swap::ArcSwap<Option<String>> = arc_swap::ArcSwap::from_pointee(None);
 
     pub static ref MAX_TIMEOUT: u64 = std::env::var("TIMEOUT")
     .ok()
@@ -476,6 +477,7 @@ lazy_static::lazy_static! {
         env_vars: Default::default(),
         native_mode: false,
         object_store_cache_config: Default::default(),
+        paused: false,
     });
 
     pub static ref WORKER_PULL_QUERIES: arc_swap::ArcSwap<Vec<String>> = arc_swap::ArcSwap::from_pointee(vec![]);
@@ -810,7 +812,7 @@ fn format_pull_query(peek: String) -> String {
             j.same_worker, j.pre_run_error, j.visible_to_owner,
             j.tag, j.concurrent_limit, j.concurrency_time_window_s, j.flow_innermost_root_job, j.root_job,
             j.timeout, j.flow_step_id, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle, j.priority, j.raw_code, j.raw_lock, j.raw_flow,
-            j.script_entrypoint_override, j.preprocessed, COALESCE(pj.runnable_path, j.args->>'_FLOW_PATH') as parent_runnable_path,
+            j.script_entrypoint_override, j.preprocessed, p.job_token_scopes, COALESCE(pj.runnable_path, j.args->>'_FLOW_PATH') as parent_runnable_path,
             COALESCE(p.email, j.permissioned_as_email) as permissioned_as_email, p.username as permissioned_as_username, p.is_admin as permissioned_as_is_admin,
             p.is_operator as permissioned_as_is_operator, p.groups as permissioned_as_groups, p.folders as permissioned_as_folders, p.end_user_email as permissioned_as_end_user_email
         FROM q, j
@@ -843,11 +845,14 @@ pub fn make_suspended_pull_query(tags: &[String]) -> String {
 }
 // pub async fn make_suspended
 pub async fn store_suspended_pull_query(wc: &WorkerConfig) {
-    if wc.worker_tags.len() == 0 {
-        tracing::error!("Empty tags in worker tags, skipping");
-        return;
-    }
-    let query = make_suspended_pull_query(&wc.worker_tags);
+    // An empty tag list must clear the query: keeping the previous one would leave a reloaded
+    // worker pulling suspended jobs for tags it no longer listens to.
+    let query = if wc.worker_tags.is_empty() {
+        tracing::error!("Empty tags in worker tags, pulling no suspended jobs");
+        String::new()
+    } else {
+        make_suspended_pull_query(&wc.worker_tags)
+    };
     WORKER_SUSPENDED_PULL_QUERY.store(std::sync::Arc::new(query));
 }
 
@@ -921,6 +926,42 @@ pub async fn store_pull_query(wc: &WorkerConfig) {
     WORKER_PULL_QUERIES_FAIRNESS.store(std::sync::Arc::new(fairness_queries));
 }
 
+const WORKER_GROUP_PAUSED_CACHE_TTL: Duration = Duration::from_secs(10);
+
+lazy_static::lazy_static! {
+    static ref WORKER_GROUP_PAUSED_CACHE: quick_cache::sync::Cache<String, (bool, std::time::Instant)> =
+        quick_cache::sync::Cache::new(1000);
+}
+
+/// Whether the config of `worker_group` is paused, as the server sees it. A worker that reads
+/// its own config knows from `WORKER_CONFIG`; this is for the server deciding on behalf of
+/// workers that do not, and is cached since they ask on every pull.
+pub async fn is_worker_group_paused(db: &DB, worker_group: &str) -> bool {
+    if let Some((paused, at)) = WORKER_GROUP_PAUSED_CACHE.get(worker_group) {
+        if at.elapsed() < WORKER_GROUP_PAUSED_CACHE_TTL {
+            return paused;
+        }
+    }
+    let paused = match sqlx::query_scalar!(
+        "SELECT COALESCE(config->'paused' = 'true'::jsonb, false) FROM config WHERE name = $1",
+        format!("worker__{worker_group}")
+    )
+    .fetch_optional(db)
+    .await
+    {
+        Ok(paused) => paused.flatten().unwrap_or(false),
+        Err(e) => {
+            tracing::error!("Could not read whether worker group {worker_group} is paused: {e:#}");
+            return false;
+        }
+    };
+    WORKER_GROUP_PAUSED_CACHE.insert(
+        worker_group.to_string(),
+        (paused, std::time::Instant::now()),
+    );
+    paused
+}
+
 lazy_static::lazy_static! {
     pub static ref WINDMILL_DIR: String = {
         let dir = std::env::var("WINDMILL_DIR")
@@ -1160,6 +1201,8 @@ pub struct PythonAnnotations {
     pub py311: bool,
     pub py312: bool,
     pub py313: bool,
+    pub py314: bool,
+    pub py315: bool,
     pub sandbox: bool,
 }
 
@@ -1742,6 +1785,76 @@ pub fn get_cpu_period() -> Option<i64> {
     Some(100000)
 }
 
+/// Bucket bounds in bytes, 16 MiB to 32 GiB, shared by the Prometheus and OTel job
+/// peak-memory histograms so the two exports stay comparable.
+pub const JOB_MEMORY_PEAK_BUCKETS: [f64; 12] = {
+    let mut buckets = [0.0; 12];
+    let mut i = 0;
+    while i < 12 {
+        buckets[i] = (16u64 << (20 + i)) as f64;
+        i += 1;
+    }
+    buckets
+};
+
+/// Cumulative CPU accounting of the worker's cgroup. The throttling fields stay at 0
+/// when the cgroup has no CPU controller, which is also what an unthrottled one reports.
+#[derive(Debug, Clone, Copy, Default, PartialEq)]
+pub struct CpuStat {
+    pub usage_usec: u64,
+    pub nr_periods: u64,
+    pub nr_throttled: u64,
+    pub throttled_usec: u64,
+}
+
+#[cfg(not(windows))]
+fn cpu_stat_field(stat: &str, key: &str) -> Option<u64> {
+    stat.lines().find_map(|line| {
+        let (k, v) = line.split_once(' ')?;
+        (k == key).then(|| v.trim().parse().ok()).flatten()
+    })
+}
+
+#[cfg(not(windows))]
+fn parse_cgroup_v2_cpu_stat(stat: &str) -> Option<CpuStat> {
+    Some(CpuStat {
+        usage_usec: cpu_stat_field(stat, "usage_usec")?,
+        nr_periods: cpu_stat_field(stat, "nr_periods").unwrap_or(0),
+        nr_throttled: cpu_stat_field(stat, "nr_throttled").unwrap_or(0),
+        throttled_usec: cpu_stat_field(stat, "throttled_usec").unwrap_or(0),
+    })
+}
+
+/// cgroup v1 splits the same figures over two controllers and counts time in nanoseconds.
+#[cfg(not(windows))]
+fn parse_cgroup_v1_cpu_stat(cpuacct_usage: &str, stat: &str) -> Option<CpuStat> {
+    Some(CpuStat {
+        usage_usec: cpuacct_usage.trim().parse::<u64>().ok()? / 1000,
+        nr_periods: cpu_stat_field(stat, "nr_periods").unwrap_or(0),
+        nr_throttled: cpu_stat_field(stat, "nr_throttled").unwrap_or(0),
+        throttled_usec: cpu_stat_field(stat, "throttled_time").unwrap_or(0) / 1000,
+    })
+}
+
+#[cfg(not(windows))]
+pub fn get_cpu_stat() -> Option<CpuStat> {
+    const V1_USAGE: &str = "/sys/fs/cgroup/cpuacct/cpuacct.usage";
+    if Path::new(V1_USAGE).exists() {
+        parse_cgroup_v1_cpu_stat(
+            &std::fs::read_to_string(V1_USAGE).ok()?,
+            &std::fs::read_to_string("/sys/fs/cgroup/cpu/cpu.stat").unwrap_or_default(),
+        )
+    } else {
+        let cgroup_path = get_cgroupv2_path()?;
+        parse_cgroup_v2_cpu_stat(&std::fs::read_to_string(format!("{cgroup_path}/cpu.stat")).ok()?)
+    }
+}
+
+#[cfg(windows)]
+pub fn get_cpu_stat() -> Option<CpuStat> {
+    None
+}
+
 /// CPUs the process is allowed to run on, ignoring any bandwidth quota — the count
 /// Go's `NumCPU` reports. `available_parallelism` cannot stand in for it: that folds
 /// the quota in, so a fraction of a CPU makes it report a single-core machine.
@@ -1911,6 +2024,7 @@ pub enum PingType {
     MainLoop,
     Job,
     InitScript,
+    Draining,
 }
 #[derive(Serialize, Deserialize)]
 pub struct Ping {
@@ -1933,6 +2047,8 @@ pub struct Ping {
     pub occupancy_rate_30m: Option<f32>,
     pub job_isolation: Option<String>,
     pub native_mode: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub draining: Option<bool>,
     pub ping_type: PingType,
 }
 pub async fn update_ping_http(
@@ -1985,6 +2101,7 @@ pub async fn update_ping_http(
                 insert_ping.memory,
                 insert_ping.job_isolation,
                 insert_ping.native_mode.unwrap_or(false),
+                insert_ping.draining,
                 db,
             )
             .await?;
@@ -2013,10 +2130,21 @@ pub async fn update_ping_http(
             )
             .await?
         }
+        PingType::Draining => set_worker_draining_query(worker_name, db).await?,
     }
     Ok(())
 }
 
+pub async fn set_worker_draining_query(worker_name: &str, db: &DB) -> anyhow::Result<()> {
+    sqlx::query!(
+        "UPDATE worker_ping SET draining = true WHERE worker = $1",
+        worker_name
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct JobCancelled {
     pub canceled_by: String,
@@ -2115,6 +2243,9 @@ pub async fn fetch_raw_script_from_app_query(
 /// `started_at` and `jobs_executed` are the only two columns carried over, being the
 /// continuity itself — plus `ip` for as long as `ip` is `None`, which means the external IP
 /// lookup has not resolved yet and the predecessor's address is still the best guess.
+///
+/// `draining` is `Some(false)` from a worker starting up and `None` from one re-registering
+/// mid-life, which must leave alone a flag its own shutdown may have set in the meantime.
 pub async fn insert_ping_query(
     worker_instance: &str,
     worker_name: &str,
@@ -2128,6 +2259,7 @@ pub async fn insert_ping_query(
     memory: Option<i64>,
     job_isolation: Option<String>,
     native_mode: bool,
+    draining: Option<bool>,
     db: &DB,
 ) -> anyhow::Result<i32> {
     // A NULL `ip` means the external IP lookup is still in flight; a later ping fills it in, and
@@ -2135,8 +2267,8 @@ pub async fn insert_ping_query(
     // lookup that has failed reports `external_ip::UNRETRIEVABLE_IP`, which does overwrite it. The
     // literal below must stay equal to `external_ip::UNKNOWN_IP`.
     let previous_jobs_executed = sqlx::query_scalar!(
-        "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12) ON CONFLICT (worker)
-        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL
+        "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation, native_mode, draining) VALUES ($1, $2, COALESCE($3, 'NO IP'), $4, $5, $6, $7, $8, $9, $10, $11, $12, COALESCE($13, false)) ON CONFLICT (worker)
+        DO UPDATE set ping_at = now(), worker_instance = EXCLUDED.worker_instance, ip = COALESCE($3, worker_ping.ip), custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_worker = EXCLUDED.dedicated_worker, dedicated_workers = EXCLUDED.dedicated_workers, wm_version = EXCLUDED.wm_version, vcpus = COALESCE(EXCLUDED.vcpus, worker_ping.vcpus), memory = COALESCE(EXCLUDED.memory, worker_ping.memory), job_isolation = EXCLUDED.job_isolation, native_mode = EXCLUDED.native_mode, current_job_id = NULL, current_job_workspace_id = NULL, draining = COALESCE($13, worker_ping.draining)
         RETURNING jobs_executed",
         worker_instance,
         worker_name,
@@ -2150,6 +2282,7 @@ pub async fn insert_ping_query(
         memory,
         job_isolation.as_deref(),
         native_mode,
+        draining,
         )
         .fetch_one(db)
         .await?;
@@ -2469,6 +2602,12 @@ pub async fn load_worker_config(
             .collect();
         priority_tags_sorted.push(PriorityTags { priority: 0, tags: Vec::from_iter(all_tags_set) }); // push the tags that were not listed as high priority with a priority = 0
         priority_tags_sorted.sort_by_key(|elt| Reverse(elt.priority)); // sort by priority DESC
+
+        // The buckets come out of hash maps: without a fixed order two loads of the same
+        // config compare unequal, and a reload reads that as a config change.
+        for bucket in priority_tags_sorted.iter_mut() {
+            bucket.tags.sort();
+        }
     } else {
         // if no priority is used, push all tags with a priority to 0
         priority_tags_sorted.push(PriorityTags { priority: 0, tags: worker_tags.clone() });
@@ -2538,6 +2677,7 @@ pub async fn load_worker_config(
         env_vars: resolved_env_vars,
         native_mode,
         object_store_cache_config: config.object_store_cache_config,
+        paused: config.paused.unwrap_or(false),
     })
 }
 
@@ -2628,6 +2768,7 @@ pub struct WorkerConfigOpt {
     pub env_vars_allowlist: Option<Vec<String>>,
     pub native_mode: Option<bool>,
     pub object_store_cache_config: Option<serde_json::Value>,
+    pub paused: Option<bool>,
 }
 
 impl Default for WorkerConfigOpt {
@@ -2647,6 +2788,7 @@ impl Default for WorkerConfigOpt {
             env_vars_allowlist: Default::default(),
             native_mode: Default::default(),
             object_store_cache_config: Default::default(),
+            paused: Default::default(),
         }
     }
 }
@@ -2669,12 +2811,15 @@ pub struct WorkerConfig {
     /// in the group config. Raw JSON: `windmill-common` cannot depend on the object store crate
     /// that parses it, and comparing the raw value is what tells a reload the store changed.
     pub object_store_cache_config: Option<serde_json::Value>,
+    /// The group pulls no job from the queue: its workers finish what they hold, keep pinging
+    /// and leave queued jobs for when it is resumed.
+    pub paused: bool,
 }
 
 impl std::fmt::Debug for WorkerConfig {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "WorkerConfig {{ worker_tags: {:?}, priority_tags_sorted: {:?}, dedicated_worker: {:?}, dedicated_workers: {:?}, init_bash: {:?}, periodic_script_bash: {:?}, periodic_script_interval_seconds: {:?}, cache_clear: {:?}, additional_python_paths: {:?}, pip_local_dependencies: {:?}, env_vars: {:?}, native_mode: {:?}, object_store_cache_config: {} }}",
-        self.worker_tags, self.priority_tags_sorted, self.dedicated_worker, self.dedicated_workers, self.init_bash, self.periodic_script_bash, self.periodic_script_interval_seconds, self.cache_clear, self.additional_python_paths, self.pip_local_dependencies, self.env_vars.iter().map(|(k, v)| format!("{}: {}{} ({} chars)", k, &v[..3.min(v.len())], "***", v.len())).collect::<Vec<String>>().join(", "), self.native_mode,
+        write!(f, "WorkerConfig {{ worker_tags: {:?}, priority_tags_sorted: {:?}, dedicated_worker: {:?}, dedicated_workers: {:?}, init_bash: {:?}, periodic_script_bash: {:?}, periodic_script_interval_seconds: {:?}, cache_clear: {:?}, additional_python_paths: {:?}, pip_local_dependencies: {:?}, env_vars: {:?}, native_mode: {:?}, paused: {:?}, object_store_cache_config: {} }}",
+        self.worker_tags, self.priority_tags_sorted, self.dedicated_worker, self.dedicated_workers, self.init_bash, self.periodic_script_bash, self.periodic_script_interval_seconds, self.cache_clear, self.additional_python_paths, self.pip_local_dependencies, self.env_vars.iter().map(|(k, v)| format!("{}: {}{} ({} chars)", k, &v[..3.min(v.len())], "***", v.len())).collect::<Vec<String>>().join(", "), self.native_mode, self.paused,
         // holds bucket credentials
         self.object_store_cache_config.as_ref().map(|_| "***").unwrap_or("None"))
     }
@@ -2749,6 +2894,8 @@ pub enum PyVAlias {
     #[default]
     Py312,
     Py313,
+    Py314,
+    Py315,
 }
 
 impl Into<pep440_rs::Version> for PyVAlias {
@@ -2766,13 +2913,20 @@ impl Into<u32> for PyVAlias {
 impl PyVAlias {
     pub fn all<T: From<PyVAlias>>() -> Vec<T> {
         use PyVAlias::*;
-        vec![Py310.into(), Py311.into(), Py312.into(), Py313.into()]
+        vec![
+            Py310.into(),
+            Py311.into(),
+            Py312.into(),
+            Py313.into(),
+            Py314.into(),
+            Py315.into(),
+        ]
     }
     // Get MAJOR part of alias. (semver: MAJOR.MINOR.PATCH)
     fn major(&self) -> u32 {
         use PyVAlias::*;
         match self {
-            Py310 | Py311 | Py312 | Py313 => 3,
+            Py310 | Py311 | Py312 | Py313 | Py314 | Py315 => 3,
             // Py400 | Py401 => 4
         }
     }
@@ -2787,6 +2941,8 @@ impl PyVAlias {
             "311" => Some(Py311),
             "312" => Some(Py312),
             "313" => Some(Py313),
+            "314" => Some(Py314),
+            "315" => Some(Py315),
             _ => None,
         }
     }
@@ -2846,6 +3002,33 @@ mod tests {
     use super::*;
     use std::collections::HashMap;
 
+    #[cfg(not(windows))]
+    #[test]
+    fn cgroup_cpu_stat_is_normalized_to_microseconds() {
+        let v2 = "usage_usec 2500000\nuser_usec 2000000\nsystem_usec 500000\n\
+                  nr_periods 40\nnr_throttled 7\nthrottled_usec 350000\nnr_bursts 0\n";
+        let expected = CpuStat {
+            usage_usec: 2_500_000,
+            nr_periods: 40,
+            nr_throttled: 7,
+            throttled_usec: 350_000,
+        };
+        assert_eq!(parse_cgroup_v2_cpu_stat(v2), Some(expected));
+
+        let v1_stat = "nr_periods 40\nnr_throttled 7\nthrottled_time 350000000\n";
+        assert_eq!(
+            parse_cgroup_v1_cpu_stat("2500000000\n", v1_stat),
+            Some(expected)
+        );
+
+        // No CPU controller: usage is still reported, throttling reads as zero.
+        assert_eq!(
+            parse_cgroup_v2_cpu_stat("usage_usec 12\nuser_usec 8\nsystem_usec 4\n"),
+            Some(CpuStat { usage_usec: 12, ..Default::default() })
+        );
+        assert_eq!(parse_cgroup_v2_cpu_stat("nr_periods 40\n"), None);
+    }
+
     #[test]
     fn datatable_role_is_read_from_the_leading_comment_block() {
         let role = |code| SqlAnnotations::datatable_role(code);
diff --git a/backend/windmill-common/src/workspace_crypt.rs b/backend/windmill-common/src/workspace_crypt.rs
new file mode 100644
index 0000000000..a561060e32
--- /dev/null
+++ b/backend/windmill-common/src/workspace_crypt.rs
@@ -0,0 +1,255 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2026
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! The cipher behind `variables::encrypt`/`decrypt`.
+//!
+//! Values are written as AES-256-GCM ("v2"), standard base64 of
+//! `MAGIC (4) || nonce (12) || AES-256-GCM(PKCS#7(plaintext)) || tag (16)`.
+//! Values written before are AES-256-CBC (`magic_crypt`) and are still read.
+//!
+//! The plaintext is padded to the block size so a v2 value decodes to a multiple of 16 bytes,
+//! like a CBC one: the CLI and `validate_already_encrypted_secret` tell ciphertext from
+//! plaintext by exactly that, and an old CLI that took a v2 value for plaintext would push it
+//! to be encrypted again, corrupting the secret.
+
+use aes_gcm::aead::{Aead, AeadCore, KeyInit, OsRng};
+use aes_gcm::{Aes256Gcm, Key, Nonce};
+use base64::Engine;
+use hkdf::Hkdf;
+use magic_crypt::{MagicCrypt256, MagicCryptTrait};
+use sha2::Sha256;
+
+use crate::min_version::MIN_VERSION_SUPPORTS_AEAD_SECRETS;
+
+pub const V2_MAGIC: [u8; 4] = *b"wmA2";
+const NONCE_LEN: usize = 12;
+const TAG_LEN: usize = 16;
+const BLOCK: usize = 16;
+
+const AEAD_KEY_INFO: &[u8] = b"windmill workspace secret aes-256-gcm v1";
+
+const B64: base64::engine::GeneralPurpose = base64::engine::general_purpose::STANDARD;
+
+/// Why a value did not decrypt. Only ever logged, never returned to a caller.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DecryptFailure {
+    Encoding,
+    Authentication,
+    Utf8,
+}
+
+impl std::fmt::Display for DecryptFailure {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            DecryptFailure::Encoding => "not base64",
+            DecryptFailure::Authentication => "authentication or padding check failed",
+            DecryptFailure::Utf8 => "plaintext is not UTF-8",
+        })
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CipherFormat {
+    LegacyCbc,
+    V2,
+}
+
+impl CipherFormat {
+    /// What new values are written as. Old workers read secrets straight from the database with
+    /// the CBC cipher alone, so v2 is written only once every live worker reads it.
+    pub fn current() -> Self {
+        if MIN_VERSION_SUPPORTS_AEAD_SECRETS.met_conservatively() {
+            CipherFormat::V2
+        } else {
+            CipherFormat::LegacyCbc
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct WorkspaceCrypt {
+    legacy: MagicCrypt256,
+    aead: Aes256Gcm,
+}
+
+/// Code that drives `magic_crypt` directly on this cipher (app link secrets, AI session
+/// objects) keeps the legacy format it always had.
+impl std::ops::Deref for WorkspaceCrypt {
+    type Target = MagicCrypt256;
+    fn deref(&self) -> &MagicCrypt256 {
+        &self.legacy
+    }
+}
+
+impl WorkspaceCrypt {
+    /// `crypt_key` is the key material the CBC cipher was always built from (workspace key, salt,
+    /// suffix). The AEAD key is derived from it under its own label, so the two ciphers never
+    /// share a key.
+    pub fn new(crypt_key: &str) -> Self {
+        let mut aead_key = [0u8; 32];
+        Hkdf::<Sha256>::new(None, crypt_key.as_bytes())
+            .expand(AEAD_KEY_INFO, &mut aead_key)
+            .expect("32 bytes is a valid HKDF-SHA256 output length");
+        Self {
+            legacy: magic_crypt::new_magic_crypt!(crypt_key, 256),
+            aead: Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&aead_key)),
+        }
+    }
+
+    pub fn encrypt_str(&self, plaintext: &str) -> String {
+        self.encrypt_str_in(plaintext, CipherFormat::current())
+    }
+
+    pub fn encrypt_str_in(&self, plaintext: &str, format: CipherFormat) -> String {
+        match format {
+            CipherFormat::V2 => B64.encode(self.seal(plaintext.as_bytes())),
+            CipherFormat::LegacyCbc => self.legacy.encrypt_str_to_base64(plaintext),
+        }
+    }
+
+    pub fn decrypt_str(&self, ciphertext: &str) -> Result<String, DecryptFailure> {
+        let bytes = B64
+            .decode(ciphertext)
+            .map_err(|_| DecryptFailure::Encoding)?;
+        String::from_utf8(self.decrypt_bytes(&bytes)?).map_err(|_| DecryptFailure::Utf8)
+    }
+
+    /// Whether `ciphertext` is a v2 value under this key.
+    pub fn is_v2(&self, ciphertext: &str) -> bool {
+        B64.decode(ciphertext)
+            .is_ok_and(|bytes| self.open(&bytes).is_some())
+    }
+
+    /// The v2 form of a legacy `ciphertext`, checked to decrypt back to the same plaintext.
+    /// `None` for a v2 value and for anything that does not decrypt under this key.
+    pub fn upgrade(&self, ciphertext: &str) -> Option<String> {
+        if self.is_v2(ciphertext) {
+            return None;
+        }
+        let plaintext = self.decrypt_str(ciphertext).ok()?;
+        let upgraded = self.encrypt_str_in(&plaintext, CipherFormat::V2);
+        (self.decrypt_str(&upgraded).ok()? == plaintext).then_some(upgraded)
+    }
+
+    fn decrypt_bytes(&self, bytes: &[u8]) -> Result<Vec<u8>, DecryptFailure> {
+        match self.open(bytes) {
+            Some(plaintext) => Ok(plaintext),
+            // Also for a value with the magic: a CBC ciphertext starts with it one time in 2^32.
+            None => self
+                .legacy
+                .decrypt_bytes_to_bytes(bytes)
+                .map_err(|_| DecryptFailure::Authentication),
+        }
+    }
+
+    fn seal(&self, plaintext: &[u8]) -> Vec<u8> {
+        let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
+        let pad = BLOCK - plaintext.len() % BLOCK;
+        let mut padded = Vec::with_capacity(plaintext.len() + pad);
+        padded.extend_from_slice(plaintext);
+        padded.resize(plaintext.len() + pad, pad as u8);
+        let sealed = self
+            .aead
+            .encrypt(&nonce, padded.as_slice())
+            .expect("AES-GCM encryption fails only past 64 GiB of plaintext");
+        let mut out = Vec::with_capacity(V2_MAGIC.len() + NONCE_LEN + sealed.len());
+        out.extend_from_slice(&V2_MAGIC);
+        out.extend_from_slice(&nonce);
+        out.extend_from_slice(&sealed);
+        out
+    }
+
+    fn open(&self, data: &[u8]) -> Option<Vec<u8>> {
+        let body = data.strip_prefix(&V2_MAGIC)?;
+        if body.len() < NONCE_LEN + BLOCK + TAG_LEN || (body.len() - NONCE_LEN) % BLOCK != 0 {
+            return None;
+        }
+        let (nonce, sealed) = body.split_at(NONCE_LEN);
+        let mut padded = self.aead.decrypt(Nonce::from_slice(nonce), sealed).ok()?;
+        let pad = *padded.last()? as usize;
+        if pad == 0
+            || pad > BLOCK
+            || padded[padded.len() - pad..]
+                .iter()
+                .any(|b| *b as usize != pad)
+        {
+            return None;
+        }
+        padded.truncate(padded.len() - pad);
+        Some(padded)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const KEY: &str = "workspace-key";
+
+    #[test]
+    fn v2_round_trips() {
+        let wc = WorkspaceCrypt::new(KEY);
+        for plain in [
+            "",
+            "s",
+            "exactly sixteen!",
+            "a longer secret value with ünïcödé",
+        ] {
+            let a = wc.encrypt_str_in(plain, CipherFormat::V2);
+            assert_ne!(a, wc.encrypt_str_in(plain, CipherFormat::V2), "nonce reuse");
+            assert!(wc.is_v2(&a));
+            assert_eq!(wc.decrypt_str(&a).unwrap(), plain);
+        }
+    }
+
+    #[test]
+    fn legacy_cbc_still_decrypts() {
+        let wc = WorkspaceCrypt::new(KEY);
+        let legacy = magic_crypt::new_magic_crypt!(KEY, 256).encrypt_str_to_base64("old secret");
+        assert!(!wc.is_v2(&legacy));
+        assert_eq!(wc.decrypt_str(&legacy).unwrap(), "old secret");
+        let upgraded = wc.upgrade(&legacy).unwrap();
+        assert!(wc.is_v2(&upgraded));
+        assert_eq!(wc.decrypt_str(&upgraded).unwrap(), "old secret");
+        assert_eq!(wc.upgrade(&upgraded), None);
+    }
+
+    #[test]
+    fn magic_prefixed_cbc_still_decrypts() {
+        // Too rare to find by search, so built: with magic_crypt's zero IV and SHA-256(key) AES
+        // key, the first CBC block is AES(P1), so P1 = AES^-1(MAGIC || zeros).
+        let mut block = [0u8; 16];
+        block[..4].copy_from_slice(&V2_MAGIC);
+        let mut plaintext = {
+            use aes_gcm::aes::cipher::{BlockDecrypt, KeyInit};
+            use sha2::Digest;
+            let cipher = aes_gcm::aes::Aes256::new_from_slice(&Sha256::digest(KEY)).unwrap();
+            let mut b = aes_gcm::aes::Block::clone_from_slice(&block);
+            cipher.decrypt_block(&mut b);
+            b.to_vec()
+        };
+        plaintext.extend_from_slice(b"tail of the secret value");
+        let ciphertext = magic_crypt::new_magic_crypt!(KEY, 256).encrypt_bytes_to_bytes(&plaintext);
+        assert!(ciphertext.starts_with(&V2_MAGIC));
+        assert_eq!(
+            WorkspaceCrypt::new(KEY).decrypt_bytes(&ciphertext).unwrap(),
+            plaintext
+        );
+    }
+
+    #[test]
+    fn v2_passes_the_block_multiple_ciphertext_shape_check() {
+        let wc = WorkspaceCrypt::new(KEY);
+        for len in 0..64 {
+            let decoded = B64
+                .decode(wc.encrypt_str_in(&"x".repeat(len), CipherFormat::V2))
+                .unwrap();
+            assert!(!decoded.is_empty() && decoded.len() % 16 == 0, "len {len}");
+        }
+    }
+}
diff --git a/backend/windmill-common/src/workspace_dependencies.rs b/backend/windmill-common/src/workspace_dependencies.rs
index 5ce5ca7f68..bc964c4286 100644
--- a/backend/windmill-common/src/workspace_dependencies.rs
+++ b/backend/windmill-common/src/workspace_dependencies.rs
@@ -510,7 +510,7 @@ impl WorkspaceDependenciesPrefetched {
         //                 external.get(0).map(|wd| dbg!(wd.content.clone())).or(Some(
         //                     "
         // module mymod
-        // go 1.26
+        // go 1.27
         // require ()
         //                         "
         //                     .to_owned(),
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 4751cb57be..3653a224f1 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -184,7 +184,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28994/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/29151/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -192,7 +192,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28994/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28993/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/29150/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
@@ -823,6 +823,7 @@ pub async fn count_workspace_forks(db: &crate::DB, root: &str) -> Result<i64> {
 pub struct BillableSeats {
     pub developers: i64,
     pub operators: i64,
+    pub service_accounts: i64,
     pub seats: i64,
 }
 
@@ -1043,9 +1044,10 @@ pub async fn guest_app_admits<'c, E: sqlx::Executor<'c, Database = sqlx::Postgre
     Ok(admits.unwrap_or(false))
 }
 
-/// Billable members of `w_id` and the seats they cost, as `ceil(developers + operators/2)`. Service
-/// accounts cannot log in and do not take a seat; a disabled member is not billed either. In a
-/// workspace that granted operators builder rights, every operator counts as a developer.
+/// Billable members of `w_id` and the seats they cost, as
+/// `ceil(developers + (operators + service_accounts)/2)`. A service account is half a seat whatever
+/// its role; a disabled member is not billed. In a workspace that granted operators builder rights,
+/// every operator counts as a developer.
 ///
 /// The workspace is invoiced by a job outside this codebase that counts the same rows with its own
 /// SQL. The two must be changed together: this rule disagreeing with that one is what bills a
@@ -1057,14 +1059,15 @@ pub async fn billable_seats(db: &crate::DB, w_id: &str) -> Result<BillableSeats>
     let row = sqlx::query!(
         r#"SELECT
             COUNT(*) FILTER (WHERE NOT operator AND NOT disabled AND NOT is_service_account) AS "developers!",
-            COUNT(*) FILTER (WHERE operator AND NOT disabled AND NOT is_service_account) AS "operators!"
+            COUNT(*) FILTER (WHERE operator AND NOT disabled AND NOT is_service_account) AS "operators!",
+            COUNT(*) FILTER (WHERE is_service_account AND NOT disabled) AS "service_accounts!"
         FROM usr WHERE workspace_id = $1"#,
         w_id
     )
     .fetch_one(db)
     .await
     .map_err(|e| Error::internal_err(format!("counting billable seats of {w_id}: {e:#}")))?;
-    let (developers, operators) = if operator_can_build_flows(db, w_id).await? {
+    let (developers, operators) = if operator_builder_rights(db, w_id).await?.any() {
         (row.developers + row.operators, 0)
     } else {
         (row.developers, row.operators)
@@ -1072,7 +1075,9 @@ pub async fn billable_seats(db: &crate::DB, w_id: &str) -> Result<BillableSeats>
     Ok(BillableSeats {
         developers,
         operators,
-        seats: ((developers as f64) + 0.5 * (operators as f64)).ceil() as i64,
+        service_accounts: row.service_accounts,
+        seats: ((developers as f64) + 0.5 * ((operators + row.service_accounts) as f64)).ceil()
+            as i64,
     })
 }
 
@@ -1200,14 +1205,47 @@ lazy_static::lazy_static! {
 
 /// Every operator right of a workspace, read and cached together because they share one
 /// `operator_settings` column and one invalidation. The two groups have opposite polarity:
-/// `builder_flows` is granted on request and costs a seat, the `manage` rights are held by
+/// the builder rights are granted on request and cost a seat, the `manage` rights are held by
 /// default and cost nothing.
 #[derive(Copy, Clone, Debug, Default, PartialEq, Eq)]
 pub struct OperatorRights {
-    pub builder_flows: bool,
+    pub builder: OperatorBuilderRights,
     pub manage: OperatorManageRights,
 }
 
+/// The two things a workspace can let its operators compose. Granted independently: composing a
+/// flow is fully checked server-side, while a full-code app is a browser-built bundle no check can
+/// read, so an admin may reasonably want the first without the second.
+#[derive(Copy, Clone, Debug, Default, PartialEq, Eq)]
+pub struct OperatorBuilderRights {
+    pub flows: bool,
+    pub apps: bool,
+}
+
+/// Which capability a gate needs. Naming a kind at each call site is what keeps the two rights
+/// from collapsing back into one: a gate that takes "either" authorizes an app write on a
+/// flows-only workspace.
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum BuilderKind {
+    Flows,
+    Apps,
+}
+
+impl OperatorBuilderRights {
+    /// Whether either right is granted. Only for surfaces that are genuinely not per-kind: the
+    /// seat a membership costs, and listing drafts.
+    pub fn any(&self) -> bool {
+        self.flows || self.apps
+    }
+
+    pub fn has(&self, kind: BuilderKind) -> bool {
+        match kind {
+            BuilderKind::Flows => self.flows,
+            BuilderKind::Apps => self.apps,
+        }
+    }
+}
+
 /// Writes an operator may perform unless the workspace withdraws them. Unlike the visibility
 /// flags beside them in `operator_settings`, these are enforced; unlike a right a workspace
 /// grants, they are held by default and cost no seat.
@@ -1286,6 +1324,7 @@ async fn operator_rights(db: &DB, workspace_id: &str) -> Result<OperatorRights>
     // defaults have to differ here rather than at the call sites.
     let row = sqlx::query!(
         "SELECT COALESCE((operator_settings->>'builder_flows')::boolean, false) AS \"flows!\",
+                COALESCE((operator_settings->>'builder_apps')::boolean, false) AS \"apps!\",
                 COALESCE((operator_settings->>'manage_schedules')::boolean, true) AS \"schedules!\",
                 COALESCE((operator_settings->>'manage_triggers')::boolean, true) AS \"triggers!\"
          FROM workspace_settings WHERE workspace_id = $1",
@@ -1301,7 +1340,7 @@ async fn operator_rights(db: &DB, workspace_id: &str) -> Result<OperatorRights>
 
     let rights = row
         .map(|r| OperatorRights {
-            builder_flows: r.flows,
+            builder: OperatorBuilderRights { flows: r.flows, apps: r.apps },
             manage: OperatorManageRights { schedules: r.schedules, triggers: r.triggers },
         })
         .unwrap_or_default();
@@ -1311,21 +1350,22 @@ async fn operator_rights(db: &DB, workspace_id: &str) -> Result<OperatorRights>
     Ok(rights)
 }
 
-/// Whether operators of this workspace may compose flows out of already-deployed runnables. Per
-/// workspace, not per user: every operator gets it, and consumes a full seat for it.
-pub async fn operator_can_build_flows(db: &DB, workspace_id: &str) -> Result<bool> {
-    Ok(operator_rights(db, workspace_id).await?.builder_flows)
+/// What operators of this workspace may compose out of already-deployed runnables. Per workspace,
+/// not per user: every operator gets whatever is granted, and consumes a full seat for it.
+pub async fn operator_builder_rights(db: &DB, workspace_id: &str) -> Result<OperatorBuilderRights> {
+    Ok(operator_rights(db, workspace_id).await?.builder)
 }
 
-/// Gate for a write only a workspace that granted builder rights lets operators perform. `action`
-/// completes "Operators cannot {action} for security reasons".
-pub async fn check_operator_can_build_flows(
+/// Gate for a write only a workspace that granted the builder right covering `kind` lets operators
+/// perform. `action` completes "Operators cannot {action} for security reasons".
+pub async fn check_operator_can_build(
     db: &DB,
     workspace_id: &str,
     is_operator: bool,
+    kind: BuilderKind,
     action: &str,
 ) -> Result<()> {
-    if is_operator && !operator_can_build_flows(db, workspace_id).await? {
+    if is_operator && !operator_builder_rights(db, workspace_id).await?.has(kind) {
         return Err(Error::PermissionDenied(format!(
             "Operators cannot {action} for security reasons"
         )));
@@ -1333,14 +1373,15 @@ pub async fn check_operator_can_build_flows(
     Ok(())
 }
 
-/// Whether a membership consumes an operator (half) seat rather than an author seat. A builder
-/// right makes an operator an author of deployable artifacts, so it weighs a full seat.
+/// Whether a membership consumes an operator (half) seat rather than an author seat. Either
+/// builder right makes an operator an author of deployable artifacts, so both weigh the same full
+/// seat: there is no half-author.
 pub async fn consumes_operator_seat(
     db: &DB,
     workspace_id: &str,
     is_operator: bool,
 ) -> Result<bool> {
-    Ok(is_operator && !operator_can_build_flows(db, workspace_id).await?)
+    Ok(is_operator && !operator_builder_rights(db, workspace_id).await?.any())
 }
 
 /// Invalidate the operator rights cache for a workspace
@@ -1523,7 +1564,8 @@ pub struct DataTableReference {
 /// The access decision for one data table: which role a caller gets, and who may ask for each.
 #[derive(Deserialize, Serialize, Debug, Clone, Default)]
 pub struct DataTablePermissions {
-    /// A role id from the instance catalog, or `admin`. Absent = `admin`.
+    /// A role id from the instance catalog, `admin`, or
+    /// [`crate::datatable_roles::NO_DEFAULT_DATATABLE_ROLE`]. Absent = `admin`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub default_role: Option<String>,
     /// Keyed by instance role id, plus the reserved `admin` key. A role absent from this map
@@ -2120,9 +2162,13 @@ pub enum DatatableAccess<'a> {
     PermissionedAs {
         permissioned_as: &'a str,
         email: &'a str,
+        /// The job's viewer: MUST be what the server recorded in `job_perms.end_user_email`,
+        /// never an argument or anything else the job or its caller can set.
+        end_user_email: Option<&'a str>,
     },
-    /// A job identified by id; its owner is read from `v2_job`. For agent workers and anything
-    /// else that authenticates as infrastructure rather than as the job's user.
+    /// A job identified by id; its owner is read from `v2_job` and its viewer from `job_perms`.
+    /// For agent workers and anything else that authenticates as infrastructure rather than as
+    /// the job's user.
     Job(uuid::Uuid),
     /// No identity established. Unpermissioned data tables resolve as before; permissioned ones
     /// are refused, so a caller predating this feature fails closed.
@@ -2170,6 +2216,13 @@ pub async fn can_use_datatable_role_in_governing_workspace(
 ///
 /// The resolved role **logs in as itself**. Never `SET ROLE`: a script could `RESET ROLE` its way
 /// back to admin.
+///
+/// A default role other than `admin` is a floor rather than the whole connection: a resolution
+/// naming no role holds it when the job's own identity may use it, plus the roles whose tenant
+/// lists name the job's viewer, as one login that is a member of each. With no role at all it is
+/// refused. Being an admin adds none of the viewer's and `admin` is never among them, so a viewer
+/// cannot be handed the connection that owns the tables and bypasses row-level security. A named
+/// role is that role alone.
 pub async fn get_datatable_resource_from_db(
     db: &DB,
     w_id: &str,
diff --git a/backend/windmill-common/tests/billing_workspace.rs b/backend/windmill-common/tests/billing_workspace.rs
index 04455318a6..ccc013d47a 100644
--- a/backend/windmill-common/tests/billing_workspace.rs
+++ b/backend/windmill-common/tests/billing_workspace.rs
@@ -101,21 +101,27 @@ async fn billing_workspace_survives_cycles(db: Pool<Postgres>) {
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn paid_seats_and_fork_count(db: Pool<Postgres>) {
     insert_ws(&db, "seat-root", None, false).await;
-    // 2 developers + 2 operators counted -> ceil(2 + 0.5*2) = 3.
     insert_member(&db, "seat-root", "dev1@w.dev", false, false, false).await;
     insert_member(&db, "seat-root", "dev2@w.dev", false, false, false).await;
     insert_member(&db, "seat-root", "op1@w.dev", true, false, false).await;
     insert_member(&db, "seat-root", "op2@w.dev", true, false, false).await;
-    // These must NOT count towards seats. The service account is a non-operator, so counting it
-    // would inflate the developer tally the invoice line is written from, not the operator one.
-    insert_member(&db, "seat-root", "disabled@w.dev", false, true, false).await;
+    // A service account is half a seat even with a developer role, counted apart from operators.
     insert_member(&db, "seat-root", "svc@w.dev", false, false, true).await;
+    // Not billed.
+    insert_member(&db, "seat-root", "disabled@w.dev", false, true, false).await;
+    insert_member(&db, "seat-root", "svc-disabled@w.dev", false, true, true).await;
 
-    assert_eq!(count_paid_seats(&db, "seat-root").await.unwrap(), 3);
+    // 2 developers + (2 operators + 1 service account)/2 -> ceil(3.5) = 4.
+    assert_eq!(count_paid_seats(&db, "seat-root").await.unwrap(), 4);
     let breakdown = billable_seats(&db, "seat-root").await.unwrap();
     assert_eq!(
-        (breakdown.developers, breakdown.operators, breakdown.seats),
-        (2, 2, 3)
+        (
+            breakdown.developers,
+            breakdown.operators,
+            breakdown.service_accounts,
+            breakdown.seats
+        ),
+        (2, 2, 1, 4)
     );
 
     sqlx::query(
@@ -127,10 +133,29 @@ async fn paid_seats_and_fork_count(db: Pool<Postgres>) {
     .unwrap();
     windmill_common::workspaces::invalidate_operator_rights_cache("seat-root");
     let breakdown = billable_seats(&db, "seat-root").await.unwrap();
+    assert_eq!(
+        (
+            breakdown.developers,
+            breakdown.operators,
+            breakdown.service_accounts,
+            breakdown.seats
+        ),
+        (4, 0, 1, 5),
+        "builder rights bill every operator as a developer, service accounts stay half a seat"
+    );
+    sqlx::query(
+        "UPDATE workspace_settings SET operator_settings = '{\"builder_apps\": true}'
+         WHERE workspace_id = 'seat-root'",
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+    windmill_common::workspaces::invalidate_operator_rights_cache("seat-root");
+    let breakdown = billable_seats(&db, "seat-root").await.unwrap();
     assert_eq!(
         (breakdown.developers, breakdown.operators, breakdown.seats),
-        (4, 0, 4),
-        "builder rights bill every operator as a developer"
+        (4, 0, 5),
+        "the app right alone also bills every operator as a developer"
     );
 
     insert_ws(&db, "seat-fork1", Some("seat-root"), false).await;
diff --git a/backend/windmill-dep-map/src/trigger_dependents.rs b/backend/windmill-dep-map/src/trigger_dependents.rs
index d5cfd8e5a4..48e151736a 100644
--- a/backend/windmill-dep-map/src/trigger_dependents.rs
+++ b/backend/windmill-dep-map/src/trigger_dependents.rs
@@ -210,6 +210,7 @@ pub async fn trigger_dependents_to_recompute_dependencies(
             None,
             None,
             None,
+            None,
         )
         .await?;
 
diff --git a/backend/windmill-mcp/src/client/mod.rs b/backend/windmill-mcp/src/client/mod.rs
index 863d6b0355..5d13a40314 100644
--- a/backend/windmill-mcp/src/client/mod.rs
+++ b/backend/windmill-mcp/src/client/mod.rs
@@ -70,7 +70,8 @@ impl McpClient {
                         headers.insert(name, value);
                     }
                     _ => {
-                        tracing::warn!("Invalid header: {}={}", key, value);
+                        // The value may be a resolved secret: keep it out of the logs.
+                        tracing::warn!("Invalid header: {}", key);
                     }
                 }
             }
diff --git a/backend/windmill-mcp/src/common/types.rs b/backend/windmill-mcp/src/common/types.rs
index 8ec6175bdb..92513b7a29 100644
--- a/backend/windmill-mcp/src/common/types.rs
+++ b/backend/windmill-mcp/src/common/types.rs
@@ -67,6 +67,11 @@ pub struct SchemaType {
     pub properties: HashMap<String, Value>,
     #[serde(default)]
     pub required: Vec<String>,
+    /// The author's guidance for choosing the inputs. A `Value` so that a schema carrying
+    /// anything but a string here still parses, and never serialized: it belongs in the
+    /// tool description, not in the input schema a client validates arguments against.
+    #[serde(default, skip_serializing)]
+    pub prompt_for_ai: Option<Value>,
 }
 
 fn default_schema_type() -> String {
@@ -75,7 +80,22 @@ fn default_schema_type() -> String {
 
 impl Default for SchemaType {
     fn default() -> Self {
-        Self { r#type: "object".to_string(), properties: HashMap::new(), required: vec![] }
+        Self {
+            r#type: "object".to_string(),
+            properties: HashMap::new(),
+            required: vec![],
+            prompt_for_ai: None,
+        }
+    }
+}
+
+impl SchemaType {
+    pub fn prompt_for_ai(&self) -> Option<&str> {
+        self.prompt_for_ai
+            .as_ref()
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .filter(|prompt| !prompt.is_empty())
     }
 }
 
diff --git a/backend/windmill-mcp/src/server/tools.rs b/backend/windmill-mcp/src/server/tools.rs
index 4fcbe086cd..98ea105db4 100644
--- a/backend/windmill-mcp/src/server/tools.rs
+++ b/backend/windmill-mcp/src/server/tools.rs
@@ -208,6 +208,11 @@ pub fn create_tool_from_item<T: ToolableItem, B: McpBackend>(
     );
 
     let schema = item.get_schema();
+    if let Some(prompt) = schema.prompt_for_ai() {
+        description.push_str(&format!(
+            " Its author gave these instructions for choosing the arguments: {prompt}"
+        ));
+    }
     let schema_obj =
         backend.transform_schema_for_resources(&schema, resources_cache, resources_types);
 
@@ -283,6 +288,31 @@ mod tests {
         .clone()
     }
 
+    #[test]
+    fn prompt_for_ai_is_read_but_kept_out_of_the_input_schema() {
+        let schema: SchemaType = serde_json::from_value(json!({
+            "type": "object",
+            "properties": { "query": { "type": "string" } },
+            "prompt_for_ai": "  Prefer short queries.  ",
+        }))
+        .unwrap();
+
+        assert_eq!(schema.prompt_for_ai(), Some("Prefer short queries."));
+        assert!(serde_json::to_value(&schema)
+            .unwrap()
+            .get("prompt_for_ai")
+            .is_none());
+
+        // A non-string value must not cost the tool its inputs.
+        let odd: SchemaType = serde_json::from_value(json!({
+            "properties": { "query": { "type": "string" } },
+            "prompt_for_ai": 3,
+        }))
+        .unwrap();
+        assert_eq!(odd.prompt_for_ai(), None);
+        assert!(odd.properties.contains_key("query"));
+    }
+
     #[test]
     fn hint_lists_optional_params_and_never_a_required_one() {
         let hint = omission_hint(&script_schema(), "script")
diff --git a/backend/windmill-operator/Cargo.toml b/backend/windmill-operator/Cargo.toml
index 30a7c0bb7a..f847e4ab25 100644
--- a/backend/windmill-operator/Cargo.toml
+++ b/backend/windmill-operator/Cargo.toml
@@ -19,6 +19,7 @@ serde_json.workspace = true
 sqlx.workspace = true
 tracing.workspace = true
 windmill-common = { workspace = true, default-features = false }
+windmill-audit.workspace = true
 anyhow.workspace = true
 thiserror.workspace = true
 kube.workspace = true
diff --git a/backend/windmill-queue/src/asset_dispatch.rs b/backend/windmill-queue/src/asset_dispatch.rs
index a3f7154cda..b44541dc9d 100644
--- a/backend/windmill-queue/src/asset_dispatch.rs
+++ b/backend/windmill-queue/src/asset_dispatch.rs
@@ -822,6 +822,7 @@ async fn push_subscriber(
             debouncing_settings,
             concurrency_settings,
             labels: script.labels,
+            job_token_scopes: script.job_token_scopes,
         }
     };
 
@@ -904,6 +905,7 @@ async fn push_subscriber(
             JobTriggerKind::Asset,
         )),
         None,
+        None,
     )
     .await
     .map_err(|e| error::Error::internal_err(format!("push asset-triggered job: {e:#}")))?;
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index c2c42c649c..68749d2b90 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -74,16 +74,16 @@ use windmill_common::{
         add_virtual_items_if_necessary, FlowModule, FlowModuleValue, FlowValue, InputTransform,
         Retry, StopAfterIf,
     },
-    jobs::{get_payload_tag_from_prefixed_path, JobKind, JobPayload, QueuedJob, RawCode},
+    jobs::{get_payload_tag_from_prefixed_path, JobKind, JobPayload, RawCode},
     min_version::{MIN_VERSION_IS_AT_LEAST_1_432, MIN_VERSION_IS_AT_LEAST_1_440},
     schedule::Schedule,
     scripts::{get_full_hub_script_by_path, ScriptHash, ScriptLang},
     users::{SUPERADMIN_NOTIFICATION_EMAIL, SUPERADMIN_SECRET_EMAIL},
     utils::{not_found_if_none, report_critical_error, StripPath, WarnAfterExt},
     worker::{
-        to_raw_value, CLOUD_HOSTED, DISABLE_FLOW_SCRIPT, NO_LOGS, PREVIEW_TAGS_OVERRIDE,
-        WORKER_PULL_QUERIES, WORKER_PULL_QUERIES_FAIRNESS, WORKER_SUSPENDED_PULL_QUERY,
-        WORKSPACE_FAIRNESS_OVERLOADED,
+        to_raw_value, CLOUD_HOSTED, DEPENDENCY_JOB_TAG, DISABLE_FLOW_SCRIPT, NO_LOGS,
+        PREVIEW_TAGS_OVERRIDE, WORKER_PULL_QUERIES, WORKER_PULL_QUERIES_FAIRNESS,
+        WORKER_SUSPENDED_PULL_QUERY, WORKSPACE_FAIRNESS_OVERLOADED,
     },
     DB, METRICS_ENABLED,
 };
@@ -182,6 +182,15 @@ pub struct CanceledBy {
     pub reason: Option<String>,
 }
 
+/// What only the worker that ran a job knows about it, for the per-runnable rollup: an
+/// agent worker's completion is processed by the server, whose own worker group is not
+/// the one the job ran in.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct JobResourceUsage {
+    pub worker_group: String,
+    pub cpu_time_ms: Option<i64>,
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct JobCompleted {
     pub job: MiniCompletedJob,
@@ -196,6 +205,8 @@ pub struct JobCompleted {
     pub duration: Option<i64>,
     pub has_stream: Option<bool>,
     pub from_cache: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resource_usage: Option<JobResourceUsage>,
     #[serde(skip)]
     pub flow_runners: Option<Arc<FlowRunners>>,
     #[serde(skip)]
@@ -359,6 +370,22 @@ ORDER BY depth, id
     .filter_map(|r| r.id.clone())
     .collect_vec();
 
+    // A native retry is the child of its first attempt, which has completed by the time the
+    // retry is queued, so the walk above stops before reaching it.
+    let tree = [&[job.id][..], &jobs_to_cancel[..]].concat();
+    let pending_retries = sqlx::query_scalar!(
+        "SELECT q.id FROM v2_job_queue q
+            JOIN native_retry_attempt n ON n.job_id = q.id
+            JOIN v2_job r ON r.id = q.id
+            JOIN v2_job a ON a.id = r.parent_job
+            WHERE q.workspace_id = $2 AND a.parent_job = ANY($1)",
+        tree.as_slice(),
+        w_id
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    jobs_to_cancel.extend(pending_retries);
+
     jobs_to_cancel.reverse();
     if !jobs_to_cancel.is_empty() {
         tracing::info!("Found {} child jobs to cancel", jobs_to_cancel.len());
@@ -503,6 +530,7 @@ pub async fn push_init_job<'c>(
         None,
         None,
         None,
+        None,
     )
     .await?;
     inner_tx.commit().await?;
@@ -563,6 +591,7 @@ pub async fn push_periodic_bash_job<'c>(
         None,
         None,
         None,
+        None,
     )
     .await?;
     inner_tx.commit().await?;
@@ -725,9 +754,11 @@ async fn restart_perpetual_runs_at_path(
         PerpetualRunToRestart,
         "SELECT q.id AS \"id!\", j.created_by, j.permissioned_as, j.permissioned_as_email, \
          j.trigger, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.preprocessed, \
-         j.args AS \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\" \
+         j.args AS \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\", \
+         p.job_token_scopes AS \"job_token_scopes?\" \
          FROM v2_job_queue q JOIN v2_job j USING (id) \
          JOIN script s ON s.workspace_id = j.workspace_id AND s.hash = j.runnable_id \
+         LEFT JOIN job_perms p ON p.job_id = q.id \
          WHERE j.workspace_id = $1 AND j.runnable_path = $2 AND j.kind = 'script' \
          AND j.flow_step_id IS NULL AND j.runnable_id != $3 AND q.canceled_by IS NULL \
          AND s.restart_unless_cancelled",
@@ -765,6 +796,20 @@ async fn restart_perpetual_runs_at_path(
     Ok(true)
 }
 
+/// A worker older than `job_token_scopes` ignores a step's or agent tool's own restriction, so
+/// a flow that sets one is refused while such a worker is live, whichever way the flow arrived
+/// (a deploy, a restart, a preview, a standalone agent, an eval). Free when every worker is
+/// current.
+async fn refuse_step_scopes_on_outdated_workers(value: &FlowValue) -> Result<(), Error> {
+    let gate = &windmill_common::min_version::MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES;
+    if !gate.met().await
+        && windmill_common::scopes::validate_flow_step_job_token_scopes(value).unwrap_or(true)
+    {
+        gate.assert().await?;
+    }
+    Ok(())
+}
+
 /// A run of an earlier version at the path, and what its replacement inherits from it.
 struct PerpetualRunToRestart {
     id: Uuid,
@@ -777,6 +822,8 @@ struct PerpetualRunToRestart {
     /// completion swaps in what a preprocessor returned.
     preprocessed: Option<bool>,
     args: Option<sqlx::types::Json<HashMap<String, Box<RawValue>>>>,
+    /// Its effective token scopes: the replacement never holds a wider token.
+    job_token_scopes: Option<Vec<String>>,
 }
 
 /// What every run at the path moves to.
@@ -857,6 +904,7 @@ async fn restart_perpetual_run(
         // an earlier version the next pass picks up.
         return Ok(());
     }
+    let scope_ceiling = run.job_token_scopes;
     let (_, tx) = push(
         db,
         PushIsolationLevel::Transaction(tx),
@@ -887,6 +935,7 @@ async fn restart_perpetual_run(
         None,
         None,
         None,
+        scope_ceiling.as_deref(),
     )
     .await?;
     tx.commit().await?;
@@ -1183,7 +1232,7 @@ pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + V
     worker_name: &str,
     flow_is_done: bool,
     duration: Option<i64>,
-) -> Result<(), Error> {
+) -> Result<CompletedSpan, Error> {
     record_failure_metrics(completed_job, worker_name).await;
 
     tracing::error!(
@@ -1191,7 +1240,7 @@ pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + V
         completed_job.id,
         completed_job.workspace_id,
     );
-    let _ = add_completed_job(
+    let (_, span) = add_completed_job(
         db,
         completed_job,
         false,
@@ -1206,7 +1255,7 @@ pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + V
     )
     .warn_after_seconds(10)
     .await?;
-    Ok(())
+    Ok(span)
 }
 
 pub async fn add_completed_job_error(
@@ -1219,6 +1268,31 @@ pub async fn add_completed_job_error(
     flow_is_done: bool,
     duration: Option<i64>,
 ) -> Result<WrappedError, Error> {
+    add_completed_job_error_with_span(
+        db,
+        completed_job,
+        mem_peak,
+        canceled_by,
+        e,
+        worker_name,
+        flow_is_done,
+        duration,
+    )
+    .await
+    .map(|(wrapped, _)| wrapped)
+}
+
+/// `add_completed_job_error`, also handing back what the completed row holds.
+pub async fn add_completed_job_error_with_span(
+    db: &Pool<Postgres>,
+    completed_job: &MiniCompletedJob,
+    mem_peak: i32,
+    canceled_by: Option<CanceledBy>,
+    e: serde_json::Value,
+    worker_name: &str,
+    flow_is_done: bool,
+    duration: Option<i64>,
+) -> Result<(WrappedError, CompletedSpan), Error> {
     record_failure_metrics(completed_job, worker_name).await;
 
     let result = WrappedError { error: e };
@@ -1228,7 +1302,7 @@ pub async fn add_completed_job_error(
         completed_job.workspace_id,
         serde_json::to_string(&result).unwrap_or_else(|_| "".to_string())
     );
-    let _ = add_completed_job(
+    let (_, span) = add_completed_job(
         db,
         &completed_job,
         false,
@@ -1243,7 +1317,7 @@ pub async fn add_completed_job_error(
     )
     .warn_after_seconds(10)
     .await?;
-    Ok(result)
+    Ok((result, span))
 }
 
 lazy_static::lazy_static! {
@@ -1251,7 +1325,7 @@ lazy_static::lazy_static! {
     pub static ref MAX_RESULT_SIZE_MB: usize = std::env::var("MAX_RESULT_SIZE_MB").unwrap_or("500".to_string()).parse().unwrap_or(500);
 
     // Cache for perpetual-restart settings (restart_unless_cancelled, timeout) - keyed by (hash, workspace_id)
-    static ref RESTART_UNLESS_CANCELLED_CACHE: Cache<(i64, String), (bool, Option<i32>)> = Cache::new(10000);
+    static ref RESTART_UNLESS_CANCELLED_CACHE: Cache<(i64, String), (bool, Option<i32>, Option<Vec<String>>)> = Cache::new(10000);
 
     // Cache for workspace error handler settings with 60s TTL
     // Key: workspace_id, Value: (error_handler, error_handler_extra_args, error_handler_muted_on_cancel, error_handler_muted_on_user_path, report_to_instance_alerts, expiry_timestamp)
@@ -1282,7 +1356,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     flow_is_done: bool,
     duration: Option<i64>,
     from_cache: bool,
-) -> Result<(Uuid, i64), Error> {
+) -> Result<(Uuid, CompletedSpan), Error> {
     // tracing::error!("Start");
     // let start = tokio::time::Instant::now();
 
@@ -1316,7 +1390,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     };
 
     let result_columns = result_columns.as_ref();
-    let (opt_uuid, duration, _skip_downstream_error_handlers, wac_parent_ready) = (|| {
+    let (opt_uuid, span, _skip_downstream_error_handlers, wac_parent_ready) = (|| {
         commit_completed_job(
             db,
             completed_job,
@@ -1357,7 +1431,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
 
     // if scheduling next job failed, return the job_id early to ensure the job get retried after a timeout
     if let Some(job_id) = opt_uuid {
-        return Ok((job_id, duration));
+        return Ok((job_id, span));
     }
 
     // Auto-resolve a retry chain that ultimately worked, from whichever of the two
@@ -1369,7 +1443,18 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
             .then(|| completed_job.parent_job)
             .flatten()
     } else if !success && !skipped && retry_pending {
-        Some(completed_job.parent_job.unwrap_or(completed_job.id))
+        let is_retry_attempt = sqlx::query_scalar!(
+            "SELECT attempt FROM native_retry_attempt WHERE job_id = $1",
+            completed_job.id,
+        )
+        .fetch_optional(db)
+        .await
+        .unwrap_or_else(|e| {
+            tracing::error!("reading the retry marker of {}: {e:#}", completed_job.id);
+            None
+        })
+        .is_some();
+        Some(native_retry_root(completed_job, is_retry_attempt))
     } else {
         None
     };
@@ -1387,7 +1472,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     }
 
     #[cfg(feature = "cloud")]
-    apply_completed_job_cloud_usage(db, completed_job, duration);
+    apply_completed_job_cloud_usage(db, completed_job, span.last_run_ms);
 
     #[cfg(all(feature = "enterprise", feature = "private"))]
     crate::jobs_ee::apply_completed_job_error_handlers(
@@ -1404,7 +1489,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
 
     // tracing::error!("4 {:?}", start.elapsed());
 
-    Ok((completed_job.id, duration))
+    Ok((completed_job.id, span))
 }
 
 async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
@@ -1422,7 +1507,7 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     // True when a native script retry was enqueued for this failed attempt, i.e.
     // this is not the terminal attempt — schedule completion handlers must wait.
     retry_pending: bool,
-) -> windmill_common::error::Result<(Option<Uuid>, i64, bool, bool)> {
+) -> windmill_common::error::Result<(Option<Uuid>, CompletedSpan, bool, bool)> {
     // let start = std::time::Instant::now();
 
     let job_id = completed_job.id;
@@ -1489,11 +1574,11 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         && monitor_parent.is_none()
         && !is_scheduled
     {
-        let Some(duration) = completion.execute(&mut *db.acquire().await?).await? else {
+        let Some(completed) = completion.execute(&mut *db.acquire().await?).await? else {
             return Err(not_in_queue_error(db, job_id).await);
         };
-        log_completed_job(completed_job, duration, success);
-        return Ok((None, duration, false, false));
+        log_completed_job(completed_job, completed.duration_ms, success);
+        return Ok((None, completed, false, false));
     }
 
     let mut tx = db.begin().warn_after_seconds(10).await?;
@@ -1501,7 +1586,8 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     // The parent's rows are locked ahead of the child's own queue row (see
     // `record_child_completion` for the order this must keep), so the duration it stamps is read
     // before the completion: the one the completed row will hold. `now()` is fixed for the
-    // transaction, and a completed row already there keeps its own duration.
+    // transaction, and a completed row already there keeps its own duration. For a child that
+    // itself parked it is the last run's, matching the last start its timeline entry carries.
     let mut wac_parent_ready = false;
     if let Some(parent_job) = wac_parent {
         let Some(duration) = sqlx::query_scalar!(
@@ -1528,7 +1614,7 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         .await?;
     }
 
-    let Some(duration) = completion.execute(&mut *tx).await? else {
+    let Some(completed) = completion.execute(&mut *tx).await? else {
         return Err(not_in_queue_error(&mut *tx, job_id).await);
     };
 
@@ -1738,16 +1824,35 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
 
     tx.commit().warn_after_seconds(10).await?;
 
-    log_completed_job(completed_job, duration, success);
+    log_completed_job(completed_job, completed.duration_ms, success);
     // tracing::info!("completed job: {:?}", start.elapsed().as_micros());
     Ok((
         None,
-        duration,
+        completed,
         _skip_downstream_error_handlers,
         wac_parent_ready,
     ))
 }
 
+/// What a job's completion wrote. `started_at` and `duration_ms` are the completed row's.
+/// `last_run_ms` is the time the job's last run held a worker, which is what gets metered;
+/// it differs from `duration_ms` only for a job that parked.
+#[derive(Debug, Clone, Copy)]
+pub struct CompletedSpan {
+    pub started_at: Option<chrono::DateTime<chrono::Utc>>,
+    pub duration_ms: i64,
+    pub last_run_ms: i64,
+}
+
+impl CompletedSpan {
+    /// Whether the row spans more than the run that started at `last_started_at`, i.e. the
+    /// job parked and resumed. A flow records such a step with the row's span, so the step
+    /// reads like the job does.
+    pub fn outlasts_run(&self, last_started_at: Option<chrono::DateTime<chrono::Utc>>) -> bool {
+        matches!((self.started_at, last_started_at), (Some(first), Some(last)) if first < last)
+    }
+}
+
 /// What a job's completion writes, for `Completion::execute`.
 struct Completion<'a> {
     completed_job: &'a MiniCompletedJob,
@@ -1764,6 +1869,11 @@ impl Completion<'_> {
     /// Moves the job from the queue to the completed jobs and refreshes a flow step's parent
     /// ping, as one statement. Returns `None` when the job was no longer in the queue.
     ///
+    /// For a job that parked (a Workflow-as-Code parent, see `suspend_wac_parent`) the row's
+    /// `started_at` and `duration_ms` span the whole workflow from its first start, and the
+    /// last run goes to `extras.wac_last_segment_ms` for readers that sum worker time from
+    /// completed rows.
+    ///
     /// The completion takes its cancellation from the queue row it deletes, not only from
     /// `canceled_by`: that is what the worker last read, and the delete waits for a cancel still
     /// being written, so the deleted row is the final word on whether the job was canceled.
@@ -1771,7 +1881,7 @@ impl Completion<'_> {
     /// It locks the queue row before the completed row's key. Any other writer completing a job
     /// (the monitor's zombie fallback, debounce) must take them in the same order, or the two
     /// deadlock.
-    async fn execute(&self, conn: &mut sqlx::PgConnection) -> error::Result<Option<i64>> {
+    async fn execute(&self, conn: &mut sqlx::PgConnection) -> error::Result<Option<CompletedSpan>> {
         let Completion {
             completed_job,
             success,
@@ -1802,16 +1912,20 @@ impl Completion<'_> {
             .then_some(completed_job.parent_job)
             .flatten()
         else {
-            return sqlx::query_scalar!(
+            return sqlx::query_as!(
+                CompletedSpan,
                 "WITH deleted AS (
                     DELETE FROM v2_job_queue WHERE id = $1
-                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason
+                    RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,
+                        (extras->>'wac_first_started_at')::timestamptz AS first_started_at,
+                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms
                 ), completed AS (
                     INSERT INTO v2_job_completed AS cj
                         ( workspace_id
                         , id
                         , started_at
                         , duration_ms
+                        , extras
                         , result
                         , result_columns
                         , canceled_by
@@ -1822,8 +1936,11 @@ impl Completion<'_> {
                         , status
                         , worker
                         )
-                    SELECT d.workspace_id, d.id, d.started_at,
-                        COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),
+                    SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),
+                        CASE WHEN d.first_started_at IS NULL THEN d.run_ms
+                            ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,
+                        CASE WHEN d.first_started_at IS NOT NULL
+                            THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,
                         $3::text::jsonb, $10,
                         CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,
                         CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,
@@ -1839,9 +1956,11 @@ impl Completion<'_> {
                             THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,
                         canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL
                             THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END
-                    RETURNING duration_ms
+                    RETURNING cj.started_at, cj.duration_ms,
+                        COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms
                 )
-                SELECT duration_ms AS \"duration_ms!\" FROM completed",
+                SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",
+                    last_run_ms AS \"last_run_ms!\" FROM completed",
                 /* $1 */ completed_job.id,
                 /* $2 */ success,
                 /* $3 */ result,
@@ -1861,16 +1980,20 @@ impl Completion<'_> {
         // A canceled flow is pinged too: it is completed by its next transition like any other
         // flow, and the zombie flow monitor needs the ping to finish the cancel if that
         // transition is lost.
-        sqlx::query_scalar!(
+        sqlx::query_as!(
+        CompletedSpan,
         "WITH deleted AS (
             DELETE FROM v2_job_queue WHERE id = $1
-            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason
+            RETURNING id, workspace_id, started_at, worker, canceled_by, canceled_reason,
+                (extras->>'wac_first_started_at')::timestamptz AS first_started_at,
+                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(started_at, now()))))*1000)::bigint AS run_ms
         ), completed AS (
             INSERT INTO v2_job_completed AS cj
                 ( workspace_id
                 , id
                 , started_at
                 , duration_ms
+                , extras
                 , result
                 , result_columns
                 , canceled_by
@@ -1881,8 +2004,11 @@ impl Completion<'_> {
                 , status
                 , worker
                 )
-            SELECT d.workspace_id, d.id, d.started_at,
-                COALESCE($9::bigint, (EXTRACT('epoch' FROM (now())) - EXTRACT('epoch' FROM (COALESCE(d.started_at, now()))))*1000),
+            SELECT d.workspace_id, d.id, COALESCE(d.first_started_at, d.started_at),
+                CASE WHEN d.first_started_at IS NULL THEN d.run_ms
+                    ELSE EXTRACT('epoch' FROM (now() - d.first_started_at))*1000 END,
+                CASE WHEN d.first_started_at IS NOT NULL
+                    THEN jsonb_build_object('wac_last_segment_ms', d.run_ms) END,
                 $3::text::jsonb, $10,
                 CASE WHEN $4::BOOL THEN $5 ELSE d.canceled_by END,
                 CASE WHEN $4::BOOL THEN $6 WHEN d.canceled_by IS NOT NULL THEN d.canceled_reason END,
@@ -1898,14 +2024,16 @@ impl Completion<'_> {
                     THEN EXCLUDED.canceled_by ELSE cj.canceled_by END,
                 canceled_reason = CASE WHEN NOT $4::BOOL AND EXCLUDED.canceled_by IS NOT NULL
                     THEN EXCLUDED.canceled_reason ELSE cj.canceled_reason END
-            RETURNING duration_ms
+            RETURNING cj.started_at, cj.duration_ms,
+                COALESCE((cj.extras->>'wac_last_segment_ms')::bigint, cj.duration_ms) AS last_run_ms
         ), parent_ping AS (
             UPDATE v2_job_runtime r SET ping = now()
             FROM v2_job_queue q
             WHERE r.id = $11 AND q.id = r.id AND q.workspace_id = $12
                 AND EXISTS (SELECT 1 FROM completed)
         )
-        SELECT duration_ms AS \"duration_ms!\" FROM completed",
+        SELECT started_at AS \"started_at?\", duration_ms AS \"duration_ms!\",
+            last_run_ms AS \"last_run_ms!\" FROM completed",
         /* $1 */ completed_job.id,
         /* $2 */ success,
         /* $3 */ result,
@@ -1972,7 +2100,7 @@ async fn check_result_size<T: ValidableJson>(
     db: &Pool<Postgres>,
     queued_job: &MiniCompletedJob,
     result: Json<&T>,
-) -> Option<Result<(Option<Uuid>, i64, bool, bool), Error>> {
+) -> Option<Result<(Option<Uuid>, CompletedSpan, bool, bool), Error>> {
     let result_size = result.size() / 1024 / 1024;
     if result_size > 2 {
         if result_size > *MAX_RESULT_SIZE_MB {
@@ -2037,13 +2165,13 @@ async fn restart_job_if_perpetual_inner(
 ) -> Result<(), Error> {
     let cache_key = (hash.0, queued_job.workspace_id.clone());
 
-    let (restart, script_timeout) = if let Some(cached) =
+    let (restart, script_timeout, script_job_token_scopes) = if let Some(cached) =
         RESTART_UNLESS_CANCELLED_CACHE.get(&cache_key)
     {
         cached
     } else {
         let row = sqlx::query!(
-            "SELECT restart_unless_cancelled, timeout FROM script WHERE hash = $1 AND workspace_id = $2",
+            "SELECT restart_unless_cancelled, timeout, job_token_scopes FROM script WHERE hash = $1 AND workspace_id = $2",
             hash.0,
             &queued_job.workspace_id
         )
@@ -2054,10 +2182,12 @@ async fn restart_job_if_perpetual_inner(
             .as_ref()
             .and_then(|r| r.restart_unless_cancelled)
             .unwrap_or(false);
-        let script_timeout = row.and_then(|r| r.timeout);
+        let script_timeout = row.as_ref().and_then(|r| r.timeout);
+        let script_job_token_scopes = row.and_then(|r| r.job_token_scopes);
 
-        RESTART_UNLESS_CANCELLED_CACHE.insert(cache_key, (restart, script_timeout));
-        (restart, script_timeout)
+        let cached = (restart, script_timeout, script_job_token_scopes);
+        RESTART_UNLESS_CANCELLED_CACHE.insert(cache_key, cached.clone());
+        cached
     };
 
     if restart {
@@ -2103,6 +2233,8 @@ async fn restart_job_if_perpetual_inner(
         .await?
         .flatten()
         .unwrap_or_default();
+        // The replacement never holds a wider token than the run it replaces.
+        let scope_ceiling = queued_job.job_token_scopes.clone();
         let (_uuid, tx) = push(
             db,
             tx,
@@ -2127,6 +2259,7 @@ async fn restart_job_if_perpetual_inner(
                 // TODO(debouncing): handle properly
                 debouncing_settings: DebouncingSettings::default(),
                 labels: None, // labels already set on original job
+                job_token_scopes: script_job_token_scopes,
             },
             PushArgs::from(&args.0),
             &queued_job.created_by,
@@ -2153,6 +2286,7 @@ async fn restart_job_if_perpetual_inner(
             None,
             None,
             None,
+            scope_ceiling.as_deref(),
         )
         .await?;
         tx.commit().await?;
@@ -2166,18 +2300,17 @@ async fn restart_job_if_perpetual_inner(
 /// resolution too; `ON CONFLICT DO NOTHING` keeps a human's note intact.
 ///
 /// Membership of the chain must be *proven* per row, never inferred from `parent_job`
-/// alone: `root` is `job.parent_job.unwrap_or(job.id)`, so for a job launched with an
-/// explicit `parent_job` (WAC inline children, SDK-launched children) `root` is the
-/// *calling* job, and its other failed children are unrelated. Resolving those would hide
-/// exactly the failures this feature exists to surface, so each row must be either
+/// alone: the success-side caller passes the succeeding job's `parent_job`, which for a
+/// job launched with an explicit parent (WAC inline children, SDK-launched children) is
+/// the *calling* job, and its other failed children are unrelated. Resolving those would
+/// hide exactly the failures this feature exists to surface, so each row must be either
 /// - a job carrying a `native_retry_attempt` marker under `root` (provably an attempt), or
-/// - `root` itself as the original attempt, which is only provable when `root` is
-///   parentless and unmarked.
+/// - `root` itself as the original attempt: unmarked, and proven a chain root by the
+///   marked success under it, since only a chain root is ever a marked job's parent
+///   (see [`native_retry_root`]).
 ///
 /// Both arms also require the same `runnable_id` as the succeeding attempt, since every
-/// attempt in a chain runs the same runnable. The deliberate cost is a miss, not an
-/// over-reach: when the original attempt had a parent it is an unmarked sibling
-/// indistinguishable from any other child of the caller, so it stays red.
+/// attempt in a chain runs the same runnable.
 ///
 /// Nothing is trusted of the caller (this writes through a privileged pool): the gate is
 /// "some marked attempt under `root` running `runnable_id` has succeeded", evaluated in
@@ -2221,7 +2354,7 @@ pub async fn resolve_retry_chain_if_succeeded(
                     AND (
                         (j.parent_job = $1
                             AND EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))
-                        OR (c.id = $1 AND j.parent_job IS NULL
+                        OR (c.id = $1
                             AND NOT EXISTS (SELECT 1 FROM native_retry_attempt WHERE job_id = c.id))
                     )
             ON CONFLICT (job_id) DO NOTHING",
@@ -2275,6 +2408,18 @@ async fn eval_retry_if(
     false
 }
 
+/// The first attempt of `job`'s native retry chain, which every later attempt is pushed
+/// with as `parent_job` and whose id seeds theirs. A first attempt may have a parent of its
+/// own (a script dispatched from another job), so only a marked attempt's parent is the root:
+/// rooting at that outer parent would merge the chains of its retried children.
+fn native_retry_root(job: &MiniCompletedJob, is_retry_attempt: bool) -> Uuid {
+    if is_retry_attempt {
+        job.parent_job.unwrap_or(job.id)
+    } else {
+        job.id
+    }
+}
+
 /// Native script retry. When a failed `Script` or `Script_Hub` job carries a retry
 /// policy (via `runnable_settings_handle`) and has attempts left, enqueue a fresh
 /// attempt of the same script after the policy's backoff delay — instead of having
@@ -2318,6 +2463,18 @@ pub async fn maybe_enqueue_native_script_retry(
     if !policy.has_attempts() {
         return Ok(false);
     }
+    // Cancelling a job that has a parent (every retry attempt does) only flags its queue row,
+    // and the worker that pulls it completes it without a `canceled_by`: read the flag here.
+    let soft_canceled = sqlx::query_scalar!(
+        "SELECT canceled_by IS NOT NULL AS \"canceled!\" FROM v2_job_queue WHERE id = $1",
+        job.id,
+    )
+    .fetch_optional(db)
+    .await?
+    .unwrap_or(false);
+    if soft_canceled {
+        return Ok(false);
+    }
 
     // Attempt counter for this job: its `native_retry_attempt` marker, or 0 for
     // the first (un-marked) attempt. The marker is persistent (unlike the queue
@@ -2330,7 +2487,7 @@ pub async fn maybe_enqueue_native_script_retry(
     .fetch_optional(db)
     .await?
     .unwrap_or(0) as u32;
-    let root = job.parent_job.unwrap_or(job.id);
+    let root = native_retry_root(job, prev_attempts > 0);
     // Scheduled chains keep the schedule trigger so the terminal attempt drives
     // the schedule completion handlers (on_failure/on_success); `parent_job`
     // keeps every retry out of the per-occurrence handler counting queries.
@@ -2411,6 +2568,8 @@ pub async fn maybe_enqueue_native_script_retry(
         )
         .await?;
     let tx = PushIsolationLevel::IsolatedRoot(db.clone());
+    // The retry never holds a wider token than the attempt it replaces.
+    let scope_ceiling = job.job_token_scopes.clone();
     let (new_id, mut tx) = match push(
         db,
         tx,
@@ -2459,6 +2618,7 @@ pub async fn maybe_enqueue_native_script_retry(
         None,
         trigger,
         None,
+        scope_ceiling.as_deref(),
     )
     .await
     {
@@ -3424,6 +3584,7 @@ pub async fn push_error_handler<'a, 'c, T: Serialize + Send + Sync>(
         None,
         None,
         None,
+        None,
     )
     .await?;
     tx.commit().await?;
@@ -3513,6 +3674,7 @@ pub async fn push_success_handler<'a, 'c, T: Serialize + Send + Sync>(
         None,
         None,
         None,
+        None,
     )
     .await?;
     tx.commit().await?;
@@ -3571,6 +3733,11 @@ pub struct MiniPulledJob {
     pub visible_to_owner: bool,
     pub permissioned_as_end_user_email: Option<String>,
     pub runnable_settings_handle: Option<i64>,
+    /// The job's effective token scopes (`job_perms.job_token_scopes`), minted into its token.
+    /// No `sqlx(default)`: a query that forgets the column must fail rather than mint an
+    /// unrestricted token.
+    #[serde(default)]
+    pub job_token_scopes: Option<Vec<String>>,
 }
 
 impl MiniPulledJob {
@@ -3622,6 +3789,7 @@ impl MiniPulledJob {
             runnable_settings_handle: None,
             concurrent_limit: None,
             concurrency_time_window_s: None,
+            job_token_scopes: None,
         }
     }
 }
@@ -3659,6 +3827,10 @@ pub struct MiniCompletedJob {
     /// the server would reject every completion it sends, not just build jobs.
     #[serde(default)]
     pub build_binary_only: bool,
+    /// The job's effective token scopes, carried from the pull: a re-run (retry, perpetual
+    /// restart) caps itself with them after the job's `job_perms` row may have been swept.
+    #[serde(default)]
+    pub job_token_scopes: Option<Vec<String>>,
 }
 
 impl From<QueuedJobV2> for MiniCompletedJob {
@@ -3686,9 +3858,11 @@ impl From<QueuedJobV2> for MiniCompletedJob {
             cache_ttl: job.cache_ttl,
             cache_ignore_s3_path: job.cache_ignore_s3_path,
             runnable_settings_handle: job.runnable_settings_handle,
-            // `QueuedJobV2` carries no args, and nothing reaches the restart gate
-            // through this conversion — the worker completes jobs from the pulled job.
+            // `QueuedJobV2` carries no args, which is what marks a binary-build job.
             build_binary_only: false,
+            // Nor scopes: a caller whose completion can re-run the job (the monitor's zombie
+            // recovery) fills them in from `job_perms` while the job is still queued.
+            job_token_scopes: None,
         }
     }
 }
@@ -3719,6 +3893,7 @@ impl From<MiniPulledJob> for MiniCompletedJob {
             cache_ttl: job.cache_ttl,
             cache_ignore_s3_path: job.cache_ignore_s3_path,
             runnable_settings_handle: job.runnable_settings_handle,
+            job_token_scopes: job.job_token_scopes.clone(),
             build_binary_only: crate::binary_prebuild::is_build_binary_job(
                 job.args.as_ref().map(|x| &x.0),
             ),
@@ -3751,6 +3926,7 @@ impl From<Arc<MiniPulledJob>> for MiniCompletedJob {
             cache_ttl: job.cache_ttl,
             cache_ignore_s3_path: job.cache_ignore_s3_path,
             runnable_settings_handle: job.runnable_settings_handle,
+            job_token_scopes: job.job_token_scopes.clone(),
             build_binary_only: crate::binary_prebuild::is_build_binary_job(
                 job.args.as_ref().map(|x| &x.0),
             ),
@@ -3825,48 +4001,6 @@ impl MiniPulledJob {
             .and_then(|f| f.chat_input_enabled)
     }
 
-    pub fn from(job: &QueuedJob) -> MiniPulledJob {
-        MiniPulledJob {
-            workspace_id: job.workspace_id.clone(),
-            id: job.id,
-            args: job.args.clone(),
-            parent_job: job.parent_job.clone(),
-            created_by: job.created_by.clone(),
-            started_at: job.started_at.clone(),
-            scheduled_for: job.scheduled_for,
-            runnable_path: job.script_path.clone(),
-            kind: job.job_kind,
-            runnable_id: job.script_hash.clone(),
-            canceled_reason: job.canceled_reason.clone(),
-            canceled_by: job.canceled_by.clone(),
-            permissioned_as: job.permissioned_as.clone(),
-            permissioned_as_email: job.email.clone(),
-            flow_status: job.flow_status.clone(),
-            tag: job.tag.clone(),
-            script_lang: job.language.clone(),
-            same_worker: job.same_worker,
-            pre_run_error: job.pre_run_error.clone(),
-            concurrent_limit: job.concurrent_limit.clone(),
-            concurrency_time_window_s: job.concurrency_time_window_s.clone(),
-            runnable_settings_handle: job.runnable_settings_handle,
-            flow_innermost_root_job: job.root_job.clone(), // QueuedJob is taken from v2_as_queue, where root_job corresponds to flow_innermost_root_job in v2_job
-            root_job: None,
-            timeout: job.timeout.clone(),
-            flow_step_id: job.flow_step_id.clone(),
-            cache_ttl: job.cache_ttl.clone(),
-            cache_ignore_s3_path: job.cache_ignore_s3_path.clone(),
-            priority: job.priority.clone(),
-            preprocessed: job.preprocessed.clone(),
-            script_entrypoint_override: job.script_entrypoint_override.clone(),
-            trigger: job.schedule_path.clone(),
-            trigger_kind: job
-                .schedule_path
-                .is_some()
-                .then(|| JobTriggerKind::Schedule.into()),
-            visible_to_owner: job.visible_to_owner.clone(),
-            permissioned_as_end_user_email: None,
-        }
-    }
     pub fn is_flow(&self) -> bool {
         self.kind.is_flow()
     }
@@ -3968,6 +4102,7 @@ impl PulledJob {
                 groups,
                 folders,
                 end_user_email: self.job.permissioned_as_end_user_email.clone(),
+                job_token_scopes: self.job.job_token_scopes.clone(),
             }),
             _ => None,
         };
@@ -4074,8 +4209,10 @@ pub async fn get_mini_pulled_job<'c>(
         trigger,
         trigger_kind as \"trigger_kind: TriggerKindLabel\",
         visible_to_owner,
-        NULL as permissioned_as_end_user_email
-        FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id WHERE v2_job_queue.id = $1",
+        NULL as permissioned_as_end_user_email,
+        job_perms.job_token_scopes
+        FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id
+        LEFT JOIN job_perms ON job_perms.job_id = v2_job_queue.id WHERE v2_job_queue.id = $1",
         job_id,
     )
     .fetch_optional(e)
@@ -4194,6 +4331,7 @@ impl PulledJobResult {
                     ))),
                     result_columns: None,
                     mem_peak: 0,
+                    resource_usage: None,
                     cached_res_path: None,
                     token: "".to_string(),
                     canceled_by: None,
@@ -4215,6 +4353,7 @@ impl PulledJobResult {
                     }))),
                     result_columns: None,
                     mem_peak: 0,
+                    resource_usage: None,
                     cached_res_path: None,
                     token: "".to_string(),
                     canceled_by: None,
@@ -4619,15 +4758,29 @@ pub async fn pull(
                         && !(job.kind.is_preview()
                             && PREVIEW_TAGS_OVERRIDE.load(std::sync::atomic::Ordering::Relaxed))
                     {
-                        let effective_ws = per_workspace_tag(&job.workspace_id, db).await;
-                        let base_tag = if job.is_flow() {
-                            "flow".to_string()
-                        } else {
-                            "dependency".to_string()
-                        };
-                        let tag = match &effective_ws {
-                            Some(ws) => format!("{}-{}", base_tag, ws),
-                            None => base_tag,
+                        let tag = match configured_dependency_job_tag(
+                            &job.kind,
+                            job.script_lang.as_ref(),
+                            // the job sits on a shell worker's tag, so its own tag is lost
+                            false,
+                            &job.workspace_id,
+                            db,
+                        )
+                        .await
+                        {
+                            Some(tag) => tag,
+                            None => {
+                                let effective_ws = per_workspace_tag(&job.workspace_id, db).await;
+                                let base_tag = if job.is_flow() {
+                                    "flow".to_string()
+                                } else {
+                                    "dependency".to_string()
+                                };
+                                match &effective_ws {
+                                    Some(ws) => format!("{}-{}", base_tag, ws),
+                                    None => base_tag,
+                                }
+                            }
                         };
                         sqlx::query!(
                             "UPDATE v2_job_queue SET tag = $1, running = false WHERE id = $2",
@@ -5275,6 +5428,29 @@ pub async fn resolve_push_tag(
     Some(interpolate_args(tag.to_string(), args, &tag_ws))
 }
 
+/// The tag a dependency job is routed to when the instance's `dependency_job_tag` setting is
+/// set, whatever tag the script, flow or app itself runs on. `None` for any other job kind, for
+/// bunnative (its bundle must be built on a worker with the bun tag), for a binary prebuild
+/// pushed with an explicit `auto_build_binary_tag`, or when the setting is unset. An untagged
+/// prebuild follows its dependency job onto the configured tag.
+pub async fn configured_dependency_job_tag(
+    job_kind: &JobKind,
+    language: Option<&ScriptLang>,
+    tagged_binary_prebuild: bool,
+    workspace_id: &str,
+    db: &DB,
+) -> Option<String> {
+    if !job_kind.is_dependency()
+        || tagged_binary_prebuild
+        || language == Some(&ScriptLang::Bunnative)
+    {
+        return None;
+    }
+    let tag = DEPENDENCY_JOB_TAG.load_full();
+    let tag = tag.as_deref()?;
+    resolve_push_tag(tag, &PushArgs::from(&HashMap::new()), workspace_id, db).await
+}
+
 /// Refuses a `tag` the caller chose that the instance's custom tags do not let `w_id` use,
 /// judging the queue it resolves to. `args` must be the ones the job is pushed with: resolving
 /// with any others checks a queue the job does not land on.
@@ -5730,8 +5906,10 @@ pub fn get_mini_completed_job<'a, 'e, A: sqlx::Acquire<'e, Database = Postgres>
             "SELECT
             j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,
             j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle,
-            COALESCE(j.args->'build_binary_only' = 'true'::jsonb, false) AS \"build_binary_only!\"
+            COALESCE(j.args->'build_binary_only' = 'true'::jsonb, false) AS \"build_binary_only!\",
+            p.job_token_scopes AS \"job_token_scopes?\"
             FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id
+            LEFT JOIN job_perms p ON p.job_id = j.id
             WHERE j.id = $1 AND j.workspace_id = $2",
             id,
             w_id
@@ -5981,6 +6159,10 @@ pub async fn push<'c, 'd>(
     end_user_email: Option<String>,
     trigger: Option<TriggerMetadata>,
     suspended_mode: Option<bool>,
+    // Caps the new job's token on top of the target's own `job_token_scopes`: the scopes of
+    // the job (or job token) this push acts for, `None` when nothing above it restricts it.
+    // A job may never hold a token wider than the job that created it.
+    scope_ceiling: Option<&[String]>,
 ) -> Result<(Uuid, Transaction<'c, Postgres>), Error> {
     Box::pin(push_inner(
         db,
@@ -6012,6 +6194,7 @@ pub async fn push<'c, 'd>(
         end_user_email,
         trigger,
         suspended_mode,
+        scope_ceiling,
     ))
     .await
 }
@@ -6047,6 +6230,7 @@ async fn push_inner<'c, 'd>(
     end_user_email: Option<String>,
     trigger: Option<TriggerMetadata>,
     suspended_mode: Option<bool>,
+    scope_ceiling: Option<&[String]>,
 ) -> Result<(Uuid, Transaction<'c, Postgres>), Error> {
     // The worker builds a preview's `_MODULES` arg into the job as its module code. Every
     // caller-reachable value lands in `args` or `extra` (webhook query and headers go to
@@ -6208,9 +6392,20 @@ async fn push_inner<'c, 'd>(
                         if team_plan_status.max_tolerated_executions.is_none()
                             || workspace_usage > team_plan_status.max_tolerated_executions.unwrap()
                         {
-                            return Err(error::Error::QuotaExceeded(format!(
-                                "Workspace {workspace_id} team plan is past due and isn't allowed to run any more jobs. Please fix your payment method in the workspace settings."
-                            )));
+                            // A canceled plan reuses the past-due cap for its last month. Only read
+                            // here, on the refusal path, to word it.
+                            let plan_canceled = sqlx::query_scalar::<_, bool>(
+                                "SELECT COALESCE(plan = 'team_canceled', false) FROM workspace_settings WHERE workspace_id = $1",
+                            )
+                            .bind(&billing_w_id)
+                            .fetch_optional(db)
+                            .await?
+                            .unwrap_or(false);
+                            return Err(error::Error::QuotaExceeded(if plan_canceled {
+                                format!("Workspace {workspace_id} team plan was canceled and has used the executions paid for this month. Jobs can run again on the free plan from the 1st, or right away by subscribing again in the workspace settings.")
+                            } else {
+                                format!("Workspace {workspace_id} team plan is past due and isn't allowed to run any more jobs. Please fix your payment method in the workspace settings.")
+                            }));
                         }
                     } else {
                         if workspace_usage > MAX_FREE_EXECS
@@ -6280,6 +6475,8 @@ async fn push_inner<'c, 'd>(
         debouncing_settings: DebouncingSettings,
         retry_settings: RetrySettings,
         labels: Option<Vec<String>>,
+        /// The target's own `job_token_scopes` setting.
+        job_token_scopes: Option<Vec<String>>,
         /// A `dependencies` job that only compiles an already-deployed script's binary.
         /// It shares the job kind, but not the queue policy lock generation needs.
         build_binary_only: bool,
@@ -6302,6 +6499,7 @@ async fn push_inner<'c, 'd>(
         debouncing_settings,
         retry_settings,
         labels,
+        job_token_scopes,
         build_binary_only,
     } = match job_payload {
         JobPayload::ScriptHash {
@@ -6316,6 +6514,7 @@ async fn push_inner<'c, 'd>(
             concurrency_settings,
             debouncing_settings,
             labels,
+            job_token_scopes,
         } => {
             if apply_preprocessor {
                 preprocessed = Some(false);
@@ -6333,6 +6532,7 @@ async fn push_inner<'c, 'd>(
                 dedicated_worker,
                 _low_level_priority: priority,
                 labels,
+                job_token_scopes,
                 ..Default::default()
             }
         }
@@ -6548,6 +6748,7 @@ async fn push_inner<'c, 'd>(
             ..Default::default()
         },
         JobPayload::RawFlow { mut value, path, restarted_from } => {
+            refuse_step_scopes_on_outdated_workers(&value).await?;
             add_virtual_items_if_necessary(&mut value.modules);
 
             let flow_status: FlowStatus = match restarted_from {
@@ -6671,20 +6872,21 @@ async fn push_inner<'c, 'd>(
                 // script's `dedicated_worker` (it drives the dedicated tag below),
                 // but the SingleStepFlow payload doesn't — resolve it from the
                 // script row so a dedicated-worker script keeps its dedicated pool.
-                let dedicated_worker = if let Some(h) = &hash {
+                // The script's `job_token_scopes` is resolved the same way.
+                let (dedicated_worker, job_token_scopes) = if let Some(h) = &hash {
                     // Read on the non-RLS pool: push_inner is also entered with RLS
                     // isolation variants under which the script row may be invisible,
                     // which would mis-resolve dedicated_worker routing.
-                    sqlx::query_scalar::<_, Option<bool>>(
-                        "SELECT dedicated_worker FROM script WHERE hash = $1 AND workspace_id = $2",
+                    sqlx::query_as::<_, (Option<bool>, Option<Vec<String>>)>(
+                        "SELECT dedicated_worker, job_token_scopes FROM script WHERE hash = $1 AND workspace_id = $2",
                     )
                     .bind(h.0)
                     .bind(workspace_id)
                     .fetch_optional(db)
                     .await?
-                    .flatten()
+                    .unwrap_or((None, None))
                 } else {
-                    None
+                    (None, None)
                 };
                 break 'ssf JobPayloadUntagged {
                     runnable_id: hash.map(|h| h.0),
@@ -6696,6 +6898,7 @@ async fn push_inner<'c, 'd>(
                     },
                     language,
                     dedicated_worker,
+                    job_token_scopes,
                     concurrency_settings,
                     debouncing_settings,
                     retry_settings: retry.as_ref().map(RetrySettings::from).unwrap_or_default(),
@@ -6866,7 +7069,14 @@ async fn push_inner<'c, 'd>(
                 ..Default::default()
             }
         }
-        JobPayload::Flow { path, dedicated_worker, apply_preprocessor, version, labels } => {
+        JobPayload::Flow {
+            path,
+            dedicated_worker,
+            apply_preprocessor,
+            version,
+            labels,
+            job_token_scopes,
+        } => {
             let mut ntx = tx.into_tx().await?;
             // Do not use the lite version unless all workers are updated.
             let data = if *DISABLE_FLOW_SCRIPT
@@ -6885,6 +7095,7 @@ async fn push_inner<'c, 'd>(
             tx = PushIsolationLevel::Transaction(ntx);
 
             let mut value = data.value().clone();
+            refuse_step_scopes_on_outdated_workers(&value).await?;
             let priority = value.priority;
             let cache_ttl = value.cache_ttl.map(|x| x as i32);
             let cache_ignore_s3_path = value.cache_ignore_s3_path;
@@ -6933,6 +7144,7 @@ async fn push_inner<'c, 'd>(
                 concurrency_settings,
                 debouncing_settings,
                 labels,
+                job_token_scopes,
                 ..Default::default()
             }
         }
@@ -6997,7 +7209,21 @@ async fn push_inner<'c, 'd>(
                 memory_id: None,
                 no_inherited_flow_env: false,
             };
+            // The completed job's own scopes are gone with its `job_perms` row, so the restart
+            // takes the flow's current setting (and the restarting caller's ceiling).
+            let job_token_scopes = match &flow_path {
+                Some(flow_path) => sqlx::query_scalar::<_, Option<Vec<String>>>(
+                    "SELECT job_token_scopes FROM flow WHERE path = $1 AND workspace_id = $2",
+                )
+                .bind(flow_path)
+                .bind(workspace_id)
+                .fetch_optional(db)
+                .await?
+                .flatten(),
+                None => None,
+            };
             let value = flow_data.value();
+            refuse_step_scopes_on_outdated_workers(value).await?;
             let priority = value.priority;
             let concurrency_settings = value.concurrency_settings.clone();
             let debouncing_settings = value.debouncing_settings.clone();
@@ -7021,6 +7247,7 @@ async fn push_inner<'c, 'd>(
                 _low_level_priority: priority,
                 concurrency_settings,
                 debouncing_settings,
+                job_token_scopes,
                 ..Default::default()
             }
         }
@@ -7140,7 +7367,14 @@ async fn push_inner<'c, 'd>(
         .map(|e| (Some(e.0), e.1))
         .unwrap_or_else(|| (None, None));
 
-    let tag = if dedicated_worker.is_some_and(|x| x) {
+    let job_token_scopes = windmill_common::scopes::intersect_job_token_scopes(
+        scope_ceiling,
+        job_token_scopes.as_deref(),
+    );
+
+    // A dedicated worker runs every job it serves with its own unscoped worker token, so a
+    // job with a restricted token runs on the regular workers of its language instead.
+    let tag = if dedicated_worker.is_some_and(|x| x) && job_token_scopes.is_none() {
         let flow_prefix = if job_kind == JobKind::Flow || job_kind == JobKind::FlowDependencies {
             "flow/"
         } else {
@@ -7152,6 +7386,16 @@ async fn push_inner<'c, 'd>(
             runnable_path.clone().expect("dedicated script has a path")
         );
         windmill_common::worker::dedicated_worker_tag(workspace_id, &full_path)
+    } else if let Some(tag) = configured_dependency_job_tag(
+        &job_kind,
+        language.as_ref(),
+        build_binary_only && tag.is_some(),
+        workspace_id,
+        db,
+    )
+    .await
+    {
+        tag
     } else {
         let interpolated_tag = match tag {
             Some(x) => resolve_push_tag(&x, &args, workspace_id, db).await,
@@ -7410,6 +7654,18 @@ async fn push_inner<'c, 'd>(
                 concurrency_settings.concurrency_time_window_s,
             )
         };
+    // jsonb rejects the `\u0000` escape (22P05), which would fail the whole push, and args are
+    // not always what a caller typed: a flow step's are evaluated from the previous step's
+    // in-memory result, an agent tool's are written by the model.
+    let serialized_args = serde_json::value::to_raw_value(&args).map_err(|e| {
+        Error::internal_err(format!("Could not serialize args of job {job_id}: {e:#}"))
+    })?;
+    let sanitized_args = match strip_json_nul(serialized_args.get()) {
+        Cow::Owned(stripped) => RawValue::from_string(stripped).map_err(|e| {
+            Error::internal_err(format!("Could not sanitize args of job {job_id}: {e:#}"))
+        })?,
+        Cow::Borrowed(_) => serialized_args,
+    };
     sqlx::query!(
         "WITH inserted_job AS (
             INSERT INTO v2_job (
@@ -7458,9 +7714,9 @@ async fn push_inner<'c, 'd>(
             INSERT INTO v2_job_runtime (id, ping) VALUES ($1, null)
         ),
         inserted_job_perms AS (
-            INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, end_user_email)
-            values ($1, $32, $33, $34, $35, $36, $37, $2, $41)
-            ON CONFLICT (job_id) DO UPDATE SET email = EXCLUDED.email, username = EXCLUDED.username, is_admin = EXCLUDED.is_admin, is_operator = EXCLUDED.is_operator, folders = EXCLUDED.folders, groups = EXCLUDED.groups, workspace_id = EXCLUDED.workspace_id, end_user_email = EXCLUDED.end_user_email
+            INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, end_user_email, job_token_scopes)
+            values ($1, $32, $33, $34, $35, $36, $37, $2, $41, $47)
+            ON CONFLICT (job_id) DO UPDATE SET email = EXCLUDED.email, username = EXCLUDED.username, is_admin = EXCLUDED.is_admin, is_operator = EXCLUDED.is_operator, folders = EXCLUDED.folders, groups = EXCLUDED.groups, workspace_id = EXCLUDED.workspace_id, end_user_email = EXCLUDED.end_user_email, job_token_scopes = EXCLUDED.job_token_scopes
         )
         INSERT INTO v2_job_queue
             (workspace_id, id, running, scheduled_for, started_at, tag, priority, cache_ignore_s3_path, runnable_settings_handle)
@@ -7476,7 +7732,7 @@ async fn push_inner<'c, 'd>(
         permissioned_as,
         runnable_id,
         runnable_path.clone(),
-        Json(args) as Json<PushArgs>,
+        Json(sanitized_args) as Json<Box<RawValue>>,
         job_kind.clone() as JobKind,
         trigger_path.flatten(),
         language as Option<ScriptLang>,
@@ -7515,6 +7771,7 @@ async fn push_inner<'c, 'd>(
         labels.as_deref() as Option<&[String]>,
         runnable_path,
         workspace_id,
+        job_token_scopes.as_deref() as Option<&[String]>,
     )
     .execute(&mut *tx)
     .warn_after_seconds(1)
@@ -8478,6 +8735,7 @@ pub async fn get_same_worker_job(
                     v2_job.trigger,
                     v2_job.trigger_kind,
                     v2_job.visible_to_owner,
+                    p.job_token_scopes,
                     v2_job.raw_code,
                     v2_job.raw_lock,
                     v2_job.raw_flow,
diff --git a/backend/windmill-queue/src/schedule.rs b/backend/windmill-queue/src/schedule.rs
index 97b175fa9e..81be3cb7e8 100644
--- a/backend/windmill-queue/src/schedule.rs
+++ b/backend/windmill-queue/src/schedule.rs
@@ -103,6 +103,7 @@ async fn get_schedule_metadata<'c>(
             on_behalf_of,
             _runnable_settings_handle,
             _labels,
+            _job_token_scopes,
         ) = windmill_common::get_latest_hash_for_path(
             &mut **tx,
             db,
@@ -368,7 +369,8 @@ pub async fn push_scheduled_job<'c>(
         .warn_after_seconds_with_sql(1, "get_flow_version_info_from_version".to_string())
         .await?;
         let on_behalf_of = flow_info.on_behalf_of(&schedule.workspace_id, db).await?;
-        let FlowVersionInfo { version, tag, dedicated_worker, labels, .. } = flow_info;
+        let FlowVersionInfo { version, tag, dedicated_worker, labels, job_token_scopes, .. } =
+            flow_info;
 
         (
             JobPayload::Flow {
@@ -377,6 +379,7 @@ pub async fn push_scheduled_job<'c>(
                 apply_preprocessor: false,
                 version,
                 labels,
+                job_token_scopes,
             },
             tag,
             None,
@@ -442,6 +445,7 @@ pub async fn push_scheduled_job<'c>(
             on_behalf_of,
             runnable_settings_handle,
             labels,
+            job_token_scopes,
         ) = windmill_common::get_latest_hash_for_path(
             &mut *tx,
             db,
@@ -535,6 +539,7 @@ pub async fn push_scheduled_job<'c>(
                         concurrency_time_window_s,
                     ),
                     labels,
+                    job_token_scopes,
                 },
                 if schedule.tag.as_ref().is_some_and(|x| x != "") {
                     schedule.tag.clone()
@@ -664,6 +669,7 @@ pub async fn push_scheduled_job<'c>(
             JobTriggerKind::Schedule,
         )),
         None,
+        None,
     )
     .warn_after_seconds_with_sql(1, "push in push_scheduled_job".to_string())
     .await?;
diff --git a/backend/windmill-queue/tests/concurrency_counter_test.rs b/backend/windmill-queue/tests/concurrency_counter_test.rs
index 3edb0d3b72..b341c317bb 100644
--- a/backend/windmill-queue/tests/concurrency_counter_test.rs
+++ b/backend/windmill-queue/tests/concurrency_counter_test.rs
@@ -33,32 +33,19 @@ mod concurrency {
         .unwrap_or(0)
     }
 
-    /// Stress: N concurrent admit-attempts on a pre-existing key with limit
-    /// L < N. Asserts admitted count is exactly L (never over-admits) AND
-    /// that the row's job_uuids reflects exactly L entries.
+    /// Stress: N concurrent admit-attempts on a key with limit L < N. Asserts
+    /// admitted count is exactly L (never over-admits) AND that the row's
+    /// job_uuids reflects exactly L entries.
     ///
-    /// The row is pre-seeded with an empty `job_uuids` because there is a
-    /// known preexisting race when the `concurrency_counter` row does not
-    /// exist yet: `SELECT ... FOR UPDATE` on a missing row locks nothing,
-    /// so all concurrent transactions see `running=0` and all admit via
-    /// `INSERT ... ON CONFLICT DO UPDATE`. That race is inherited from
-    /// the legacy code path and is out of scope for this PR. This test
-    /// validates the property we *do* preserve: no over-admit once the
-    /// row exists.
+    /// The `concurrency_counter` row is deliberately absent at the start: the
+    /// monitor deletes empty rows while jobs for the key are still queued, so
+    /// the admit path has to serialize without a pre-existing row to lock.
     #[sqlx::test(migrations = "../migrations")]
     async fn stress_never_over_admits(db: Pool<Postgres>) {
         let key = "stress-never-over-admits".to_string();
         let limit: i32 = 5;
         let workers: usize = 50;
 
-        sqlx::query!(
-            "INSERT INTO concurrency_counter(concurrency_id, job_uuids) VALUES ($1, '{}'::jsonb)",
-            key,
-        )
-        .execute(&db)
-        .await
-        .expect("seed empty counter row");
-
         let mut tasks = Vec::with_capacity(workers);
         for _ in 0..workers {
             let db = db.clone();
diff --git a/backend/windmill-queue/tests/debounce_test.rs b/backend/windmill-queue/tests/debounce_test.rs
index d74f20ff3f..14f7ec2dd9 100644
--- a/backend/windmill-queue/tests/debounce_test.rs
+++ b/backend/windmill-queue/tests/debounce_test.rs
@@ -3458,6 +3458,7 @@ mod debounce {
             visible_to_owner: false,
             permissioned_as_end_user_email: None,
             runnable_settings_handle: rs_handle,
+            job_token_scopes: None,
         };
 
         let pulled = PulledJob {
@@ -3699,6 +3700,7 @@ mod debounce {
             visible_to_owner: false,
             permissioned_as_end_user_email: None,
             runnable_settings_handle: rs_handle,
+            job_token_scopes: None,
         };
 
         let pulled = PulledJob {
diff --git a/backend/windmill-queue/tests/native_retry_test.rs b/backend/windmill-queue/tests/native_retry_test.rs
index 3b2290a50f..4cf278cf83 100644
--- a/backend/windmill-queue/tests/native_retry_test.rs
+++ b/backend/windmill-queue/tests/native_retry_test.rs
@@ -45,6 +45,7 @@ mod native_retry {
             cache_ignore_s3_path: None,
             runnable_settings_handle: handle,
             build_binary_only: false,
+            job_token_scopes: None,
         }
     }
 
@@ -165,6 +166,39 @@ mod native_retry {
         Ok(())
     }
 
+    // A retry keeps the restriction of the run it replaces even once that run's `job_perms`
+    // row is gone (swept after it left the queue): the completed job carries its scopes.
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn retry_keeps_the_restriction_of_a_swept_run(db: Pool<Postgres>) -> anyhow::Result<()> {
+        let retry = Retry {
+            constant: ConstantDelay { attempts: 1, seconds: 1 },
+            exponential: Default::default(),
+            retry_if: None,
+        };
+        let handle = insert_rs(
+            RunnableSettings {
+                debouncing_settings: None,
+                concurrency_settings: None,
+                retry_settings: RetrySettings::from(&retry).insert_cached(&db).await?,
+            },
+            &db,
+        )
+        .await?;
+        let root_id = Uuid::new_v4();
+        let mut root = mini(root_id, None, handle);
+        root.job_token_scopes = Some(vec!["jobs:run".to_string()]);
+
+        assert!(maybe_enqueue_native_script_retry(&db, &root, &None, &no_result).await?);
+        let (r1_id, ..) = retry_by_attempt(&db, root_id, 1).await.expect("retry 1 exists");
+        let scopes: Option<Vec<String>> =
+            sqlx::query_scalar("SELECT job_token_scopes FROM job_perms WHERE job_id = $1")
+                .bind(r1_id)
+                .fetch_one(&db)
+                .await?;
+        assert_eq!(scopes, Some(vec!["jobs:run".to_string()]));
+        Ok(())
+    }
+
     // Cancellation always wins over a pending retry.
     #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
     async fn canceled_job_does_not_retry(db: Pool<Postgres>) -> anyhow::Result<()> {
@@ -527,4 +561,123 @@ mod native_retry {
                 .unwrap();
         assert_eq!(status, "failure", "resolving must not change job status");
     }
+
+    // A script dispatched from another job keeps that job as its parent, so its chain is
+    // rooted at the first attempt itself: sibling dispatches must not share retry ids, and
+    // a parented first attempt is still resolved once its retry succeeds.
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn parented_first_attempts_root_their_own_chains(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        let retry = Retry {
+            constant: ConstantDelay { attempts: 1, seconds: 0 },
+            exponential: Default::default(),
+            retry_if: None,
+        };
+        let handle = insert_rs(
+            RunnableSettings {
+                debouncing_settings: None,
+                concurrency_settings: None,
+                retry_settings: RetrySettings::from(&retry).insert_cached(&db).await?,
+            },
+            &db,
+        )
+        .await?;
+        let dispatcher = Uuid::new_v4();
+        let (a, b) = (Uuid::new_v4(), Uuid::new_v4());
+        for first in [a, b] {
+            let attempt = mini(first, Some(dispatcher), handle);
+            assert!(maybe_enqueue_native_script_retry(&db, &attempt, &None, &no_result).await?);
+        }
+        assert!(
+            retry_by_attempt(&db, a, 1).await.is_some(),
+            "a's retry hangs off a"
+        );
+        assert!(
+            retry_by_attempt(&db, b, 1).await.is_some(),
+            "b's retry is not mistaken for a's"
+        );
+
+        let (c, c_retry, c_sibling) = (Uuid::new_v4(), Uuid::new_v4(), Uuid::new_v4());
+        seed_job(&db, c, Some(dispatcher), false, "failure").await;
+        seed_job(&db, c_sibling, Some(dispatcher), false, "failure").await;
+        seed_job(&db, c_retry, Some(c), true, "success").await;
+        windmill_queue::jobs::resolve_retry_chain_if_succeeded(&db, c, WS, None).await?;
+        windmill_queue::jobs::resolve_retry_chain_if_succeeded(&db, dispatcher, WS, None).await?;
+        let resolved: Vec<Uuid> = sqlx::query_scalar("SELECT job_id FROM job_resolution")
+            .fetch_all(&db)
+            .await?;
+        assert_eq!(
+            resolved,
+            vec![c],
+            "only the parented first attempt resolves, not its sibling"
+        );
+        Ok(())
+    }
+
+    // Cancelling the job that dispatched a script reaches that script's pending retry, which
+    // hangs off a first attempt that has already completed.
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn cancelling_the_caller_cancels_a_pending_retry(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        let retry = Retry {
+            constant: ConstantDelay { attempts: 2, seconds: 60 },
+            exponential: Default::default(),
+            retry_if: None,
+        };
+        let handle = insert_rs(
+            RunnableSettings {
+                debouncing_settings: None,
+                concurrency_settings: None,
+                retry_settings: RetrySettings::from(&retry).insert_cached(&db).await?,
+            },
+            &db,
+        )
+        .await?;
+        let (caller, first) = (Uuid::new_v4(), Uuid::new_v4());
+        sqlx::query(
+            "INSERT INTO v2_job (id, workspace_id, kind, runnable_path) VALUES ($1, $2, 'script', $3)",
+        )
+        .bind(caller)
+        .bind(WS)
+        .bind(SCRIPT)
+        .execute(&db)
+        .await?;
+        sqlx::query(
+            "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, running) VALUES ($1, $2, now(), true)",
+        )
+        .bind(caller)
+        .bind(WS)
+        .execute(&db)
+        .await?;
+        seed_job(&db, first, Some(caller), false, "failure").await;
+        let attempt = mini(first, Some(caller), handle);
+        assert!(maybe_enqueue_native_script_retry(&db, &attempt, &None, &no_result).await?);
+        let (retry_id, ..) = retry_by_attempt(&db, first, 1)
+            .await
+            .expect("retry is queued");
+
+        let tx = db.begin().await?;
+        let (tx, _) =
+            windmill_queue::jobs::cancel_job("test-user", None, caller, WS, tx, &db, false, false)
+                .await?;
+        tx.commit().await?;
+
+        let canceled_by: Option<String> =
+            sqlx::query_scalar("SELECT canceled_by FROM v2_job_queue WHERE id = $1")
+                .bind(retry_id)
+                .fetch_one(&db)
+                .await?;
+        assert_eq!(canceled_by.as_deref(), Some("test-user"));
+
+        // The worker that pulls the canceled retry completes it without a `canceled_by`.
+        let (_, _, _, _, retry_handle) = retry_by_attempt(&db, first, 1).await.unwrap();
+        let canceled_retry = mini(retry_id, Some(first), retry_handle);
+        assert!(
+            !maybe_enqueue_native_script_retry(&db, &canceled_retry, &None, &no_result).await?,
+            "a canceled retry does not enqueue the next attempt"
+        );
+        Ok(())
+    }
 }
diff --git a/backend/windmill-queue/tests/schedule_push.rs b/backend/windmill-queue/tests/schedule_push.rs
index c68c59bb16..ed50215473 100644
--- a/backend/windmill-queue/tests/schedule_push.rs
+++ b/backend/windmill-queue/tests/schedule_push.rs
@@ -93,6 +93,7 @@ mod schedule_push {
             cache_ignore_s3_path: None,
             runnable_settings_handle: None,
             build_binary_only: false,
+            job_token_scopes: None,
         }
     }
 
diff --git a/backend/windmill-runtime-nativets/Cargo.toml b/backend/windmill-runtime-nativets/Cargo.toml
index d0b4e97f19..22da97ab1d 100644
--- a/backend/windmill-runtime-nativets/Cargo.toml
+++ b/backend/windmill-runtime-nativets/Cargo.toml
@@ -22,16 +22,15 @@ deno_webidl.workspace = true
 deno_web.workspace = true
 deno_crypto.workspace = true
 deno_net.workspace = true
-deno_console.workspace = true
-deno_url.workspace = true
 deno_core.workspace = true
 deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
-deno_io.workspace = true
-deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
+sys_traits.workspace = true
+# Not used directly: depending on it is what makes the workspace pin bind.
+v8.workspace = true
 winapi.workspace = true
 
 itertools.workspace = true
@@ -58,14 +57,8 @@ deno_webidl.workspace = true
 deno_web.workspace = true
 deno_crypto.workspace = true
 deno_net.workspace = true
-deno_console.workspace = true
-deno_url.workspace = true
 deno_core.workspace = true
 deno_ast.workspace = true
-deno_tls.workspace = true
-deno_permissions.workspace = true
-deno_io.workspace = true
-deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
 winapi.workspace = true
diff --git a/backend/windmill-runtime-nativets/build.rs b/backend/windmill-runtime-nativets/build.rs
index 29a6dbf81b..fab6cbb1ed 100644
--- a/backend/windmill-runtime-nativets/build.rs
+++ b/backend/windmill-runtime-nativets/build.rs
@@ -1,107 +1,11 @@
 use deno_ast::{MediaType, ParseParams};
-use deno_core::{ModuleCodeString, ModuleName, SourceMapData};
+use deno_core::{Extension, ModuleCodeString, ModuleName, SourceMapData};
 use deno_error::JsErrorBox;
-use deno_fetch::FetchPermissions;
-use deno_net::NetPermissions;
-use deno_web::{BlobStore, TimersPermission};
-use std::borrow::Cow;
+use std::collections::HashSet;
 use std::env;
+use std::fmt::Write as _;
 use std::io::Write;
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-pub struct PermissionsContainer;
-
-impl FetchPermissions for PermissionsContainer {
-    #[inline(always)]
-    fn check_net_url(
-        &mut self,
-        _url: &deno_core::url::Url,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    #[inline(always)]
-    fn check_read<'a>(
-        &mut self,
-        _path: Cow<'a, Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        unreachable!("snapshotting")
-    }
-
-    #[inline(always)]
-    fn check_write<'a>(
-        &mut self,
-        _path: Cow<'a, Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        unreachable!("snapshotting")
-    }
-
-    #[inline(always)]
-    fn check_net_vsock(
-        &mut self,
-        _cid: u32,
-        _port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-}
-
-impl TimersPermission for PermissionsContainer {
-    #[inline(always)]
-    fn allow_hrtime(&mut self) -> bool {
-        true
-    }
-}
-
-impl NetPermissions for PermissionsContainer {
-    fn check_read(
-        &mut self,
-        _p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_write(
-        &mut self,
-        _p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_net<T: AsRef<str>>(
-        &mut self,
-        _host: &(T, Option<u16>),
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_write_path<'a>(
-        &mut self,
-        _p: Cow<'a, Path>,
-        _api_name: &str,
-    ) -> Result<Cow<'a, Path>, deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_vsock(
-        &mut self,
-        _cid: u32,
-        _port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-}
 
 deno_core::extension!(
     fetch,
@@ -109,38 +13,29 @@ deno_core::extension!(
     esm = ["src/runtime.js"],
 );
 
-// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`.
+// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`,
+// also applied to the residual lazy sources below.
 //
-// Specialized to our snapshot's inputs. Of the eight deno_* extensions
-// we register via `init()`, seven ship pre-built `.js` files
-// in their `esm` lists (webidl/url/console/web/crypto/fetch/net) — only
-// `deno_telemetry`'s `extension!` macro lists `.ts` files
-// (`telemetry.ts`, `util.ts`), so the TypeScript branch is needed
-// solely for that crate. Our local `fetch` extension contributes
-// `src/runtime.js` (pure JS). No `node:` imports happen at snapshot
-// build time, no `.mjs`, no user-supplied modules. So:
+// Specialized to our inputs: the deno_* extensions ship `.js`, except
+// `deno_telemetry` whose lazy scripts are `.ts`. Our local `fetch` extension
+// contributes `src/runtime.js`. No `node:` imports, no `.mjs`, no
+// user-supplied modules. So:
 //   - `.js` → pass through.
 //   - `.ts` → transpile via deno_ast (deno_telemetry only).
 //   - anything else → build bug (deno shipping an unexpected file type
 //     or us mislabelling one), panic loudly rather than emit a broken
 //     snapshot.
 //
-// No source maps: the snapshot is a binary blob the runtime loads — source
-// maps would never be consumed.
+// No source maps: nothing consumes them.
 //
-// The signature still returns `Result<_, JsErrorBox>` because that's what
-// `extension_transpiler` expects, but we never construct one — parse and
-// transpile failures are build-time bugs in deno's own .ts internals (or
-// in our runtime.js, if we ever change its extension), so they panic.
+// The signature returns `Result<_, JsErrorBox>` because that's what
+// `extension_transpiler` expects, but we never construct one: parse and
+// transpile failures are build-time bugs, so they panic.
 //
-// This replaces a call to `deno_runtime::transpile::maybe_transpile_source`
-// from `deno_runtime 0.198.0`. The original is more general (handles
-// `node:` modules, `.mjs`, emits source maps in debug builds, plumbs
-// errors via `JsErrorBox`); none of that surface is reachable in our
-// build. Dropping the `deno_runtime` dep eliminates a
-// `deno_cache → rusqlite → libsqlite3-sys 0.35` transitive chain that
-// collides with sqlx-sqlite's `libsqlite3-sys 0.30` (cargo's
-// `links = "sqlite3"` rule).
+// `deno_runtime::transpile::maybe_transpile_source` is the general version;
+// depending on `deno_runtime` would pull a
+// `deno_cache → rusqlite → libsqlite3-sys` chain that collides with
+// sqlx-sqlite's `libsqlite3-sys` (cargo's `links = "sqlite3"` rule).
 fn maybe_transpile_source(
     name: ModuleName,
     source: ModuleCodeString,
@@ -154,7 +49,7 @@ fn maybe_transpile_source(
 
     let parsed = deno_ast::parse_module(ParseParams {
         specifier: deno_core::url::Url::parse(&name).unwrap(),
-        text: source.into(),
+        text: source.as_str().into(),
         media_type,
         capture_tokens: false,
         scope_analysis: false,
@@ -169,7 +64,13 @@ fn maybe_transpile_source(
                 ..Default::default()
             },
             &deno_ast::TranspileModuleOptions::default(),
-            &deno_ast::EmitOptions::default(),
+            // The default appends an inline source map comment, which is a
+            // syntax error where deno_core evaluates a lazy script as an
+            // expression.
+            &deno_ast::EmitOptions {
+                source_map: deno_ast::SourceMapOption::None,
+                ..Default::default()
+            },
         )
         .unwrap_or_else(|e| panic!("snapshot transpile: emit failed for {name}: {e}"))
         .into_source();
@@ -177,27 +78,66 @@ fn maybe_transpile_source(
     Ok((transpiled.text.into(), None))
 }
 
+/// One `(specifier, source)` table of the extension scripts the snapshot did
+/// not evaluate. The snapshot only carries scripts that ran while it was built,
+/// so a script first loaded in a live isolate has to come from here.
+///
+/// deno_core binary-searches the table and reads each source as ASCII without
+/// checking, so it must be sorted by specifier, free of duplicates, and ASCII.
+fn residual_table(
+    name: &str,
+    files: impl Iterator<Item = deno_core::ExtensionFileSource>,
+    consumed: &HashSet<String>,
+) -> String {
+    let mut files: Vec<_> = files.filter(|f| !consumed.contains(f.specifier)).collect();
+    files.sort_by_key(|f| f.specifier);
+    files.dedup_by_key(|f| f.specifier);
+
+    let mut out = format!("pub static {name}: &[(&str, &str)] = &[\n");
+    for file in files {
+        let source = file
+            .load()
+            .unwrap_or_else(|e| panic!("could not load {}: {e}", file.specifier));
+        let (code, _) =
+            maybe_transpile_source(ModuleName::from_static(file.specifier), source).unwrap();
+        assert!(
+            code.as_str().is_ascii(),
+            "{} is not ASCII after transpiling",
+            file.specifier
+        );
+        writeln!(out, "    ({:?}, {:?}),", file.specifier, code.as_str()).unwrap();
+    }
+    out.push_str("];\n");
+    out
+}
+
 fn main() {
     println!("cargo:rustc-env=TARGET={}", env::var("TARGET").unwrap());
     println!("cargo:rustc-env=PROFILE={}", env::var("PROFILE").unwrap());
 
-    let exts = vec![
-        deno_telemetry::deno_telemetry::init(),
-        deno_webidl::deno_webidl::init(),
-        deno_url::deno_url::init(),
-        deno_console::deno_console::init(),
-        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
-        deno_crypto::deno_crypto::init(None),
-        deno_fetch::deno_fetch::init::<PermissionsContainer>(Default::default()),
-        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+    // Same list and order as `create_nativets_runtime`, which supplies their
+    // state through `lazy_init_extensions`.
+    let exts: Vec<Extension> = vec![
+        deno_telemetry::deno_telemetry::lazy_init(),
+        deno_webidl::deno_webidl::lazy_init(),
+        deno_web::deno_web::lazy_init(),
+        deno_crypto::deno_crypto::lazy_init(),
+        deno_fetch::deno_fetch::lazy_init(),
+        deno_net::deno_net::lazy_init(),
         fetch::init(),
     ];
 
-    // Build the file path to the snapshot.
+    let lazy_js: Vec<_> = exts
+        .iter()
+        .flat_map(|e| e.lazy_loaded_js_files.iter().cloned())
+        .collect();
+    let lazy_esm: Vec<_> = exts
+        .iter()
+        .flat_map(|e| e.lazy_loaded_esm_files.iter().cloned())
+        .collect();
+
     let o = PathBuf::from(env::var_os("OUT_DIR").unwrap());
-    let snapshot_path = o.join("FETCH_SNAPSHOT.bin");
 
-    // Create the snapshot.
     let output = deno_core::snapshot::create_snapshot(
         deno_core::snapshot::CreateSnapshotOptions {
             cargo_manifest_dir: env!("CARGO_MANIFEST_DIR"),
@@ -213,9 +153,17 @@ fn main() {
     )
     .unwrap();
 
-    let mut file = std::fs::File::create(snapshot_path).unwrap();
+    let mut file = std::fs::File::create(o.join("FETCH_SNAPSHOT.bin")).unwrap();
     file.write_all(&output.output).unwrap();
 
+    let consumed: HashSet<String> = output.consumed_lazy_specifiers.into_iter().collect();
+    let residual = format!(
+        "{}{}",
+        residual_table("RESIDUAL_LAZY_JS", lazy_js.into_iter(), &consumed),
+        residual_table("RESIDUAL_LAZY_ESM", lazy_esm.into_iter(), &consumed),
+    );
+    std::fs::write(o.join("residual_lazy_sources.rs"), residual).unwrap();
+
     for path in output.files_loaded_during_snapshot {
         println!("cargo:rerun-if-changed={}", path.display());
     }
diff --git a/backend/windmill-runtime-nativets/src/lib.rs b/backend/windmill-runtime-nativets/src/lib.rs
index 1c2a76cda5..750cdaa609 100644
--- a/backend/windmill-runtime-nativets/src/lib.rs
+++ b/backend/windmill-runtime-nativets/src/lib.rs
@@ -22,9 +22,7 @@ mod smoke_tests;
 mod cert_tests;
 
 use std::{
-    borrow::Cow,
     cell::RefCell,
-    path::PathBuf,
     rc::Rc,
     sync::{Arc, LazyLock, Mutex},
 };
@@ -32,17 +30,55 @@ use std::{
 // Re-export deno_telemetry for use by windmill-worker's otel proxy
 pub use deno_telemetry;
 
+/// The real environment and filesystem, except that the OTLP protocol always
+/// reads as HTTP.
+///
+/// The caller points `OTEL_EXPORTER_OTLP_ENDPOINT` at its own HTTP collector
+/// only while [`init_telemetry`] runs, and the instance's own exporter shares
+/// `OTEL_EXPORTER_OTLP_PROTOCOL`. Honouring `grpc` there would build an exporter
+/// that reads the endpoint again on every export, and `console` one that never
+/// reads it, so either would send job telemetry past that collector.
+struct HttpOtlpSys;
+
+impl sys_traits::BaseEnvVar for HttpOtlpSys {
+    fn base_env_var_os(&self, key: &std::ffi::OsStr) -> Option<std::ffi::OsString> {
+        if key == "OTEL_EXPORTER_OTLP_PROTOCOL" {
+            return Some("http/protobuf".into());
+        }
+        sys_traits::impls::RealSys.base_env_var_os(key)
+    }
+}
+
+impl sys_traits::BaseFsRead for HttpOtlpSys {
+    fn base_fs_read(
+        &self,
+        path: &std::path::Path,
+    ) -> std::io::Result<std::borrow::Cow<'static, [u8]>> {
+        sys_traits::impls::RealSys.base_fs_read(path)
+    }
+}
+
+/// `deno_telemetry::init` for the isolates of this process.
+pub fn init_telemetry(
+    rt_config: deno_telemetry::OtelRuntimeConfig,
+    config: deno_telemetry::OtelConfig,
+) -> anyhow::Result<()> {
+    deno_telemetry::init(&HttpOtlpSys, rt_config, config)
+}
+
 use deno_ast::ParseParams;
 use deno_core::{
+    error::CoreErrorKind,
     op2, serde_v8, url,
     v8::{self, IsolateHandle},
     Extension, JsRuntime, OpState, PollEventLoopOptions, RuntimeOptions,
 };
 use deno_error::JsErrorBox;
-use deno_fetch::FetchPermissions;
-use deno_net::NetPermissions;
+use deno_permissions::{
+    Permissions, PermissionsContainer, PermissionsOptions, RuntimePermissionDescriptorParser,
+};
 use deno_tls::{rustls::pki_types::CertificateDer, rustls::RootCertStore, RootCertStoreProvider};
-use deno_web::{BlobStore, TimersPermission};
+use deno_web::{BlobStore, InMemoryBroadcastChannel};
 use itertools::Itertools;
 use lazy_static::lazy_static;
 use regex::Regex;
@@ -57,156 +93,55 @@ use windmill_common::worker::{write_file, Connection, WINDMILL_DIR};
 
 // ── Snapshot-matched extensions ──────────────────────────────────────
 //
-// `deno_core` 0.352 validates that the snapshot's extension list is a
-// *prefix* of the runtime's extension list (snapshot does not need an
-// exact match — runtime is allowed to add extensions at the tail, but
-// must not reorder or omit any that the snapshot baked in).
+// The snapshot (build.rs) is built from the deno_* extensions in their
+// `lazy_init()` form followed by this local `fetch` ext. deno_core requires the
+// runtime's extension list to start with that same list in that same order; it
+// may append more, which is how the windmill `ext` carrying our own ops gets in.
 //
-// Our snapshot (in build.rs) is the same eight deno_* extensions ending
-// with this local `fetch` ext. The runtime adds one extra entry at the
-// end — the windmill `ext` carrying our own ops — which is fine because
-// it's after the snapshot prefix.
-//
-// This local `fetch` extension declaration must be present in both
-// build.rs and lib.rs so the type passes through the `init()` macro.
-// The ESM is already in the snapshot, so this `init()` call at runtime
-// is a no-op for esm — the registration just records the ext.
+// This declaration must exist in both build.rs and lib.rs. The ESM is already
+// in the snapshot, so `init()` at runtime only records the extension.
 deno_core::extension!(
     fetch,
     esm_entry_point = "ext:fetch/src/runtime.js",
     esm = ["src/runtime.js"],
 );
 
-// ── Permission container ─────────────────────────────────────────────
+include!(concat!(env!("OUT_DIR"), "/residual_lazy_sources.rs"));
 
-/// `no_network` is what `//no_network` promises: no outbound traffic of any kind,
-/// the Windmill API included (the client module reaches it through `fetch`).
-/// Enforced here and by disabling the deno_net ops, never in JS: user code can
-/// call `Deno.core.ops.*` directly and skip any JS-level guard.
-pub struct PermissionsContainer {
-    pub no_network: bool,
-}
-
-const NO_NETWORK_ANNOTATION: &str = "no_network";
+// ── Permissions ──────────────────────────────────────────────────────
 
 /// Every op deno_net registers, see `create_nativets_runtime`. Read from the
 /// extension itself so an upgrade that adds an op cannot leave it enabled.
 static NO_NETWORK_DISABLED_OPS: LazyLock<std::collections::HashSet<&'static str>> =
     LazyLock::new(|| {
-        deno_net::deno_net::init::<PermissionsContainer>(None, None)
+        deno_net::deno_net::lazy_init()
             .ops
             .iter()
             .map(|op| op.name)
             .collect()
     });
 
-impl PermissionsContainer {
-    fn deny_net(&self, target: &str) -> Result<(), deno_permissions::PermissionCheckError> {
-        if self.no_network {
-            Err(deno_permissions::PermissionDeniedError::Fatal {
-                access: format!(
-                    "net access to {target} (the script is annotated //{NO_NETWORK_ANNOTATION})"
-                ),
-            }
-            .into())
-        } else {
-            Ok(())
-        }
-    }
-}
-
-impl FetchPermissions for PermissionsContainer {
-    #[inline(always)]
-    fn check_net_url(
-        &mut self,
-        url: &deno_core::url::Url,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("\"{}\"", url.host_str().unwrap_or_default()))
-    }
-
-    #[inline(always)]
-    fn check_read<'a>(
-        &mut self,
-        path: Cow<'a, std::path::Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        Ok(deno_fs::CheckedPath::Unresolved(path))
-    }
-
-    #[inline(always)]
-    fn check_write<'a>(
-        &mut self,
-        path: Cow<'a, std::path::Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        Ok(deno_fs::CheckedPath::Unresolved(path))
-    }
-
-    #[inline(always)]
-    fn check_net_vsock(
-        &mut self,
-        cid: u32,
-        port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("vsock {cid}:{port}"))
-    }
-}
-
-impl TimersPermission for PermissionsContainer {
-    #[inline(always)]
-    fn allow_hrtime(&mut self) -> bool {
-        true
-    }
-}
-
-impl NetPermissions for PermissionsContainer {
-    fn check_read(
-        &mut self,
-        p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("unix socket \"{p}\""))?;
-        Ok(PathBuf::from(p))
-    }
-
-    fn check_write(
-        &mut self,
-        p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("unix socket \"{p}\""))?;
-        Ok(PathBuf::from(p))
-    }
-
-    fn check_net<T: AsRef<str>>(
-        &mut self,
-        host: &(T, Option<u16>),
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("\"{}\"", host.0.as_ref()))
-    }
-
-    fn check_write_path<'a>(
-        &mut self,
-        p: Cow<'a, std::path::Path>,
-        _api_name: &str,
-    ) -> Result<Cow<'a, std::path::Path>, deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("unix socket \"{}\"", p.display()))?;
-        Ok(p)
-    }
-
-    fn check_vsock(
-        &mut self,
-        cid: u32,
-        port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("vsock {cid}:{port}"))
-    }
+/// What an isolate may do: reach the network, unless `no_network`, and nothing
+/// else (no filesystem, environment, subprocess or FFI). Nothing prompts.
+///
+/// `no_network` is what `//no_network` promises: no outbound traffic of any
+/// kind, the Windmill API included (the client module reaches it through
+/// `fetch`). Enforced here and by disabling the deno_net ops, never in JS: user
+/// code can call `Deno.core.ops.*` directly and skip any JS-level guard.
+fn isolate_permissions(no_network: bool) -> anyhow::Result<PermissionsContainer> {
+    let parser = Arc::new(RuntimePermissionDescriptorParser::new(
+        sys_traits::impls::RealSys,
+    ));
+    // An empty list means "all hosts", for a grant and for a denial alike.
+    let options = PermissionsOptions {
+        allow_net: (!no_network).then(Vec::new),
+        deny_net: no_network.then(Vec::new),
+        prompt: false,
+        ..Default::default()
+    };
+    let permissions = Permissions::from_options(parser.as_ref(), &options)
+        .map_err(|e| anyhow::anyhow!("invalid isolate permissions: {e}"))?;
+    Ok(PermissionsContainer::new(parser, permissions))
 }
 
 // ── Types ────────────────────────────────────────────────────────────
@@ -228,7 +163,7 @@ pub struct NativeAnnotation {
     /// script; `None` leaves the default in force.
     pub fetch_response_timeout_secs: Option<u64>,
     /// `//no_network`: the isolate may open no connection at all, see
-    /// [`PermissionsContainer`].
+    /// [`isolate_permissions`].
     pub no_network: bool,
 }
 
@@ -413,13 +348,10 @@ pub fn setup_deno_runtime() -> anyhow::Result<()> {
         // deno_fetch requires a TLS provider; install ring as default (idempotent).
         let _ = rustls::crypto::ring::default_provider().install_default();
 
-        let unrecognized_v8_flags = deno_core::v8_set_flags(vec![
-            "--stack-size=1024".to_string(),
-            "--no-harmony-import-assertions".to_string(),
-        ])
-        .into_iter()
-        .skip(1)
-        .collect::<Vec<_>>();
+        let unrecognized_v8_flags = deno_core::v8_set_flags(vec!["--stack-size=1024".to_string()])
+            .into_iter()
+            .skip(1)
+            .collect::<Vec<_>>();
 
         if !unrecognized_v8_flags.is_empty() {
             init_err = Some(format!(
@@ -435,7 +367,7 @@ pub fn setup_deno_runtime() -> anyhow::Result<()> {
         // SIGSEGV in WasmCodePointerTable::AllocateUninitializedEntry() on x86_64 Linux.
         // See: https://github.com/denoland/deno_core/issues/952
         let platform = deno_core::v8::new_unprotected_default_platform(0, false).make_shared();
-        deno_core::JsRuntime::init_platform(Some(platform), false);
+        deno_core::JsRuntime::init_platform(Some(platform));
     });
 
     if let Some(msg) = init_err {
@@ -666,17 +598,15 @@ pub(crate) fn create_nativets_runtime(
         ..Default::default()
     };
 
+    // Same list and order as the snapshot (build.rs); their state follows in
+    // `lazy_init_extensions` below, which must match it too.
     let exts: Vec<Extension> = vec![
-        deno_telemetry::deno_telemetry::init(),
-        deno_webidl::deno_webidl::init(),
-        deno_url::deno_url::init(),
-        deno_console::deno_console::init(),
-        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
-        // Registered after deno_web to keep the snapshot (build.rs) a prefix of
-        // the runtime extension list; deno_crypto declares deps = [deno_webidl, deno_web].
-        deno_crypto::deno_crypto::init(None),
-        deno_fetch::deno_fetch::init::<PermissionsContainer>(fetch_options),
-        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+        deno_telemetry::deno_telemetry::lazy_init(),
+        deno_webidl::deno_webidl::lazy_init(),
+        deno_web::deno_web::lazy_init(),
+        deno_crypto::deno_crypto::lazy_init(),
+        deno_fetch::deno_fetch::lazy_init(),
+        deno_net::deno_net::lazy_init(),
         fetch::init(),
         ext,
     ];
@@ -688,6 +618,8 @@ pub(crate) fn create_nativets_runtime(
             deno_core::v8::CreateParams::default().heap_limits(0, 1024 * 1024 * 128),
         ),
         startup_snapshot: Some(RUNTIME_SNAPSHOT),
+        residual_lazy_js_sources: RESIDUAL_LAZY_JS,
+        residual_lazy_esm_sources: RESIDUAL_LAZY_ESM,
         module_loader: Some(Rc::new(deno_core::FsModuleLoader)),
         extension_transpiler: None,
         ..Default::default()
@@ -714,12 +646,28 @@ pub(crate) fn create_nativets_runtime(
         y * 2
     });
 
+    js_runtime
+        .lazy_init_extensions(vec![
+            deno_telemetry::deno_telemetry::args(),
+            deno_webidl::deno_webidl::args(),
+            deno_web::deno_web::args(
+                Arc::new(BlobStore::default()),
+                None,
+                false,
+                InMemoryBroadcastChannel::default(),
+            ),
+            deno_crypto::deno_crypto::args(None),
+            deno_fetch::deno_fetch::args(fetch_options),
+            deno_net::deno_net::args(None, None),
+        ])
+        .map_err(windmill_common::error::to_anyhow)?;
+
     let (log_sender, log_receiver) = mpsc::unbounded_channel::<String>();
 
     {
         let op_state = js_runtime.op_state();
         let mut op_state = op_state.borrow_mut();
-        op_state.put(PermissionsContainer { no_network });
+        op_state.put(isolate_permissions(no_network)?);
         op_state.put(MainArgs { args: initial_args });
         op_state.put(LogString { s: log_sender });
     }
@@ -731,7 +679,7 @@ pub(crate) fn create_nativets_runtime(
         .execute_script(
             "<wm_init>",
             format!(
-                "globalThis.__wmInitPerIsolate({{ fetchResponseTimeoutMs: {fetch_response_timeout_ms} }})"
+                "globalThis.__wmInitPerIsolate({{ fetchResponseTimeoutMs: {fetch_response_timeout_ms}, noNetwork: {no_network} }})"
             ),
         )
         .map_err(windmill_common::error::to_anyhow)?;
@@ -777,7 +725,7 @@ pub(crate) fn extract_global_string(
     js_runtime: &mut JsRuntime,
     global: v8::Global<v8::Value>,
 ) -> Result<Box<RawValue>, String> {
-    let scope = &mut js_runtime.handle_scope();
+    deno_core::scope!(scope, js_runtime);
     let local = v8::Local::new(scope, global);
     match serde_v8::from_v8::<Option<String>>(scope, local) {
         Ok(s) => Ok(unsafe_raw(s.unwrap_or_else(|| "null".to_string()))),
@@ -929,8 +877,8 @@ pub async fn eval_fetch_timeout(
                     for line in logged.as_deref().unwrap_or(&log).lines() {
                         tracing::info!(
                             target: "windmill:job_log",
-                            job_id = ?job_id,
-                            workspace_id = ?w_id_for_tracing,
+                            job_id = %job_id,
+                            workspace_id = %w_id_for_tracing,
                             "{line}"
                         );
                         if *OTEL_JOB_LOGS {
@@ -1169,7 +1117,10 @@ import("file:///eval.ts").then((module) => module.{main_fn}(...args))
         Ok(global) => {
             extract_global_string(js_runtime, global).map_err(|e| ExecuteError::Script(e))
         }
-        Err(deno_core::error::CoreError::Js(e)) => {
+        Err(e) if matches!(e.as_kind(), CoreErrorKind::Js(_)) => {
+            let CoreErrorKind::Js(e) = e.into_kind() else {
+                unreachable!("matched as a JS error above")
+            };
             let source = e.frames.first().and_then(|f| {
                 f.file_name
                     .as_ref()
diff --git a/backend/windmill-runtime-nativets/src/runtime.js b/backend/windmill-runtime-nativets/src/runtime.js
index 88e10f765a..86d20dd022 100644
--- a/backend/windmill-runtime-nativets/src/runtime.js
+++ b/backend/windmill-runtime-nativets/src/runtime.js
@@ -1,39 +1,42 @@
-import * as abortSignal from "ext:deno_web/03_abort_signal.js";
-import * as domException from "ext:deno_web/01_dom_exception.js";
-import * as base64 from "ext:deno_web/05_base64.js";
-import * as console from "ext:deno_console/01_console.js";
-import * as encoding from "ext:deno_web/08_text_encoding.js";
-import * as event from "ext:deno_web/02_event.js";
-import * as fetch from "ext:deno_fetch/26_fetch.js";
-import * as file from "ext:deno_web/09_file.js";
-import * as fileReader from "ext:deno_web/10_filereader.js";
-import * as formData from "ext:deno_fetch/21_formdata.js";
-import * as headers from "ext:deno_fetch/20_headers.js";
-import * as streams from "ext:deno_web/06_streams.js";
-import * as timers from "ext:deno_web/02_timers.js";
-import * as url from "ext:deno_url/00_url.js";
-import * as net from "ext:deno_net/01_net.js";
-import * as tls from "ext:deno_net/02_tls.js";
-import * as urlPattern from "ext:deno_url/01_urlpattern.js";
-import * as webidl from "ext:deno_webidl/00_webidl.js";
-import * as crypto from "ext:deno_crypto/00_crypto.js";
-import * as response from "ext:deno_fetch/23_response.js";
-import * as request from "ext:deno_fetch/23_request.js";
-import "ext:deno_web/02_structured_clone.js";
-import * as globalInterfaces from "ext:deno_web/04_global_interfaces.js";
-// Namespace imports (not side-effect-only) so their constructors are reachable
-// for the globalThis wiring below. The module bodies still execute on
-// evaluation, so their side effects apply.
-import * as messagePort from "ext:deno_web/13_message_port.js";
-import * as compression from "ext:deno_web/14_compression.js";
-import * as performance from "ext:deno_web/15_performance.js";
-import "ext:deno_web/16_image_data.js";
-import "ext:deno_fetch/27_eventsource.js";
+import { core, internals } from "ext:core/mod.js";
+
+// deno_crypto brands CryptoKeys with this symbol and reads it from `internals`
+// when it evaluates; in Deno a deno_node module sets it, which is not loaded here.
+internals.kKeyObject ??= Symbol("kKeyObject");
+
+// Every script loaded here runs at snapshot-build time and is baked into the
+// snapshot. One that is first loaded at run time comes from the residual table
+// build.rs emits instead.
+const abortSignal = core.loadExtScript("ext:deno_web/03_abort_signal.js");
+const domException = core.loadExtScript("ext:deno_web/01_dom_exception.js");
+const base64 = core.loadExtScript("ext:deno_web/05_base64.js");
+const console = core.loadExtScript("ext:deno_web/01_console.js");
+const encoding = core.loadExtScript("ext:deno_web/08_text_encoding.js");
+const event = core.loadExtScript("ext:deno_web/02_event.js");
+const fetch = core.loadExtScript("ext:deno_fetch/26_fetch.js");
+const file = core.loadExtScript("ext:deno_web/09_file.js");
+const fileReader = core.loadExtScript("ext:deno_web/10_filereader.js");
+const formData = core.loadExtScript("ext:deno_fetch/21_formdata.js");
+const headers = core.loadExtScript("ext:deno_fetch/20_headers.js");
+const streams = core.loadExtScript("ext:deno_web/06_streams.js");
+const timers = core.loadExtScript("ext:deno_web/02_timers.js");
+const url = core.loadExtScript("ext:deno_web/00_url.js");
+const urlPattern = core.loadExtScript("ext:deno_web/01_urlpattern.js");
+const webidl = core.loadExtScript("ext:deno_webidl/00_webidl.js");
+const crypto = core.loadExtScript("ext:deno_crypto/00_crypto.js");
+const response = core.loadExtScript("ext:deno_fetch/23_response.js");
+const request = core.loadExtScript("ext:deno_fetch/23_request.js");
+const globalInterfaces = core.loadExtScript(
+  "ext:deno_web/04_global_interfaces.js",
+);
+const messagePort = core.loadExtScript("ext:deno_web/13_message_port.js");
+const compression = core.loadExtScript("ext:deno_web/14_compression.js");
+const performance = core.loadExtScript("ext:deno_web/15_performance.js");
 
 // deno_fetch applies no deadline, so a peer that accepts a request and then
 // never answers leaves `await fetch(...)` pending until the job timeout, which
 // self-hosted defaults to 7 days.
-const ORIGINAL_FETCH = fetch.fetch;
+const DENO_FETCH = fetch.fetch;
 
 // deno_web's timers reject any `this` other than undefined/globalThis, so
 // `timers.setTimeout(...)` passes the module namespace and throws "Illegal
@@ -50,6 +53,14 @@ const abortControllerAbort = Function.prototype.call.bind(
 );
 const ReflectApply = Reflect.apply;
 
+// Forwards the original argument count, like every caller below relies on. The
+// extra promise hop under `no_network` costs the same-tick settling of an
+// aborted fetch, which only matters where a request could have been made.
+function ORIGINAL_FETCH() {
+  const p = ReflectApply(DENO_FETCH, undefined, arguments);
+  return noNetwork ? promiseThen(p, undefined, rewordNoNetworkDenial) : p;
+}
+
 // Installed per isolate by __wmInitPerIsolate; 0 disables. Only a backstop
 // for the impossible case of fetch running before that init.
 let fetchResponseTimeoutMs = 900_000;
@@ -74,6 +85,21 @@ function fetchResponseTimeoutError(requestUrl, timeoutMs) {
   );
 }
 
+// Set per isolate for a `//no_network` script. The denial itself is the
+// isolate's permissions (Rust); this only replaces deno's "run again with the
+// --allow-net flag" hint, which names a flag a script author cannot pass.
+let noNetwork = false;
+
+function rewordNoNetworkDenial(e) {
+  if (e?.name === "NotCapable" && typeof e.message === "string") {
+    e.message = e.message.replace(
+      ", run again with the --allow-net flag",
+      ": the script is annotated //no_network",
+    );
+  }
+  throw e;
+}
+
 globalThis.atob = base64.atob;
 globalThis.btoa = base64.btoa;
 // Not `async`, for the same reason deno_fetch's own outer fetch isn't: WPT
@@ -152,7 +178,22 @@ globalThis.console = new console.Console((msg, level) =>
 );
 globalThis.AbortController = abortSignal.AbortController;
 globalThis.AbortSignal = abortSignal.AbortSignal;
-globalThis.crypto = crypto.crypto;
+// A getter, not a value: `crypto.crypto` mints a cppgc object, and the cppgc
+// heap is not attached while this module runs at snapshot-build time.
+Object.defineProperty(globalThis, "crypto", {
+  configurable: true,
+  enumerable: true,
+  get: () => crypto.crypto,
+  // Assignment has to keep working, as it does on a plain property.
+  set(value) {
+    Object.defineProperty(globalThis, "crypto", {
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value,
+    });
+  },
+});
 globalThis.Crypto = crypto.Crypto;
 globalThis.CryptoKey = crypto.CryptoKey;
 globalThis.SubtleCrypto = crypto.SubtleCrypto;
@@ -233,6 +274,7 @@ globalThis.__wmInitPerIsolate = (config) => {
   if (config != null && typeof config.fetchResponseTimeoutMs === "number") {
     fetchResponseTimeoutMs = config.fetchResponseTimeoutMs;
   }
+  noNetwork = config?.noNetwork === true;
 
   // setTimeOrigin() seeds performance.timeOrigin from the isolate's wall clock;
   // without it timeOrigin is undefined and `timeOrigin + performance.now()` is NaN.
@@ -256,13 +298,14 @@ globalThis.__wmInitPerIsolate = (config) => {
 };
 
 // Expose bootstrapOtel globally so it can be called from Rust after runtime creation.
-// We use dynamic import so deno_telemetry isn't loaded during snapshot creation.
+// Loaded on first call so deno_telemetry isn't evaluated during snapshot creation.
 // Config: [tracingEnabled, metricsEnabled, consoleConfig, deterministic]
 // consoleConfig: 0=ignore, 1=capture, 2=replace
 globalThis.__bootstrapOtel = () => {
-  import("ext:deno_telemetry/telemetry.ts").then(({ bootstrap, enterSpan }) => {
-    bootstrap([1, 0, 1, 0]);
-    // Expose enterSpan for setting parent trace context
-    globalThis.__enterSpan = enterSpan;
-  });
+  const { bootstrap, enterSpan } = core.loadExtScript(
+    "ext:deno_telemetry/telemetry.ts",
+  );
+  bootstrap([1, 0, 1, 0]);
+  // Expose enterSpan for setting parent trace context
+  globalThis.__enterSpan = enterSpan;
 };
diff --git a/backend/windmill-runtime-nativets/src/smoke_tests.rs b/backend/windmill-runtime-nativets/src/smoke_tests.rs
index f3da460227..1373a8abd4 100644
--- a/backend/windmill-runtime-nativets/src/smoke_tests.rs
+++ b/backend/windmill-runtime-nativets/src/smoke_tests.rs
@@ -451,6 +451,10 @@ export async function main(): Promise<{ uuid: string; nonzero: boolean; sha256:
         .map((b) => b.toString(16).padStart(2, "0"))
         .join("");
 
+    // `crypto` is installed as an accessor; polyfill-style assignment must
+    // still work rather than throw for want of a setter.
+    (globalThis as any).crypto = globalThis.crypto;
+
     return { uuid, nonzero, sha256 };
 }
 "#;
diff --git a/backend/windmill-runtime-nativets/tests/no_network.rs b/backend/windmill-runtime-nativets/tests/no_network.rs
index 876207fc26..dc7086f22e 100644
--- a/backend/windmill-runtime-nativets/tests/no_network.rs
+++ b/backend/windmill-runtime-nativets/tests/no_network.rs
@@ -55,6 +55,9 @@ async function attempt(f) {{
 export async function main() {{
   return {{
     fetch: await attempt(() => fetch("http://127.0.0.1:{port}/").then((r) => r.text())),
+    data_url: await attempt(() => fetch("data:text/plain,ok").then((r) => r.text())),
+    blob_url: await attempt(() => fetch(URL.createObjectURL(new Blob(["ok"]))).then((r) => r.text())),
+    raw_fetch: await attempt(() => Deno.core.ops.op_fetch("GET", "http://127.0.0.1:{port}/", [], null, false, null, null)),
     tcp: await attempt(() => Deno.core.ops.op_net_connect_tcp({{ hostname: "127.0.0.1", port: {port} }}, null, null)),
     unix: await attempt(() => Deno.core.ops.op_net_connect_unix("/var/run/docker.sock")),
     quic: await attempt(() => Deno.core.ops.op_quic_endpoint_create({{ hostname: "localhost", port: 0 }}, true)),
@@ -76,6 +79,15 @@ async fn no_network_denies_fetch_and_raw_socket_ops() {
         fetch.contains("no_network"),
         "fetch was not denied: {fetch}"
     );
+    // Neither opens a connection, so neither is network access.
+    assert_eq!(out["data_url"], "allowed", "{out}");
+    assert_eq!(out["blob_url"], "allowed", "{out}");
+    // The global `fetch` only words the refusal; the op under it is what refuses.
+    let raw_fetch = out["raw_fetch"].as_str().unwrap();
+    assert!(
+        raw_fetch.contains("Requires net access"),
+        "the fetch op was not denied: {raw_fetch}"
+    );
     for key in ["tcp", "unix", "quic"] {
         let msg = out[key].as_str().unwrap();
         assert!(
diff --git a/backend/windmill-runtime-nativets/tests/otel_e2e.rs b/backend/windmill-runtime-nativets/tests/otel_e2e.rs
index 22fd18de90..d1853c461d 100644
--- a/backend/windmill-runtime-nativets/tests/otel_e2e.rs
+++ b/backend/windmill-runtime-nativets/tests/otel_e2e.rs
@@ -71,7 +71,7 @@ async fn spawn_capturing_http(captured: Arc<Mutex<Vec<Vec<u8>>>>) -> u16 {
 /// drifts away from `tracing_enabled + Capture`, this test breaks
 /// before the customer-facing panic does.
 fn init_with_ee_otel_config() {
-    deno_telemetry::init(
+    windmill_runtime_nativets::init_telemetry(
         deno_telemetry::OtelRuntimeConfig {
             runtime_name: "windmill-nativets".into(),
             runtime_version: "0".into(),
@@ -157,13 +157,12 @@ export async function main(): Promise<number> {{
         "fetch target should have been hit exactly once"
     );
 
-    // 4. Force the BatchSpanProcessor to flush so the exporter posts
-    //    to our mock collector synchronously (default flush interval
-    //    is ~5s; tests can't wait that long).
-    deno_telemetry::flush();
-    // Exporter is async over the OTel runtime; give it a beat to
-    // actually send the HTTP request.
-    tokio::time::sleep(Duration::from_millis(500)).await;
+    // 4. The BatchSpanProcessor exports on its own schedule (about 5s by
+    //    default) and deno_telemetry exposes no flush, so wait for it.
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(20);
+    while otlp_hits.lock().await.is_empty() && tokio::time::Instant::now() < deadline {
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
 
     let otlp_captured = otlp_hits.lock().await;
     assert!(
diff --git a/backend/windmill-runtime-nativets/tests/otel_init.rs b/backend/windmill-runtime-nativets/tests/otel_init.rs
index fdf1ac944d..80ef8683aa 100644
--- a/backend/windmill-runtime-nativets/tests/otel_init.rs
+++ b/backend/windmill-runtime-nativets/tests/otel_init.rs
@@ -46,7 +46,7 @@ async fn ee_otel_init_config_populates_otel_globals() {
     // Step 1: reproduce the footgun. `OtelConfig::default()` has
     // tracing/metrics off and `console = Ignore`, which trips the
     // 0.31 early-return — Ok(()) but OnceCell stays empty.
-    deno_telemetry::init(
+    windmill_runtime_nativets::init_telemetry(
         deno_telemetry::OtelRuntimeConfig {
             runtime_name: "windmill-nativets-test".into(),
             runtime_version: "0".into(),
@@ -63,10 +63,17 @@ async fn ee_otel_init_config_populates_otel_globals() {
          tracing_enabled/console fields."
     );
 
+    // The instance's own exporter shares this variable and may be set to gRPC,
+    // or to anything else. Native telemetry must not read it: a value
+    // deno_telemetry rejects outright shows it is never consulted.
+    // SAFETY: the only test in this binary, so nothing reads the environment
+    // concurrently.
+    unsafe { std::env::set_var("OTEL_EXPORTER_OTLP_PROTOCOL", "not-a-protocol") };
+
     // Step 2: re-call init with the exact config shape that the EE
     // `load_internal_otel_exporter` ships — this is what production
     // hits, so the test exercises the actual prod call path.
-    deno_telemetry::init(
+    windmill_runtime_nativets::init_telemetry(
         deno_telemetry::OtelRuntimeConfig {
             runtime_name: "windmill-nativets".into(),
             runtime_version: "0".into(),
diff --git a/backend/windmill-store/src/variables.rs b/backend/windmill-store/src/variables.rs
index 8f288dc85e..151b75bd85 100644
--- a/backend/windmill-store/src/variables.rs
+++ b/backend/windmill-store/src/variables.rs
@@ -563,7 +563,8 @@ async fn check_path_conflict(db: &DB, w_id: &str, path: &str) -> Result<()> {
 ///
 /// The check is purely structural and never decrypts, so it cannot act as a
 /// decryption/padding oracle for a caller who can write but not read secrets.
-/// `encrypt` (AES-256-CBC) always yields standard base64 decoding to a non-zero
+/// `encrypt` (AES-256-GCM, or legacy AES-256-CBC; see `windmill_common::workspace_crypt`)
+/// always yields standard base64 decoding to a non-zero
 /// multiple of the 16-byte block size; anything else cannot be our ciphertext.
 /// Values stored by an external backend ($vault:/$aws_sm:/$azure_kv: markers)
 /// are not workspace ciphertext and are passed through untouched.
diff --git a/backend/windmill-test-utils/src/lib.rs b/backend/windmill-test-utils/src/lib.rs
index 773616a807..f05fff66f8 100644
--- a/backend/windmill-test-utils/src/lib.rs
+++ b/backend/windmill-test-utils/src/lib.rs
@@ -249,6 +249,7 @@ impl RunJob {
             None,
             None,
             None,
+            None,
         )
         .await
         .expect("push has to succeed");
@@ -296,6 +297,7 @@ impl RunJob {
             None,
             None,
             None,
+            None,
         )
         .await
         .expect("push has to succeed");
@@ -969,6 +971,7 @@ pub async fn run_deployed_relative_imports(
                 debouncing_settings:
                     windmill_common::runnable_settings::DebouncingSettings::default(),
                 labels: None,
+                job_token_scopes: None,
             })
             .push(&db2)
             .await;
diff --git a/backend/windmill-trigger-postgres/src/lib.rs b/backend/windmill-trigger-postgres/src/lib.rs
index 15918fca7b..94bc2b4a5e 100644
--- a/backend/windmill-trigger-postgres/src/lib.rs
+++ b/backend/windmill-trigger-postgres/src/lib.rs
@@ -355,6 +355,8 @@ pub async fn get_raw_postgres_connection(
         config.options(options);
     }
 
+    windmill_common::set_pg_keepalive(&mut config);
+
     let connector = build_tls_connector(ssl_mode, database.root_certificate_pem.as_ref())?;
     let client = if let Some(connector) = connector {
         let (client, connection) = config.connect(connector).await.map_err(to_anyhow)?;
diff --git a/backend/windmill-trigger-postgres/src/listener.rs b/backend/windmill-trigger-postgres/src/listener.rs
index 876b75661e..c99043ae9b 100644
--- a/backend/windmill-trigger-postgres/src/listener.rs
+++ b/backend/windmill-trigger-postgres/src/listener.rs
@@ -136,7 +136,7 @@ impl PostgresSimpleClient {
 /// Resolves the Postgres resource, validates that the configured publication and
 /// replication slot still exist, and opens a fresh logical replication stream.
 ///
-/// Returns `Error::BadConfig` when the publication or slot is missing, or the
+/// Returns `Error::BadConfig` when the publication or slot is missing or invalidated, or the
 /// data table is under roles (unrecoverable misconfigurations). Any other error is treated as transient
 /// (connection refused, network interruption, ...) and is retried by the caller.
 /// The resource is re-resolved on every call so credential rotations are picked
@@ -183,18 +183,33 @@ async fn connect_logical_replication_stream(
         ));
     }
 
+    // `invalidation_reason` (PG 17+) and `conflicting` (PG 16) are read through jsonb so the
+    // query still runs on versions that lack those columns.
     let replication_slot = client
         .execute_query(&format!(
-            "SELECT slot_name FROM pg_replication_slots WHERE slot_name = {}",
+            r#"SELECT COALESCE(
+                j->>'invalidation_reason',
+                CASE WHEN j->>'wal_status' = 'lost' THEN 'wal_removed'
+                     WHEN j->>'conflicting' = 'true' THEN 'conflict with recovery' END
+            ) FROM pg_replication_slots s, to_jsonb(s) j WHERE slot_name = {}"#,
             quote_literal(replication_slot_name)
         ))
         .await
         .map_err(to_anyhow)?;
 
-    if !replication_slot.row_exist() {
+    let Some(slot) = replication_slot.iter().find_map(|m| match m {
+        SimpleQueryMessage::Row(row) => Some(row),
+        _ => None,
+    }) else {
         return Err(Error::BadConfig(
             ERROR_REPLICATION_SLOT_NOT_EXISTS.to_string(),
         ));
+    };
+
+    if let Some(reason) = slot.get(0) {
+        return Err(Error::BadConfig(format!(
+            "The replication slot `{replication_slot_name}` associated with this trigger has been invalidated by PostgreSQL (reason: `{reason}`). Changes since the invalidation cannot be replayed. Drop the slot (Advanced tab, slots) and save the trigger again to recreate it, or select another slot."
+        )));
     }
 
     client
diff --git a/backend/windmill-trigger/src/global_handler.rs b/backend/windmill-trigger/src/global_handler.rs
index ec74b4f139..64ad693a10 100644
--- a/backend/windmill-trigger/src/global_handler.rs
+++ b/backend/windmill-trigger/src/global_handler.rs
@@ -342,7 +342,7 @@ pub async fn cancel_suspended_trigger_jobs(
         let cancelled_jobs = cancel_jobs(
             jobs_to_cancel,
             &db,
-            authed.username.as_str(),
+            &authed,
             w_id.as_str(),
             true,
         )
diff --git a/backend/windmill-trigger/src/trigger_helpers.rs b/backend/windmill-trigger/src/trigger_helpers.rs
index 7e47613d1a..ae805d195e 100644
--- a/backend/windmill-trigger/src/trigger_helpers.rs
+++ b/backend/windmill-trigger/src/trigger_helpers.rs
@@ -976,6 +976,7 @@ async fn trigger_script_with_retry_and_error_handler<'c>(
         None,
         Some(trigger),
         suspended_mode,
+        None,
     )
     .await?;
 
diff --git a/backend/windmill-types/src/flows.rs b/backend/windmill-types/src/flows.rs
index a2fc7fd58d..890318b8aa 100644
--- a/backend/windmill-types/src/flows.rs
+++ b/backend/windmill-types/src/flows.rs
@@ -48,6 +48,10 @@ pub struct Flow {
     pub on_behalf_of: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub labels: Option<Vec<String>>,
+    /// Caps the scopes of the token minted for each job of this flow; `None` = unrestricted.
+    #[sqlx(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub job_token_scopes: Option<Vec<String>>,
     /// Labels inherited from the parent folder, computed at read time. Not stored on the flow row.
     #[sqlx(default)]
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -145,6 +149,15 @@ pub struct NewFlow {
     pub ws_error_handler_muted: Option<bool>,
     #[serde(default)]
     pub labels: Option<Vec<String>>,
+    /// Absent keeps the deployed flow's value, so a client unaware of the setting cannot
+    /// drop a restriction by saving; `null` clears it.
+    #[sqlx(skip)]
+    #[serde(
+        default,
+        deserialize_with = "crate::more_serde::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub job_token_scopes: Option<Option<Vec<String>>>,
     /// Caller-intent flag (set by the CLI / git sync): when true, deploying
     /// this flow must NOT delete an existing user draft at the same path.
     /// Transient — never persisted.
@@ -183,6 +196,12 @@ pub struct EditFlow {
     pub ws_error_handler_muted: Option<bool>,
     #[serde(default)]
     pub labels: Option<Vec<String>>,
+    #[serde(
+        default,
+        deserialize_with = "crate::more_serde::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub job_token_scopes: Option<Option<Vec<String>>>,
     #[serde(default)]
     pub skip_draft_deletion: Option<bool>,
 }
@@ -207,6 +226,7 @@ impl EditFlow {
             preserve_on_behalf_of: self.preserve_on_behalf_of,
             ws_error_handler_muted: self.ws_error_handler_muted,
             labels: self.labels,
+            job_token_scopes: self.job_token_scopes,
             skip_draft_deletion: self.skip_draft_deletion,
         }
     }
@@ -357,6 +377,8 @@ impl FlowValue {
                 | Flow { .. }
                 | FlowScript { .. }
                 | Identity) => cb(&s, &module.id)?,
+                // Runs no script of its own.
+                AIDecision { .. } => {}
                 ForloopFlow { modules, .. } | WhileloopFlow { modules, .. } => {
                     Self::traverse_leafs(modules.iter().collect(), cb)?
                 }
@@ -615,6 +637,9 @@ pub struct FlowModule {
     pub pass_flow_input_directly: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub debouncing: Option<DebouncingSettings>,
+    /// Caps the token of the jobs this step runs, on top of the flow's own restriction.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub job_token_scopes: Option<Vec<String>>,
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone)]
@@ -902,6 +927,9 @@ pub struct AgentTool {
     /// Overrides the description auto-derived from the underlying runnable.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
+    /// Caps the token of this tool's jobs, on top of the agent step's own restriction.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub job_token_scopes: Option<Vec<String>>,
     pub value: ToolValue,
 }
 
@@ -915,6 +943,7 @@ impl AgentTool {
 
         self.id = flow_module.id;
         self.summary = flow_module.summary;
+        self.job_token_scopes = flow_module.job_token_scopes;
         self.value = ToolValue::FlowModule(module_value);
     }
 }
@@ -927,6 +956,7 @@ impl From<&AgentTool> for Option<FlowModule> {
                 id: tool.id.clone(),
                 value: to_raw_value(module_value),
                 summary: tool.summary.clone(),
+                job_token_scopes: tool.job_token_scopes.clone(),
                 ..Default::default()
             }),
             ToolValue::Mcp(_) => None,
@@ -1110,6 +1140,13 @@ pub enum FlowModuleValue {
         #[serde(default, skip_serializing_if = "HashMap::is_empty")]
         tool_inputs: HashMap<String, HashMap<String, InputTransform>>,
     },
+    /// One call to a decision model (such as TypeSafe's Jev) answering the typed `questions` of its
+    /// `input_transforms` about a `state`. A flow branches on the answers with a `BranchOne`.
+    AIDecision {
+        input_transforms: HashMap<String, InputTransform>,
+        #[serde(skip_serializing_if = "is_none_or_empty")]
+        tag: Option<String>,
+    },
 }
 
 fn is_none_or_empty(expr: &Option<String>) -> bool {
@@ -1254,6 +1291,10 @@ impl<'de> Deserialize<'de> for FlowModuleValue {
                 agent: untagged.agent,
                 tool_inputs: untagged.tool_inputs.unwrap_or_default(),
             }),
+            "aidecision" => Ok(FlowModuleValue::AIDecision {
+                input_transforms: untagged.input_transforms.unwrap_or_default(),
+                tag: untagged.tag,
+            }),
             other => Err(serde::de::Error::unknown_variant(
                 other,
                 &[
@@ -1266,6 +1307,7 @@ impl<'de> Deserialize<'de> for FlowModuleValue {
                     "rawscript",
                     "identity",
                     "aiagent",
+                    "aidecision",
                 ],
             )),
         }
@@ -1331,6 +1373,7 @@ pub fn add_virtual_items_if_necessary(modules: &mut Vec<FlowModule>) {
             apply_preprocessor: None,
             pass_flow_input_directly: None,
             debouncing: None,
+            job_token_scopes: None,
         });
     }
 }
diff --git a/backend/windmill-types/src/jobs.rs b/backend/windmill-types/src/jobs.rs
index 530b8a948d..9768373b91 100644
--- a/backend/windmill-types/src/jobs.rs
+++ b/backend/windmill-types/src/jobs.rs
@@ -515,6 +515,8 @@ pub enum JobPayload {
         concurrency_settings: ConcurrencySettings,
         debouncing_settings: DebouncingSettings,
         labels: Option<Vec<String>>,
+        /// The script's `job_token_scopes` setting, read with the rest of the payload.
+        job_token_scopes: Option<Vec<String>>,
     },
     FlowNode {
         id: FlowNodeId,
@@ -579,6 +581,8 @@ pub enum JobPayload {
         apply_preprocessor: bool,
         version: i64,
         labels: Option<Vec<String>>,
+        /// The flow's `job_token_scopes` setting, read with the rest of the payload.
+        job_token_scopes: Option<Vec<String>>,
     },
     RestartedFlow {
         completed_job_id: Uuid,
diff --git a/backend/windmill-types/src/scripts.rs b/backend/windmill-types/src/scripts.rs
index 9e29731505..1e4a8858ed 100644
--- a/backend/windmill-types/src/scripts.rs
+++ b/backend/windmill-types/src/scripts.rs
@@ -331,7 +331,7 @@ pub const SCRIPT_COLUMNS: &str = concat!(
     "timeout, delete_after_use, delete_after_secs, restart_unless_cancelled, ",
     "visible_to_runner_only, auto_kind, codebase, has_preprocessor, ",
     "on_behalf_of, ",
-    "assets, modules, labels, concurrency_key, concurrent_limit, ",
+    "assets, modules, labels, job_token_scopes, concurrency_key, concurrent_limit, ",
     "concurrency_time_window_s, debounce_key, debounce_delay_s, runnable_settings_handle",
 );
 
@@ -401,6 +401,9 @@ pub struct Script<SR> {
     pub modules: Option<HashMap<String, ScriptModule>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub labels: Option<Vec<String>>,
+    /// Caps the scopes of the token minted for each job of this script; `None` = unrestricted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub job_token_scopes: Option<Vec<String>>,
     /// Labels inherited from the parent folder, computed at read time. Not stored on the script row.
     #[sqlx(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -580,6 +583,14 @@ pub struct NewScript {
     pub auto_parent: Option<bool>,
     #[serde(default)]
     pub labels: Option<Vec<String>>,
+    /// Absent keeps the parent version's value, so a client unaware of the setting
+    /// cannot drop a restriction by redeploying; `null` clears it.
+    #[serde(
+        default,
+        deserialize_with = "crate::more_serde::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub job_token_scopes: Option<Option<Vec<String>>>,
     /// Caller-intent flag (set by the CLI / git sync): when true, deploying
     /// this script must NOT delete an existing user draft at the same path.
     /// Transient — never persisted. Deliberately excluded from `impl Hash`
@@ -628,6 +639,7 @@ impl Hash for NewScript {
         self.preserve_on_behalf_of.hash(state);
         self.assets.hash(state);
         self.labels.hash(state);
+        self.job_token_scopes.hash(state);
         if let Some(modules) = &self.modules {
             let mut sorted: Vec<_> = modules.iter().collect();
             sorted.sort_by_key(|(k, _)| *k);
diff --git a/backend/windmill-worker-volumes/src/lib.rs b/backend/windmill-worker-volumes/src/lib.rs
index e2e4ab866b..364795510a 100644
--- a/backend/windmill-worker-volumes/src/lib.rs
+++ b/backend/windmill-worker-volumes/src/lib.rs
@@ -54,11 +54,45 @@ pub struct VolumeMount {
     pub target: String,
 }
 
+/// A file's size and last change time. Sync-back trusts a pulled file's stored hash only while
+/// its stamp is the one taken at hand-off: size alone misses a rewrite of the same length. A
+/// write within the filesystem's timestamp granularity of the hand-off is not seen.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FileStamp {
+    size: u64,
+    changed: Option<(i64, i64)>,
+}
+
+impl FileStamp {
+    /// Whether the file is as it was at `earlier`. An unreadable change time never matches.
+    pub fn unchanged_since(&self, earlier: &FileStamp) -> bool {
+        self.changed.is_some() && self == earlier
+    }
+
+    pub fn of(meta: &std::fs::Metadata) -> Self {
+        // ctime rather than mtime: a tool that restores mtime (cp -p, tar, rsync -t) cannot set it.
+        #[cfg(unix)]
+        let changed = {
+            use std::os::unix::fs::MetadataExt;
+            Some((meta.ctime(), meta.ctime_nsec()))
+        };
+        #[cfg(not(unix))]
+        let changed = meta
+            .modified()
+            .ok()
+            .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+            .map(|d| (d.as_secs() as i64, d.subsec_nanos() as i64));
+        Self { size: meta.len(), changed }
+    }
+}
+
 pub struct VolumeState {
     pub mount: VolumeMount,
     pub local_dir: PathBuf,
     pub manifest: HashMap<String, FileEntry>,
     pub symlinks: HashMap<String, String>,
+    /// Stamp of each pulled file as the job received it, keyed like `manifest`.
+    pub stamps: HashMap<String, FileStamp>,
 }
 
 pub struct DownloadStats {
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index 5e95a1e20a..57b292f8f2 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -101,6 +101,7 @@ mappable-rc.workspace = true
 git-version.workspace = true
 once_cell.workspace = true
 tokio-postgres.workspace = true
+postgres-protocol.workspace = true
 bit-vec.workspace = true
 url.workspace = true
 async-stream.workspace = true
diff --git a/backend/windmill-worker/nsjail/build.csharp.config.proto b/backend/windmill-worker/nsjail/build.csharp.config.proto
new file mode 100644
index 0000000000..a926d923f2
--- /dev/null
+++ b/backend/windmill-worker/nsjail/build.csharp.config.proto
@@ -0,0 +1,128 @@
+name: "csharp restore/build"
+
+mode: ONCE
+hostname: "csharp"
+log_level: ERROR
+time_limit: {TIMEOUT}
+
+disable_rl: true
+
+cwd: "{JOB_DIR}"
+
+clone_newnet: false
+clone_newuser: {CLONE_NEWUSER}
+
+skip_setsid: true
+keep_caps: false
+keep_env: true
+mount_proc: true
+
+mount {
+    src: "/bin"
+    dst: "/bin"
+    is_bind: true
+}
+
+mount {
+    src: "/lib"
+    dst: "/lib"
+    is_bind: true
+}
+
+mount {
+    src: "/lib64"
+    dst: "/lib64"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/usr"
+    dst: "/usr"
+    is_bind: true
+}
+
+mount {
+    src: "{DOTNET_ROOT}"
+    dst: "{DOTNET_ROOT}"
+    is_bind: true
+}
+
+mount {
+    src: "/etc"
+    dst: "/etc"
+	is_bind: true
+}
+
+# Container runtimes bind exactly these 3 files as separate submounts over
+# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
+# Load-bearing -- do not remove as redundant with the /etc bind above.
+mount {
+    src: "/etc/resolv.conf"
+    dst: "/etc/resolv.conf"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hosts"
+    dst: "/etc/hosts"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hostname"
+    dst: "/etc/hostname"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/dev/null"
+    dst: "/dev/null"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    src: "/dev/urandom"
+    dst: "/dev/urandom"
+    is_bind: true
+}
+
+mount {
+    src: "/dev/random"
+    dst: "/dev/random"
+    is_bind: true
+}
+
+{TMP_MOUNT_BLOCK}
+
+# project files, nuget.config, and the published output dir are all here; cwd of dotnet
+mount {
+    src: "{JOB_DIR}"
+    dst: "{JOB_DIR}"
+    is_bind: true
+    rw: true
+}
+
+# DOTNET_CLI_HOME + NUGET_PACKAGES (nuget/). Writable, like the install/run jails'
+# shared caches.
+mount {
+    src: "{CSHARP_CACHE_DIR}"
+    dst: "{CSHARP_CACHE_DIR}"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    src: "{TRACING_PROXY_CA_CERT_PATH}"
+    dst: "{TRACING_PROXY_CA_CERT_PATH}"
+    is_bind: true
+    mandatory: false
+}
+
+envar: "HOME=/tmp"
+
+#{DEV}
diff --git a/backend/windmill-worker/nsjail/lock.php.config.proto b/backend/windmill-worker/nsjail/lock.php.config.proto
new file mode 100644
index 0000000000..d06c1699a6
--- /dev/null
+++ b/backend/windmill-worker/nsjail/lock.php.config.proto
@@ -0,0 +1,124 @@
+name: "php composer install"
+
+mode: ONCE
+hostname: "php"
+log_level: ERROR
+time_limit: {TIMEOUT}
+
+disable_rl: true
+
+cwd: "{JOB_DIR}"
+
+clone_newnet: false
+clone_newuser: {CLONE_NEWUSER}
+
+skip_setsid: true
+keep_caps: false
+keep_env: true
+mount_proc: true
+
+mount {
+    src: "/bin"
+    dst: "/bin"
+	is_bind: true
+}
+
+mount {
+    src: "/lib"
+    dst: "/lib"
+	is_bind: true
+}
+
+mount {
+    src: "/lib64"
+    dst: "/lib64"
+	is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/usr"
+    dst: "/usr"
+	is_bind: true
+}
+
+mount {
+    src: "/etc"
+    dst: "/etc"
+	is_bind: true
+}
+
+# Container runtimes bind exactly these 3 files as separate submounts over
+# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
+# Load-bearing -- do not remove as redundant with the /etc bind above.
+mount {
+    src: "/etc/resolv.conf"
+    dst: "/etc/resolv.conf"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hosts"
+    dst: "/etc/hosts"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hostname"
+    dst: "/etc/hostname"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+	src: "/dev/null"
+	dst: "/dev/null"
+	is_bind: true
+	rw: true
+}
+
+mount {
+	src: "/dev/urandom"
+	dst: "/dev/urandom"
+	is_bind: true
+}
+
+mount {
+	src: "/dev/random"
+	dst: "/dev/random"
+	is_bind: true
+}
+
+{TMP_MOUNT_BLOCK}
+
+# composer.json/composer.lock live here and vendor/ is written here; cwd of composer
+mount {
+    src: "{JOB_DIR}"
+    dst: "{JOB_DIR}"
+    is_bind: true
+    rw: true
+}
+
+# COMPOSER_HOME: package download cache. Writable, like the install/run jails'
+# shared caches.
+mount {
+    src: "{COMPOSER_CACHE_DIR}"
+    dst: "{COMPOSER_CACHE_DIR}"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    src: "{TRACING_PROXY_CA_CERT_PATH}"
+    dst: "{TRACING_PROXY_CA_CERT_PATH}"
+    is_bind: true
+    mandatory: false
+}
+
+{CA_MOUNT}
+
+envar: "HOME=/tmp"
+
+#{DEV}
diff --git a/backend/windmill-worker/nsjail/lock.py.config.proto b/backend/windmill-worker/nsjail/lock.py.config.proto
new file mode 100644
index 0000000000..14119c4089
--- /dev/null
+++ b/backend/windmill-worker/nsjail/lock.py.config.proto
@@ -0,0 +1,133 @@
+name: "python lock compile"
+
+mode: ONCE
+hostname: "python"
+log_level: ERROR
+time_limit: {TIMEOUT}
+
+# Dependency resolution may invoke the PEP 517 build backend of an sdist whose
+# metadata is not static, which runs arbitrary package code (e.g. setup.py).
+# That build, and uv's bytecode compile pool, size thread/fd pools to the host's
+# CPU count, so these mirror download.py.config.proto rather than the run sandbox.
+rlimit_as: 8192
+rlimit_cpu: 1000
+rlimit_fsize: 1024
+rlimit_nofile: 10000
+
+envar: "HOME=/tmp"
+envar: "LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH"
+
+cwd: "{JOB_DIR}"
+
+clone_newnet: false
+clone_newuser: {CLONE_NEWUSER}
+
+skip_setsid: true
+keep_caps: true
+keep_env: true
+mount_proc: true
+
+mount {
+    src: "/bin"
+    dst: "/bin"
+	is_bind: true
+}
+
+mount {
+    src: "/lib"
+    dst: "/lib"
+	is_bind: true
+}
+
+mount {
+    src: "/lib64"
+    dst: "/lib64"
+	is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/usr"
+    dst: "/usr"
+	is_bind: true
+}
+
+mount {
+    src: "/etc"
+    dst: "/etc"
+	is_bind: true
+}
+
+# Container runtimes bind exactly these 3 files as separate submounts over
+# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
+# Load-bearing -- do not remove as redundant with the /etc bind above.
+mount {
+    src: "/etc/resolv.conf"
+    dst: "/etc/resolv.conf"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hosts"
+    dst: "/etc/hosts"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hostname"
+    dst: "/etc/hostname"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+	src: "/dev/null"
+	dst: "/dev/null"
+	is_bind: true
+	rw: true
+}
+
+mount {
+	src: "/dev/urandom"
+	dst: "/dev/urandom"
+	is_bind: true
+}
+
+{TMP_MOUNT_BLOCK}
+
+# requirements.in -> requirements.txt, cwd of uv
+mount {
+    src: "{JOB_DIR}"
+    dst: "{JOB_DIR}"
+    is_bind: true
+    rw: true
+}
+
+# shared uv cache: resolution metadata + where sdist build backends run
+# (builds-v0/). Writable, as the install jail's target already is; a poisoned
+# shared cache is the known residual, not a new one.
+mount {
+    src: "{UV_CACHE_DIR}"
+    dst: "{UV_CACHE_DIR}"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    src: "{PY_INSTALL_DIR}"
+    dst: "{PY_INSTALL_DIR}"
+    is_bind: true
+}
+
+{INDEX_CERT_MOUNT}
+
+mount {
+    src: "{TRACING_PROXY_CA_CERT_PATH}"
+    dst: "{TRACING_PROXY_CA_CERT_PATH}"
+    is_bind: true
+    mandatory: false
+}
+
+#{DEV}
diff --git a/backend/windmill-worker/src/ai/compaction.rs b/backend/windmill-worker/src/ai/compaction.rs
index c88ecb8178..b933348a2e 100644
--- a/backend/windmill-worker/src/ai/compaction.rs
+++ b/backend/windmill-worker/src/ai/compaction.rs
@@ -651,6 +651,7 @@ async fn summarize_prefix(
             .query_builder
             .parse_streaming_response(resp, StreamEventProcessor::new_silent().boxed_sink())
             .await?
+            .without_nul()
     };
 
     match parsed {
diff --git a/backend/windmill-worker/src/ai/stream_event_processor.rs b/backend/windmill-worker/src/ai/stream_event_processor.rs
index fe8a3b9b00..c4d17f080a 100644
--- a/backend/windmill-worker/src/ai/stream_event_processor.rs
+++ b/backend/windmill-worker/src/ai/stream_event_processor.rs
@@ -1,3 +1,8 @@
+use std::sync::{
+    atomic::{AtomicUsize, Ordering},
+    Arc,
+};
+
 use async_trait::async_trait;
 use windmill_ai::{query_builder::StreamEventSink, types::*};
 use windmill_common::{error::Error, worker::Connection};
@@ -10,11 +15,13 @@ use crate::job_logger::append_result_stream;
 pub struct StreamEventProcessor {
     tx: Option<tokio::sync::mpsc::Sender<String>>,
     pub handle: Option<tokio::task::JoinHandle<()>>,
+    /// Shared by every clone, so a sink lent to a parser counts into its owner.
+    streamed: Arc<AtomicUsize>,
 }
 
 impl Clone for StreamEventProcessor {
     fn clone(&self) -> Self {
-        Self { tx: self.tx.clone(), handle: None }
+        Self { tx: self.tx.clone(), handle: None, streamed: self.streamed.clone() }
     }
 }
 
@@ -48,13 +55,19 @@ impl StreamEventProcessor {
             }
         });
 
-        Self { tx: Some(tx), handle: Some(handle) }
+        Self { tx: Some(tx), handle: Some(handle), streamed: Arc::default() }
     }
 
     /// Create a silent StreamEventProcessor that only accumulates events locally
     /// without persisting them to the database. Used when streaming is disabled.
     pub fn new_silent() -> Self {
-        Self { tx: None, handle: None }
+        Self { tx: None, handle: None, streamed: Arc::default() }
+    }
+
+    /// How many events have been streamed to the job's readers. A silent processor
+    /// streams none.
+    pub fn streamed_events(&self) -> usize {
+        self.streamed.load(Ordering::Relaxed)
     }
 
     pub fn to_handle(self) -> Option<tokio::task::JoinHandle<()>> {
@@ -79,6 +92,7 @@ impl StreamEventSink for StreamEventProcessor {
             Ok(event_json) => {
                 let event_json = format!("{}\n", event_json);
                 events_str.push_str(&event_json);
+                self.streamed.fetch_add(1, Ordering::Relaxed);
 
                 if let Err(err) = tx
                     .send(event_json.clone())
diff --git a/backend/windmill-worker/src/ai/tools.rs b/backend/windmill-worker/src/ai/tools.rs
index 930a329be4..9ff1815ad4 100644
--- a/backend/windmill-worker/src/ai/tools.rs
+++ b/backend/windmill-worker/src/ai/tools.rs
@@ -4,7 +4,7 @@ use crate::ai::utils::{
     is_completed_input_transform, update_flow_status_module_with_actions,
     update_flow_status_module_with_actions_success, FlowContext,
 };
-use crate::common::OccupancyMetrics;
+use crate::common::{get_root_job_id, OccupancyMetrics};
 use crate::result_processor::handle_non_flow_job_error;
 use crate::worker_flow::{
     evaluate_input_transform, raw_script_to_payload, resolve_flow_step_tag, script_to_payload,
@@ -372,7 +372,8 @@ async fn enqueue_windmill_tool(
         FlowModuleValue::Script { input_transforms, .. }
         | FlowModuleValue::RawScript { input_transforms, .. }
         | FlowModuleValue::FlowScript { input_transforms, .. }
-        | FlowModuleValue::AIAgent { input_transforms, .. } => input_transforms,
+        | FlowModuleValue::AIAgent { input_transforms, .. }
+        | FlowModuleValue::AIDecision { input_transforms, .. } => input_transforms,
         _ => {
             return Err(Error::internal_err(format!(
                 "Unsupported tool: {}",
@@ -473,13 +474,15 @@ async fn enqueue_windmill_tool(
             let has_nested_agent_tools = sub_tools.iter().any(|t| {
                 matches!(
                     t.value,
-                    windmill_common::flows::ToolValue::FlowModule(FlowModuleValue::AIAgent { .. })
+                    windmill_common::flows::ToolValue::FlowModule(
+                        FlowModuleValue::AIAgent { .. } | FlowModuleValue::AIDecision { .. }
+                    )
                 )
             });
             if has_nested_agent_tools {
                 return Err(Error::internal_err(
                     "AI agent tools cannot be nested beyond 2 levels. The nested agent tool contains \
-                     AIAgent sub-tools, which would exceed the maximum nesting depth.".to_string()
+                     AI agent or AI decision sub-tools, which would exceed the maximum nesting depth.".to_string()
                 ));
             }
             let path = format!("{}/tools/{}", ctx.job.runnable_path(), tool_module.id);
@@ -492,6 +495,18 @@ async fn enqueue_windmill_tool(
                 on_behalf_of: None,
             }
         }
+        // Runs as an AI agent job, whose handler finds this tool on the calling agent and answers
+        // it as a decision.
+        FlowModuleValue::AIDecision { tag, .. } => JobPayloadWithTag {
+            payload: JobPayload::AIAgent {
+                path: format!("{}/tools/{}", ctx.job.runnable_path(), tool_module.id),
+            },
+            tag: tag.filter(|t| !t.trim().is_empty()),
+            delete_after_use: tool_module.delete_after_use.unwrap_or(false),
+            delete_after_secs: None,
+            timeout: None,
+            on_behalf_of: None,
+        },
         _ => {
             return Err(Error::internal_err(format!(
                 "Unsupported tool: {}",
@@ -599,6 +614,16 @@ async fn enqueue_windmill_tool(
         None,
         None,
         None,
+        // A tool never holds a wider token than the agent calling it, and its own setting
+        // narrows that further.
+        windmill_common::scopes::intersect_job_token_scopes(
+            ctx.job.job_token_scopes.as_deref(),
+            windmill_common::scopes::step_job_token_scopes(
+                tool_module.job_token_scopes.as_deref(),
+            )
+            .as_deref(),
+        )
+        .as_deref(),
     )
     .await?;
 
@@ -824,8 +849,12 @@ async fn execute_windmill_tools(
                     .result
                     .map(|value| value.0)
                     .unwrap_or_else(|| to_raw_value(&serde_json::Value::Null));
+                // A nested agent's or a decision's result is an envelope; the model sees `output`.
                 let is_agent = tool.module.as_ref().is_some_and(|module| {
-                    matches!(module.get_value(), Ok(FlowModuleValue::AIAgent { .. }))
+                    matches!(
+                        module.get_value(),
+                        Ok(FlowModuleValue::AIAgent { .. } | FlowModuleValue::AIDecision { .. })
+                    )
                 });
                 let content = if is_agent && completed.success {
                     extract_ai_agent_output(&result).unwrap_or_else(|| result.get().to_string())
@@ -961,11 +990,7 @@ fn windmill_tool_row(
 /// Add tool message to conversation if chat is enabled
 async fn add_tool_message_to_chat(
     ctx: &mut ToolExecutionContext<'_>,
-    // The job this row belongs to: the tool's own where it has one, else the agent's, which
-    // is the job it ran inside. Every row names one so that retention collects the whole
-    // turn — `delete_jobs` removes messages by `job_id = ANY(..)` (there is no FK on the
-    // column; `drop_v2_job_side_table_cascades` dropped it), and a row naming no job would
-    // survive every purge and leave a conversation that can never become empty.
+    // The tool's own job where it has one, else the agent's, which is the job it ran inside.
     tool_job_id: Option<Uuid>,
     content: &str,
     success: bool,
@@ -1005,6 +1030,7 @@ async fn add_tool_message_to_chat(
                 ctx.db,
                 &memory_id,
                 tool_job_id,
+                get_root_job_id(ctx.job),
                 content,
                 MessageType::Tool,
                 &step_name,
diff --git a/backend/windmill-worker/src/ai/utils.rs b/backend/windmill-worker/src/ai/utils.rs
index 3efdc67a3d..f0a0b5c20f 100644
--- a/backend/windmill-worker/src/ai/utils.rs
+++ b/backend/windmill-worker/src/ai/utils.rs
@@ -103,9 +103,9 @@ pub fn filter_schema_by_input_transforms(
             .get_mut("properties")
             .and_then(|p| p.as_object_mut())
         {
-            for key in &keys_to_remove {
-                properties.remove(key);
-            }
+            // `remove` swaps the last entry into the freed slot, so removing in set order
+            // would leave the survivors in a different order on every run.
+            properties.retain(|key, _| !keys_to_remove.contains(key));
         }
 
         // Also remove from required array
@@ -209,6 +209,7 @@ pub async fn add_message_to_conversation(
     db: &DB,
     conversation_id: &Uuid,
     job_id: Option<Uuid>,
+    turn_job_id: Uuid,
     message_content: &str,
     message_type: MessageType,
     step_name: &Option<String>,
@@ -220,6 +221,7 @@ pub async fn add_message_to_conversation(
         &mut tx,
         *conversation_id,
         job_id,
+        turn_job_id,
         &message_content,
         message_type,
         step_name.as_deref(),
@@ -568,7 +570,7 @@ pub async fn load_mcp_tools(
         // is not allowed to read (resources:read:{path}). Reading through the raw
         // db pool here would bypass the authorization enforced by the regular MCP
         // tools API (get_mcp_tools) and act as a confused deputy.
-        let mcp_resource = client
+        let mut mcp_resource = client
             .get_resource_value::<McpResource>(path)
             .await
             .map_err(|e| {
@@ -613,6 +615,18 @@ pub async fn load_mcp_tools(
             None
         };
 
+        // Header secrets go through the same permissioned path as the token.
+        for (name, value) in mcp_resource.headers.iter_mut().flatten() {
+            if let Some(var_path) = value.strip_prefix("$var:") {
+                *value = client.get_variable_value(var_path).await.map_err(|e| {
+                    Error::internal_err(format!(
+                        "Failed to resolve variable {} for header {} of MCP resource {}: {}",
+                        var_path, name, resource_name, e
+                    ))
+                })?;
+            }
+        }
+
         // Create new MCP client for this execution
         tracing::debug!("Creating fresh MCP client for {}", resource_name);
         let mcp_conn = McpClient::from_resource(mcp_resource, token)
@@ -718,6 +732,7 @@ pub fn any_tool_needs_previous_result(tools: &[Tool]) -> bool {
                     FlowModuleValue::RawScript { input_transforms, .. } => input_transforms,
                     FlowModuleValue::FlowScript { input_transforms, .. } => input_transforms,
                     FlowModuleValue::AIAgent { input_transforms, .. } => input_transforms,
+                    FlowModuleValue::AIDecision { input_transforms, .. } => input_transforms,
                     _ => return false,
                 };
 
@@ -733,3 +748,32 @@ pub fn any_tool_needs_previous_result(tools: &[Tool]) -> bool {
         false
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A tool's schema sits in the prompt prefix the provider caches on, so the
+    /// parameters left for the model must keep their order on every run.
+    #[test]
+    fn filtering_preset_inputs_keeps_the_remaining_property_order() {
+        let keys = ["a", "b", "c", "d", "e", "f", "g", "h"];
+        let props = keys
+            .iter()
+            .map(|k| format!(r#""{k}":{{"type":"string"}}"#))
+            .collect::<Vec<_>>()
+            .join(",");
+        let schema =
+            RawValue::from_string(format!(r#"{{"type":"object","properties":{{{props}}}}}"#))
+                .unwrap();
+        let preset = ["a", "c", "f"]
+            .iter()
+            .map(|k| (k.to_string(), InputTransform::Static { value: to_raw_value(&1) }))
+            .collect();
+
+        let filtered = filter_schema_by_input_transforms(schema, &preset).unwrap();
+        let value: serde_json::Value = serde_json::from_str(filtered.get()).unwrap();
+        let remaining: Vec<&String> = value["properties"].as_object().unwrap().keys().collect();
+        assert_eq!(remaining, ["b", "d", "e", "g", "h"]);
+    }
+}
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index 958caeaefc..1b889aea34 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -28,6 +28,7 @@ use windmill_mcp::McpClient;
 use crate::ai::tools::McpClientStub as McpClient;
 use windmill_ai::{
     ai_providers::AIProvider,
+    decision::{decision_inputs, run_decision, AIDecisionArgs},
     image_handler::upload_image_to_s3,
     model_context::model_context_window,
     providers::{
@@ -42,6 +43,7 @@ use windmill_ai::{
         common_outbound_headers, needs_unavailable_oauth_exchange, retain_effective_credentials,
     },
     query_builder::{BuildRequestArgs, ParsedResponse},
+    retry::{as_transient, into_final_error, response_error, send_error, Backoff, MAX_RETRIES},
     types::*,
     utils::{pinned_ai_client_for, should_use_structured_output_tool},
 };
@@ -64,9 +66,13 @@ use windmill_queue::{append_logs, cancel_single_job, CanceledBy, MiniPulledJob};
 use crate::{
     ai::stream_event_processor::StreamEventProcessor,
     common::{
-        build_args_map, resolve_job_timeout, transform_json_value, OccupancyMetrics, StreamNotifier,
+        build_args_map, get_root_job_id, resolve_job_timeout, transform_json_value,
+        OccupancyMetrics, StreamNotifier,
+    },
+    handle_child::{
+        run_future_with_polling_update_job_poller,
+        run_future_with_polling_update_job_poller_graceful, GracefulPollOutcome,
     },
-    handle_child::{run_future_with_polling_update_job_poller_graceful, GracefulPollOutcome},
 };
 
 lazy_static::lazy_static! {
@@ -80,6 +86,20 @@ lazy_static::lazy_static! {
         "required": ["user_message"],
         "additionalProperties": false,
     }));
+
+    // Text only: the model writes the state as it reads the conversation, and a schema offering a
+    // union of types is refused by some providers' strict tool schemas.
+    static ref AI_DECISION_TOOL_SCHEMA: Box<RawValue> = to_raw_value(&serde_json::json!({
+        "type": "object",
+        "properties": {
+            "state": {
+                "type": "string",
+                "description": "What the questions are asked about, with only what they need.",
+            },
+        },
+        "required": ["state"],
+        "additionalProperties": false,
+    }));
 }
 
 const DEFAULT_MAX_AGENT_ITERATIONS: usize = 10;
@@ -497,7 +517,8 @@ fn overlay_tool_inputs(
             FlowModuleValue::Script { input_transforms, .. }
             | FlowModuleValue::RawScript { input_transforms, .. }
             | FlowModuleValue::FlowScript { input_transforms, .. }
-            | FlowModuleValue::AIAgent { input_transforms, .. } => input_transforms,
+            | FlowModuleValue::AIAgent { input_transforms, .. }
+            | FlowModuleValue::AIDecision { input_transforms, .. } => input_transforms,
             _ => continue,
         };
         for (key, transform) in overrides {
@@ -712,6 +733,22 @@ pub async fn handle_ai_agent_job(
 
     let summary = module.summary.clone();
 
+    let module_value = module.get_value()?;
+    if let FlowModuleValue::AIDecision { .. } = module_value {
+        return handle_ai_decision(
+            conn,
+            db,
+            job,
+            &local_args,
+            direct_parent_job_kind == JobKind::AIAgent,
+            canceled_by,
+            mem_peak,
+            occupancy_metrics,
+            worker_name,
+        )
+        .await;
+    }
+
     let FlowModuleValue::AIAgent {
         tools: module_tools,
         omit_output_from_conversation,
@@ -719,7 +756,7 @@ pub async fn handle_ai_agent_job(
         tool_inputs,
         input_transforms: step_input_transforms,
         ..
-    } = module.get_value()?
+    } = module_value
     else {
         return Err(Error::internal_err(
             "AI agent module is not an AI agent".to_string(),
@@ -819,16 +856,18 @@ pub async fn handle_ai_agent_job(
     keep_authored_memory_id(&mut args, &step_input_transforms);
 
     // Nesting is capped at flow → agent → nested agent. When this job is itself a nested tool,
-    // a linked resource's tool set may still contain AIAgent tools (the editor can't constrain a
-    // shared resource); don't advertise them — invoking one would only fail the depth check as a
-    // third-level agent.
+    // a linked resource's tool set may still contain AIAgent or AIDecision tools (the editor can't
+    // constrain a shared resource); don't advertise them — invoking one would only fail the depth
+    // check as a third level.
     let tools = if direct_parent_job_kind == JobKind::AIAgent {
         tools
             .into_iter()
             .filter(|t| {
                 !matches!(
                     &t.value,
-                    ToolValue::FlowModule(FlowModuleValue::AIAgent { .. })
+                    ToolValue::FlowModule(
+                        FlowModuleValue::AIAgent { .. } | FlowModuleValue::AIDecision { .. }
+                    )
                 )
             })
             .collect()
@@ -1003,6 +1042,18 @@ pub async fn handle_ai_agent_job(
                         None,
                     )
                 }
+                FlowModuleValue::AIDecision { input_transforms, .. } => {
+                    // The calling model supplies only the state: the questions are the tool.
+                    let description = decision_tool_description(&input_transforms);
+                    (
+                        Some(
+                            RawValue::from_string(AI_DECISION_TOOL_SCHEMA.get().to_string())
+                                .expect("AI_DECISION_TOOL_SCHEMA should always be valid JSON"),
+                        ),
+                        input_transforms,
+                        description,
+                    )
+                }
                 _ => {
                     return Err(Error::internal_err(format!(
                         "Unsupported tool: {}",
@@ -1241,6 +1292,12 @@ pub async fn run_agent(
     job_completed_tx: crate::JobCompletedSender,
 ) -> error::Result<Box<RawValue>> {
     let output_type = args.output_type.as_ref().unwrap_or(&OutputType::Text);
+    if args.provider.kind.is_decision_provider() {
+        return Err(Error::BadRequest(format!(
+            "{:?} serves decision models, which answer typed questions rather than messages: use an AI decision step",
+            args.provider.kind
+        )));
+    }
     let credentials = args.provider.to_provider_credentials(db).await?;
     let base_url = &credentials.base_url;
     let api_key = credentials.api_key.as_deref().unwrap_or("");
@@ -1603,10 +1660,17 @@ pub async fn run_agent(
         .await;
 
         let mut retried_context = false;
+        let mut backoff = Backoff::default();
+        let streamed_events = || {
+            stream_event_processor
+                .as_ref()
+                .map_or(0, |processor| processor.streamed_events())
+        };
         let (parsed, request_message_count) = loop {
             // How many messages this request carries, so the provider's prompt count can
             // later be told apart from what the response and its tool results add.
             let request_message_count = messages.context().len();
+            let streamed_before = streamed_events();
 
             // Handle AWS Bedrock provider specially using the official SDK
             let attempt: error::Result<_> = async {
@@ -1762,7 +1826,7 @@ pub async fn run_agent(
                         let resp = build_http_request(&endpoint, &auth_headers, request_body)
                             .send()
                             .await
-                            .map_err(|e| Error::internal_err(format!("Failed to call API: {}", e)))?;
+                            .map_err(|e| send_error(e, "Failed to call API"))?;
 
                         match resp.error_for_status_ref() {
                             Ok(_) => {
@@ -1773,6 +1837,7 @@ pub async fn run_agent(
                             }
                             Err(e) => {
                                 let status = resp.status();
+                                let headers = resp.headers().clone();
                                 let text = resp
                                     .text()
                                     .await
@@ -1842,10 +1907,9 @@ pub async fn run_agent(
                                     query_builder = create_chat_completions_query_builder(&credentials);
                                     include_usage = true;
                                 } else {
-                                    return Err(Error::internal_err(format!(
-                                        "API error calling {}: {} - {}",
-                                        endpoint, e, text
-                                    )));
+                                    let message =
+                                        format!("API error calling {}: {} - {}", endpoint, e, text);
+                                    return Err(response_error(status, &headers, &text, message));
                                 }
                             }
                         }
@@ -1859,7 +1923,7 @@ pub async fn run_agent(
                         query_builder.parse_image_response(resp).await?
                     }
                 };
-                Ok(parsed)
+                Ok(parsed.without_nul())
             }.await;
 
             match attempt {
@@ -1905,7 +1969,45 @@ pub async fn run_agent(
                         return Err(error);
                     }
                 }
-                Err(error) => return Err(error),
+                Err(error) => {
+                    let Some(transient) = as_transient(&error) else {
+                        return Err(error);
+                    };
+                    // Readers have no way to take back what they were shown, so a call
+                    // that already streamed part of its answer fails as it is.
+                    if streamed_events() != streamed_before {
+                        append_logs(
+                            &job.id,
+                            &job.workspace_id,
+                            "AI provider call failed after part of its answer had streamed; not retried.\n".to_string(),
+                            conn,
+                        )
+                        .await;
+                        return Err(into_final_error(error));
+                    }
+                    let Some(delay) = backoff.next_delay(transient) else {
+                        return Err(into_final_error(error));
+                    };
+                    append_logs(
+                        &job.id,
+                        &job.workspace_id,
+                        format!(
+                            "AI provider call failed: {}. Retrying in {:.1}s (retry {}/{MAX_RETRIES}).\n",
+                            transient.message,
+                            delay.as_secs_f64(),
+                            backoff.retries()
+                        ),
+                        conn,
+                    )
+                    .await;
+                    let mut cancelled = cancel_rx.clone();
+                    tokio::select! {
+                        _ = tokio::time::sleep(delay) => {}
+                        Ok(_) = cancelled.wait_for(|cancelled| *cancelled) => {
+                            return Err(Error::ExecutionErr("Job cancelled".to_string()));
+                        }
+                    }
+                }
             }
         };
 
@@ -1968,6 +2070,7 @@ pub async fn run_agent(
                                 db,
                                 &conversation_id,
                                 Some(job.id),
+                                get_root_job_id(job),
                                 "Used websearch tool",
                                 MessageType::Tool,
                                 &step_name,
@@ -2020,6 +2123,7 @@ pub async fn run_agent(
                                 db,
                                 &conversation_id,
                                 Some(job.id),
+                                get_root_job_id(job),
                                 response_content,
                                 MessageType::Assistant,
                                 &step_name,
@@ -2150,6 +2254,7 @@ pub async fn run_agent(
                             db,
                             &conversation_id,
                             Some(job.id),
+                            get_root_job_id(job),
                             answer,
                             MessageType::Assistant,
                             &step_name,
@@ -2201,6 +2306,7 @@ pub async fn run_agent(
                             db,
                             &conversation_id,
                             Some(job.id),
+                            get_root_job_id(job),
                             &message_content,
                             MessageType::Assistant,
                             &step_name,
@@ -2374,6 +2480,104 @@ pub async fn run_agent(
     }))
 }
 
+/// An AI decision, run as a flow step or as a tool of an agent: its questions answered about its
+/// state in one call, with no loop, tools, memory or stream. It writes no conversation row: it is
+/// not an agent step, so a chat flow posts its result like any other step's.
+async fn handle_ai_decision(
+    conn: &Connection,
+    db: &DB,
+    job: &MiniPulledJob,
+    local_args: &HashMap<String, Box<RawValue>>,
+    as_tool: bool,
+    canceled_by: &mut Option<CanceledBy>,
+    mem_peak: &mut i32,
+    occupancy_metrics: &mut OccupancyMetrics,
+    worker_name: &str,
+) -> error::Result<Box<RawValue>> {
+    let args = serde_json::from_str::<AIDecisionArgs>(&serde_json::to_string(local_args)?)?;
+    if !args.provider.kind.runs_decisions() {
+        return Err(Error::BadRequest(format!(
+            "An AI decision runs on a TypeSafe, Cloudflare or OpenAI resource, not {:?}",
+            args.provider.kind
+        )));
+    }
+    let (state, questions) = decision_inputs(args.state.as_ref(), args.questions.as_ref())?;
+    let credentials = args.provider.to_provider_credentials(db).await?;
+    let timeout = resolve_job_timeout(conn, &job.workspace_id, job.id, job.timeout)
+        .await
+        .0;
+    // Under the job poller, so the job keeps its heartbeat and a cancel drops the request.
+    let result = run_future_with_polling_update_job_poller(
+        job.id,
+        job.timeout,
+        conn,
+        mem_peak,
+        canceled_by,
+        run_decision(
+            &credentials,
+            args.provider.get_model(),
+            state,
+            questions,
+            timeout,
+        ),
+        worker_name,
+        &job.workspace_id,
+        &mut Some(occupancy_metrics),
+        Box::pin(futures::stream::once(async { 0 })),
+    )
+    .await?;
+    windmill_common::feature_usage::log_feature_usage(
+        "ai_decision",
+        "run",
+        if as_tool { "tool" } else { "step" },
+    );
+    Ok(to_raw_value(&result))
+}
+
+/// What a decision tool tells the calling model it answers, read off its static questions. None
+/// when they come from an expression, which only a run evaluates.
+fn decision_tool_description(input_transforms: &HashMap<String, InputTransform>) -> Option<String> {
+    let InputTransform::Static { value } = input_transforms.get("questions")? else {
+        return None;
+    };
+    let questions = serde_json::from_str::<serde_json::Map<String, serde_json::Value>>(value.get())
+        .ok()
+        .filter(|questions| !questions.is_empty())?;
+    let described = questions
+        .iter()
+        .map(|(name, question)| {
+            let criteria = question.get("criteria");
+            let kind = match question.get("type").and_then(|t| t.as_str()) {
+                Some("choice") => {
+                    let options = criteria
+                        .and_then(|c| c.as_object())
+                        .map(|c| c.keys().cloned().collect::<Vec<_>>().join(", "))
+                        .unwrap_or_default();
+                    format!("one of {options}")
+                }
+                Some("score") => {
+                    let levels = criteria
+                        .and_then(|c| c.as_array())
+                        .map(|c| {
+                            c.iter()
+                                .filter_map(|l| l.as_str())
+                                .collect::<Vec<_>>()
+                                .join(" < ")
+                        })
+                        .unwrap_or_default();
+                    format!("a score over {levels}")
+                }
+                _ => "yes or no".to_string(),
+            };
+            format!("{name} ({kind})")
+        })
+        .collect::<Vec<_>>()
+        .join("; ");
+    Some(format!(
+        "Answers these questions about the state it is given, with probabilities: {described}."
+    ))
+}
+
 /// Whether the step asked for its answer as it is generated. Absence means on, matching the
 /// schema's own default: a step that never wrote the key never had an opinion, and an answer
 /// arriving as it is written is what people expect. Only an explicit `false` holds it back.
@@ -2745,6 +2949,7 @@ mod tests {
             let mut its = HashMap::new();
             its.insert(key.to_string(), js(expr));
             AgentTool {
+                job_token_scopes: None,
                 id: id.to_string(),
                 summary: None,
                 description: None,
@@ -2772,6 +2977,7 @@ mod tests {
             script_tool("a", "x", "authoring_flow_expr"),
             script_tool("b", "y", "keep_me"),
             AgentTool {
+                job_token_scopes: None,
                 id: "m".to_string(),
                 summary: None,
                 description: None,
@@ -2819,6 +3025,7 @@ mod tests {
     fn narrow_roster_keeps_the_entries_a_run_named() {
         fn named(id: &str, summary: &str) -> AgentTool {
             AgentTool {
+                job_token_scopes: None,
                 id: id.to_string(),
                 summary: Some(summary.to_string()),
                 description: None,
@@ -2834,6 +3041,7 @@ mod tests {
         }
         fn mcp(id: &str, summary: &str, path: &str) -> AgentTool {
             AgentTool {
+                job_token_scopes: None,
                 id: id.to_string(),
                 summary: Some(summary.to_string()),
                 description: None,
@@ -2846,6 +3054,7 @@ mod tests {
         }
         fn websearch(id: &str, summary: Option<&str>) -> AgentTool {
             AgentTool {
+                job_token_scopes: None,
                 id: id.to_string(),
                 summary: summary.map(str::to_string),
                 description: None,
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index c4a792c6a0..de33a2b9e6 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -2896,6 +2896,9 @@ pub async fn handle_wac_v2_output(
                             concurrency_settings: ConcurrencySettings::default(),
                             debouncing_settings: DebouncingSettings::default(),
                             labels: None,
+                            // Capped by the parent at push, which already holds this
+                            // script's setting.
+                            job_token_scopes: None,
                         })
                     } else {
                         Err(error::Error::internal_err(
@@ -3023,6 +3026,7 @@ pub async fn handle_wac_v2_output(
                             apply_preprocessor: false,
                             version: flow_info.version,
                             labels: flow_info.labels.clone(),
+                            job_token_scopes: flow_info.job_token_scopes.clone(),
                         };
                         let on_behalf_of = flow_info.on_behalf_of(&job.workspace_id, db).await?;
                         (ChildRunnable::Deployed(payload), on_behalf_of)
@@ -3269,9 +3273,10 @@ pub async fn handle_wac_v2_output(
                             .or(if own_runnable { None } else { job.priority }),
                         None,  // authed
                         false, // running
-                        None,  // end_user_email
-                        None,  // trigger
-                        None,  // suspended_mode
+                        job.permissioned_as_end_user_email.clone(),
+                        None, // trigger
+                        None, // suspended_mode
+                        job.job_token_scopes.as_deref(),
                     )
                     .await?;
 
@@ -3726,7 +3731,10 @@ pub async fn handle_wac_v2_output(
             // status row, the order every child completion takes.
             let segment_ms = sqlx::query_scalar!(
                 "WITH prev AS (SELECT started_at FROM v2_job_queue WHERE id = $1)
-                 UPDATE v2_job_queue q SET running = false, started_at = null
+                 UPDATE v2_job_queue q SET running = false, started_at = null,
+                     extras = CASE WHEN q.started_at IS NULL OR q.extras ? 'wac_first_started_at' THEN q.extras
+                         ELSE jsonb_set(COALESCE(q.extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(q.started_at))
+                     END
                  FROM prev WHERE q.id = $1
                  RETURNING (extract(epoch FROM now() - prev.started_at) * 1000)::bigint",
                 job.id,
@@ -4078,6 +4086,7 @@ async fn handle_dedicated_bunnative(
                             result,
                             result_columns: None,
                             mem_peak: 0,
+                            resource_usage: None,
                             canceled_by: None,
                             success,
                             cached_res_path: None,
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index 9c012fd117..6088fb4960 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -643,6 +643,7 @@ pub async fn update_worker_ping_for_failed_init_script(
                         wm_memory_usage: None,
                         job_isolation: None,
                         native_mode: None,
+                        draining: None,
                         ping_type: PingType::InitScript,
                     },
                 )
@@ -1068,12 +1069,87 @@ pub async fn start_child_process(
     Ok(child)
 }
 
+/// Which limit a resolved job timeout comes from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TimeoutSource {
+    /// The timeout set on the script or the flow step.
+    Custom,
+    /// What is left of a wall clock that the phases of one job spend down together.
+    RemainingBudget,
+    /// The instance `job_default_timeout` setting.
+    InstanceDefault,
+    /// The instance ceiling (`TIMEOUT`), which no other timeout can exceed.
+    InstanceMax,
+}
+
+impl TimeoutSource {
+    /// How to name a limit of `secs` seconds in a message shown to the job's author.
+    pub fn describe(&self, secs: u64) -> String {
+        match self {
+            TimeoutSource::Custom => {
+                format!("the {secs}s custom timeout set on the script or flow step")
+            }
+            TimeoutSource::RemainingBudget => format!(
+                "the {secs}s left of the job's timeout, which its phases share"
+            ),
+            TimeoutSource::InstanceDefault => format!(
+                "the {secs}s instance default timeout (instance setting 'Default timeout'); set a longer custom timeout on the script or flow step to raise it"
+            ),
+            TimeoutSource::InstanceMax => format!(
+                "the {secs}s instance maximum job duration (TIMEOUT env variable of the worker), which no custom or default timeout can exceed"
+            ),
+        }
+    }
+}
+
+lazy_static! {
+    static ref RUNNING_JOB_CUSTOM_TIMEOUTS: std::sync::Mutex<HashMap<Uuid, Option<i32>>> =
+        std::sync::Mutex::new(HashMap::new());
+}
+
+/// Makes a running job's custom timeout visible to the phases that are not handed it (dependency
+/// resolution, install, build), for as long as the guard lives.
+pub struct RunningJobCustomTimeout(Uuid);
+
+impl RunningJobCustomTimeout {
+    pub fn register(job_id: Uuid, custom_timeout_secs: Option<i32>) -> Self {
+        if let Ok(mut m) = RUNNING_JOB_CUSTOM_TIMEOUTS.lock() {
+            m.insert(
+                job_id,
+                windmill_common::runnable_settings::none_if_non_positive(custom_timeout_secs),
+            );
+        }
+        Self(job_id)
+    }
+}
+
+impl Drop for RunningJobCustomTimeout {
+    fn drop(&mut self) {
+        if let Ok(mut m) = RUNNING_JOB_CUSTOM_TIMEOUTS.lock() {
+            m.remove(&self.0);
+        }
+    }
+}
+
+/// `None` when the job is not registered, `Some(None)` when it runs without a custom timeout.
+fn registered_custom_timeout(job_id: Uuid) -> Option<Option<i32>> {
+    RUNNING_JOB_CUSTOM_TIMEOUTS
+        .lock()
+        .ok()
+        .and_then(|m| m.get(&job_id).copied())
+}
+
+/// Resolves the time limit of one phase of a job and where that limit comes from.
+///
+/// A phase called without a custom timeout runs under the instance default. A job's custom
+/// timeout may only lengthen such a phase, never shorten it: a short run timeout must not kill
+/// a dependency install that the instance default allows.
 pub async fn resolve_job_timeout(
     _conn: &Connection,
     _w_id: &str,
-    _job_id: Uuid,
+    job_id: Uuid,
     custom_timeout_secs: Option<i32>,
-) -> (Duration, Option<String>, bool) {
+) -> (Duration, Option<String>, TimeoutSource) {
     let mut warn_msg: Option<String> = None;
     #[cfg(feature = "cloud")]
     let cloud_premium_workspace =
@@ -1091,6 +1167,7 @@ pub async fn resolve_job_timeout(
 
     let global_max_timeout_duration =
         Duration::from_secs(max_job_duration_secs(cloud_premium_workspace));
+    let max_secs = global_max_timeout_duration.as_secs();
 
     // A `custom_timeout_secs <= 0` is not a 0-second limit but "unset": fall through to the
     // default/global-max timeout instead of killing the job immediately.
@@ -1098,34 +1175,95 @@ pub async fn resolve_job_timeout(
         Some(timeout_secs)
             if Duration::from_secs(timeout_secs as u64) < global_max_timeout_duration =>
         {
-            (Duration::from_secs(timeout_secs as u64), warn_msg, true)
+            // A phase handed anything but the job's own custom timeout was handed the rest of a
+            // shared wall clock, whatever limit that clock was started from.
+            let source =
+                if registered_custom_timeout(job_id).is_none_or(|t| t == Some(timeout_secs)) {
+                    TimeoutSource::Custom
+                } else {
+                    TimeoutSource::RemainingBudget
+                };
+            (Duration::from_secs(timeout_secs as u64), warn_msg, source)
         }
         Some(timeout_secs) => {
-            warn_msg = Some(format!("WARNING: Custom job timeout of {timeout_secs} seconds was greater than the maximum timeout. It will be ignored and the max timeout will be used instead"));
+            warn_msg = Some(format!("WARNING: Custom job timeout of {timeout_secs} seconds was greater than the instance maximum job duration of {max_secs} seconds (TIMEOUT env variable of the worker). It will be ignored and the max timeout will be used instead"));
             tracing::warn!(warn_msg);
-            (global_max_timeout_duration, warn_msg, false)
+            (
+                global_max_timeout_duration,
+                warn_msg,
+                TimeoutSource::InstanceMax,
+            )
         }
         None => {
             // fallback to default timeout or max if not set
-            let default_timeout = match JOB_DEFAULT_TIMEOUT.read().await.clone() {
-                None => global_max_timeout_duration,
+            let (default_timeout, source) = match JOB_DEFAULT_TIMEOUT.read().await.clone() {
+                None => (global_max_timeout_duration, TimeoutSource::InstanceMax),
                 Some(default_timeout_secs)
                     if Duration::from_secs(default_timeout_secs as u64)
                         < global_max_timeout_duration =>
                 {
-                    Duration::from_secs(default_timeout_secs as u64)
+                    (
+                        Duration::from_secs(default_timeout_secs as u64),
+                        TimeoutSource::InstanceDefault,
+                    )
                 }
                 Some(default_timeout_secs) => {
-                    warn_msg = Some(format!("WARNING: Default job timeout of {default_timeout_secs} seconds was greater than the maximum timeout. It will be ignored and the global max timeout will be used instead"));
+                    warn_msg = Some(format!("WARNING: Default job timeout of {default_timeout_secs} seconds was greater than the instance maximum job duration of {max_secs} seconds (TIMEOUT env variable of the worker). It will be ignored and the max timeout will be used instead"));
                     tracing::warn!(warn_msg);
-                    global_max_timeout_duration
+                    (global_max_timeout_duration, TimeoutSource::InstanceMax)
                 }
             };
-            (default_timeout, warn_msg, false)
+            let job_custom_timeout = registered_custom_timeout(job_id)
+                .flatten()
+                .map(|secs| Duration::from_secs(secs as u64));
+            let (timeout, source) = lengthen_with_job_custom_timeout(
+                default_timeout,
+                source,
+                job_custom_timeout,
+                global_max_timeout_duration,
+            );
+            (timeout, warn_msg, source)
         }
     }
 }
 
+fn lengthen_with_job_custom_timeout(
+    phase_timeout: Duration,
+    phase_source: TimeoutSource,
+    job_custom_timeout: Option<Duration>,
+    max_timeout: Duration,
+) -> (Duration, TimeoutSource) {
+    match job_custom_timeout {
+        Some(custom) if custom > phase_timeout && custom < max_timeout => {
+            (custom, TimeoutSource::Custom)
+        }
+        Some(custom) if custom > phase_timeout => (max_timeout, TimeoutSource::InstanceMax),
+        _ => (phase_timeout, phase_source),
+    }
+}
+
+#[cfg(test)]
+mod job_timeout_tests {
+    use super::{lengthen_with_job_custom_timeout, TimeoutSource};
+    use std::time::Duration;
+
+    // A phase that is not handed the job's custom timeout (dependency install, build) runs under
+    // the instance default. The custom timeout may extend it up to the instance max, but a
+    // shorter one must leave it alone.
+    #[test]
+    fn job_custom_timeout_only_lengthens_a_setup_phase() {
+        let s = Duration::from_secs;
+        let default = (s(120), TimeoutSource::InstanceDefault);
+        let resolve = |custom: Option<u64>| {
+            lengthen_with_job_custom_timeout(default.0, default.1, custom.map(s), s(600))
+        };
+        assert_eq!(resolve(None), default);
+        assert_eq!(resolve(Some(240)), (s(240), TimeoutSource::Custom));
+        assert_eq!(resolve(Some(30)), default);
+        assert_eq!(resolve(Some(900)), (s(600), TimeoutSource::InstanceMax));
+    }
+}
+
 /// Compute the nsjail timeout (in seconds) with a 15s buffer so handle_child fires first.
 pub async fn resolve_nsjail_timeout(
     conn: &Connection,
@@ -1517,6 +1655,10 @@ async fn hash_args(
     #[allow(unused)] ignore_s3_path: bool,
 ) {
     if let Some(Json(hm)) = v {
+        // Resolving an AWS OIDC storage mints a token for the job, so each storage is
+        // resolved once however many arguments point into it.
+        #[cfg(feature = "parquet")]
+        let mut storages: HashMap<Option<String>, Option<ObjectStoreResource>> = HashMap::new();
         for k in hm.keys().sorted() {
             hasher.update(k.as_bytes());
             let arg_value = hm.get(k).unwrap();
@@ -1524,18 +1666,21 @@ async fn hash_args(
             #[cfg(feature = "parquet")]
             let etag = match serde_json::from_str::<S3Object>(arg_value.get()).ok() {
                 Some(s3_object) => {
-                    let s3_resource = get_workspace_s3_resource_path(
-                        db,
-                        client,
-                        workspace_id,
-                        s3_object.storage.as_ref(),
-                        job_id,
-                    )
-                    .await
-                    .ok()
-                    .flatten();
-                    match s3_resource {
-                        Some(s3_resource) => get_etag_or_empty(&s3_resource, s3_object).await,
+                    if !storages.contains_key(&s3_object.storage) {
+                        let s3_resource = get_workspace_s3_resource_path(
+                            db,
+                            client,
+                            workspace_id,
+                            s3_object.storage.as_ref(),
+                            job_id,
+                        )
+                        .await
+                        .ok()
+                        .flatten();
+                        storages.insert(s3_object.storage.clone(), s3_resource);
+                    }
+                    match storages.get(&s3_object.storage).and_then(Option::as_ref) {
+                        Some(s3_resource) => get_etag_or_empty(s3_resource, s3_object).await,
                         None => None,
                     }
                 }
@@ -1581,6 +1726,23 @@ pub async fn cached_result_path(
         hasher.update(b"wac_step:");
         hasher.update(step_key.as_bytes());
     }
+    // What a run returns can depend on who it ran for (`WM_END_USER_EMAIL`, a data table used
+    // as the viewer), so a result cached for one viewer is never served to another. Read from
+    // `job_perms`: a flow job re-fetched between steps does not carry it.
+    let end_user: Option<Option<String>> = sqlx::query_scalar(
+        "SELECT end_user_email FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
+    )
+    .bind(job.id)
+    .bind(&job.workspace_id)
+    .fetch_optional(db)
+    .await?;
+    // Length-prefixed: the arguments follow undelimited, and the end of one viewer's address
+    // must not read as the start of another run's first argument name.
+    if let Some(end_user) = end_user.flatten() {
+        hasher.update(b"end_user:");
+        hasher.update((end_user.len() as u64).to_le_bytes());
+        hasher.update(end_user.as_bytes());
+    }
     hash_args(
         db,
         client,
@@ -1817,6 +1979,18 @@ pub async fn save_in_cache(
     CACHED_RESULTS.insert(cached_path, Arc::new(store_cache_resource));
 }
 
+pub(crate) fn deno_not_installed_error() -> Error {
+    Error::ExecutionErr(format!(
+        "Deno is not installed on this worker (looked for it at {}). The standard Windmill images \
+         no longer ship Deno: official support for it on those images was discontinued after Deno \
+         announced the end of development of the Deno runtime (https://deno.com/blog/cloudflare). \
+         We recommend migrating this script to Bun. To keep running Deno scripts, use the \
+         windmill-full or windmill-ee-full image on every worker that accepts the deno tag, or \
+         install Deno on them and point DENO_PATH at it.",
+        crate::DENO_PATH.as_str()
+    ))
+}
+
 fn tentatively_improve_error(err: Error, executable: &str) -> Error {
     #[cfg(unix)]
     let err_msgs = vec!["os error 2", "os error 3", "No such file or directory"];
@@ -1825,6 +1999,11 @@ fn tentatively_improve_error(err: Error, executable: &str) -> Error {
     let err_msgs = vec!["program not found", "os error 2", "os error 3"];
 
     if err_msgs.iter().any(|msg| err.to_string().contains(msg)) {
+        // An absolute DENO_PATH is checked before spawning, where a missing job dir
+        // cannot be mistaken for a missing binary.
+        if executable == crate::DENO_PATH.as_str() && !Path::new(executable).is_absolute() {
+            return deno_not_installed_error();
+        }
         return Error::internal_err(format!(
             "Executable {executable} not found on worker. PATH: {}",
             *PATH_ENV
@@ -2309,9 +2488,56 @@ mod tests {
             visible_to_owner: false,
             permissioned_as_end_user_email: None,
             runnable_settings_handle: None,
+            job_token_scopes: None,
         }
     }
 
+    // A cache hit returns before the job runs, so the key is all that keeps a result computed
+    // for one viewer (a data table used as the viewer, `WM_END_USER_EMAIL`) from another.
+    #[sqlx::test(migrations = "../migrations")]
+    async fn a_cached_result_is_keyed_by_the_recorded_viewer(pool: sqlx::PgPool) {
+        let client = test_client();
+
+        // The last two differ only in where the viewer's address ends and the first argument
+        // name starts.
+        let mut paths = vec![];
+        for (viewer, arg) in [
+            (Some("a@windmill.dev"), "mode"),
+            (Some("a@windmill.dev"), "mode"),
+            (Some("b@windmill.dev"), "mode"),
+            (None, "mode"),
+            (Some("a@windmill.co"), "mode"),
+            (Some("a@windmill.com"), "ode"),
+        ] {
+            let args = HashMap::from([(arg.to_string(), to_raw_value(&"all"))]);
+            let job = MiniPulledJob {
+                id: uuid::Uuid::new_v4(),
+                args: Some(sqlx::types::Json(args)),
+                ..test_job()
+            };
+            sqlx::query(
+                "INSERT INTO job_perms (job_id, email, username, is_admin, is_operator,
+                     workspace_id, groups, folders, end_user_email)
+                 VALUES ($1, 'publisher@windmill.dev', 'publisher', false, false, 'test', '{}',
+                     '{}', $2)",
+            )
+            .bind(job.id)
+            .bind(viewer)
+            .execute(&pool)
+            .await
+            .unwrap();
+            paths.push(cached_result_path(&pool, &client, &job, None).await.unwrap());
+        }
+        assert_eq!(
+            paths[0], paths[1],
+            "one viewer shares their own cached result"
+        );
+        assert_ne!(paths[0], paths[2], "two viewers share a cached result");
+        assert_ne!(paths[0], paths[3]);
+        assert_ne!(paths[2], paths[3]);
+        assert_ne!(paths[4], paths[5], "an address runs into the argument names");
+    }
+
     #[tokio::test]
     async fn test_transform_array_over_1000_passthrough() {
         let db_url = std::env::var("DATABASE_URL")
diff --git a/backend/windmill-worker/src/csharp_executor.rs b/backend/windmill-worker/src/csharp_executor.rs
index d393171f7f..7d77f8703f 100644
--- a/backend/windmill-worker/src/csharp_executor.rs
+++ b/backend/windmill-worker/src/csharp_executor.rs
@@ -33,7 +33,7 @@ use crate::{
     get_proxy_envs_for_lang,
     handle_child::handle_child,
     is_sandboxing_enabled, read_ee_registry_with_workspace_override, CSHARP_CACHE_DIR,
-    DISABLE_NUSER, DOTNET_PATH, HOME_ENV, NSJAIL_PATH, NUGET_CONFIG, PATH_ENV,
+    DISABLE_NUSER, DOTNET_PATH, HOME_ENV, NSJAIL_PATH, NUGET_CONFIG, PATH_ENV, PROXY_ENVS,
     TRACING_PROXY_CA_CERT_PATH, TZ_ENV,
 };
 #[cfg(feature = "csharp")]
@@ -47,6 +47,9 @@ use crate::SYSTEM_ROOT;
 
 #[cfg(feature = "csharp")]
 const NSJAIL_CONFIG_RUN_CSHARP_CONTENT: &str = include_str!("../nsjail/run.csharp.config.proto");
+#[cfg(feature = "csharp")]
+const NSJAIL_CONFIG_BUILD_CSHARP_CONTENT: &str =
+    include_str!("../nsjail/build.csharp.config.proto");
 
 #[cfg(feature = "csharp")]
 #[cfg(windows)]
@@ -124,6 +127,9 @@ pub async fn generate_nuget_lockfile(
 
     gen_cs_proj(code, job_dir, reqs, lines_to_remove)?;
 
+    // `dotnet restore` resolves and downloads packages but does not import their
+    // MSBuild `build/*.targets`, so it runs no package code — only `dotnet publish`
+    // (jailed below) does — so it runs unsandboxed.
     let mut gen_lockfile_cmd = Command::new(DOTNET_PATH.as_str());
     gen_lockfile_cmd
         .current_dir(job_dir)
@@ -384,31 +390,82 @@ async fn build_cs_proj(
         }
     }
 
-    let mut build_cs_cmd = Command::new(DOTNET_PATH.as_str());
-    build_cs_cmd
-        .current_dir(job_dir)
-        .env_clear()
-        .env("PATH", PATH_ENV.as_str())
-        .env("BASE_INTERNAL_URL", base_internal_url)
-        .env("HOME", HOME_ENV.as_str())
-        .env("DOTNET_CLI_HOME", &*CSHARP_CACHE_DIR)
-        .env("NUGET_PACKAGES", format!("{}/nuget", *CSHARP_CACHE_DIR))
-        .env("DOTNET_CLI_TELEMETRY_OPTOUT", "true")
-        .env("DOTNET_NOLOGO", "true")
-        .env("MSBUILDDISABLENODEREUSE", "1")
-        .env("DOTNET_ROOT", DOTNET_ROOT.as_str())
-        .args(vec![
-            "publish",
-            "--configuration",
-            "Release",
-            "-o",
-            &format!("{job_dir}/out"),
-            "--no-self-contained",
-            "-p:PublishSingleFile=true",
-            "-p:IncludeNativeLibrariesForSelfExtract=true",
-        ])
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
+    let out_dir = format!("{job_dir}/out");
+    let publish_args = vec![
+        "publish",
+        "--configuration",
+        "Release",
+        "-o",
+        out_dir.as_str(),
+        "--no-self-contained",
+        "-p:PublishSingleFile=true",
+        "-p:IncludeNativeLibrariesForSelfExtract=true",
+    ];
+    // `dotnet publish` imports and runs the MSBuild targets/tasks of restored NuGet
+    // packages (a package's build/*.targets execute at build, not at restore), i.e.
+    // arbitrary package code. Confine it under nsjail when sandboxing is on, the same
+    // way the run step is; HOME is set to /tmp by the config, keep_env passes the
+    // explicit dotnet/proxy vars, and the job dir + shared nuget cache are writable.
+    // Without sandboxing, publish runs directly with no isolation.
+    // mut is required by the #[cfg(windows)] env block below; unused on unix.
+    #[allow(unused_mut)]
+    let mut build_cs_cmd = if is_sandboxing_enabled() {
+        std::fs::create_dir_all(&*CSHARP_CACHE_DIR)?;
+        let nsjail_timeout = resolve_nsjail_timeout(conn, w_id, *job_id, None).await;
+        write_file(
+            job_dir,
+            "build.config.proto",
+            NSJAIL_CONFIG_BUILD_CSHARP_CONTENT
+                .replace("{TIMEOUT}", &nsjail_timeout)
+                .replace("{JOB_DIR}", job_dir)
+                .replace("{CSHARP_CACHE_DIR}", &*CSHARP_CACHE_DIR)
+                .replace("{DOTNET_ROOT}", DOTNET_ROOT.as_str())
+                .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
+                .replace("{TRACING_PROXY_CA_CERT_PATH}", &*TRACING_PROXY_CA_CERT_PATH)
+                .replace("#{DEV}", DEV_CONF_NSJAIL)
+                .replace(
+                    "{TMP_MOUNT_BLOCK}",
+                    &resolve_nsjail_tmp_mount_block(job_dir).await,
+                )
+                .as_str(),
+        )?;
+        let mut nsjail_args = vec!["--config", "build.config.proto", "--", DOTNET_PATH.as_str()];
+        nsjail_args.extend(publish_args.iter().copied());
+        let mut cmd = Command::new(NSJAIL_PATH.as_str());
+        cmd.current_dir(job_dir)
+            .env_clear()
+            .env("PATH", PATH_ENV.as_str())
+            .env("BASE_INTERNAL_URL", base_internal_url)
+            .env("DOTNET_CLI_HOME", &*CSHARP_CACHE_DIR)
+            .env("NUGET_PACKAGES", format!("{}/nuget", *CSHARP_CACHE_DIR))
+            .env("DOTNET_CLI_TELEMETRY_OPTOUT", "true")
+            .env("DOTNET_NOLOGO", "true")
+            .env("MSBUILDDISABLENODEREUSE", "1")
+            .env("DOTNET_ROOT", DOTNET_ROOT.as_str())
+            .envs(PROXY_ENVS.clone())
+            .envs(&*crate::worker::WHITELIST_ENVS)
+            .args(nsjail_args)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped());
+        cmd
+    } else {
+        let mut cmd = Command::new(DOTNET_PATH.as_str());
+        cmd.current_dir(job_dir)
+            .env_clear()
+            .env("PATH", PATH_ENV.as_str())
+            .env("BASE_INTERNAL_URL", base_internal_url)
+            .env("HOME", HOME_ENV.as_str())
+            .env("DOTNET_CLI_HOME", &*CSHARP_CACHE_DIR)
+            .env("NUGET_PACKAGES", format!("{}/nuget", *CSHARP_CACHE_DIR))
+            .env("DOTNET_CLI_TELEMETRY_OPTOUT", "true")
+            .env("DOTNET_NOLOGO", "true")
+            .env("MSBUILDDISABLENODEREUSE", "1")
+            .env("DOTNET_ROOT", DOTNET_ROOT.as_str())
+            .args(publish_args.clone())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped());
+        cmd
+    };
 
     #[cfg(windows)]
     build_cs_cmd
@@ -433,14 +490,20 @@ async fn build_cs_proj(
                 .unwrap_or_else(|_| format!("{}\\AppData\\Local", HOME_ENV.as_str())),
         );
 
-    let build_cs_process = start_child_process(build_cs_cmd, DOTNET_PATH.as_str(), true).await?;
+    let build_cs_executable = if is_sandboxing_enabled() {
+        NSJAIL_PATH.as_str()
+    } else {
+        DOTNET_PATH.as_str()
+    };
+    let build_cs_process = start_child_process(build_cs_cmd, build_cs_executable, true).await?;
     handle_child(
         job_id,
         conn,
         mem_peak,
         canceled_by,
         build_cs_process,
-        false,
+        // jailed when sandboxing is on, so mem sampling finds the real process
+        is_sandboxing_enabled(),
         worker_name,
         w_id,
         "dotnet publish",
diff --git a/backend/windmill-worker/src/dbt_executor.rs b/backend/windmill-worker/src/dbt_executor.rs
index 8119897d6d..90db1b9795 100644
--- a/backend/windmill-worker/src/dbt_executor.rs
+++ b/backend/windmill-worker/src/dbt_executor.rs
@@ -779,6 +779,7 @@ pub(crate) async fn dbt_dep(
     // A dependency job carries no per-job timeout of its own, but its phases
     // still share one wall clock rather than each getting the instance-wide
     // one.
+    let _custom_timeout = crate::common::RunningJobCustomTimeout::register(*job_id, None);
     let deadline = JobDeadline::start(&conn, w_id, *job_id, None).await;
     let mut ctx = JobCtx { mem_peak, canceled_by, occupancy_metrics, worker_name, deadline };
     let prepared = prepare_project(
@@ -3560,11 +3561,10 @@ async fn attach_column_index(
         .iter()
         .map(|n| n.unique_id.as_str())
         .collect();
-    let index =
-        crate::dbt_column_index::collect(
-            p, descriptor, inv, command, ctx, job_id, w_id, conn, &kept,
-        )
-            .await?;
+    let index = crate::dbt_column_index::collect(
+        p, descriptor, inv, command, ctx, job_id, w_id, conn, &kept,
+    )
+    .await?;
     drop(kept);
     let Some(index) = index else {
         return Ok(());
diff --git a/backend/windmill-worker/src/deno_executor.rs b/backend/windmill-worker/src/deno_executor.rs
index 2c5c17bb27..58388c3cfd 100644
--- a/backend/windmill-worker/src/deno_executor.rs
+++ b/backend/windmill-worker/src/deno_executor.rs
@@ -7,7 +7,8 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        build_command_with_isolation, create_args_and_out_file, get_reserved_variables,
+        build_command_with_isolation, create_args_and_out_file, deno_not_installed_error,
+        get_reserved_variables,
         parse_npm_config, read_file, read_result, start_child_process, OccupancyMetrics,
         StreamNotifier,
     },
@@ -155,6 +156,17 @@ async fn get_common_deno_proc_envs(
     return deno_envs;
 }
 
+/// A spawn failure only names Deno when Deno itself is the spawned executable; behind an
+/// isolation wrapper or a dedicated worker it surfaces as an opaque exit. A bare `DENO_PATH`
+/// is resolved through PATH at spawn time, so it is left to the spawn error.
+fn ensure_deno_installed() -> Result<()> {
+    let path = std::path::Path::new(DENO_PATH.as_str());
+    if path.is_absolute() && !path.exists() {
+        return Err(deno_not_installed_error());
+    }
+    Ok(())
+}
+
 pub async fn generate_deno_lock(
     job_id: &Uuid,
     code: &str,
@@ -167,6 +179,7 @@ pub async fn generate_deno_lock(
     base_internal_url: &str,
     occupancy_metrics: &mut Option<&mut OccupancyMetrics>,
 ) -> error::Result<String> {
+    ensure_deno_installed()?;
     let _ = write_file(job_dir, "main.ts", code)?;
 
     let import_map_path = format!("{job_dir}/import_map.json");
@@ -249,6 +262,7 @@ pub async fn handle_deno_job(
     occupancy_metrics: &mut OccupancyMetrics,
     has_stream: &mut bool,
 ) -> error::Result<Box<RawValue>> {
+    ensure_deno_installed()?;
     let annotations = TypeScriptAnnotations::parse(inner_content);
 
     // let mut start = Instant::now();
@@ -745,6 +759,7 @@ pub async fn start_worker(
 
     use crate::common::build_envs_map;
 
+    ensure_deno_installed()?;
     let _ = write_file(job_dir, "main.ts", inner_content)?;
     let common_deno_proc_envs = get_common_deno_proc_envs(
         &token,
diff --git a/backend/windmill-worker/src/duckdb_executor.rs b/backend/windmill-worker/src/duckdb_executor.rs
index b8c850a2f4..58e47b9332 100644
--- a/backend/windmill-worker/src/duckdb_executor.rs
+++ b/backend/windmill-worker/src/duckdb_executor.rs
@@ -2758,6 +2758,7 @@ async fn transform_attach_datatable(
                 DatatableAccess::PermissionedAs {
                     permissioned_as: &job.permissioned_as,
                     email: &job.permissioned_as_email,
+                    end_user_email: job.permissioned_as_end_user_email.as_deref(),
                 },
             )
             .await?
diff --git a/backend/windmill-worker/src/handle_child.rs b/backend/windmill-worker/src/handle_child.rs
index 3c9be1f4c5..31eb8034f9 100644
--- a/backend/windmill-worker/src/handle_child.rs
+++ b/backend/windmill-worker/src/handle_child.rs
@@ -49,7 +49,7 @@ use futures::{
     stream, StreamExt,
 };
 
-use crate::common::{resolve_job_timeout, OccupancyMetrics, StreamNotifier};
+use crate::common::{resolve_job_timeout, OccupancyMetrics, StreamNotifier, TimeoutSource};
 use crate::job_logger::{append_job_logs, append_result_stream, append_with_limit, strip_nul};
 use crate::job_logger_oss::process_streaming_log_lines;
 use crate::worker_utils::{ping_job_status, update_worker_ping_from_job};
@@ -59,6 +59,56 @@ use windmill_common::tracing_init::{OTEL_JOB_LOGS, OTEL_PREFIX, QUIET_MODE, VERB
 
 lazy_static::lazy_static! {
     pub static ref SLOW_LOGS: bool = std::env::var("SLOW_LOGS").ok().is_some_and(|x| x == "1" || x == "true");
+    // A job runs several children in turn (install, build, run): their CPU time adds up
+    // here until the job completes.
+    static ref JOB_CPU_TIME_MS: std::sync::Mutex<std::collections::HashMap<Uuid, i64>> = Default::default();
+}
+
+/// CPU time of the children run so far for the job, which stops being tracked.
+pub(crate) fn take_job_cpu_time_ms(job_id: &Uuid) -> Option<i64> {
+    JOB_CPU_TIME_MS.lock().unwrap().remove(job_id)
+}
+
+/// CPU time in ms from the content of `/proc/<pid>/stat`: the process's own user and
+/// system time plus that of the children it waited for, which is where the time of a
+/// job run under a wrapper (nsjail, unshare) ends up.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn parse_proc_stat_cpu_ms(stat: &str) -> Option<i64> {
+    // The values are in USER_HZ ticks, which Linux fixes at 100 per second.
+    const MS_PER_TICK: i64 = 10;
+    // `comm` is free text in parentheses: the numbered fields resume after its last `)`,
+    // with the state as field 3 and utime, stime, cutime, cstime as fields 14 to 17.
+    let fields: Vec<&str> = stat.rsplit_once(')')?.1.split_ascii_whitespace().collect();
+    let ticks = fields
+        .get(11..15)?
+        .iter()
+        .map(|f| f.parse::<i64>().ok())
+        .sum::<Option<i64>>()?;
+    Some(ticks * MS_PER_TICK)
+}
+
+/// Resolves once the child has exited, to its CPU time. The child is left un-reaped:
+/// `/proc/<pid>/stat` is only readable until then, so the caller reaps afterwards.
+#[cfg(target_os = "linux")]
+async fn wait_for_exit_cpu_time_ms(pid: u32) -> Option<i64> {
+    use nix::sys::wait::{waitid, Id, WaitPidFlag};
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    // A plain thread rather than `spawn_blocking`: the wait cannot be cancelled, and a
+    // blocking task still parked on a live child would hold up the runtime's shutdown.
+    std::thread::Builder::new()
+        .name("job-cpu-time".to_string())
+        .spawn(move || {
+            let cpu = waitid(
+                Id::Pid(Pid::from_raw(pid as i32)),
+                WaitPidFlag::WEXITED | WaitPidFlag::WNOWAIT,
+            )
+            .ok()
+            .and_then(|_| std::fs::read_to_string(format!("/proc/{pid}/stat")).ok())
+            .and_then(|stat| parse_proc_stat_cpu_ms(&stat));
+            let _ = tx.send(cpu);
+        })
+        .ok()?;
+    rx.await.ok().flatten()
 }
 
 //  - kill windows process along with all child processes
@@ -181,7 +231,7 @@ pub async fn handle_child(
 
     enum KillReason {
         TooManyLogs,
-        Timeout { is_job_specific: bool },
+        Timeout { phase: String, source: TimeoutSource, secs: u64 },
         Cancelled(Option<CanceledBy>),
         AlreadyCompleted,
     }
@@ -190,11 +240,9 @@ pub async fn handle_child(
         fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
             match self {
                 KillReason::TooManyLogs => f.write_str("too many logs (max size: 2MB)"),
-                KillReason::Timeout { is_job_specific } => f.write_str(if *is_job_specific {
-                    "timeout after exceeding job-specific duration limit"
-                } else {
-                    "timeout after exceeding instance-wide job duration limit"
-                }),
+                KillReason::Timeout { phase, source, secs } => {
+                    write!(f, "timeout: `{phase}` exceeded {}", source.describe(*secs))
+                }
                 KillReason::Cancelled(canceled_by) => {
                     let mut reason = "cancelled".to_string();
                     if let Some(canceled_by) = canceled_by {
@@ -212,7 +260,54 @@ pub async fn handle_child(
         }
     }
 
-    let (timeout_duration, timeout_warn_msg, is_job_specific) =
+    impl KillReason {
+        /// Reports a kill once the process is gone: a span event on the enclosing span and,
+        /// through the logs bridge, a log record carrying the job's log context.
+        fn emit_canceled_event(
+            &self,
+            job_id: &Uuid,
+            timeout_reason: &str,
+            signal: &'static str,
+            detected_at: chrono::DateTime<chrono::Utc>,
+        ) {
+            // `force` is only known for a soft cancel: a job completed under the worker
+            // may have been force canceled or completed by anything else server-side.
+            let (kill_reason, canceled_by, canceled_reason, force) = match self {
+                KillReason::TooManyLogs => return,
+                KillReason::Timeout { .. } => {
+                    ("timeout", Some("timeout"), Some(timeout_reason), None)
+                }
+                KillReason::Cancelled(by) => (
+                    "cancelled",
+                    by.as_ref().and_then(|x| x.username.as_deref()),
+                    by.as_ref().and_then(|x| x.reason.as_deref()),
+                    Some(false),
+                ),
+                KillReason::AlreadyCompleted => ("already_completed", None, None, None),
+            };
+            let exited_at = chrono::Utc::now();
+            let root_job = windmill_common::log_context::current_log_context()
+                .and_then(|c| c.root_job.clone());
+            let rfc3339 = |t: chrono::DateTime<chrono::Utc>| {
+                t.to_rfc3339_opts(chrono::SecondsFormat::Millis, true)
+            };
+            tracing::info!(
+                job_id = %job_id,
+                root_job,
+                kill_reason,
+                canceled_by,
+                canceled_reason,
+                force,
+                kill_signal = signal,
+                cancel_detected_at = %rfc3339(detected_at),
+                process_exited_at = %rfc3339(exited_at),
+                kill_duration_ms = (exited_at - detected_at).num_milliseconds(),
+                "job.canceled"
+            );
+        }
+    }
+
+    let (timeout_duration, timeout_warn_msg, timeout_source) =
         resolve_job_timeout(&conn, w_id, job_id, custom_timeout).await;
     if let Some(msg) = timeout_warn_msg {
         append_logs(&job_id, w_id, msg.as_str(), conn).await;
@@ -222,28 +317,40 @@ pub async fn handle_child(
     let wait_on_child = async {
         let kill_reason = tokio::select! {
             biased;
-            result = Box::into_pin(child.wait()) => return result.map(Ok),
+            result = async {
+                #[cfg(target_os = "linux")]
+                if let Some(pid) = pid.filter(|_| job_id != Uuid::nil()) {
+                    if let Some(cpu) = wait_for_exit_cpu_time_ms(pid).await {
+                        *JOB_CPU_TIME_MS.lock().unwrap().entry(job_id).or_insert(0) += cpu;
+                    }
+                }
+                Box::into_pin(child.wait()).await
+            } => return result.map(Ok),
             Ok(()) = too_many_logs.changed() => KillReason::TooManyLogs,
-            _ = sleep(timeout_duration) => KillReason::Timeout { is_job_specific },
+            _ = sleep(timeout_duration) => KillReason::Timeout {
+                phase: child_name.to_string(),
+                source: timeout_source,
+                secs: timeout_duration.as_secs(),
+            },
             ex = update_job, if job_id != Uuid::nil() => match ex {
                 UpdateJobPollingExit::Done(canceled_by) => KillReason::Cancelled(canceled_by),
                 UpdateJobPollingExit::AlreadyCompleted => KillReason::AlreadyCompleted,
             },
         };
+        let detected_at = chrono::Utc::now();
         tx.send(()).expect("rx should never be dropped");
         drop(tx);
 
+        let timeout_reason = format!(
+            "`{child_name}` exceeded {}",
+            timeout_source.describe(timeout_duration.as_secs())
+        );
         let set_reason = async {
             if matches!(kill_reason, KillReason::Timeout { .. }) {
                 match conn {
                     Connection::Sql(db) => {
-                        if let Err(err) = set_job_cancelled_query(
-                            job_id,
-                            db,
-                            "timeout",
-                            &format!("duration > {}", timeout_duration.as_secs()),
-                        )
-                        .await
+                        if let Err(err) =
+                            set_job_cancelled_query(job_id, db, "timeout", &timeout_reason).await
                         {
                             tracing::error!(%job_id, %err, "error setting cancelation reason for job {job_id}: {err}");
                         }
@@ -255,7 +362,7 @@ pub async fn handle_child(
                                 None,
                                 &JobCancelled {
                                     canceled_by: "timeout".to_string(),
-                                    reason: format!("duration > {}", timeout_duration.as_secs()),
+                                    reason: timeout_reason.clone(),
                                 },
                             )
                             .await
@@ -267,59 +374,78 @@ pub async fn handle_child(
             }
         };
 
-        #[allow(unused_variables)]
-        if let Some(id) = child.id() {
-            if *MAX_WAIT_FOR_SIGINT > 0 {
-                #[cfg(any(target_os = "linux", target_os = "macos"))]
-                signal::kill(Pid::from_raw(id as i32), Signal::SIGINT).unwrap();
+        // Resolves once the process is reaped, to the last signal it was sent, or to `None`
+        // when the kill could not be confirmed. SIGINT and SIGTERM are only sent where the
+        // sends below are compiled in: elsewhere an exit during their wait is unsignaled.
+        let unix_signal = |s: &'static str| {
+            if cfg!(any(target_os = "linux", target_os = "macos")) { s } else { "none" }
+        };
+        let kill = async {
+            #[allow(unused_variables)]
+            if let Some(id) = child.id() {
+                if *MAX_WAIT_FOR_SIGINT > 0 {
+                    #[cfg(any(target_os = "linux", target_os = "macos"))]
+                    signal::kill(Pid::from_raw(id as i32), Signal::SIGINT).unwrap();
 
-                for _ in 0..*MAX_WAIT_FOR_SIGINT {
+                    for _ in 0..*MAX_WAIT_FOR_SIGINT {
+                        if child.try_wait().is_ok_and(|x| x.is_some()) {
+                            break;
+                        }
+                        sleep(Duration::from_secs(1)).await;
+                    }
                     if child.try_wait().is_ok_and(|x| x.is_some()) {
-                        break;
+                        set_reason.await;
+                        return Ok(Some(unix_signal("SIGINT")));
                     }
-                    sleep(Duration::from_secs(1)).await;
                 }
-                if child.try_wait().is_ok_and(|x| x.is_some()) {
-                    set_reason.await;
-                    return Ok(Err(kill_reason));
+                if sigterm {
+                    #[cfg(any(target_os = "linux", target_os = "macos"))]
+                    signal::kill(Pid::from_raw(id as i32), Signal::SIGTERM).unwrap();
+
+                    for _ in 0..*MAX_WAIT_FOR_SIGTERM {
+                        if child.try_wait().is_ok_and(|x| x.is_some()) {
+                            break;
+                        }
+                        sleep(Duration::from_secs(1)).await;
+                    }
+                    if child.try_wait().is_ok_and(|x| x.is_some()) {
+                        set_reason.await;
+                        return Ok(Some(unix_signal("SIGTERM")));
+                    }
                 }
             }
-            if sigterm {
-                #[cfg(any(target_os = "linux", target_os = "macos"))]
-                signal::kill(Pid::from_raw(id as i32), Signal::SIGTERM).unwrap();
-
-                for _ in 0..*MAX_WAIT_FOR_SIGTERM {
-                    if child.try_wait().is_ok_and(|x| x.is_some()) {
-                        break;
+            #[cfg(windows)]
+            {
+                let pid_to_kill = child.id();
+                let killed = match kill_process_tree(pid_to_kill).await {
+                    Ok(_) => {
+                        tracing::debug!(
+                            "successfully killed process tree with PID: {:?}",
+                            pid_to_kill
+                        );
+                        true
                     }
-                    sleep(Duration::from_secs(1)).await;
-                }
-                if child.try_wait().is_ok_and(|x| x.is_some()) {
-                    set_reason.await;
-                    return Ok(Err(kill_reason));
-                }
+                    Err(e) => {
+                        tracing::error!("failed to kill process tree: {:?}", e);
+                        false
+                    }
+                };
+                set_reason.await;
+                return Ok(killed.then_some("taskkill"));
             }
-        }
-        #[cfg(windows)]
-        {
-            let pid_to_kill = child.id();
-            match kill_process_tree(pid_to_kill).await {
-                Ok(_) => tracing::debug!(
-                    "successfully killed process tree with PID: {:?}",
-                    pid_to_kill
-                ),
-                Err(e) => tracing::error!("failed to kill process tree: {:?}", e),
-            };
-            set_reason.await;
-            return Ok(Err(kill_reason));
-        }
 
-        #[cfg(unix)]
-        {
-            /* send SIGKILL and reap child process */
-            let (_, kill) = future::join(set_reason, Box::into_pin(child.kill())).await;
-            kill.map(|()| Err(kill_reason))
+            #[cfg(unix)]
+            {
+                /* send SIGKILL and reap child process */
+                let (_, kill) = future::join(set_reason, Box::into_pin(child.kill())).await;
+                kill.map(|()| Some("SIGKILL"))
+            }
+        };
+        let signal: io::Result<Option<&'static str>> = kill.await;
+        if let Some(signal) = signal? {
+            kill_reason.emit_canceled_event(&job_id, &timeout_reason, signal, detected_at);
         }
+        Ok(Err(kill_reason))
     };
 
     let mut stream_result = Vec::new();
@@ -956,9 +1082,9 @@ where
 
     let conn = conn.clone();
     // No tick at t=0: a job that finishes within the first interval issues none of the
-    // ping/metric statements below. Cancels are picked up by the first job ping (500 ms in,
-    // 2 s on agent workers). Memory is still sampled at start, without SQL: it is the only
-    // `mem_peak` reading a short job gets, and the completed job row reports it.
+    // ping/metric statements below. Cancels are picked up by the next job ping. Memory is still
+    // sampled at start, without SQL: it is the only `mem_peak` reading a short job gets,
+    // and the completed job row reports it.
     let mut interval = interval_at(Instant::now() + update_job_interval, update_job_interval);
     interval.set_missed_tick_behavior(MissedTickBehavior::Skip);
     *mem_peak = (*mem_peak).max(get_mem.next().await.unwrap_or(0));
@@ -981,6 +1107,7 @@ where
                     let wm_memory_usage = get_windmill_memory_usage();
                     tracing::info!("job {job_id} on {worker_name} in {w_id} worker memory snapshot {}kB/{}kB", memory_usage.unwrap_or_default()/1024, wm_memory_usage.unwrap_or_default()/1024);
                     let occupancy = occupancy_metrics.as_mut().map(|x| x.update_occupancy_metrics());
+                    crate::resource_metrics::record_worker_resources(worker_name, memory_usage, wm_memory_usage, occupancy.as_ref());
                     if job_id != Uuid::nil() {
                         if let Err(err) = update_worker_ping_from_job(&conn, &job_id, w_id, worker_name, memory_usage, wm_memory_usage, occupancy).await {
                             tracing::error!("Unable to update worker ping for job {} in workspace {}. Error was: {:?}", job_id, w_id, err);
@@ -1022,11 +1149,10 @@ where
                             }
                         }
                     }
-                    if matches!(conn, Connection::Http(_)) {
-                        if i % 4 != 0 {
-                            // only ping every 4th time (2s) on http agent mode
-                            continue;
-                        }
+                    // An agent worker pays an HTTP round trip per ping, so it pings every 2 s for
+                    // the first 10 s, then every 5 s.
+                    if matches!(conn, Connection::Http(_)) && i % if i < 20 { 4 } else { 10 } != 0 {
+                        continue;
                     }
                     let ping_job_status = ping_job_status(&conn, &job_id, Some(*mem_peak), if current_mem > 0 { Some(current_mem) } else { None }).await.unwrap_or_else(|e| {
                         tracing::error!("Unable to ping job status for job {job_id}. Error was: {:?}", e);
@@ -1073,8 +1199,8 @@ fn child_joined_output_stream(
         .take()
         .expect("child did not have a handle to stdout");
 
-    let stdout = BufReader::new(stdout).lines();
-    let stderr = BufReader::new(stderr).lines();
+    let stdout = BufReader::new(stdout).split(b'\n');
+    let stderr = BufReader::new(stderr).split(b'\n');
     stream::select(
         lines_to_stream(stderr, true, job_id.clone(), w_id.clone())
             .map(|l| l.map(|line| OutputLine { stderr: true, line })),
@@ -1084,18 +1210,32 @@ fn child_joined_output_stream(
 }
 
 pub fn lines_to_stream<R: tokio::io::AsyncBufRead + Unpin>(
-    mut lines: tokio::io::Lines<R>,
+    mut lines: tokio::io::Split<R>,
     stderr: bool,
     job_id: Uuid,
     w_id: String,
 ) -> impl futures::Stream<Item = io::Result<String>> {
     stream::poll_fn(move |cx| {
         std::pin::Pin::new(&mut lines)
-            .poll_next_line(cx)
-            .map(|result| process_streaming_log_lines(result, stderr, &job_id, &w_id))
+            .poll_next_segment(cx)
+            .map(|result| {
+                let result = result.map(|segment| segment.map(decode_output_line));
+                process_streaming_log_lines(result, stderr, &job_id, &w_id)
+            })
     })
 }
 
+/// Child output is not guaranteed to be UTF-8 (e.g. pwsh on Windows writes in the
+/// console code page), so decode lossily: a strict decode errors out and ends log
+/// capture for the rest of the job. Strips a trailing `\r` so CRLF output doesn't keep it.
+pub(crate) fn decode_output_line(mut segment: Vec<u8>) -> String {
+    if segment.last() == Some(&b'\r') {
+        segment.pop();
+    }
+    String::from_utf8(segment)
+        .unwrap_or_else(|err| String::from_utf8_lossy(err.as_bytes()).into_owned())
+}
+
 pub fn process_status(
     program: &str,
     status: ExitStatus,
@@ -1132,6 +1272,21 @@ pub fn process_status(
 mod tests {
     use super::*;
 
+    #[test]
+    fn proc_stat_cpu_time_survives_a_hostile_process_name() {
+        // utime 150, stime 50, cutime 700, cstime 100 ticks: 1000 ticks, 10 s.
+        let tail = "Z 1 42 42 0 -1 4194560 100 200 0 0 150 50 700 100 20 0 1 0 12345 0 0";
+        assert_eq!(
+            parse_proc_stat_cpu_ms(&format!("42 (bun) {tail}")),
+            Some(10_000)
+        );
+        assert_eq!(
+            parse_proc_stat_cpu_ms(&format!("42 (a) R 9 (9 9 9 9 9 9 9 9 9) {tail}")),
+            Some(10_000)
+        );
+        assert_eq!(parse_proc_stat_cpu_ms("42 (bun) Z 1 42"), None);
+    }
+
     // A non-positive timeout means "unset" to `resolve_job_timeout`, so an
     // exhausted budget that reported 0 would hand the next phase no deadline at
     // all — the opposite of what running out of time should do.
@@ -1142,4 +1297,33 @@ mod tests {
         let left = JobDeadline(Some(Instant::now() + Duration::from_secs(120)));
         assert!(matches!(left.remaining_secs(), Some(s) if (118..=120).contains(&s)));
     }
+
+    // "Prüfe" in CP850/1252 is not UTF-8. A strict decode errors on that line and
+    // would stop log capture, dropping every line after it.
+    #[tokio::test]
+    async fn a_non_utf8_line_is_decoded_lossily_and_later_lines_still_arrive() {
+        let output: &[u8] =
+            b"start\r\nPr\x81fe Benutzer\nPr\xfcfe\nGr\xc3\xbc\xc3\x9fe\r\nafter\n\nlast";
+        let lines: Vec<String> = lines_to_stream(
+            BufReader::new(output).split(b'\n'),
+            false,
+            Uuid::nil(),
+            "w".into(),
+        )
+        .map(|line| line.expect("reading from a byte slice cannot fail"))
+        .collect()
+        .await;
+        assert_eq!(
+            lines,
+            vec![
+                "start",
+                "Pr\u{FFFD}fe Benutzer",
+                "Pr\u{FFFD}fe",
+                "Grüße",
+                "after",
+                "",
+                "last",
+            ]
+        );
+    }
 }
diff --git a/backend/windmill-worker/src/lib.rs b/backend/windmill-worker/src/lib.rs
index 6059936af6..aa1d9ab209 100644
--- a/backend/windmill-worker/src/lib.rs
+++ b/backend/windmill-worker/src/lib.rs
@@ -81,6 +81,7 @@ mod prepare_deps;
 mod python_executor;
 #[cfg(feature = "python")]
 mod python_versions;
+mod resource_metrics;
 pub mod result_processor;
 #[cfg(feature = "rust")]
 mod rust_executor;
diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index 69aa3ee0fb..6309ba8c95 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -1,8 +1,6 @@
 use std::collections::{HashMap, HashSet};
-use std::net::IpAddr;
 use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
-use std::sync::Arc;
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 use anyhow::Context;
 use base64::{engine, Engine as _};
@@ -14,7 +12,6 @@ use rust_decimal::{prelude::FromPrimitive, Decimal};
 use serde_json::value::RawValue;
 use serde_json::Map;
 use serde_json::Value;
-use tokio::sync::{Mutex, RwLock};
 use tokio_postgres::Client;
 use tokio_postgres::{types::ToSql, Row};
 use tokio_postgres::{
@@ -55,17 +52,454 @@ use windmill_common::client::AuthedClient;
 use windmill_types::s3::S3Object;
 
 lazy_static! {
-    pub static ref CONNECTION_CACHE: Arc<Mutex<Option<(String, tokio_postgres::Client)>>> =
-        Arc::new(Mutex::new(None));
-    pub static ref CONNECTION_COUNTER: Arc<RwLock<HashMap<String, u64>>> =
-        Arc::new(RwLock::new(HashMap::new()));
-    pub static ref LAST_QUERY: AtomicU64 = AtomicU64::new(0);
     pub static ref CACHE_HITS: AtomicU64 = AtomicU64::new(0);
 }
 
+/// Idle connections kept per cache key, checked out by a job for the duration
+/// of its query and checked back in afterwards.
+///
+/// Invariant: the process never keeps an idle connection in a pool scope
+/// ([`pg_pool_scope`]) while one of its jobs runs on a connection of its own in
+/// that scope. Behind a session-mode pooler (PgBouncer, RDS Proxy pinning, …)
+/// an idle connection holds a server slot, and the job on its own connection
+/// waits for that slot with no timeout, forever if other jobs keep reusing the
+/// idle connection.
+static PG_CONNECTION_CACHE: std::sync::Mutex<PgConnectionCache> =
+    std::sync::Mutex::new(PgConnectionCache { idle: Vec::new(), own: Vec::new(), next_own_id: 0 });
+static PG_CONNECTION_CACHE_SWEEPER: std::sync::Once = std::sync::Once::new();
+const PG_CONNECTION_IDLE_TIMEOUT: Duration = Duration::from_secs(60);
+/// Across all keys. Native mode runs 8 jobs at once in one process.
+const PG_MAX_IDLE_CONNECTIONS: usize = 8;
+/// A pooler can also share slots across pool scopes: two host names for one
+/// pooler, or a per-database or per-user limit. A job on its own connection for
+/// longer than this may be waiting on such a slot, so no idle connection is
+/// kept, in any scope, until it finishes.
+const PG_OWN_CONNECTION_STALL: Duration = Duration::from_secs(5);
+/// The session reset run before reusing a cached connection is a few trivial
+/// statements. A server that vanished without closing the socket never answers
+/// it, and waiting for TCP to notice takes the keepalive budget (~2 min).
+const PG_RESET_PROBE_TIMEOUT: Duration = Duration::from_secs(5);
+/// How long a closed connection gets to wind down. An idle one only has its Terminate to
+/// send; one closed with results still arriving is cut off here.
+const PG_CLOSE_GRACE: Duration = Duration::from_secs(2);
+/// How long the connection of a failed job gets to end its query and reset its session.
+/// Past this it is closed regardless.
+const PG_CLOSE_CLEANUP_TIMEOUT: Duration = Duration::from_secs(5);
+/// How long a failed job's last query gets to be answered before it is taken to be still
+/// sending results, and cancelled.
+const PG_UNREAD_RESULT_GRACE: Duration = Duration::from_millis(250);
+/// Clears the session state a job can leave behind. Each statement is explained where a
+/// cached connection is probed with it.
+const PG_SESSION_RESET: &str = "RESET ALL; RESET SESSION AUTHORIZATION; UNLISTEN *; CLOSE ALL; \
+     SELECT pg_advisory_unlock_all();";
+
+struct PgConnectionCache {
+    /// Least recently used first.
+    idle: Vec<PgConnection>,
+    /// Jobs of this process running on a connection of their own.
+    own: Vec<OwnConnection>,
+    next_own_id: u64,
+}
+
+struct OwnConnection {
+    id: u64,
+    scope: String,
+    since: Instant,
+}
+
+impl PgConnectionCache {
+    /// Registers a job on its own connection. Returns the idle connections of
+    /// its scope, to be closed before it connects.
+    fn register_own(&mut self, scope: &str) -> (u64, Vec<PgConnection>) {
+        let id = self.next_own_id;
+        self.next_own_id += 1;
+        self.own
+            .push(OwnConnection { id, scope: scope.to_string(), since: Instant::now() });
+        let (evicted, kept) = std::mem::take(&mut self.idle)
+            .into_iter()
+            .partition(|c| c.scope == scope);
+        self.idle = kept;
+        (id, evicted)
+    }
+
+    fn stalled(&self) -> bool {
+        self.own
+            .iter()
+            .any(|o| o.since.elapsed() >= PG_OWN_CONNECTION_STALL)
+    }
+
+    fn may_keep(&self, scope: &str) -> bool {
+        !self.stalled() && self.own.iter().all(|o| o.scope != scope)
+    }
+}
+
+fn pg_connection_cache() -> std::sync::MutexGuard<'static, PgConnectionCache> {
+    PG_CONNECTION_CACHE
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+}
+
+/// What a session pooler shares server slots across: PgBouncer pools by
+/// database and user. Keys differing only in sslmode, TLS inputs, auth mode or
+/// options share a scope. Hosts are compared by name, not address.
+fn pg_pool_scope(database: &PgDatabase) -> String {
+    format!(
+        "{:?}",
+        (
+            database.host.trim().to_ascii_lowercase(),
+            database.port.unwrap_or(5432),
+            &database.dbname,
+            database.login_name().trim(),
+        )
+    )
+}
+
+struct PgConnection {
+    key: String,
+    scope: String,
+    client: Client,
+    connection_task: Option<tokio::task::JoinHandle<()>>,
+    last_used: Instant,
+}
+
+impl Drop for PgConnection {
+    /// The connection task sends the protocol Terminate and ends by itself once the client is
+    /// gone, right after this returns. Aborting it straight away closes the socket without
+    /// one, and a transaction pooler may then hand the server connection to its next client
+    /// as the job left it, inside a failed transaction.
+    fn drop(&mut self) {
+        let Some(mut task) = self.connection_task.take() else {
+            return;
+        };
+        match tokio::runtime::Handle::try_current() {
+            Ok(runtime) => {
+                runtime.spawn(async move {
+                    if tokio::time::timeout(PG_CLOSE_GRACE, &mut task)
+                        .await
+                        .is_err()
+                    {
+                        task.abort();
+                    }
+                });
+            }
+            Err(_) => task.abort(),
+        }
+    }
+}
+
+/// A job's claim on a connection. Dropping it checks the connection back in,
+/// or closes it when its query did not finish or keeping it would break the
+/// cache invariant.
+struct PgConnectionLease {
+    scope: String,
+    /// Set while the job is on a connection of its own.
+    own: Option<u64>,
+    conn: Option<PgConnection>,
+    /// Check the connection back in on drop. Set once the job's query has read
+    /// all its results, so every other way out closes the connection.
+    keep: bool,
+}
+
+impl PgConnectionLease {
+    /// Takes the most recently used idle connection for `key`. Otherwise
+    /// registers the job as on its own connection and closes the idle
+    /// connections of its scope, so they cannot hold the server slot its own
+    /// connection is about to need.
+    fn checkout(key: &str, scope: String) -> Self {
+        let (lease, evicted) = {
+            let mut cache = pg_connection_cache();
+            match cache.idle.iter().rposition(|c| c.key == key) {
+                Some(i) => {
+                    let conn = cache.idle.remove(i);
+                    (
+                        Self { scope, own: None, conn: Some(conn), keep: false },
+                        vec![],
+                    )
+                }
+                None => {
+                    let (id, evicted) = cache.register_own(&scope);
+                    (
+                        Self { scope, own: Some(id), conn: None, keep: false },
+                        evicted,
+                    )
+                }
+            }
+        };
+        drop(evicted);
+        lease
+    }
+
+    fn uncached() -> Self {
+        Self { scope: String::new(), own: None, conn: None, keep: false }
+    }
+
+    /// Gives up a cached connection that failed its probe; the job then
+    /// connects on its own.
+    fn discard(&mut self) {
+        let conn = self.conn.take();
+        let evicted = if self.own.is_none() {
+            let (id, evicted) = pg_connection_cache().register_own(&self.scope);
+            self.own = Some(id);
+            evicted
+        } else {
+            vec![]
+        };
+        drop(conn);
+        drop(evicted);
+    }
+
+    fn client(&self) -> &Client {
+        &self.conn.as_ref().expect("lease holds a connection").client
+    }
+}
+
+impl Drop for PgConnectionLease {
+    fn drop(&mut self) {
+        let conn = self.conn.take();
+        let (kept, closed) = {
+            let mut cache = pg_connection_cache();
+            if let Some(id) = self.own {
+                cache.own.retain(|o| o.id != id);
+            }
+            match conn {
+                Some(mut conn) if self.keep && cache.may_keep(&self.scope) => {
+                    conn.last_used = Instant::now();
+                    cache.idle.push(conn);
+                    let over = cache.idle.len().saturating_sub(PG_MAX_IDLE_CONNECTIONS);
+                    (true, cache.idle.drain(..over).collect::<Vec<_>>())
+                }
+                conn => (false, conn.into_iter().collect()),
+            }
+        };
+        drop(closed);
+        if kept {
+            PG_CONNECTION_CACHE_SWEEPER.call_once(|| {
+                tokio::spawn(sweep_idle_pg_connections());
+            });
+        }
+    }
+}
+
+/// Closes the connection of a job that failed or left a transaction open, in the background
+/// so the job ends without waiting. A pooler in transaction mode hands the server connection
+/// to its next client the way this one leaves it, and one closed inside a transaction it may
+/// not get back at all, so the transaction is ended and the session reset first.
+///
+/// `abandoned` is set for a query the timeout or a cancellation cut short. Closing does not
+/// stop it, the server works on until it next writes to the client, so it is cancelled. So
+/// is one still sending results the job stopped reading, which would otherwise be drained.
+fn close_unclean_connection(
+    lease: PgConnectionLease,
+    database: PgDatabase,
+    token_auth: bool,
+    abandoned: bool,
+) {
+    if lease.conn.is_none() {
+        return;
+    }
+    tokio::spawn(async move {
+        let client = lease.client();
+        let cleanup = async {
+            let cancel = || database.cancel_query(client.cancel_token(), token_auth);
+            if abandoned {
+                cancel().await?;
+            }
+            // Answered once the server is done with the job's last query. A cancel request
+            // is only sent by then, not acted on, and a pooler drops one whose client left.
+            let settled = client.batch_execute("");
+            tokio::pin!(settled);
+            let answer = if abandoned {
+                settled.await
+            } else {
+                match tokio::time::timeout(PG_UNREAD_RESULT_GRACE, &mut settled).await {
+                    Ok(answer) => answer,
+                    Err(_) => {
+                        cancel().await?;
+                        settled.await
+                    }
+                }
+            };
+            // A cancel request that found the query already over lands on what comes next.
+            let cancelled = |e: &tokio_postgres::Error| {
+                e.code() == Some(&tokio_postgres::error::SqlState::QUERY_CANCELED)
+            };
+            answer
+                .or_else(|e| if cancelled(&e) { Ok(()) } else { Err(e) })
+                .map_err(to_anyhow)?;
+            let reset = || async {
+                let in_transaction =
+                    client.transaction_status() != tokio_postgres::TransactionStatus::Idle;
+                let rollback = if in_transaction { "ROLLBACK; " } else { "" };
+                client
+                    .batch_execute(&format!("{rollback}{PG_SESSION_RESET}"))
+                    .await
+            };
+            let mut done = reset().await;
+            if done.as_ref().is_err_and(cancelled) {
+                done = reset().await;
+            }
+            done.map_err(to_anyhow)?;
+            Ok::<_, Error>(())
+        };
+        match tokio::time::timeout(PG_CLOSE_CLEANUP_TIMEOUT, cleanup).await {
+            Ok(Ok(())) => {}
+            // A connection that failed the job has nothing left to clean up.
+            Ok(Err(e)) if abandoned => {
+                tracing::warn!("could not cancel an abandoned postgres query: {e}")
+            }
+            Ok(Err(_)) => {}
+            Err(_) => tracing::warn!(
+                "a postgres connection did not settle within {}s of its job ending, closing it",
+                PG_CLOSE_CLEANUP_TIMEOUT.as_secs()
+            ),
+        }
+        drop(lease);
+    });
+}
+
+async fn sweep_idle_pg_connections() {
+    loop {
+        tokio::time::sleep(Duration::from_secs(1)).await;
+        let (stalled, closed) = {
+            let mut cache = pg_connection_cache();
+            let stalled = cache.stalled();
+            let (closed, kept): (Vec<_>, Vec<_>) = std::mem::take(&mut cache.idle)
+                .into_iter()
+                .partition(|c| stalled || c.last_used.elapsed() > PG_CONNECTION_IDLE_TIMEOUT);
+            cache.idle = kept;
+            (stalled, closed)
+        };
+        if !closed.is_empty() {
+            if stalled {
+                tracing::info!(
+                    "Closing {} cached pg executor connection(s): a job has been on its own connection for over {}s",
+                    closed.len(),
+                    PG_OWN_CONNECTION_STALL.as_secs()
+                );
+            } else {
+                tracing::info!(
+                    "Closing {} cached pg executor connection(s) due to inactivity",
+                    closed.len()
+                );
+            }
+        }
+    }
+}
+
+/// PostgreSQL's role, database and server caps, by SQLSTATE 53300 since the
+/// server translates the message under a non-English `lc_messages`, and
+/// PgBouncer's client and user caps, whose messages are English only and come
+/// with a generic code.
+fn is_connection_cap_refusal(e: &Error) -> bool {
+    if let Error::Anyhow { error, .. } = e {
+        let postgres_cap = error
+            .chain()
+            .filter_map(|cause| cause.downcast_ref::<tokio_postgres::Error>())
+            .any(|pg| pg.code() == Some(&tokio_postgres::error::SqlState::TOO_MANY_CONNECTIONS));
+        if postgres_cap {
+            return true;
+        }
+    }
+    e.to_string().contains("no more connections allowed")
+}
+
+fn close_idle_pg_connections() -> usize {
+    let idle = std::mem::take(&mut pg_connection_cache().idle);
+    idle.len()
+}
+
+/// How far a job's statements have got, read by its stall warning.
+struct PgProgress {
+    start: std::time::Instant,
+    statement: AtomicUsize,
+    rows: AtomicU64,
+    last_progress_ms: AtomicU64,
+}
+
+impl PgProgress {
+    fn new() -> Self {
+        Self {
+            start: std::time::Instant::now(),
+            statement: AtomicUsize::new(0),
+            rows: AtomicU64::new(0),
+            last_progress_ms: AtomicU64::new(0),
+        }
+    }
+
+    fn elapsed_ms(&self) -> u64 {
+        self.start.elapsed().as_millis() as u64
+    }
+
+    fn start_statement(&self, index: usize) {
+        self.statement.store(index, Ordering::Relaxed);
+        self.last_progress_ms
+            .store(self.elapsed_ms(), Ordering::Relaxed);
+    }
+
+    fn row(&self) {
+        self.rows.fetch_add(1, Ordering::Relaxed);
+        self.last_progress_ms
+            .store(self.elapsed_ms(), Ordering::Relaxed);
+    }
+
+    fn rows(&self) -> u64 {
+        self.rows.load(Ordering::Relaxed)
+    }
+}
+
+const PG_STALL_WARNING_AFTER: Duration = Duration::from_secs(5 * 60);
+/// Steps faster than this are not logged: a log line is a write to the main DB,
+/// and a script split into many statements would pay one per statement.
+const PG_SLOW_STEP: Duration = Duration::from_secs(1);
+
+fn connection_kind(fresh_connection: bool) -> &'static str {
+    if fresh_connection {
+        "new connection"
+    } else {
+        "worker's cached connection"
+    }
+}
+
+/// Warns once per stall in the job log; never completes. A statement still
+/// computing its first row also trips it, which is why it only warns: the job
+/// timeout stays the one thing that stops a job.
+async fn warn_on_stalled_statement(
+    progress: &PgProgress,
+    statement_count: usize,
+    fresh_connection: bool,
+    job_id: Uuid,
+    workspace_id: &str,
+    conn: &Connection,
+) -> std::convert::Infallible {
+    let mut warned_for = None;
+    loop {
+        tokio::time::sleep(Duration::from_secs(30)).await;
+        let last = progress.last_progress_ms.load(Ordering::Relaxed);
+        let stalled = Duration::from_millis(progress.elapsed_ms().saturating_sub(last));
+        if stalled < PG_STALL_WARNING_AFTER || warned_for == Some(last) {
+            continue;
+        }
+        warned_for = Some(last);
+        windmill_queue::append_logs(
+            &job_id,
+            workspace_id,
+            format!(
+                "No new row for {} min on statement {}/{statement_count} ({} rows so far, {}). \
+                 A query still running on the database is normal; if the database shows no \
+                 active query for this connection, the job is stuck in the worker.\n",
+                stalled.as_secs() / 60,
+                progress.statement.load(Ordering::Relaxed) + 1,
+                progress.rows(),
+                connection_kind(fresh_connection),
+            ),
+            conn,
+        )
+        .await;
+    }
+}
+
 pub async fn clear_pg_cache() {
-    *CONNECTION_CACHE.lock().await = None;
-    CONNECTION_COUNTER.write().await.clear();
+    close_idle_pg_connections();
 }
 
 /// How the connection authenticates, which also keys the connection cache: a
@@ -159,8 +593,6 @@ async fn new_pg_connection(
     };
     let handle = tokio::spawn(async move {
         if let Err(e) = connection.await {
-            let mut mtex = CONNECTION_CACHE.lock().await;
-            *mtex = None;
             tracing::error!("connection error: {}", e);
         }
     });
@@ -362,6 +794,79 @@ fn wrap_param_encoding_error(
     to_anyhow(err).into()
 }
 
+/// Whether a statement may return a row stream, and so needs its column types described
+/// before it runs. Anything not recognised as returning at most a row counts as a stream:
+/// a wrong guess only costs a round trip, while a missed stream can hang the job.
+fn can_stream_rows(query: &str) -> bool {
+    let Some(keyword) = leading_keyword(query) else {
+        return true;
+    };
+    let rowless = matches!(
+        keyword.as_str(),
+        "insert"
+            | "update"
+            | "delete"
+            | "merge"
+            | "create"
+            | "alter"
+            | "drop"
+            | "truncate"
+            | "grant"
+            | "revoke"
+            | "comment"
+            | "set"
+            | "reset"
+            | "call"
+            | "do"
+            | "begin"
+            | "commit"
+            | "rollback"
+            | "lock"
+            | "vacuum"
+            | "analyze"
+            | "refresh"
+    );
+    !rowless || query.to_ascii_lowercase().contains("returning")
+}
+
+/// The first keyword of a statement, past whitespace and comments, following Postgres's
+/// scanner: a `--` comment ends at CR or LF, and block comments nest, so
+/// `/* /* a */ INSERT */ SELECT` starts with SELECT. `None` when the comments never end.
+fn leading_keyword(query: &str) -> Option<String> {
+    let mut rest = query;
+    loop {
+        rest = rest.trim_start();
+        if let Some(after) = rest.strip_prefix("--") {
+            rest = &after[after.find(['\n', '\r'])?..];
+        } else if rest.starts_with("/*") {
+            let mut depth = 0usize;
+            let mut i = 0;
+            let bytes = rest.as_bytes();
+            loop {
+                match bytes.get(i..i + 2)? {
+                    b"/*" => depth += 1,
+                    b"*/" => depth -= 1,
+                    _ => {
+                        i += 1;
+                        continue;
+                    }
+                }
+                i += 2;
+                if depth == 0 {
+                    break;
+                }
+            }
+            rest = &rest[i..];
+        } else {
+            break;
+        }
+    }
+    let end = rest
+        .find(|c: char| !(c.is_ascii_alphanumeric() || c == '_' || c == '$'))
+        .unwrap_or(rest.len());
+    Some(rest[..end].to_ascii_lowercase())
+}
+
 fn otyp_to_pg_type(otyp: &str) -> error::Result<Type> {
     let base = otyp.trim_end_matches("[]");
     let is_array = otyp.ends_with("[]");
@@ -411,6 +916,7 @@ fn do_postgresql_inner<'a>(
     workspace_id: &'a str,
     log_conn: &'a Connection,
     raw_output: bool,
+    progress: &'a PgProgress,
 ) -> error::Result<BoxFuture<'a, error::Result<Vec<Box<RawValue>>>>> {
     let mut query_params = vec![];
     let mut param_types: Vec<Type> = vec![];
@@ -510,15 +1016,25 @@ fn do_postgresql_inner<'a>(
     let result_f = async move {
         let mut res: Vec<Box<serde_json::value::RawValue>> = vec![];
 
-        // Always prefer query_typed_raw (unnamed prepared statement). It is sent as
-        // a single Parse+Bind+Execute+Sync round-trip, so it survives transaction-mode
-        // connection poolers (PgBouncer/Supabase pooler/RDS Proxy) where named
+        // Always prefer query_typed_raw (unnamed prepared statement). It and its
+        // describe are each a self-contained round-trip ending in Sync, so they
+        // survive transaction-mode connection poolers (PgBouncer/Supabase
+        // pooler/RDS Proxy) where named
         // statements ("s0", "s1", ...) can be reported missing because the prepare
         // and the execute land on different backend connections. Fall back to
         // prepare + query_raw only when an arg has a type unsupported by
         // otyp_to_pg_type (e.g. custom enum, geometry, …) — in that case we lose
         // pooler safety, but the query at least runs against a direct connection.
         let rows = if all_types_resolved {
+            // query_typed_raw looks up result column types this connection has not seen
+            // (enums, domains, extension types) while the rows already stream, and on a
+            // large result that lookup waits behind them forever. Describing first resolves
+            // them up front, still without a named statement.
+            if can_stream_rows(&query) {
+                if let Err(e) = client.describe_typed(&query, &param_types).await {
+                    return Err(wrap_param_encoding_error(e, &param_meta, &param_types));
+                }
+            }
             let typed_params = query_params
                 .iter()
                 .zip(param_types.iter())
@@ -551,10 +1067,13 @@ fn do_postgresql_inner<'a>(
 
         if skip_collect {
             futures::pin_mut!(rows);
-            while rows.try_next().await.map_err(to_anyhow)?.is_some() {}
+            while rows.try_next().await.map_err(to_anyhow)?.is_some() {
+                progress.row();
+            }
         } else if let Some(ref s3) = s3 {
             let format_state_ref = &format_state;
             let rows_stream = rows.map_err(to_anyhow).map(move |row_result| {
+                progress.row();
                 row_result.and_then(|row| {
                     postgres_row_to_json_value_with_state(row, format_state_ref).map_err(to_anyhow)
                 })
@@ -592,6 +1111,7 @@ fn do_postgresql_inner<'a>(
             let mut column_names: Option<Vec<String>> = None;
 
             while let Some(row) = rows.try_next().await.map_err(to_anyhow)? {
+                progress.row();
                 if column_names.is_none() {
                     column_names = Some(
                         row.columns()
@@ -709,6 +1229,7 @@ pub async fn do_postgresql(
                             DatatableAccess::PermissionedAs {
                                 permissioned_as: &job.permissioned_as,
                                 email: &job.permissioned_as_email,
+                                end_user_email: job.permissioned_as_end_user_email.as_deref(),
                             },
                         )
                         .await?
@@ -786,97 +1307,114 @@ pub async fn do_postgresql(
         database.to_uri(),
         auth_mode.cache_key_segment()
     );
-    let database_string_clone = database_string.clone();
 
-    let cached_client;
-    let new_client;
-    if !*CLOUD_HOSTED {
-        let mut guard = CONNECTION_CACHE.try_lock().ok();
-        increment_connection_counter(&database_string).await;
-
-        if guard
-            .as_ref()
-            .is_some_and(|x| x.as_ref().is_some_and(|y| y.0 == database_string))
-        {
-            // Probe the cached connection with a curated session reset before
-            // reusing it. Each statement targets a specific class of state:
-            //
-            //   RESET ALL                     — GUC parameters (search_path,
-            //                                   application_name, statement_
-            //                                   timeout, transaction_*…). Note
-            //                                   that this does NOT reset SET
-            //                                   ROLE or SET SESSION
-            //                                   AUTHORIZATION (security!).
-            //   RESET SESSION AUTHORIZATION   — undoes both `SET SESSION
-            //                                   AUTHORIZATION` and `SET ROLE`,
-            //                                   restoring the connecting user.
-            //                                   Without this a previous job
-            //                                   leaving an elevated role
-            //                                   active would silently leak
-            //                                   permissions into the next.
-            //   UNLISTEN *                    — drops LISTEN registrations.
-            //   CLOSE ALL                     — closes open cursors.
-            //   pg_advisory_unlock_all()      — releases any session-scoped
-            //                                   advisory locks. Without this
-            //                                   a job that called
-            //                                   pg_advisory_lock and exited
-            //                                   without unlocking would block
-            //                                   later jobs holding the same
-            //                                   key (DISCARD ALL covered this
-            //                                   too).
-            //
-            // We deliberately do NOT use `DISCARD ALL`. DISCARD includes
-            // `DEALLOCATE ALL`, which deallocates *all* prepared statements
-            // server-side — including the typeinfo statements that
-            // tokio_postgres caches per-Client to resolve custom enum/domain
-            // Oids. After DISCARD, tokio_postgres still holds Statement
-            // objects whose names the server has forgotten, so the next
-            // custom-type query fails with `prepared statement "sN" does not
-            // exist`. The trade-off: temp tables and user-PREPARE statements
-            // may persist across cached-connection reuse (rare in datatable /
-            // script workloads).
-            //
-            // Doubles as a liveness probe — if the connection is broken any
-            // statement in the chain fails and we replace it.
-            let probe_client = &guard.as_ref().unwrap().as_ref().unwrap().1;
-            if probe_client
-                .batch_execute(
-                    "RESET ALL; \
-                     RESET SESSION AUTHORIZATION; \
-                     UNLISTEN *; \
-                     CLOSE ALL; \
-                     SELECT pg_advisory_unlock_all();",
-                )
-                .await
-                .is_ok()
-            {
-                tracing::info!("Using cached connection");
-                CACHE_HITS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-                LAST_QUERY.store(
-                    chrono::Utc::now().timestamp().try_into().unwrap_or(0),
-                    std::sync::atomic::Ordering::Relaxed,
-                );
-                cached_client = guard;
-                new_client = None;
-            } else {
-                tracing::info!("Cached connection is stale, creating new one");
-                if let Some(ref mut g) = guard {
-                    **g = None;
-                }
-                drop(guard);
-                cached_client = None;
-                new_client = Some(new_pg_connection(&database, auth_mode, conn.as_sql()).await?);
-            }
-        } else {
-            // Release the lock before connecting so the post-query caching
-            // code can re-acquire it.
-            drop(guard);
-            cached_client = None;
-            new_client = Some(new_pg_connection(&database, auth_mode, conn.as_sql()).await?);
-        }
+    let connect_started = std::time::Instant::now();
+    let mut cached_connection_failed_reset = false;
+    let mut reused_cached_connection = false;
+    let mut lease = if *CLOUD_HOSTED {
+        PgConnectionLease::uncached()
     } else {
-        cached_client = None;
-        new_client = Some(new_pg_connection(&database, auth_mode, conn.as_sql()).await?);
+        PgConnectionLease::checkout(&database_string, pg_pool_scope(&database))
+    };
+
+    if lease.conn.is_some() {
+        // Probe the cached connection with a curated session reset before
+        // reusing it. Each statement targets a specific class of state:
+        //
+        //   RESET ALL                     — GUC parameters (search_path,
+        //                                   application_name, statement_
+        //                                   timeout, transaction_*…). Note
+        //                                   that this does NOT reset SET
+        //                                   ROLE or SET SESSION
+        //                                   AUTHORIZATION (security!).
+        //   RESET SESSION AUTHORIZATION   — undoes both `SET SESSION
+        //                                   AUTHORIZATION` and `SET ROLE`,
+        //                                   restoring the connecting user.
+        //                                   Without this a previous job
+        //                                   leaving an elevated role
+        //                                   active would silently leak
+        //                                   permissions into the next.
+        //   UNLISTEN *                    — drops LISTEN registrations.
+        //   CLOSE ALL                     — closes open cursors.
+        //   pg_advisory_unlock_all()      — releases any session-scoped
+        //                                   advisory locks. Without this
+        //                                   a job that called
+        //                                   pg_advisory_lock and exited
+        //                                   without unlocking would block
+        //                                   later jobs holding the same
+        //                                   key (DISCARD ALL covered this
+        //                                   too).
+        //
+        // We deliberately do NOT use `DISCARD ALL`. DISCARD includes
+        // `DEALLOCATE ALL`, which deallocates *all* prepared statements
+        // server-side — including the typeinfo statements that
+        // tokio_postgres caches per-Client to resolve custom enum/domain
+        // Oids. After DISCARD, tokio_postgres still holds Statement
+        // objects whose names the server has forgotten, so the next
+        // custom-type query fails with `prepared statement "sN" does not
+        // exist`. The trade-off: temp tables and user-PREPARE statements
+        // may persist across cached-connection reuse (rare in datatable /
+        // script workloads).
+        //
+        // Doubles as a liveness probe — if the connection is broken any
+        // statement in the chain fails, or it never answers, and we replace it.
+        let reset = lease.client().batch_execute(PG_SESSION_RESET);
+        if matches!(
+            tokio::time::timeout(PG_RESET_PROBE_TIMEOUT, reset).await,
+            Ok(Ok(()))
+        ) {
+            tracing::info!("Using cached connection");
+            CACHE_HITS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            reused_cached_connection = true;
+        } else {
+            tracing::info!("Cached connection is stale, creating new one");
+            cached_connection_failed_reset = true;
+            lease.discard();
+        }
+    }
+    if lease.conn.is_none() {
+        let (client, connection_task) =
+            match new_pg_connection(&database, auth_mode, conn.as_sql()).await {
+                Ok(connected) => connected,
+                // A server or pooler can also refuse outright past a per-login or
+                // total connection cap, which pool scopes do not capture. Free the
+                // idle connections of every scope and try once more.
+                Err(e) => {
+                    if !is_connection_cap_refusal(&e) || close_idle_pg_connections() == 0 {
+                        return Err(e);
+                    }
+                    tokio::time::sleep(Duration::from_millis(250)).await;
+                    new_pg_connection(&database, auth_mode, conn.as_sql()).await?
+                }
+            };
+        lease.conn = Some(PgConnection {
+            key: database_string.clone(),
+            scope: lease.scope.clone(),
+            client,
+            connection_task: Some(connection_task),
+            last_used: Instant::now(),
+        });
+    }
+
+    let fresh_connection = !reused_cached_connection;
+    let log_progress = !run_inline && !annotations.prepare;
+    let connect_time = connect_started.elapsed();
+    if log_progress && connect_time >= PG_SLOW_STEP {
+        windmill_queue::append_logs(
+            &job.id,
+            &job.workspace_id,
+            format!(
+                "Getting a database connection took {} ms ({})\n",
+                connect_time.as_millis(),
+                if cached_connection_failed_reset {
+                    "the cached connection failed its reset, then a new connection"
+                } else {
+                    connection_kind(fresh_connection)
+                }
+            ),
+            conn,
+        )
+        .await;
     }
 
     let (mut sig, _) = parse_pgsql_sig_with_typed_schema(&query)
@@ -903,12 +1441,7 @@ pub async fn do_postgresql(
 
     let queries = parse_sql_blocks(query, true);
 
-    let (client, handle) = if let Some((client, handle)) = new_client.as_ref() {
-        (client, Some(handle))
-    } else {
-        let (_, client) = cached_client.as_ref().unwrap().as_ref().unwrap();
-        (client, None)
-    };
+    let client = lease.client();
 
     let param_idx_to_arg_and_value = sig
         .args
@@ -918,6 +1451,9 @@ pub async fn do_postgresql(
 
     let size = AtomicUsize::new(0);
     let size_ref = &size;
+    let progress = PgProgress::new();
+    let progress_ref = &progress;
+    let statement_count = queries.len();
     let result_f = async move {
         let mut results = vec![];
         // Session reset (DISCARD ALL) is now handled eagerly when validating
@@ -955,6 +1491,9 @@ pub async fn do_postgresql(
             let skip_collect = collection_strategy.collect_last_statement_only(queries.len())
                 && i < queries.len() - 1;
             let is_last = i == queries.len() - 1;
+            progress_ref.start_statement(i);
+            let rows_before = progress_ref.rows();
+            let statement_started = std::time::Instant::now();
             let result = do_postgresql_inner(
                 query.to_string(),
                 &param_idx_to_arg_and_value,
@@ -976,8 +1515,24 @@ pub async fn do_postgresql(
                 &job.workspace_id,
                 conn,
                 annotations.raw_output && is_last && !skip_collect,
+                progress_ref,
             )?
             .await?;
+            let statement_time = statement_started.elapsed();
+            if log_progress && statement_time >= PG_SLOW_STEP {
+                windmill_queue::append_logs(
+                    &job.id,
+                    &job.workspace_id,
+                    format!(
+                        "Statement {}/{statement_count}: {} rows in {} ms\n",
+                        i + 1,
+                        progress_ref.rows() - rows_before,
+                        statement_time.as_millis()
+                    ),
+                    conn,
+                )
+                .await;
+            }
             results.push(result);
         }
 
@@ -990,6 +1545,24 @@ pub async fn do_postgresql(
             collection_strategy.collect(results)
         }
     };
+    let result_f = async {
+        if log_progress {
+            tokio::select! {
+                result = result_f => result,
+                never = warn_on_stalled_statement(progress_ref, statement_count, fresh_connection, job.id, &job.workspace_id, conn) => match never {},
+            }
+        } else {
+            result_f.await
+        }
+    };
+    // Still unset once the job is over: the query was abandoned mid-flight, by the timeout or
+    // a cancellation, rather than ended by an error of its own.
+    let query_ended = std::sync::atomic::AtomicBool::new(false);
+    let result_f = async {
+        let result = result_f.await;
+        query_ended.store(true, Ordering::Relaxed);
+        result
+    };
 
     let result = if run_inline {
         result_f.await
@@ -1007,100 +1580,52 @@ pub async fn do_postgresql(
             Box::pin(futures::stream::once(async { 0 })),
         )
         .await
-    }
-    .map_err(|e| map_s3object_jsonb_overflow(e, had_s3object_input))?;
-
-    // Release the cache lock now that we have the result — allows the
-    // post-query caching code below to re-acquire it if needed.
-    drop(cached_client);
+    };
+    let result = match result {
+        Ok(result) => result,
+        Err(e) => {
+            close_unclean_connection(
+                lease,
+                database,
+                auth_mode != PgAuthMode::Password,
+                !query_ended.load(Ordering::Relaxed),
+            );
+            return Err(map_s3object_jsonb_overflow(e, had_s3object_input));
+        }
+    };
 
     *mem_peak = size.load(Ordering::Relaxed) as i32;
 
-    if let Some(handle) = handle {
-        if !*CLOUD_HOSTED {
-            if let Ok(mut mtex) = CONNECTION_CACHE.try_lock() {
-                if mtex.as_ref().is_none_or(|x| x.0 != database_string) {
-                    let abort_handler = handle.abort_handle();
-
-                    let mut cache_new_con = false;
-                    if let Some(new_client) = new_client {
-                        cache_new_con = is_most_used_conn(&database_string).await;
-                        if cache_new_con {
-                            *mtex = Some((database_string, new_client.0));
-                        } else {
-                            new_client.1.abort();
-                        }
-                    } else {
-                        handle.abort();
-                    }
-
-                    if cache_new_con {
-                        LAST_QUERY.store(
-                            chrono::Utc::now().timestamp().try_into().unwrap_or(0),
-                            std::sync::atomic::Ordering::Relaxed,
-                        );
-                        tokio::spawn(async move {
-                            loop {
-                                tokio::time::sleep(Duration::from_secs(5)).await;
-                                let last_query =
-                                    LAST_QUERY.load(std::sync::atomic::Ordering::Relaxed);
-                                let now = chrono::Utc::now().timestamp().try_into().unwrap_or(0);
-
-                                //we cache connection for 5 minutes at most
-                                if last_query + 60 * 1 < now {
-                                    // tracing::error!("Closing cache connection due to inactivity");
-                                    tracing::info!(
-                                        "Closing cache pg executor connection due to inactivity"
-                                    );
-                                    break;
-                                }
-                                let mtex = CONNECTION_CACHE.lock().await;
-                                if mtex.is_none() {
-                                    // connection is not in the mutex anymore
-                                    break;
-                                } else if let Some(mtex) = mtex.as_ref() {
-                                    if mtex.0.as_str() != &database_string_clone {
-                                        // connection is not the latest one
-                                        break;
-                                    }
-                                }
-
-                                tracing::debug!(
-                                    "Keeping cached pg executor connection alive due to activity"
-                                )
-                            }
-                            let mut mtex = CONNECTION_CACHE.lock().await;
-                            *mtex = None;
-                            abort_handler.abort();
-                        });
-                    }
-                } else {
-                    handle.abort();
-                }
-            } else {
-                handle.abort();
-            }
-        } else {
-            handle.abort();
+    // A transaction the script left open would otherwise carry over into the
+    // next job that reuses the connection, so it is rolled back and the connection
+    // closed. The status comes with the last reply, so a script that ends cleanly
+    // pays nothing for this check.
+    if lease.client().transaction_status() != tokio_postgres::TransactionStatus::Idle {
+        if !run_inline {
+            windmill_queue::append_logs(
+                &job.id,
+                &job.workspace_id,
+                "The script ended inside an open transaction, which was rolled back. \
+                 End it with COMMIT to keep its changes.\n",
+                conn,
+            )
+            .await;
         }
+        close_unclean_connection(lease, database, auth_mode != PgAuthMode::Password, false);
+    } else {
+        // Keep the connection only after a query that read its results to the end.
+        // An error may have stopped reading early (the result cap, a decode failure),
+        // as a timeout, a dropped future or a first-row collection do: the server
+        // keeps sending, and the next job's reset probe would wait on it.
+        lease.keep = !*CLOUD_HOSTED && !collection_strategy.collect_first_row_only();
+        drop(lease);
     }
+
     *mem_peak = (result.get().len() / 1000) as i32;
     // And then check that we got back the same string we sent over.
     return Ok(result);
 }
 
-async fn is_most_used_conn(database_string: &str) -> bool {
-    let counter_map = CONNECTION_COUNTER.read().await;
-    let current_count = counter_map.get(database_string).copied().unwrap_or(0);
-    let max_count = counter_map.values().copied().max().unwrap_or(0);
-    current_count >= max_count
-}
-
-async fn increment_connection_counter(database_string: &str) {
-    let mut counter_map = CONNECTION_COUNTER.write().await;
-    *counter_map.entry(database_string.to_string()).or_insert(0) += 1;
-}
-
 /// For each `(s3object)` arg in `sig_args`: download the referenced file, decode it
 /// to JSON text, then rewrite the arg to bind as `jsonb`. Mutates `args_map` in place
 /// so the existing bind path picks up the materialized payload. Returns whether any
@@ -1889,8 +2414,8 @@ pub fn pg_cell_to_json_value_with_state(
         Type::UUID => get_basic(row, column, column_i, |a: uuid::Uuid| {
             Ok(JSONValue::String(a.to_string()))
         })?,
-        Type::INET => get_basic(row, column, column_i, |a: IpAddr| {
-            Ok(JSONValue::String(a.to_string()))
+        Type::INET | Type::CIDR => get_basic(row, column, column_i, |a: InetStr| {
+            Ok(JSONValue::String(a.0))
         })?,
         Type::INTERVAL => get_basic(row, column, column_i, |a: IntervalStr| {
             Ok(JSONValue::String(a.0))
@@ -1997,6 +2522,9 @@ pub fn pg_cell_to_json_value_with_state(
         Type::BYTEA_ARRAY => get_array(row, column, column_i, |a: Vec<u8>| {
             Ok(JSONValue::String(format!("\\x{}", hex::encode(a))))
         })?,
+        Type::INET_ARRAY | Type::CIDR_ARRAY => get_array(row, column, column_i, |a: InetStr| {
+            Ok(JSONValue::String(a.0))
+        })?,
         Type::VOID => JSONValue::Null,
         // Default fallback for unhandled column types: read as text. We use
         // `AnyTextValue` instead of plain `String` so that `Kind::Enum`,
@@ -2156,6 +2684,29 @@ fn get_array<'a, T: FromSql<'a>>(
     })
 }
 
+/// `inet` / `cidr` in Postgres's own text form. `IpAddr`'s `FromSql` drops the
+/// prefix length, so a network such as `10.0.0.0/8` would read back as a host.
+struct InetStr(String);
+impl FromSql<'_> for InetStr {
+    fn from_sql(
+        ty: &Type,
+        raw: &[u8],
+    ) -> Result<InetStr, Box<dyn std::error::Error + Sync + Send>> {
+        let inet = postgres_protocol::types::inet_from_sql(raw)?;
+        let host_prefix = if inet.addr().is_ipv4() { 32 } else { 128 };
+        Ok(InetStr(
+            if *ty == Type::CIDR || inet.netmask() != host_prefix {
+                format!("{}/{}", inet.addr(), inet.netmask())
+            } else {
+                inet.addr().to_string()
+            },
+        ))
+    }
+    fn accepts(ty: &Type) -> bool {
+        matches!(*ty, Type::INET | Type::CIDR)
+    }
+}
+
 // you can remove this section if not using TS_VECTOR (or other types requiring an intermediary `FromSQL` struct)
 struct StringCollector(String);
 impl FromSql<'_> for StringCollector {
@@ -2271,6 +2822,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn inet_keeps_the_prefix_postgres_prints() {
+        let inet = |netmask: u8, addr: [u8; 4]| {
+            let mut raw = vec![2, netmask, 0, 4];
+            raw.extend(addr);
+            raw
+        };
+        let read = |ty: &Type, raw: &[u8]| InetStr::from_sql(ty, raw).unwrap().0;
+        assert_eq!(read(&Type::INET, &inet(32, [10, 1, 2, 3])), "10.1.2.3");
+        assert_eq!(read(&Type::INET, &inet(8, [10, 0, 0, 0])), "10.0.0.0/8");
+        assert_eq!(read(&Type::CIDR, &inet(32, [10, 1, 2, 3])), "10.1.2.3/32");
+    }
+
     #[test]
     fn test_parse_naive_date() {
         // chrono's NaiveDate::to_string() format
@@ -2472,6 +3036,39 @@ mod tests {
         windmill_parser_sql::parse_pg_typ(arg_t)
     }
 
+    #[test]
+    fn only_rowless_statements_skip_the_describe() {
+        for q in [
+            "SELECT * FROM t",
+            "-- $1 n (int)\nselect $1",
+            "WITH x AS (DELETE FROM t RETURNING *) SELECT * FROM x",
+            "INSERT INTO t VALUES (1) RETURNING id",
+            "/* c */ UPDATE t SET a = 1\nreturning *",
+            "UPDATE t SET note = $$a;b$$ RETURNING *",
+            "/* /* inner */ INSERT */ SELECT * FROM t",
+            "/* never closed INSERT",
+            "-- INSERT",
+            "-- header\rSELECT m, pad AS\nupdate FROM t",
+            "insert_rows()",
+            "TABLE t",
+            "VALUES (1)",
+            "EXPLAIN SELECT 1",
+        ] {
+            assert!(can_stream_rows(q), "{q}");
+        }
+        for q in [
+            "INSERT INTO t VALUES (1)",
+            "-- $1 n (int)\nUPDATE t SET a = $1",
+            "delete from t",
+            "CREATE TABLE t (a int)",
+            "SET search_path TO x",
+            "CALL p()",
+            "/* a /* b */ c */\n-- d\nINSERT INTO t VALUES (1)",
+        ] {
+            assert!(!can_stream_rows(q), "{q}");
+        }
+    }
+
     #[test]
     fn convert_val_null_for_every_known_arg_t() {
         // `Value::Null` for every type the parser may resolve, plus an unknown
diff --git a/backend/windmill-worker/src/php_executor.rs b/backend/windmill-worker/src/php_executor.rs
index 03328b82cb..8378455ef4 100644
--- a/backend/windmill-worker/src/php_executor.rs
+++ b/backend/windmill-worker/src/php_executor.rs
@@ -17,6 +17,7 @@ use windmill_queue::MiniPulledJob;
 use windmill_parser::{MainArgSignature, Typ};
 use windmill_queue::{append_logs, CanceledBy};
 
+use crate::common::DEV_CONF_NSJAIL;
 use crate::{
     common::{
         build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file,
@@ -24,11 +25,13 @@ use crate::{
         resolve_nsjail_tmp_mount_block, start_child_process, MaybeLock, OccupancyMetrics,
     },
     handle_child::handle_child,
-    is_sandboxing_enabled, COMPOSER_CACHE_DIR, COMPOSER_PATH, DISABLE_NUSER, NSJAIL_PATH, PHP_PATH,
+    is_sandboxing_enabled, COMPOSER_CACHE_DIR, COMPOSER_PATH, DISABLE_NUSER, NSJAIL_PATH, PATH_ENV,
+    PHP_PATH, PROXY_ENVS, TRACING_PROXY_CA_CERT_PATH,
 };
 use windmill_common::client::AuthedClient;
 
 const NSJAIL_CONFIG_RUN_PHP_CONTENT: &str = include_str!("../nsjail/run.php.config.proto");
+const NSJAIL_CONFIG_LOCK_PHP_CONTENT: &str = include_str!("../nsjail/lock.php.config.proto");
 
 lazy_static::lazy_static! {
     static ref RE: Regex = Regex::new(r"^//\s?(\S+)\s*$").unwrap();
@@ -199,15 +202,99 @@ pub async fn composer_install(
         write_file(job_dir, "composer.lock", lock)?;
     }
 
-    let mut child_cmd = Command::new(&*COMPOSER_PATH);
-    let args = vec!["install", "--no-dev", "--no-progress"];
-    child_cmd
-        .current_dir(job_dir)
-        .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
-        .args(args)
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
-    let child_process = start_child_process(child_cmd, &*COMPOSER_PATH, false).await?;
+    // `composer install` runs the plugin and script code of installed packages, so
+    // when sandboxing is on it is confined under nsjail like the run step. Inside the
+    // jail the environment is cleared down to what composer needs: PATH, COMPOSER_HOME
+    // (pointed at the mounted cache dir), the proxies, the operator-controlled
+    // WHITELIST_ENVS, and every other COMPOSER_* var from the worker env — Windmill has
+    // no managed composer-registry setting, so operators supply private Packagist auth
+    // and composer tuning (COMPOSER_AUTH, COMPOSER_PROCESS_TIMEOUT, …) through those.
+    // COMPOSER_CACHE_DIR is dropped so it can't point composer outside the jail, and a
+    // custom COMPOSER_CAFILE/COMPOSER_CAPATH is bind-mounted so TLS to private feeds
+    // keeps working. COMPOSER_PATH is Windmill-internal. Without sandboxing composer
+    // runs directly, with no isolation.
+    let composer_args = ["install", "--no-dev", "--no-progress"];
+    let child_cmd = if is_sandboxing_enabled() {
+        // The cache dir is bind-mounted into the jail, so it must exist before
+        // nsjail builds the mount tree.
+        std::fs::create_dir_all(&*COMPOSER_CACHE_DIR)?;
+        let nsjail_timeout = resolve_nsjail_timeout(conn, w_id, *job_id, None).await;
+        // A custom CA bundle/dir lives outside the jail's mounts; bind it in so
+        // composer's TLS can read it (mandatory: false → skipped when the path is unset).
+        let ca_mount = ["COMPOSER_CAFILE", "COMPOSER_CAPATH"]
+            .iter()
+            .filter_map(|k| std::env::var(k).ok().filter(|v| !v.trim().is_empty()))
+            .map(|p| {
+                format!(
+                    "mount {{\n    src: \"{p}\"\n    dst: \"{p}\"\n    is_bind: true\n    mandatory: false\n}}\n"
+                )
+            })
+            .collect::<String>();
+        write_file(
+            job_dir,
+            "lock.config.proto",
+            NSJAIL_CONFIG_LOCK_PHP_CONTENT
+                .replace("{TIMEOUT}", &nsjail_timeout)
+                .replace("{JOB_DIR}", job_dir)
+                .replace("{COMPOSER_CACHE_DIR}", &*COMPOSER_CACHE_DIR)
+                .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
+                .replace("{TRACING_PROXY_CA_CERT_PATH}", &*TRACING_PROXY_CA_CERT_PATH)
+                .replace("{CA_MOUNT}", &ca_mount)
+                .replace("#{DEV}", DEV_CONF_NSJAIL)
+                .replace(
+                    "{TMP_MOUNT_BLOCK}",
+                    &resolve_nsjail_tmp_mount_block(job_dir).await,
+                )
+                .as_str(),
+        )?;
+
+        let composer_passthrough_envs: Vec<(String, String)> = std::env::vars()
+            .filter(|(k, _)| {
+                k.starts_with("COMPOSER_")
+                    && k != "COMPOSER_HOME"
+                    && k != "COMPOSER_CACHE_DIR"
+                    && k != "COMPOSER_PATH"
+            })
+            .collect();
+
+        let mut nsjail_args = vec![
+            "--config",
+            "lock.config.proto",
+            "--",
+            COMPOSER_PATH.as_str(),
+        ];
+        nsjail_args.extend(composer_args);
+
+        let mut child_cmd = Command::new(NSJAIL_PATH.as_str());
+        child_cmd
+            .current_dir(job_dir)
+            .env_clear()
+            // HOME is set to /tmp by the nsjail config; keep_env passes the rest.
+            .env("PATH", PATH_ENV.as_str())
+            .envs(PROXY_ENVS.clone())
+            .envs(&*crate::worker::WHITELIST_ENVS)
+            .envs(composer_passthrough_envs)
+            .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
+            .args(nsjail_args)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped());
+        child_cmd
+    } else {
+        let mut child_cmd = Command::new(&*COMPOSER_PATH);
+        child_cmd
+            .current_dir(job_dir)
+            .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
+            .args(composer_args)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped());
+        child_cmd
+    };
+    let child_executable = if is_sandboxing_enabled() {
+        NSJAIL_PATH.as_str()
+    } else {
+        COMPOSER_PATH.as_str()
+    };
+    let child_process = start_child_process(child_cmd, child_executable, false).await?;
 
     handle_child(
         job_id,
@@ -215,7 +302,8 @@ pub async fn composer_install(
         mem_peak,
         canceled_by,
         child_process,
-        false,
+        // jailed when sandboxing is on, so mem sampling finds the real process
+        is_sandboxing_enabled(),
         worker_name,
         w_id,
         "composer install",
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index 6b24b93e77..7f2291099a 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -116,6 +116,7 @@ async fn handle_piptar_uploads(mut rx: tokio::sync::mpsc::UnboundedReceiver<Pipt
 
 const NSJAIL_CONFIG_DOWNLOAD_PY_CONTENT: &str = include_str!("../nsjail/download.py.config.proto");
 const NSJAIL_CONFIG_RUN_PYTHON3_CONTENT: &str = include_str!("../nsjail/run.python3.config.proto");
+const NSJAIL_CONFIG_LOCK_PY_CONTENT: &str = include_str!("../nsjail/lock.py.config.proto");
 pub const RELATIVE_PYTHON_LOADER: &str = include_str!("../loader.py");
 
 /// Every file exchanged with a job is UTF-8 by construction, so the interpreter
@@ -156,7 +157,7 @@ use crate::{
     },
     get_proxy_envs_for_lang,
     handle_child::handle_child,
-    is_sandboxing_enabled, read_ee_registry_with_workspace_override,
+    is_sandboxing_enabled, read_ee_registry,
     worker_utils::ping_job_status,
     PyV, DISABLE_NUSER, HOME_ENV, INDEX_CERT, NATIVE_CERT, NSJAIL_AVAILABLE, NSJAIL_PATH,
     NSJAIL_PY_RLIMIT_AS_MB, PATH_ENV, PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, PROXY_ENVS,
@@ -279,7 +280,12 @@ pub async fn uv_pip_compile(
     #[cfg(feature = "enterprise")]
     let requirements = replace_pip_secret(conn, w_id, &requirements, worker_name, job_id).await?;
 
-    let ws_suffix = crate::workspace_registry_cache_suffix(w_id).await;
+    let pip_indexes = PipIndexes::snapshot(w_id).await;
+    let ws_suffix = if pip_indexes.ws_scoped {
+        format!(":ws:{w_id}")
+    } else {
+        String::new()
+    };
     let exclude_newer_suffix = uv_exclude_newer
         .as_deref()
         .map(|v| format!("-en{}", v))
@@ -343,31 +349,12 @@ pub async fn uv_pip_compile(
         if no_cache {
             args.extend(["--no-cache"]);
         }
-        let pip_extra_index_url = read_ee_registry_with_workspace_override(
-            PIP_EXTRA_INDEX_URL.read().await.clone(),
-            "pip_extra_index_url",
-            "pip extra index url",
-            job_id,
-            w_id,
-            conn,
-        )
-        .await
-        .map(handle_ephemeral_token);
+        let (pip_extra_index_url, pip_index_url) = pip_indexes.urls(job_id, w_id, conn).await;
         if let Some(url) = pip_extra_index_url.as_ref() {
             url.split(",").for_each(|url| {
                 args.extend(["--extra-index-url", url]);
             });
         }
-        let pip_index_url = read_ee_registry_with_workspace_override(
-            PIP_INDEX_URL.read().await.clone(),
-            "pip_index_url",
-            "pip index url",
-            job_id,
-            w_id,
-            conn,
-        )
-        .await
-        .map(handle_ephemeral_token);
         if let Some(url) = pip_index_url.as_ref() {
             args.extend(["--index-url", url]);
         }
@@ -393,18 +380,76 @@ pub async fn uv_pip_compile(
         #[cfg(unix)]
         let uv_cmd = UV_PATH.as_str();
 
-        let mut child_cmd = Command::new(uv_cmd);
-        child_cmd
-            .current_dir(job_dir)
-            .env_clear()
-            .env("HOME", HOME_ENV.to_string())
-            .env("PATH", PATH_ENV.to_string())
-            .env("UV_PYTHON_INSTALL_DIR", PY_INSTALL_DIR.to_string())
-            .env("UV_INDEX_STRATEGY", uv_index_strategy)
-            .envs(PROXY_ENVS.clone())
-            .args(&args)
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped());
+        // Resolving an sdist whose metadata is not static makes uv invoke its
+        // PEP 517 build backend, which runs arbitrary package code (e.g.
+        // setup.py). When sandboxing is on, confine that under nsjail exactly
+        // like the install and run steps already are — otherwise it runs as the
+        // worker, in the worker's namespaces, with the worker's env and tokens
+        // readable. The jail gets network to the index, the job dir and the
+        // shared uv cache writable, and the managed interpreter read-only.
+        let mut child_cmd = if is_sandboxing_enabled() {
+            let index_cert_mount = INDEX_CERT
+                .as_ref()
+                .map(|p| {
+                    format!(
+                        "mount {{\n    src: \"{p}\"\n    dst: \"{p}\"\n    is_bind: true\n    mandatory: false\n}}\n"
+                    )
+                })
+                .unwrap_or_default();
+            // The cache dir is bind-mounted into the jail, so it must exist before
+            // nsjail builds the mount tree (uv would otherwise create it itself).
+            std::fs::create_dir_all(&*UV_CACHE_DIR)?;
+            let nsjail_timeout = resolve_nsjail_timeout(conn, w_id, *job_id, None).await;
+            write_file(
+                job_dir,
+                "lock.config.proto",
+                NSJAIL_CONFIG_LOCK_PY_CONTENT
+                    .replace("{TIMEOUT}", &nsjail_timeout)
+                    .replace("{JOB_DIR}", job_dir)
+                    .replace("{UV_CACHE_DIR}", &*UV_CACHE_DIR)
+                    .replace("{PY_INSTALL_DIR}", &*PY_INSTALL_DIR)
+                    .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
+                    .replace("{INDEX_CERT_MOUNT}", &index_cert_mount)
+                    .replace("{TRACING_PROXY_CA_CERT_PATH}", &*TRACING_PROXY_CA_CERT_PATH)
+                    .replace("#{DEV}", DEV_CONF_NSJAIL)
+                    .replace(
+                        "{TMP_MOUNT_BLOCK}",
+                        &resolve_nsjail_tmp_mount_block(job_dir).await,
+                    )
+                    .as_str(),
+            )?;
+
+            let mut nsjail_args = vec!["--config", "lock.config.proto", "--", uv_cmd];
+            nsjail_args.extend(args.iter().copied());
+
+            let mut child_cmd = Command::new(NSJAIL_PATH.as_str());
+            child_cmd
+                .current_dir(job_dir)
+                .env_clear()
+                // HOME is set to /tmp by the nsjail config; keep_env passes the rest.
+                .env("PATH", PATH_ENV.to_string())
+                .env("UV_PYTHON_INSTALL_DIR", PY_INSTALL_DIR.to_string())
+                .env("UV_INDEX_STRATEGY", uv_index_strategy)
+                .envs(PROXY_ENVS.clone())
+                .args(nsjail_args)
+                .stdout(Stdio::piped())
+                .stderr(Stdio::piped());
+            child_cmd
+        } else {
+            let mut child_cmd = Command::new(uv_cmd);
+            child_cmd
+                .current_dir(job_dir)
+                .env_clear()
+                .env("HOME", HOME_ENV.to_string())
+                .env("PATH", PATH_ENV.to_string())
+                .env("UV_PYTHON_INSTALL_DIR", PY_INSTALL_DIR.to_string())
+                .env("UV_INDEX_STRATEGY", uv_index_strategy)
+                .envs(PROXY_ENVS.clone())
+                .args(&args)
+                .stdout(Stdio::piped())
+                .stderr(Stdio::piped());
+            child_cmd
+        };
 
         if let Some(mirror) = UV_PYTHON_INSTALL_MIRROR.read().await.as_ref() {
             child_cmd.env("UV_PYTHON_INSTALL_MIRROR", mirror);
@@ -454,7 +499,12 @@ pub async fn uv_pip_compile(
                 );
         }
 
-        let child_process = start_child_process(child_cmd, uv_cmd, false).await?;
+        let child_executable = if is_sandboxing_enabled() {
+            NSJAIL_PATH.as_str()
+        } else {
+            uv_cmd
+        };
+        let child_process = start_child_process(child_cmd, child_executable, false).await?;
         append_logs(&job_id, &w_id, logs, conn).await;
         handle_child(
             job_id,
@@ -462,7 +512,8 @@ pub async fn uv_pip_compile(
             mem_peak,
             canceled_by,
             child_process,
-            false,
+            // jailed when sandboxing is on, so mem sampling finds the real process
+            is_sandboxing_enabled(),
             worker_name,
             &w_id,
             // TODO: Rename to uv-pip-compile?
@@ -860,7 +911,7 @@ pub async fn handle_python_job(
         if v == '<function call>':
             del pre_args[k]
     _pre_result = inner_script.preprocessor(**pre_args)
-    if hasattr(_pre_result, '__await__'):
+    if any('__await__' in vars(c) for c in type(_pre_result).__mro__):
         import asyncio
         _pre_result = asyncio.run(_pre_result)
     kwargs = _pre_result if _pre_result is not None else {{}}
@@ -981,7 +1032,7 @@ try:
         raise ValueError("{main_override} function is missing")
     res = _await(inner_script.{main_override}(**args))
     typ = type(res)
-    if hasattr(res, '__iter__') and not isinstance(res, (str, dict, list, bytes, tuple, set, frozenset, range, memoryview, bytearray)) and typ.__name__ != 'DataFrame':
+    if _defines(res, '__iter__') and not isinstance(res, (str, dict, list, bytes, tuple, set, frozenset, range, memoryview, bytearray)) and typ.__name__ != 'DataFrame':
         for chunk in res:
             print("WM_STREAM: " + chunk.replace('\n', '\\n'))
         res = None
@@ -2068,6 +2119,62 @@ Returned from server: py_version - {:?}, py_version_v2 - {:?}
     Ok((pyv, additional_python_paths))
 }
 
+/// The pip index settings a job resolves and installs from, and whether its workspace
+/// overrides any registry.
+///
+/// Both come from one snapshot of the workspace's overrides: read separately, a settings
+/// reload in between could file an install from an overridden index under a shared cache name.
+struct PipIndexes {
+    extra_index_url: Option<String>,
+    index_url: Option<String>,
+    /// Caches filled through these URLs must not be shared with other workspaces.
+    ws_scoped: bool,
+}
+
+impl PipIndexes {
+    async fn snapshot(w_id: &str) -> Self {
+        let overrides = crate::workspace_registry_overrides(w_id).await;
+        let ws_value = |key: &str| match overrides.get(key) {
+            Some(serde_json::Value::String(s)) => Some(s.clone()),
+            _ => None,
+        };
+        // An empty value means unset, and an empty workspace override unsets the global one.
+        Self {
+            extra_index_url: ws_value("pip_extra_index_url")
+                .or(PIP_EXTRA_INDEX_URL.read().await.clone())
+                .filter(|s| !s.trim().is_empty()),
+            index_url: ws_value("pip_index_url")
+                .or(PIP_INDEX_URL.read().await.clone())
+                .filter(|s| !s.trim().is_empty()),
+            ws_scoped: !overrides.is_empty(),
+        }
+    }
+
+    /// The `(extra index, index)` URLs to hand uv. Kept apart from [`Self::snapshot`]: it runs
+    /// `EPHEMERAL_TOKEN_CMD`, which a caller served from a cache has no reason to pay for.
+    async fn urls(
+        self,
+        job_id: &Uuid,
+        w_id: &str,
+        conn: &Connection,
+    ) -> (Option<String>, Option<String>) {
+        (
+            read_ee_registry(
+                self.extra_index_url,
+                "pip extra index url",
+                job_id,
+                w_id,
+                conn,
+            )
+            .await
+            .map(handle_ephemeral_token),
+            read_ee_registry(self.index_url, "pip index url", job_id, w_id, conn)
+                .await
+                .map(handle_ephemeral_token),
+        )
+    }
+}
+
 lazy_static::lazy_static! {
     static ref PIP_SECRET_VARIABLE: Regex = Regex::new(r"\$\{PIP_SECRET:([^\s\}]+)\}").unwrap();
 
@@ -2527,28 +2634,18 @@ pub async fn handle_python_reqs(
         job_id
     );
 
-    let pip_indexes = (
-        read_ee_registry_with_workspace_override(
-            PIP_EXTRA_INDEX_URL.read().await.clone(),
-            "pip_extra_index_url",
-            "pip extra index url",
-            job_id,
-            w_id,
-            conn,
-        )
-        .await
-        .map(handle_ephemeral_token),
-        read_ee_registry_with_workspace_override(
-            PIP_INDEX_URL.read().await.clone(),
-            "pip_index_url",
-            "pip index url",
-            job_id,
-            w_id,
-            conn,
-        )
-        .await
-        .map(handle_ephemeral_token),
-    );
+    let pip_indexes = PipIndexes::snapshot(w_id).await;
+    let ws_scoped = pip_indexes.ws_scoped;
+    let pip_indexes = pip_indexes.urls(job_id, w_id, conn).await;
+    // The wheel dir is shared by every workspace on the worker, and by every worker through
+    // the object store, under a name that says nothing of the index it was filled from. A
+    // workspace with its own registries gets its own, as its resolution cache does. The id
+    // is hashed: it is not restricted to characters safe in a file name.
+    let ws_dir_suffix = if ws_scoped {
+        format!("-ws-{}", &calculate_hash(w_id)[..16])
+    } else {
+        String::new()
+    };
 
     // Cached paths
     let mut req_with_penv: Vec<(String, String)> = vec![];
@@ -2577,7 +2674,7 @@ pub async fn handle_python_reqs(
         let py_prefix = &py_version.to_cache_dir(false);
 
         let venv_p = format!(
-            "{py_prefix}/{}",
+            "{py_prefix}/{}{ws_dir_suffix}",
             req.replace(' ', "").replace('/', "").replace(':', "")
         );
         if metadata(venv_p.clone() + "/.valid.windmill").await.is_ok() {
@@ -3340,10 +3437,16 @@ This is not normal behavior, please make sure all workers have enough memory.\n
 /// loop-per-call would break them from the second job on. A loop the script
 /// set while importing (`asyncio.set_event_loop`) is reused. asyncio is
 /// imported lazily so sync jobs don't pay its import time.
+/// `_defines` reads the class dicts instead of calling `hasattr`: a result is
+/// arbitrary user data, and `hasattr` runs its `__getattr__` (or its
+/// metaclass's), which may raise something other than AttributeError or
+/// answer every name.
 const PY_AWAIT_HELPER: &str = r#"_loop = None
+def _defines(r, name):
+    return any(name in vars(c) for c in type(r).__mro__)
 def _await(r):
     global _loop
-    if not hasattr(r, '__await__'):
+    if not _defines(r, '__await__'):
         return r
     import asyncio
     if _loop is None or _loop.is_closed():
diff --git a/backend/windmill-worker/src/resource_metrics.rs b/backend/windmill-worker/src/resource_metrics.rs
new file mode 100644
index 0000000000..53c7dc5b4d
--- /dev/null
+++ b/backend/windmill-worker/src/resource_metrics.rs
@@ -0,0 +1,235 @@
+use std::sync::{atomic::Ordering, Mutex, OnceLock};
+
+use windmill_common::{
+    otel_oss::{
+        otel_add_worker_cpu, otel_record_job_memory_peak, otel_set_worker_memory,
+        otel_set_worker_occupancy_rate,
+    },
+    worker::{get_cpu_stat, get_memory, CpuStat, WORKER_GROUP},
+    OTEL_METRICS_ENABLED,
+};
+
+use crate::common::OccupancyResult;
+
+#[cfg(feature = "prometheus")]
+struct PromMetrics {
+    memory_usage: prometheus::IntGaugeVec,
+    windmill_memory_usage: prometheus::IntGaugeVec,
+    memory_limit: prometheus::IntGaugeVec,
+    cpu_usage: prometheus::CounterVec,
+    cpu_periods: prometheus::IntCounterVec,
+    cpu_throttled_periods: prometheus::IntCounterVec,
+    cpu_throttled_seconds: prometheus::CounterVec,
+    occupancy_rate: prometheus::GaugeVec,
+    job_memory_peak: prometheus::HistogramVec,
+}
+
+#[cfg(feature = "prometheus")]
+lazy_static::lazy_static! {
+    static ref PROM_METRICS: Option<PromMetrics> =
+        if windmill_common::METRICS_ENABLED.load(Ordering::Relaxed) {
+            const WORKER: &[&str] = &["name", "worker_group"];
+            Some(PromMetrics {
+                memory_usage: prometheus::register_int_gauge_vec!(
+                    "worker_memory_usage_bytes",
+                    "Memory used by the worker's container, page cache excluded",
+                    WORKER
+                )
+                .unwrap(),
+                windmill_memory_usage: prometheus::register_int_gauge_vec!(
+                    "worker_windmill_memory_usage_bytes",
+                    "Resident memory of the worker process itself",
+                    WORKER
+                )
+                .unwrap(),
+                memory_limit: prometheus::register_int_gauge_vec!(
+                    "worker_memory_limit_bytes",
+                    "Memory limit of the worker's container",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_usage: prometheus::register_counter_vec!(
+                    "worker_cpu_usage_seconds_total",
+                    "CPU time consumed by the worker's container",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_periods: prometheus::register_int_counter_vec!(
+                    "worker_cpu_periods_total",
+                    "CPU enforcement periods elapsed for the worker's container",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_throttled_periods: prometheus::register_int_counter_vec!(
+                    "worker_cpu_throttled_periods_total",
+                    "CPU enforcement periods in which the worker's container was throttled",
+                    WORKER
+                )
+                .unwrap(),
+                cpu_throttled_seconds: prometheus::register_counter_vec!(
+                    "worker_cpu_throttled_seconds_total",
+                    "Time the worker's container spent throttled by its CPU limit",
+                    WORKER
+                )
+                .unwrap(),
+                occupancy_rate: prometheus::register_gauge_vec!(
+                    "worker_occupancy_rate",
+                    "Share of time the worker spent executing jobs, over the window",
+                    &["name", "worker_group", "window"]
+                )
+                .unwrap(),
+                job_memory_peak: prometheus::register_histogram_vec!(
+                    "worker_job_memory_peak_bytes",
+                    "Peak memory of a job's main process",
+                    &["tag"],
+                    windmill_common::worker::JOB_MEMORY_PEAK_BUCKETS.to_vec()
+                )
+                .unwrap(),
+            })
+        } else {
+            None
+        };
+}
+
+fn metrics_enabled() -> bool {
+    #[cfg(feature = "prometheus")]
+    if PROM_METRICS.is_some() {
+        return true;
+    }
+    OTEL_METRICS_ENABLED.load(Ordering::Relaxed)
+}
+
+// Memory and CPU are read from the cgroup, which every worker of a process shares
+// (native mode runs several). Only the first worker to report exports them, so that
+// summing the series over workers does not count one container several times.
+static CONTAINER_SERIES_OWNER: OnceLock<String> = OnceLock::new();
+static MEMORY_LIMIT: Mutex<Option<Option<i64>>> = Mutex::new(None);
+
+/// Replaces the exported memory limit, for the ping that re-reads the cgroup limits.
+pub(crate) fn set_memory_limit(limit: Option<i64>) {
+    *MEMORY_LIMIT.lock().unwrap() = Some(limit);
+}
+static LAST_CPU_STAT: Mutex<CpuStat> =
+    Mutex::new(CpuStat { usage_usec: 0, nr_periods: 0, nr_throttled: 0, throttled_usec: 0 });
+
+/// Exports the worker's resource readings. Meant for the ping ticks, which have already
+/// read memory usage and occupancy; the only extra work is the cgroup `cpu.stat` read.
+pub(crate) fn record_worker_resources(
+    worker_name: &str,
+    memory_usage: Option<i64>,
+    wm_memory_usage: Option<i64>,
+    occupancy: Option<&OccupancyResult>,
+) {
+    if !metrics_enabled() {
+        return;
+    }
+    let worker_group = WORKER_GROUP.as_str();
+
+    if let Some(occupancy) = occupancy {
+        let windows = [
+            ("total", Some(occupancy.occupancy_rate)),
+            ("15s", occupancy.occupancy_rate_15s),
+            ("5m", occupancy.occupancy_rate_5m),
+            ("30m", occupancy.occupancy_rate_30m),
+        ];
+        for (window, rate) in windows {
+            let Some(rate) = rate.filter(|r| r.is_finite()) else {
+                continue;
+            };
+            #[cfg(feature = "prometheus")]
+            if let Some(m) = PROM_METRICS.as_ref() {
+                m.occupancy_rate
+                    .with_label_values(&[worker_name, worker_group, window])
+                    .set(rate as f64);
+            }
+            otel_set_worker_occupancy_rate(worker_name, worker_group, window, rate as f64);
+        }
+    }
+
+    if CONTAINER_SERIES_OWNER.get_or_init(|| worker_name.to_string()) != worker_name {
+        return;
+    }
+
+    let memory_limit = *MEMORY_LIMIT.lock().unwrap().get_or_insert_with(get_memory);
+    #[cfg(feature = "prometheus")]
+    if let Some(m) = PROM_METRICS.as_ref() {
+        let labels = &[worker_name, worker_group];
+        if let Some(v) = memory_usage {
+            m.memory_usage.with_label_values(labels).set(v);
+        }
+        if let Some(v) = wm_memory_usage {
+            m.windmill_memory_usage.with_label_values(labels).set(v);
+        }
+        if let Some(v) = memory_limit {
+            m.memory_limit.with_label_values(labels).set(v);
+        }
+    }
+    otel_set_worker_memory(
+        worker_name,
+        worker_group,
+        memory_usage,
+        wm_memory_usage,
+        memory_limit,
+    );
+
+    let Some(stat) = get_cpu_stat() else {
+        return;
+    };
+    let delta = {
+        let mut last = LAST_CPU_STAT.lock().unwrap();
+        // A reading below the previous one means the cgroup changed under the process:
+        // restart from it rather than exporting a negative increase.
+        let delta = if stat.usage_usec < last.usage_usec {
+            CpuStat::default()
+        } else {
+            CpuStat {
+                usage_usec: stat.usage_usec - last.usage_usec,
+                nr_periods: stat.nr_periods.saturating_sub(last.nr_periods),
+                nr_throttled: stat.nr_throttled.saturating_sub(last.nr_throttled),
+                throttled_usec: stat.throttled_usec.saturating_sub(last.throttled_usec),
+            }
+        };
+        *last = stat;
+        delta
+    };
+    let usage_secs = delta.usage_usec as f64 / 1e6;
+    let throttled_secs = delta.throttled_usec as f64 / 1e6;
+    #[cfg(feature = "prometheus")]
+    if let Some(m) = PROM_METRICS.as_ref() {
+        let labels = &[worker_name, worker_group];
+        m.cpu_usage.with_label_values(labels).inc_by(usage_secs);
+        m.cpu_periods
+            .with_label_values(labels)
+            .inc_by(delta.nr_periods);
+        m.cpu_throttled_periods
+            .with_label_values(labels)
+            .inc_by(delta.nr_throttled);
+        m.cpu_throttled_seconds
+            .with_label_values(labels)
+            .inc_by(throttled_secs);
+    }
+    otel_add_worker_cpu(
+        worker_name,
+        worker_group,
+        usage_secs,
+        delta.nr_periods,
+        delta.nr_throttled,
+        throttled_secs,
+    );
+}
+
+/// `mem_peak_kb` is the job's `mem_peak`: non-positive when the executor had no process
+/// to sample or the reading failed, and those are not observations.
+pub(crate) fn record_job_memory_peak(tag: &str, mem_peak_kb: i32) {
+    if mem_peak_kb <= 0 {
+        return;
+    }
+    let bytes = mem_peak_kb as u64 * 1024;
+    #[cfg(feature = "prometheus")]
+    if let Some(m) = PROM_METRICS.as_ref() {
+        m.job_memory_peak
+            .with_label_values(&[tag])
+            .observe(bytes as f64);
+    }
+    otel_record_job_memory_peak(tag, bytes);
+}
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index 0490ed1754..e5b84f39b9 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -21,6 +21,7 @@ use windmill_common::{
     error::{self, Error},
     flow_status::FlowJobDuration,
     jobs::JobKind,
+    runnable_job_stats::{accumulate_runnable_job_stats, flush_runnable_job_stats},
     utils::WarnAfterExt,
     worker::{error_to_value, to_raw_value, Connection, WORKER_GROUP},
     worker_group_job_stats::{accumulate_job_stats, flush_stats_to_db, JobStatsMap},
@@ -32,8 +33,8 @@ use windmill_common::bench::{BenchmarkInfo, BenchmarkIter};
 
 use windmill_queue::{
     append_logs, asset_dispatch, get_mini_completed_job, is_pre_shaped_wm_failure_result,
-    parse_result_object, CanceledBy, FlowRunners, JobCompleted, MiniCompletedJob, MiniPulledJob,
-    ValidableJson, WrappedError, INIT_SCRIPT_TAG, MANUAL_FAILURE_ERROR_NAME,
+    parse_result_object, CanceledBy, FlowRunners, JobCompleted, JobResourceUsage, MiniCompletedJob,
+    MiniPulledJob, ValidableJson, WrappedError, INIT_SCRIPT_TAG, MANUAL_FAILURE_ERROR_NAME,
 };
 
 use serde_json::{json, value::RawValue, Value};
@@ -231,6 +232,10 @@ async fn process_jc(
     let duration_ms = jc.duration.clone();
     let script_lang = jc.job.script_lang.clone();
     let workspace_id = jc.job.workspace_id.clone();
+    let job_kind = jc.job.kind;
+    let runnable_path = jc.job.runnable_path.clone();
+    let mem_peak = jc.mem_peak;
+    let resource_usage = jc.resource_usage.take();
 
     let root_job = handle_receive_completed_job(
         jc,
@@ -269,6 +274,17 @@ async fn process_jc(
             duration_ms,
         )
         .await;
+        accumulate_runnable_job_stats(
+            &workspace_id,
+            job_kind,
+            runnable_path.as_deref(),
+            resource_usage
+                .as_ref()
+                .map_or(WORKER_GROUP.as_str(), |u| u.worker_group.as_str()),
+            duration_ms,
+            mem_peak,
+            resource_usage.as_ref().and_then(|u| u.cpu_time_ms),
+        );
     }
 
     success
@@ -317,6 +333,14 @@ pub fn start_background_processor(
         let flush_handle = tokio::spawn(async move {
             let mut interval = tokio::time::interval(tokio::time::Duration::from_secs(900)); // Flush every 15 min
 
+            // Once per hourly bucket, at an offset of its own per worker so that a fleet
+            // started together does not write the same rows in the same second.
+            let runnable_period = tokio::time::Duration::from_secs(3600);
+            let mut runnable_interval = tokio::time::interval_at(
+                tokio::time::Instant::now() + runnable_period.mul_f64(rand::random::<f64>()),
+                runnable_period,
+            );
+
             loop {
                 tokio::select! {
                     _ = interval.tick() => {
@@ -324,6 +348,11 @@ pub fn start_background_processor(
                             tracing::error!("Failed to flush worker group job stats: {}", e);
                         }
                     }
+                    _ = runnable_interval.tick() => {
+                        if let Err(e) = flush_runnable_job_stats(&db_clone).await {
+                            tracing::error!("Failed to flush runnable job stats: {}", e);
+                        }
+                    }
                     _ = killpill_rx_clone.recv() => {
                         tracing::info!("bg processor received killpill signal, flushing remaining stats");
                         break;
@@ -524,6 +553,18 @@ pub fn start_background_processor(
             Ok(Err(join_err)) => tracing::error!("Stats flush task failed: {}", join_err),
             Err(_) => tracing::error!("Stats flush timed out after 10 seconds"),
         }
+        // The periodic task stops at the killpill, before the jobs drained above were
+        // accumulated: without this a short-lived worker would lose its whole rollup.
+        match tokio::time::timeout(
+            std::time::Duration::from_secs(10),
+            flush_runnable_job_stats(&db),
+        )
+        .await
+        {
+            Ok(Ok(())) => {}
+            Ok(Err(e)) => tracing::error!("Failed to flush runnable job stats: {}", e),
+            Err(_) => tracing::error!("Runnable job stats flush timed out after 10 seconds"),
+        }
 
         job_completed_processor_is_done.store(true, Ordering::SeqCst);
 
@@ -555,6 +596,7 @@ pub async fn process_result(
     job_dir: &str,
     job_completed_tx: JobCompletedSender,
     mem_peak: i32,
+    cpu_time_ms: Option<i64>,
     canceled_by: Option<CanceledBy>,
     cached_res_path: Option<String>,
     token: &str,
@@ -565,6 +607,7 @@ pub async fn process_result(
     has_stream: bool,
     flow_runners: Option<Arc<FlowRunners>>,
 ) -> error::Result<crate::worker::JobOutcome> {
+    let resource_usage = Some(JobResourceUsage { worker_group: WORKER_GROUP.clone(), cpu_time_ms });
     match result {
         Ok(result) => {
             send_job_completed(
@@ -575,6 +618,7 @@ pub async fn process_result(
                     result,
                     result_columns,
                     mem_peak,
+                    resource_usage,
                     canceled_by,
                     success: true,
                     cached_res_path,
@@ -658,6 +702,7 @@ pub async fn process_result(
                     result_columns: None,
                     preprocessed_args: None,
                     mem_peak,
+                    resource_usage,
                     canceled_by,
                     success: false,
                     cached_res_path,
@@ -1776,7 +1821,7 @@ pub async fn process_completed_job(
 
         add_time!(bench, "pre add_completed_job");
 
-        let (_, duration) = add_completed_job(
+        let (_, span) = add_completed_job(
             db,
             &job,
             true,
@@ -1835,7 +1880,10 @@ pub async fn process_completed_job(
                     true,
                     canceled_by,
                     result,
-                    started_at.map(|x| FlowJobDuration { started_at: x, duration_ms: duration }),
+                    span.started_at.or(started_at).map(|x| FlowJobDuration {
+                        started_at: x,
+                        duration_ms: span.duration_ms,
+                    }),
                     StepFailureKind::Normal,
                     &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).to_owned(),
                     &worker_dir,
@@ -1867,9 +1915,10 @@ pub async fn process_completed_job(
         // `wm_failure` field) so a real runtime failure whose raw
         // result happens to contain a `wm_failure` field still goes
         // through the standard `WrappedError { error: ... }` wrap path.
-        let downstream_result: Arc<Box<RawValue>> = if is_pre_shaped_wm_failure_result(result.get())
-        {
-            windmill_queue::add_completed_job_pre_shaped_failure(
+        let (downstream_result, span): (Arc<Box<RawValue>>, _) = if is_pre_shaped_wm_failure_result(
+            result.get(),
+        ) {
+            let span = windmill_queue::add_completed_job_pre_shaped_failure(
                 db,
                 &job,
                 mem_peak.to_owned(),
@@ -1880,9 +1929,9 @@ pub async fn process_completed_job(
                 None,
             )
             .await?;
-            result.clone()
+            (result.clone(), span)
         } else {
-            let wrapped = add_completed_job_error(
+            let (wrapped, span) = windmill_queue::add_completed_job_error_with_span(
                 db,
                 &job,
                 mem_peak.to_owned(),
@@ -1895,7 +1944,10 @@ pub async fn process_completed_job(
                 None,
             )
             .await?;
-            Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap())
+            (
+                Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap()),
+                span,
+            )
         };
         #[cfg(all(feature = "enterprise", feature = "private"))]
         if job.kind == JobKind::DeploymentCallback {
@@ -1927,12 +1979,19 @@ pub async fn process_completed_job(
                     false,
                     canceled_by,
                     downstream_result,
-                    duration.and_then(|d| {
-                        job.started_at.map(|started_at| FlowJobDuration {
-                            started_at: started_at,
-                            duration_ms: d,
+                    if span.outlasts_run(job.started_at) {
+                        span.started_at.map(|started_at| FlowJobDuration {
+                            started_at,
+                            duration_ms: span.duration_ms,
                         })
-                    }),
+                    } else {
+                        duration.and_then(|d| {
+                            job.started_at.map(|started_at| FlowJobDuration {
+                                started_at: started_at,
+                                duration_ms: d,
+                            })
+                        })
+                    },
                     StepFailureKind::Normal,
                     &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).to_owned(),
                     &worker_dir,
diff --git a/backend/windmill-worker/src/snowflake_executor.rs b/backend/windmill-worker/src/snowflake_executor.rs
index b4bb448b99..411dd520b9 100644
--- a/backend/windmill-worker/src/snowflake_executor.rs
+++ b/backend/windmill-worker/src/snowflake_executor.rs
@@ -855,7 +855,7 @@ fn convert_typ_val(arg_t: String, arg_v: Value) -> Value {
                 }
             })
         }
-        "binary" => {
+        "binary" | "varbinary" => {
             // convert base64 to hex as expected by snowflake
             let bytes = engine::general_purpose::STANDARD
                 .decode(arg_v.as_str().unwrap_or(""))
@@ -873,7 +873,8 @@ fn convert_typ_val(arg_t: String, arg_v: Value) -> Value {
             let mut v = arg_v;
 
             if !v.is_string() {
-                // if not string, convert to string for api request
+                // The SQL API has no ARRAY/VARIANT binding type: a list or object
+                // is bound as its JSON text, which the query reads with PARSE_JSON(?).
                 v = json!(v.to_string());
             }
 
@@ -935,3 +936,16 @@ fn parse_val(value: &Value, typ: &str) -> Value {
         ))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn list_arg_binds_as_json_text() {
+        assert_eq!(
+            convert_typ_val("varchar[]".to_string(), json!(["sales", "g/ops"])),
+            json!({ "type": "TEXT", "value": r#"["sales","g/ops"]"# })
+        );
+    }
+}
diff --git a/backend/windmill-worker/src/sql_s3_input.rs b/backend/windmill-worker/src/sql_s3_input.rs
index e3a5b25411..ecf2c53dec 100644
--- a/backend/windmill-worker/src/sql_s3_input.rs
+++ b/backend/windmill-worker/src/sql_s3_input.rs
@@ -56,7 +56,7 @@ pub async fn fetch_s3object_as_json_text(
         crate::worker_utils::JobPingHeartbeat::start(conn, job_id, "s3object materialization");
 
     let bytes = client
-        .download_s3_file(workspace_id, &obj.s3, obj.storage.clone())
+        .download_s3_file(workspace_id, &obj.s3, obj.storage.clone(), None)
         .await
         .with_context(|| format!("Failed to download S3 object `{}`", obj.s3))?;
 
diff --git a/backend/windmill-worker/src/wac_executor.rs b/backend/windmill-worker/src/wac_executor.rs
index 45d76c74e8..3cc9c1e23a 100644
--- a/backend/windmill-worker/src/wac_executor.rs
+++ b/backend/windmill-worker/src/wac_executor.rs
@@ -113,6 +113,11 @@ pub enum WacPark {
 /// handler — falls back to `now() - started_at`. Left pointing at the first segment,
 /// that fallback reports the whole sleep or approval wait as execution time.
 ///
+/// The first park keeps that first start in `extras.wac_first_started_at`, so the
+/// completed row can still say when the workflow began and how long it took overall
+/// (`Completion::execute`). The queue row's `started_at` stays per segment. The inline
+/// checkpoint requeue clears `started_at` on its own and keeps the first start the same way.
+///
 /// Call it before any write to the parent's `v2_job_status` row in the same
 /// transaction: a child's completion locks the queue row and then the status row
 /// (`record_child_completion`), and taking them the other way round here can
@@ -156,7 +161,10 @@ pub async fn suspend_wac_parent(
 
     sqlx::query!(
         "UPDATE v2_job_queue
-         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null
+         SET suspend = $3, suspend_until = now() + make_interval(secs => $4), started_at = null,
+             extras = CASE WHEN started_at IS NULL OR extras ? 'wac_first_started_at' THEN extras
+                 ELSE jsonb_set(COALESCE(extras, '{}'::jsonb), '{wac_first_started_at}', to_jsonb(started_at))
+             END
          WHERE id = $1 AND workspace_id = $2",
         job_id,
         w_id,
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 6b51073b84..3aa377c904 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -16,8 +16,6 @@ use tokio::time::timeout;
 // Re-export proxy env-var snapshots so callers (including EE modules)
 // can keep importing them via `crate::{NO_PROXY, HTTP_PROXY, HTTPS_PROXY}`.
 use windmill_common::client::AuthedClient;
-use windmill_common::db::UserDbWithAuthed;
-use windmill_common::get_latest_deployed_hash_for_path;
 use windmill_common::jobs::InlineScriptTarget;
 use windmill_common::jobs::RunInlineScriptFnParams;
 use windmill_common::jobs::WorkerInternalServerInlineUtils;
@@ -157,7 +155,7 @@ use crate::{
         handle_app_dependency_job, handle_dependency_job, handle_flow_dependency_job,
         tally_unfinished_dependency_deploy,
     },
-    worker_utils::{insert_ping, queue_vacuum, update_worker_ping_full},
+    worker_utils::{insert_ping, mark_worker_draining, queue_vacuum, update_worker_ping_full},
 };
 
 #[cfg(feature = "rust")]
@@ -217,6 +215,8 @@ lazy_static::lazy_static! {
     pub static ref PY311_CACHE_DIR: String = format!("{}python_3_11", *ROOT_CACHE_DIR);
     pub static ref PY312_CACHE_DIR: String = format!("{}python_3_12", *ROOT_CACHE_DIR);
     pub static ref PY313_CACHE_DIR: String = format!("{}python_3_13", *ROOT_CACHE_DIR);
+    pub static ref PY314_CACHE_DIR: String = format!("{}python_3_14", *ROOT_CACHE_DIR);
+    pub static ref PY315_CACHE_DIR: String = format!("{}python_3_15", *ROOT_CACHE_DIR);
 
     pub static ref TAR_JAVA_CACHE_DIR: String = format!("{}tar/java", *ROOT_CACHE_DIR);
 
@@ -951,6 +951,22 @@ pub async fn workspace_registry_cache_suffix(w_id: &str) -> String {
     }
 }
 
+/// The registry overrides of a workspace, empty when it has none.
+///
+/// One snapshot: registry settings reload under running jobs, so a caller whose cache key
+/// has to agree with the registry values it used reads both from here rather than calling
+/// [`workspace_registry_cache_suffix`] and a `read_ee_registry_*` helper separately.
+pub async fn workspace_registry_overrides(
+    w_id: &str,
+) -> std::collections::HashMap<String, serde_json::Value> {
+    let registries = WORKSPACE_REGISTRIES.read().await;
+    registries
+        .as_ref()
+        .and_then(|m| m.get(w_id))
+        .cloned()
+        .unwrap_or_default()
+}
+
 /// The name a build artifact is cached under, derived from `base` — the runnable's own
 /// cache-key input — and its inline modules.
 ///
@@ -2007,6 +2023,7 @@ pub fn create_span_with_name(
         root_job = field::Empty,
         workspace_id = %arc_job.workspace_id,
         worker = %worker_name,
+        worker_group = %*WORKER_GROUP,
         hostname = field::Empty,
         tag = %arc_job.tag,
         language = field::Empty,
@@ -2158,6 +2175,7 @@ pub fn log_context_for_job(
         job_id: Some(arc_job.id.to_string()),
         workspace_id: Some(arc_job.workspace_id.clone()),
         worker: Some(worker_name.to_string()),
+        worker_group: Some(WORKER_GROUP.clone()),
         tag: Some(arc_job.tag.clone()),
         job_kind: Some(arc_job.kind.as_str().to_string()),
         created_by: Some(arc_job.created_by.clone()),
@@ -2231,6 +2249,7 @@ pub async fn handle_all_job_kind_error(
                         ))),
                         result_columns: None,
                         mem_peak: 0,
+                        resource_usage: None,
                         canceled_by: None,
                         success: false,
                         cached_res_path: None,
@@ -2697,7 +2716,7 @@ pub async fn run_worker(
     let mut last_ping = Instant::now() - Duration::from_secs(NUM_SECS_PING + 1);
 
     let mut reported_ip = cached_ip();
-    let previous_jobs_executed = insert_ping(hostname, &worker_name, reported_ip, conn)
+    let previous_jobs_executed = insert_ping(hostname, &worker_name, reported_ip, true, conn)
         .await
         .expect("initial ping could be sent");
 
@@ -3144,6 +3163,31 @@ pub async fn run_worker(
 
     let mut killpill_rx2 = killpill_rx.resubscribe();
 
+    // The loop below only sees the killpill once the running job is done, which is too late
+    // for that job to learn its worker is going away.
+    {
+        let mut killpill_rx = killpill_rx.resubscribe();
+        let conn = conn.clone();
+        let worker_name = worker_name.clone();
+        tokio::spawn(async move {
+            if matches!(
+                killpill_rx.recv().await,
+                Err(broadcast::error::RecvError::Closed)
+            ) {
+                return;
+            }
+            for attempt in 1..=3 {
+                match mark_worker_draining(&conn, &worker_name).await {
+                    Ok(()) => return,
+                    Err(e) => {
+                        tracing::warn!(worker = %worker_name, "failed to mark worker as draining (attempt {attempt}/3): {e:#}");
+                        tokio::time::sleep(Duration::from_secs(2)).await;
+                    }
+                }
+            }
+        });
+    }
+
     loop {
         let last_processing_duration_secs = last_processing_duration.load(Ordering::SeqCst);
         if last_processing_duration_secs > 5 {
@@ -3219,7 +3263,7 @@ pub async fn run_worker(
             // which costs at most the last job's id here: no job of this worker is in flight at this
             // point in the loop, and the next one refills them.
             if ip_just_resolved && conn.as_sql().is_none() {
-                if let Err(e) = insert_ping(hostname, &worker_name, ip, &conn).await {
+                if let Err(e) = insert_ping(hostname, &worker_name, ip, false, &conn).await {
                     tracing::warn!(
                         worker = %worker_name, hostname = %hostname,
                         "failed to re-register with the resolved external IP: {e}"
@@ -3408,6 +3452,10 @@ pub async fn run_worker(
                     tokio::time::sleep(Duration::from_millis(200)).await;
                     continue;
                 }
+            } else if WORKER_CONFIG.load().paused {
+                // Checked after the same-worker channel: a flow this worker already runs
+                // still needs it for its remaining same-worker steps.
+                Ok(None)
             } else {
                 match &conn {
                     Connection::Sql(db) => {
@@ -3595,8 +3643,12 @@ pub async fn run_worker(
                     // dispatch by path and return before that check, so a job sent down them
                     // would run with whatever arguments survived the failure.
                     let fails_before_running = job.pre_run_error.is_some();
+                    // A dedicated worker or flow runner runs every job it gets with its own
+                    // unscoped worker token, so a job with a restricted token runs here, with the
+                    // token minted for it, whichever tag brought it.
+                    let restricted = job.job_token_scopes.is_some();
 
-                    if !dedicated_workers.is_empty() && !fails_before_running {
+                    if !dedicated_workers.is_empty() && !fails_before_running && !restricted {
                         let dedicated_worker_tx = job.runnable_path.as_ref().and_then(|path| {
                             // For flow steps inside branches/loops, runnable_path includes
                             // nesting segments (e.g. f/flow/branchone-0/a) but the dedicated
@@ -3641,7 +3693,9 @@ pub async fn run_worker(
                         NextJob::Http(_) => None,
                     };
 
-                    if let Some(flow_runners) = flow_runners.filter(|_| !fails_before_running) {
+                    if let Some(flow_runners) =
+                        flow_runners.filter(|_| !fails_before_running && !restricted)
+                    {
                         let key_o = job.flow_step_id.as_ref().map(|x| x.to_string());
                         if let Some(key) = key_o {
                             if let Some(flow_runner_tx) = flow_runners.runners.get(&key) {
@@ -3721,6 +3775,7 @@ pub async fn run_worker(
                                 result: Arc::new(empty_result()),
                                 result_columns: None,
                                 mem_peak: 0,
+                                resource_usage: None,
                                 cached_res_path: None,
                                 token: "".to_string(),
                                 canceled_by: None,
@@ -4712,6 +4767,7 @@ pub async fn handle_queued_job(
                             result,
                             result_columns: None,
                             mem_peak: 0,
+                            resource_usage: None,
                             canceled_by: None,
                             success: true,
                             cached_res_path: None,
@@ -5061,6 +5117,8 @@ pub async fn handle_queued_job(
 
         let cjob = MiniCompletedJob::from(job.to_owned());
         drop(job);
+        // Taken ahead of the returns below so that none of them leaves the entry behind.
+        let cpu_time_ms = crate::handle_child::take_job_cpu_time_ms(&cjob.id);
         //it's a test job, no need to update the db
         if cjob.workspace_id == "" {
             return Ok(JobOutcome::Completed);
@@ -5077,14 +5135,27 @@ pub async fn handle_queued_job(
             .is_err_and(|err| matches!(err, &Error::WacSuspended(_)))
         {
             // WAC v2 job suspended while waiting for child jobs — don't complete it
+            // Only a worker with a database connection flushes the rollup.
+            if let Connection::Sql(_) = conn {
+                windmill_common::runnable_job_stats::accumulate_runnable_round(
+                    &cjob.workspace_id,
+                    cjob.kind,
+                    cjob.runnable_path.as_deref(),
+                    &WORKER_GROUP,
+                    started.elapsed().as_millis() as i64,
+                    cpu_time_ms,
+                );
+            }
             return Ok(JobOutcome::Completed);
         }
+        crate::resource_metrics::record_job_memory_peak(&cjob.tag, mem_peak);
         process_result(
             cjob,
             result.map(|x| Arc::new(x)),
             job_dir,
             job_completed_tx,
             mem_peak,
+            cpu_time_ms,
             canceled_by,
             cached_res_path,
             &client.token,
@@ -5397,6 +5468,7 @@ async fn handle_code_execution_job(
     precomputed_agent_info: Option<PrecomputedAgentInfo>,
     has_stream: &mut bool,
 ) -> error::Result<Box<RawValue>> {
+    let _custom_timeout = crate::common::RunningJobCustomTimeout::register(job.id, job.timeout);
     let script_hash = || {
         job.runnable_id
             .ok_or_else(|| Error::internal_err("expected script hash"))
@@ -7181,7 +7253,7 @@ pub fn init_worker_internal_server_inline_utils(
         base_internal_url,
         killpill_rx: Arc::new(killpill_rx),
         run_inline_preview_script: Arc::new(|params| {
-            let job = MiniPulledJob::new_inline(
+            let mut job = MiniPulledJob::new_inline(
                 params.workspace_id,
                 params.args,
                 params.created_by,
@@ -7193,6 +7265,7 @@ pub fn init_worker_internal_server_inline_utils(
                 "inline_preview".to_string(),
                 Some(params.lang),
             );
+            job.permissioned_as_end_user_email = params.end_user_email;
             Box::pin(async move {
                 let mut mem_peak: i32 = -1;
                 let mut canceled_by: Option<CanceledBy> = None;
@@ -7234,37 +7307,15 @@ pub fn init_worker_internal_server_inline_utils(
         run_inline_script: Arc::new(|params: RunInlineScriptFnParams| {
             Box::pin(async move {
                 let (script_hash, runnable_path) = match params.target {
-                    InlineScriptTarget::Path(ref path) => {
-                        let db = params
-                            .conn
-                            .as_sql()
-                            .ok_or_else(|| {
-                                error::Error::InternalErr(
-                                    "run_inline_script by path requires a SQL connection"
-                                        .to_string(),
-                                )
-                            })?
-                            .clone();
-                        let authed_ref = params.user_db.as_ref().map(|(_, a)| a.to_authed_ref());
-                        let user_db_authed =
-                            params.user_db.as_ref().zip(authed_ref.as_ref()).map(
-                                |((udb, _), ar)| UserDbWithAuthed { db: udb.clone(), authed: ar },
-                            );
-                        let script_hash_info = get_latest_deployed_hash_for_path(
-                            user_db_authed,
-                            db,
-                            &params.workspace_id,
-                            path,
-                        )
-                        .await?;
-                        (ScriptHash(script_hash_info.hash), Some(path.clone()))
+                    InlineScriptTarget::Path { ref path, hash } => {
+                        (ScriptHash(hash), Some(path.clone()))
                     }
                     InlineScriptTarget::Hash(hash) => (ScriptHash(hash), None),
                 };
                 let content_info =
                     get_script_content_by_hash(&script_hash, &params.workspace_id, &params.conn)
                         .await?;
-                let job = MiniPulledJob::new_inline(
+                let mut job = MiniPulledJob::new_inline(
                     params.workspace_id,
                     params.args,
                     params.created_by,
@@ -7276,6 +7327,7 @@ pub fn init_worker_internal_server_inline_utils(
                     "inline_run".to_string(),
                     content_info.language,
                 );
+                job.permissioned_as_end_user_email = params.end_user_email;
                 let mut mem_peak: i32 = -1;
                 let mut canceled_by: Option<CanceledBy> = None;
                 let mut column_order: Option<Vec<String>> = None;
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 7c1ea23de4..4f67780f18 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -192,6 +192,7 @@ pub async fn update_flow_status_after_job_completion(
         flow_job_duration,
         stop_early_override,
         has_triggered_error_handler: false,
+        recovered_by_child: false,
     };
     let mut step_failure = step_failure;
     loop {
@@ -211,6 +212,7 @@ pub async fn update_flow_status_after_job_completion(
             worker_dir,
             rec.stop_early_override,
             rec.has_triggered_error_handler,
+            rec.recovered_by_child,
             worker_name,
             job_completed_tx.clone(),
             flow_runners.clone(),
@@ -240,6 +242,7 @@ pub async fn update_flow_status_after_job_completion(
                     worker_dir,
                     rec.stop_early_override,
                     rec.has_triggered_error_handler,
+                    false,
                     worker_name,
                     job_completed_tx.clone(),
                     flow_runners.clone(),
@@ -293,6 +296,10 @@ pub struct RecUpdateFlowStatusAfterJobCompletion {
     flow_job_duration: Option<FlowJobDuration>,
     stop_early_override: Option<bool>,
     has_triggered_error_handler: bool,
+    /// The failed child's error handler returned `recover: true`. The parent still handles the
+    /// failure as it would any other, so the same steps run; only a root flow that this failure
+    /// ends turns green.
+    recovered_by_child: bool,
 }
 
 #[derive(Deserialize)]
@@ -427,6 +434,7 @@ pub async fn update_flow_status_after_job_completion_internal(
     worker_dir: &str,
     stop_early_override: Option<bool>,
     has_triggered_error_handler: bool,
+    mut recovered_by_child: bool,
     worker_name: &str,
     job_completed_tx: JobCompletedSender,
     flow_runners: Option<Arc<FlowRunners>>,
@@ -449,6 +457,7 @@ pub async fn update_flow_status_after_job_completion_internal(
         skip_if_stop_early,
         nresult,
         is_failure_step,
+        failure_step_recovers,
         _cleanup_module,
         chat_ai_info,
     ) = {
@@ -1096,6 +1105,9 @@ pub async fn update_flow_status_after_job_completion_internal(
                     } else {
                         has_triggered_error_handler = false;
                     }
+                    // Recovered iterations are stored as successes, so a failed parallel
+                    // node failed on an iteration that did not recover.
+                    recovered_by_child = false;
                     (success, Some(new_status))
                 } else {
                     add_time!(bench, "handle parallel flow start");
@@ -1823,6 +1835,13 @@ pub async fn update_flow_status_after_job_completion_internal(
             _ => false,
         };
 
+        let failure_step_recovers = is_failure_step && result_has_recover_true(nresult.clone());
+        // An error this flow raises on its own (a stop predicate's error message) is a new
+        // failure that no error handler recovered.
+        if stop_early_err_msg.is_some() {
+            recovered_by_child = false;
+        }
+
         let chat_ai_info = ChatAiInfo {
             chat_input_enabled: old_status.chat_input_enabled.unwrap_or(false),
             conversation_id: old_status.memory_id,
@@ -1837,6 +1856,7 @@ pub async fn update_flow_status_after_job_completion_internal(
             skip_if_stop_early,
             nresult,
             is_failure_step,
+            failure_step_recovers,
             old_status.cleanup_module,
             chat_ai_info,
         )
@@ -1844,6 +1864,10 @@ pub async fn update_flow_status_after_job_completion_internal(
 
     let flow_job = Arc::new(flow_job);
 
+    // An inner flow that ends on a recovered failure stays failed, as parents read their
+    // children's stored status (a parallel node counts its iterations' statuses), so only the
+    // root flow turns green.
+    let ends_root = !(flow_job.is_flow_step() && flow_job.parent_job.is_some());
     let done = if !should_continue_flow {
         {
             let logs = if flow_job.is_canceled() {
@@ -1851,7 +1875,9 @@ pub async fn update_flow_status_after_job_completion_internal(
             } else if stop_early {
                 format!("Flow job stopped early because of a stop early predicate returning true\n")
             } else if is_failure_step {
-                format!("Flow job completed with error, and error handler was triggered.\nIt completed with {}, and with recover: {}\n", if success { "success" } else { "error" }, result_has_recover_true(nresult.clone()))
+                format!("Flow job completed with error, and error handler was triggered.\nIt completed with {}, and with recover: {}\n", if success { "success" } else { "error" }, failure_step_recovers)
+            } else if !success && recovered_by_child && ends_root {
+                format!("Flow job completed with success: the step that failed had its error recovered by the error handler (recover: true)\n")
             } else {
                 format!(
                     "Flow job completed with {}\n",
@@ -2048,7 +2074,11 @@ pub async fn update_flow_status_after_job_completion_internal(
                 .await;
             }
 
-            let success = success && (!is_failure_step || result_has_recover_true(nresult.clone()));
+            let success = if is_failure_step {
+                success && failure_step_recovers
+            } else {
+                success || (recovered_by_child && ends_root)
+            };
 
             add_time!(bench, "flow status update 1");
 
@@ -2056,6 +2086,7 @@ pub async fn update_flow_status_after_job_completion_internal(
             add_tool_message_to_conversation(
                 db,
                 &job_id_for_status,
+                flow,
                 success,
                 skipped,
                 chat_ai_info.is_ai_agent_step,
@@ -2066,7 +2097,7 @@ pub async fn update_flow_status_after_job_completion_internal(
             )
             .await?;
             let duration = if success {
-                let (_, duration) = add_completed_job(
+                let (_, span) = add_completed_job(
                     db,
                     &cflow_job,
                     true,
@@ -2080,9 +2111,9 @@ pub async fn update_flow_status_after_job_completion_internal(
                     false,
                 )
                 .await?;
-                duration
+                span.duration_ms
             } else {
-                let (_, duration) = add_completed_job(
+                let (_, span) = add_completed_job(
                     db,
                     &cflow_job,
                     false,
@@ -2100,7 +2131,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                     false,
                 )
                 .await?;
-                duration
+                span.duration_ms
             };
             flow_job_duration = flow_job
                 .started_at
@@ -2148,6 +2179,8 @@ pub async fn update_flow_status_after_job_completion_internal(
                 .await;
                 // override prior child's success so the parent learns this flow failed
                 success = false;
+                // a new failure, which no error handler recovered
+                recovered_by_child = false;
                 true
             }
             Ok(_) => false,
@@ -2177,6 +2210,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             None
                         },
                         has_triggered_error_handler: has_triggered_error_handler || is_failure_step,
+                        recovered_by_child: failure_step_recovers || (recovered_by_child && !success),
                     },
                 ));
             }
@@ -2233,6 +2267,7 @@ fn extract_chat_message_from_flow_result(result: &RawValue) -> error::Result<Opt
 async fn add_tool_message_to_conversation(
     db: &DB,
     job_id: &Uuid,
+    flow: Uuid,
     success: bool,
     skipped: bool,
     is_ai_agent_step: bool,
@@ -2261,7 +2296,8 @@ async fn add_tool_message_to_conversation(
                 add_message_to_conversation_tx(
                     &mut tx,
                     conversation_id,
-                    Some(job_id.clone()),
+                    Some(*job_id),
+                    flow,
                     &content,
                     MessageType::Assistant,
                     None,
@@ -2366,6 +2402,7 @@ async fn advance_flow_status(
                 THEN v2_job_status.flow_leaf_jobs
                 ELSE JSONB_SET(COALESCE(v2_job_status.flow_leaf_jobs, '{}'::JSONB), ARRAY[$7::TEXT], $8) END
         FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id
+            LEFT JOIN job_perms ON job_perms.job_id = v2_job_queue.id
         WHERE v2_job_status.id = $1 AND v2_job_queue.id = $1
         RETURNING
             v2_job_queue.workspace_id,
@@ -2402,7 +2439,8 @@ async fn advance_flow_status(
             v2_job.trigger,
             v2_job.trigger_kind as \"trigger_kind: TriggerKindLabel\",
             v2_job.visible_to_owner,
-            NULL as permissioned_as_end_user_email",
+            NULL as permissioned_as_end_user_email,
+            job_perms.job_token_scopes",
         flow,
         &step_path as &[&str],
         step,
@@ -4179,7 +4217,8 @@ async fn push_next_flow_job(
                 | FlowModuleValue::RawScript { input_transforms, .. }
                 | FlowModuleValue::FlowScript { input_transforms, .. }
                 | FlowModuleValue::Flow { input_transforms, .. }
-                | FlowModuleValue::AIAgent { input_transforms, .. },
+                | FlowModuleValue::AIAgent { input_transforms, .. }
+                | FlowModuleValue::AIDecision { input_transforms, .. },
             ) => {
                 let ctx = get_transform_context(&flow_job, &previous_id, &status);
                 transform_context = Some(ctx);
@@ -4327,11 +4366,15 @@ async fn push_next_flow_job(
     };
 
     // only start runners if we're not already in a squash for loop
+    // Runners would run its steps with their own unscoped token: a restricted flow, or a loop
+    // that restricts itself or any step in it, runs them as regular jobs.
     let start_runners = flow_runners.is_none()
+        && flow_job.job_token_scopes.is_none()
         && matches!(
             next_status,
             NextStatus::NextLoopIteration { start_runners: true, .. }
-        );
+        )
+        && !restricts_any_step(module);
 
     let do_not_pass_runners = matches!(next_status, NextStatus::NextStep { .. })
         && flow_runners
@@ -4746,6 +4789,16 @@ async fn push_next_flow_job(
             end_user_email,
             None,
             None,
+            // A step never holds a wider token than the flow running it, and its own setting
+            // narrows that further.
+            windmill_common::scopes::intersect_job_token_scopes(
+                flow_job.job_token_scopes.as_deref(),
+                windmill_common::scopes::step_job_token_scopes(
+                    module.job_token_scopes.as_deref(),
+                )
+                .as_deref(),
+            )
+            .as_deref(),
         )
         .warn_after_seconds(2)
         .await?;
@@ -5469,7 +5522,8 @@ async fn compute_next_flow_transform(
                 NextStatus::NextStep,
             ))
         }
-        FlowModuleValue::AIAgent { tag, .. } => {
+        // A decision runs as an AI agent job, whose handler answers it as a decision.
+        FlowModuleValue::AIAgent { tag, .. } | FlowModuleValue::AIDecision { tag, .. } => {
             let path = get_path(flow_job, status, module);
             let payload = JobPayload::AIAgent { path };
             Ok(NextFlowTransform::Continue(
@@ -6330,6 +6384,16 @@ pub fn raw_script_to_payload(
     }
 }
 
+/// Whether `module`, or any step or agent tool under it, sets `job_token_scopes`.
+fn restricts_any_step(module: &FlowModule) -> bool {
+    let mut any = false;
+    let _ = FlowModule::traverse_modules(&vec![module.clone()], &mut |m: &FlowModule| {
+        any |= m.job_token_scopes.is_some();
+        Ok(())
+    });
+    any
+}
+
 async fn flow_to_payload(
     path: String,
     delete_after_use: bool,
@@ -6339,13 +6403,14 @@ async fn flow_to_payload(
 ) -> Result<JobPayloadWithTag, Error> {
     let flow_info = get_latest_flow_version_info_for_path(None, &db, w_id, &path, true).await?;
     let on_behalf_of = flow_info.on_behalf_of(w_id, &db).await?;
-    let FlowVersionInfo { version, tag, .. } = flow_info;
+    let FlowVersionInfo { version, tag, job_token_scopes, .. } = flow_info;
     let payload = JobPayload::Flow {
         path,
         dedicated_worker: None,
         apply_preprocessor: false,
         version,
         labels: None,
+        job_token_scopes,
     };
     Ok(JobPayloadWithTag {
         payload,
@@ -6419,6 +6484,7 @@ pub async fn script_to_payload(
                 delete_after_use,
                 delete_after_secs,
                 timeout,
+                job_token_scopes,
                 runnable_settings:
                     ScriptRunnableSettingsInline { concurrency_settings, debouncing_settings },
                 ..
@@ -6436,6 +6502,7 @@ pub async fn script_to_payload(
                     priority,
                     apply_preprocessor: apply_preprocessor.unwrap_or(false),
                     labels: None,
+                    job_token_scopes,
                 },
                 tag_override.to_owned().or(tag),
                 delete_after_use,
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index 861a9625e9..6189d39b8d 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -137,6 +137,7 @@ async fn maybe_queue_binary_prebuild(
         None,
         None,
         None,
+        None,
     )
     .await?;
     tx.commit().await?;
@@ -1243,6 +1244,7 @@ pub async fn handle_flow_dependency_job(
                 &job.workspace_id,
                 flow.failure_module.as_ref(),
                 flow.same_worker,
+                flow.preserve_step_tags,
             )
             .await?;
 
@@ -2133,6 +2135,7 @@ async fn insert_flow_modules<'c>(
     workspace_id: &str,
     failure_module: Option<&Box<FlowModule>>,
     same_worker: bool,
+    preserve_step_tags: bool,
     modules: &mut Vec<FlowModule>,
     modules_node: &mut Option<FlowNodeId>,
 ) -> Result<sqlx::Transaction<'c, sqlx::Postgres>> {
@@ -2143,6 +2146,7 @@ async fn insert_flow_modules<'c>(
         workspace_id,
         failure_module,
         same_worker,
+        preserve_step_tags,
     ))
     .await?;
     if modules.is_empty() || crate::worker_flow::is_simple_modules(modules, failure_module) {
@@ -2159,6 +2163,7 @@ async fn insert_flow_modules<'c>(
             modules: std::mem::take(modules),
             failure_module: failure_module.cloned(),
             same_worker,
+            preserve_step_tags,
             ..Default::default()
         }))),
         None,
@@ -2175,6 +2180,7 @@ async fn reduce_flow<'c>(
     workspace_id: &str,
     failure_module: Option<&Box<FlowModule>>,
     same_worker: bool,
+    preserve_step_tags: bool,
 ) -> Result<sqlx::Transaction<'c, sqlx::Postgres>> {
     use FlowModuleValue::*;
     for module in &mut *modules {
@@ -2233,6 +2239,7 @@ async fn reduce_flow<'c>(
                     workspace_id,
                     failure_module,
                     same_worker,
+                    preserve_step_tags,
                     modules,
                     modules_node,
                 )
@@ -2246,6 +2253,7 @@ async fn reduce_flow<'c>(
                         workspace_id,
                         failure_module,
                         same_worker,
+                        preserve_step_tags,
                         &mut branch.modules,
                         &mut branch.modules_node,
                     )
@@ -2257,6 +2265,7 @@ async fn reduce_flow<'c>(
                     workspace_id,
                     failure_module,
                     same_worker,
+                    preserve_step_tags,
                     default,
                     default_node,
                 )
@@ -2270,6 +2279,7 @@ async fn reduce_flow<'c>(
                         workspace_id,
                         failure_module,
                         same_worker,
+                        preserve_step_tags,
                         &mut branch.modules,
                         &mut branch.modules_node,
                     )
diff --git a/backend/windmill-worker/src/worker_utils.rs b/backend/windmill-worker/src/worker_utils.rs
index 3a313e9360..c634c13b6a 100644
--- a/backend/windmill-worker/src/worker_utils.rs
+++ b/backend/windmill-worker/src/worker_utils.rs
@@ -7,9 +7,9 @@ use windmill_common::{
     external_ip::UNKNOWN_IP,
     worker::{
         get_memory, get_vcpus, get_windmill_memory_usage, get_worker_memory_usage,
-        insert_ping_query, update_job_ping_query, update_worker_ping_from_job_query,
-        update_worker_ping_main_loop_query, Connection, Ping, PingType, NATIVE_MODE_RESOLVED,
-        WORKER_CONFIG, WORKER_GROUP,
+        insert_ping_query, set_worker_draining_query, update_job_ping_query,
+        update_worker_ping_from_job_query, update_worker_ping_main_loop_query, Connection, Ping,
+        PingType, NATIVE_MODE_RESOLVED, WORKER_CONFIG, WORKER_GROUP,
     },
     KillpillSender, DB,
 };
@@ -39,17 +39,26 @@ pub(crate) async fn update_worker_ping_full(
     let wm_memory_usage = get_windmill_memory_usage();
 
     let (vcpus, memory) = if read_cgroups {
-        (get_vcpus(), get_memory())
+        let memory = get_memory();
+        crate::resource_metrics::set_memory_limit(memory);
+        (get_vcpus(), memory)
     } else {
         (None, None)
     };
 
+    let occupancy = occupancy_metrics.update_occupancy_metrics();
+    crate::resource_metrics::record_worker_resources(
+        worker_name,
+        memory_usage,
+        wm_memory_usage,
+        Some(&occupancy),
+    );
     let OccupancyResult {
         occupancy_rate,
         occupancy_rate_15s,
         occupancy_rate_5m,
         occupancy_rate_30m,
-    } = occupancy_metrics.update_occupancy_metrics();
+    } = occupancy;
 
     let ping_start = std::time::Instant::now();
     if let Err(e) = (|| {
@@ -164,6 +173,7 @@ async fn update_worker_ping_full_inner(
                         wm_memory_usage: get_windmill_memory_usage(),
                         job_isolation: None,
                         native_mode: Some(native_mode),
+                        draining: None,
                         ping_type: PingType::MainLoop,
                     },
                 )
@@ -179,6 +189,7 @@ pub async fn insert_ping(
     worker_instance: &str,
     worker_name: &str,
     ip: Option<&str>,
+    reset_draining: bool,
     db: &Connection,
 ) -> anyhow::Result<i32> {
     let (tags, dw, dws, native_mode) = {
@@ -224,6 +235,7 @@ pub async fn insert_ping(
                 memory,
                 job_isolation,
                 native_mode,
+                reset_draining.then_some(false),
                 db,
             )
             .await;
@@ -256,6 +268,7 @@ pub async fn insert_ping(
                         wm_memory_usage: get_windmill_memory_usage(),
                         job_isolation,
                         native_mode: Some(native_mode),
+                        draining: reset_draining.then_some(false),
                         ping_type: PingType::Initial,
                     },
                 )
@@ -314,6 +327,7 @@ pub async fn update_worker_ping_from_job(
                     &Ping {
                         last_job_executed: Some(job_id.clone()),
                         last_job_workspace_id: Some(w_id.to_string()),
+                        draining: None,
                         ping_type: PingType::Job,
                         worker_instance: None,
                         ip: None,
@@ -342,6 +356,45 @@ pub async fn update_worker_ping_from_job(
     Ok(())
 }
 
+/// Publishes on the worker's ping row that it has received its killpill, so the job it is
+/// still running can find out and exit early.
+pub async fn mark_worker_draining(conn: &Connection, worker_name: &str) -> anyhow::Result<()> {
+    match conn {
+        Connection::Sql(db) => set_worker_draining_query(worker_name, db).await,
+        Connection::Http(client) => {
+            client
+                .post::<Ping, ()>(
+                    UPDATE_PING_URL,
+                    None,
+                    &Ping {
+                        last_job_executed: None,
+                        last_job_workspace_id: None,
+                        draining: None,
+                        ping_type: PingType::Draining,
+                        worker_instance: None,
+                        ip: None,
+                        tags: None,
+                        dw: None,
+                        dws: None,
+                        version: None,
+                        vcpus: None,
+                        memory: None,
+                        memory_usage: None,
+                        wm_memory_usage: None,
+                        jobs_executed: None,
+                        occupancy_rate: None,
+                        occupancy_rate_15s: None,
+                        occupancy_rate_5m: None,
+                        occupancy_rate_30m: None,
+                        job_isolation: None,
+                        native_mode: None,
+                    },
+                )
+                .await
+        }
+    }
+}
+
 pub async fn ping_job_status(
     conn: &Connection,
     job_id: &Uuid,
diff --git a/benchmarks/README.md b/benchmarks/README.md
index fc758c006f..1dc4818848 100644
--- a/benchmarks/README.md
+++ b/benchmarks/README.md
@@ -22,12 +22,12 @@ deno run -A benchmark_suite.ts -c suite_wac.json
 
 ### Script benchmarks
 - `noop` — Empty jobs (measures pure scheduling overhead)
-- `deno`, `bun`, `python`, `go`, `bash` — Language runtimes
+- `bun`, `python`, `go`, `bash` — Language runtimes
 - `nativets` — BunNative (no isolation)
 - `dedicated`, `dedicated_nativets` — Dedicated worker mode
 
 ### Flow benchmarks
-- `2steps` — 2-step flow (deno + identity)
+- `2steps` — 2-step flow (bun + identity)
 - `bigscriptinflow` — Flow with large raw bash script
 - `flow_seq_2_bun` — 2 sequential bun steps
 - `flow_par_2_bun` — 2 parallel bun steps (branchall)
diff --git a/benchmarks/benchmark_oneoff.ts b/benchmarks/benchmark_oneoff.ts
index 5f075d2034..5aa75b5864 100644
--- a/benchmarks/benchmark_oneoff.ts
+++ b/benchmarks/benchmark_oneoff.ts
@@ -37,7 +37,7 @@ async function verifyOutputs(uuids: string[], workspace: string) {
   console.log(`Incorrect results: ${incorrectResults}`);
 }
 
-export const NON_TEST_TAGS = ["deno", "python", "go", "bash", "dedicated", "bun", "nativets", "dedicated_nativets", "flow"]
+export const NON_TEST_TAGS = ["python", "go", "bash", "dedicated", "bun", "nativets", "dedicated_nativets", "flow"]
 
 const FLOW_COMPARISON_KINDS = ["flow_seq_2_bun", "flow_par_2_bun", "flow_seq_3_bun"];
 export async function main({
@@ -148,7 +148,7 @@ export async function main({
   }
 
   if (
-    ["deno", "python", "go", "bash", "dedicated", "bun", "nativets", "dedicated_nativets"].includes(
+    ["python", "go", "bash", "dedicated", "bun", "nativets", "dedicated_nativets"].includes(
       kind
     )
   ) {
@@ -169,7 +169,7 @@ export async function main({
       kind: "noop",
     });
   } else if (
-    ["deno", "python", "go", "bash", "dedicated", "bun", "nativets", "dedicated_nativets"].includes(
+    ["python", "go", "bash", "dedicated", "bun", "nativets", "dedicated_nativets"].includes(
       kind
     )
   ) {
@@ -414,7 +414,7 @@ if (import.meta.main) {
     )
     .option(
       "--kind <kind:string>",
-      "Specifiy the benchmark kind among: deno, identity, python, go, bash, dedicated, bun, noop, 2steps, nativets, dedicated_nativets, wac_seq_2, wac_par_2, wac_seq_3, wac_inline_2, flow_seq_2_bun, flow_par_2_bun, flow_seq_3_bun",
+      "Specifiy the benchmark kind among: identity, python, go, bash, dedicated, bun, noop, 2steps, nativets, dedicated_nativets, wac_seq_2, wac_par_2, wac_seq_3, wac_inline_2, flow_seq_2_bun, flow_par_2_bun, flow_seq_3_bun",
       {
         required: true,
       }
diff --git a/benchmarks/graphs_config.json b/benchmarks/graphs_config.json
index 8e37695d66..61b5bdddc8 100644
--- a/benchmarks/graphs_config.json
+++ b/benchmarks/graphs_config.json
@@ -49,26 +49,6 @@
       }
     ]
   },
-  {
-    "graph_title": "deno throughput benchmark",
-    "benchmarks": [
-      {
-        "kind": "deno",
-        "workers": 1,
-        "label": "1 worker"
-      },
-      {
-        "kind": "deno",
-        "workers": 4,
-        "label": "4 workers"
-      },
-      {
-        "kind": "deno",
-        "workers": 8,
-        "label": "8 workers"
-      }
-    ]
-  },
   {
     "graph_title": "bun throughput benchmark",
     "benchmarks": [
@@ -170,7 +150,7 @@
     ]
   },
   {
-    "graph_title": "go vs python vs deno vs bun vs bash vs nativets",
+    "graph_title": "go vs python vs bun vs bash vs nativets",
     "benchmarks": [
       {
         "kind": "go",
@@ -182,11 +162,6 @@
         "workers": 1,
         "label": "python"
       },
-      {
-        "kind": "deno",
-        "workers": 1,
-        "label": "deno"
-      },
       {
         "kind": "bun",
         "workers": 1,
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 1ef3f82939..34e4da5cf3 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.821.0";
+export const VERSION = "v1.830.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
@@ -87,10 +87,6 @@ export async function createBenchScript(
     schemaProperties = {
       uuid: { default: null, description: "", type: "string" },
     };
-  } else if (scriptPattern === "deno") {
-    scriptContent =
-      'export function main(){ return Deno.env.get("WM_JOB_ID"); }';
-    language = "deno";
   } else if (scriptPattern === "nativets") {
     scriptContent =
       '//native\nexport async function main(){ return (await fetch(BASE_URL + "/api/version")).text() }';
@@ -256,10 +252,10 @@ export const getFlowPayload = (flowPattern: string): api.FlowPreview => {
             id: "a",
             value: {
               input_transforms: {},
-              language: api.RawScript.language.DENO,
+              language: "bun" as api.RawScript.language,
               type: "rawscript",
               content:
-                'export function main(){ return Deno.env.get("WM_FLOW_JOB_ID"); }',
+                'export function main(){ return Bun.env["WM_FLOW_JOB_ID"]; }',
             },
           },
           {
@@ -277,7 +273,7 @@ export const getFlowPayload = (flowPattern: string): api.FlowPreview => {
                         expr: "results.a",
                       },
                     },
-                    language: api.RawScript.language.DENO,
+                    language: "bun" as api.RawScript.language,
                     type: "rawscript",
                     content: "export function main(x: string){ return x; }",
                   },
@@ -298,10 +294,10 @@ export const getFlowPayload = (flowPattern: string): api.FlowPreview => {
             id: "a",
             value: {
               input_transforms: {},
-              language: api.RawScript.language.DENO,
+              language: "bun" as api.RawScript.language,
               type: "rawscript",
               content:
-                'export function main(){ return Deno.env.get("WM_FLOW_JOB_ID"); }',
+                'export function main(){ return Bun.env["WM_FLOW_JOB_ID"]; }',
             },
           },
           {
@@ -321,7 +317,7 @@ export const getFlowPayload = (flowPattern: string): api.FlowPreview => {
                             expr: "results.a",
                           },
                         },
-                        language: api.RawScript.language.DENO,
+                        language: "bun" as api.RawScript.language,
                         type: "rawscript",
                         content: "export function main(x: string){ return x; }",
                       },
@@ -339,7 +335,7 @@ export const getFlowPayload = (flowPattern: string): api.FlowPreview => {
                             expr: "results.a",
                           },
                         },
-                        language: api.RawScript.language.DENO,
+                        language: "bun" as api.RawScript.language,
                         type: "rawscript",
                         content: "export function main(x: string){ return x; }",
                       },
@@ -490,10 +486,10 @@ export const getFlowPayload = (flowPattern: string): api.FlowPreview => {
             id: "a",
             value: {
               input_transforms: {},
-              language: api.RawScript.language.DENO,
+              language: "bun" as api.RawScript.language,
               type: "rawscript",
               content:
-                'export function main(){ return Deno.env.get("WM_FLOW_JOB_ID"); }',
+                'export function main(){ return Bun.env["WM_FLOW_JOB_ID"]; }',
             },
           },
           {
diff --git a/benchmarks/main.ts b/benchmarks/main.ts
index 1f681a9c03..bf2f998854 100644
--- a/benchmarks/main.ts
+++ b/benchmarks/main.ts
@@ -175,11 +175,11 @@ export async function main({
   if (
     !useFlows &&
     (scriptPattern === undefined ||
-      ["deno", "python", "go", "bash", "bun", "dedicated"].includes(
+      ["python", "go", "bash", "bun", "dedicated"].includes(
         scriptPattern
       ))
   ) {
-    await createBenchScript(scriptPattern || "deno", workspace);
+    await createBenchScript(scriptPattern || "bun", workspace);
   }
 
   let workers: Worker[] = new Array(num_workers);
@@ -458,7 +458,7 @@ if (import.meta.main) {
     )
     .option(
       "--script-pattern <pattern:string>",
-      "Use a different script pattern among: deno, identity, python, go, bash, dedicated, bun (Default deno)"
+      "Use a different script pattern among: bun, identity, python, go, bash, dedicated (Default bun)"
     )
     .option("--custom <custom_path:string>", "Use custom actions during bench")
     .option(
diff --git a/benchmarks/suite_config.json b/benchmarks/suite_config.json
index a2704a46fe..ed50c60b1e 100644
--- a/benchmarks/suite_config.json
+++ b/benchmarks/suite_config.json
@@ -7,10 +7,6 @@
     "kind": "2steps",
     "jobs": 250
   },
-  {
-    "kind": "deno",
-    "jobs": 500
-  },
   {
     "kind": "bun",
     "jobs": 500
diff --git a/benchmarks/worker.ts b/benchmarks/worker.ts
index ae06fa9779..ce2d695771 100644
--- a/benchmarks/worker.ts
+++ b/benchmarks/worker.ts
@@ -118,7 +118,7 @@ while (cont) {
         } else {
           uuid = await windmill.JobService.runScriptByPath({
             workspace: config.workspace_id,
-            path: "f/benchmarks/" + (config.scriptPattern || "deno"),
+            path: "f/benchmarks/" + (config.scriptPattern || "bun"),
             requestBody: {},
           });
         }
diff --git a/chat-sdk/README.md b/chat-sdk/README.md
index 62a5467a47..006d5407d8 100644
--- a/chat-sdk/README.md
+++ b/chat-sdk/README.md
@@ -1,21 +1,21 @@
-# windmill-chat
+# @windmill-labs/chat-sdk
 
 Build a chat interface on a Windmill flow deployed in **chat mode**, from any frontend
 or from a Windmill raw app. The library is headless: it runs the flow, follows the
 answer as it streams, keeps the conversation history, and hands you state to render.
 
 ```
-npm install windmill-chat
+npm install @windmill-labs/chat-sdk
 ```
 
-No runtime dependencies. Optional peers: `react` for `windmill-chat/react`, `ai` for
-`windmill-chat/ai-sdk`, `@assistant-ui/react` for `windmill-chat/assistant-ui`.
+No runtime dependencies. Optional peers: `react` for `@windmill-labs/chat-sdk/react`, `ai` for
+`@windmill-labs/chat-sdk/ai-sdk`, `@assistant-ui/react` for `@windmill-labs/chat-sdk/assistant-ui`.
 
 | You build the UI with | Import | You get |
 |---|---|---|
-| Vercel AI SDK `useChat`, AI Elements | `windmill-chat/ai-sdk` | a `ChatTransport`: `useChat({ transport })`, nothing else changes |
-| assistant-ui | `windmill-chat/assistant-ui` | a runtime for `AssistantRuntimeProvider`, threads included |
-| Your own components | `windmill-chat/react` or `windmill-chat` | a hook / a store with messages, status and actions |
+| Vercel AI SDK `useChat`, AI Elements | `@windmill-labs/chat-sdk/ai-sdk` | a `ChatTransport`: `useChat({ transport })`, nothing else changes |
+| assistant-ui | `@windmill-labs/chat-sdk/assistant-ui` | a runtime for `AssistantRuntimeProvider`, threads included |
+| Your own components | `@windmill-labs/chat-sdk/react` or `@windmill-labs/chat-sdk` | a hook / a store with messages, status and actions |
 
 ## The flow
 
@@ -31,7 +31,7 @@ so an AI agent step remembers earlier turns. The answer is:
 
 ```tsx
 import { useChat } from '@ai-sdk/react'
-import { createWindmillChatTransport } from 'windmill-chat/ai-sdk'
+import { createWindmillChatTransport } from '@windmill-labs/chat-sdk/ai-sdk'
 
 const transport = createWindmillChatTransport({
   baseUrl: 'https://app.windmill.dev',
@@ -65,7 +65,7 @@ explanatory error.
 
 ```tsx
 import { AssistantRuntimeProvider } from '@assistant-ui/react'
-import { useWindmillRuntime } from 'windmill-chat/assistant-ui'
+import { useWindmillRuntime } from '@windmill-labs/chat-sdk/assistant-ui'
 
 export function Support() {
   const runtime = useWindmillRuntime({ baseUrl, workspace, flowPath, token })
@@ -84,7 +84,7 @@ through `Reasoning`. It takes the same options as `useWindmillChat` below.
 ## React
 
 ```tsx
-import { useWindmillChat } from 'windmill-chat/react'
+import { useWindmillChat } from '@windmill-labs/chat-sdk/react'
 
 export function Support() {
   const chat = useWindmillChat({
@@ -155,7 +155,7 @@ change, and returns the unsubscribe function. That is the Svelte store contract,
 `$chat` works as is; other frameworks wrap it in a few lines.
 
 ```ts
-import { createChat } from 'windmill-chat'
+import { createChat } from '@windmill-labs/chat-sdk'
 
 const chat = createChat({ baseUrl, workspace, flowPath, token })
 chat.subscribe((state) => render(state))
@@ -164,7 +164,7 @@ await chat.sendMessage('Hello')
 
 ```svelte
 <script>
-  import { createChat } from 'windmill-chat'
+  import { createChat } from '@windmill-labs/chat-sdk'
   const chat = createChat({ flowPath: 'f/support/assistant' })
 </script>
 
@@ -331,8 +331,8 @@ custom integrations.
 ## For AI coding agents
 
 When asked to add a chat over a Windmill flow: the flow must be deployed with chat mode
-on. Pick the entry point from the table at the top (`useChat` → `windmill-chat/ai-sdk`,
-assistant-ui → `windmill-chat/assistant-ui`, otherwise `windmill-chat/react`). Inside a
+on. Pick the entry point from the table at the top (`useChat` → `@windmill-labs/chat-sdk/ai-sdk`,
+assistant-ui → `@windmill-labs/chat-sdk/assistant-ui`, otherwise `@windmill-labs/chat-sdk/react`). Inside a
 Windmill raw app pass only `flowPath`. Elsewhere pass `baseUrl`, `workspace` and a
 `token`; for a public page use a token scoped to `jobs:run:flows:<flowPath>` and leave
 `history` at its default. Render `role`, `content`, `pending`, `success` and
diff --git a/chat-sdk/package-lock.json b/chat-sdk/package-lock.json
index 9d41c6cbfc..74f6914f37 100644
--- a/chat-sdk/package-lock.json
+++ b/chat-sdk/package-lock.json
@@ -1,12 +1,12 @@
 {
-  "name": "windmill-chat",
-  "version": "1.821.0",
+  "name": "@windmill-labs/chat-sdk",
+  "version": "1.830.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "windmill-chat",
-      "version": "1.821.0",
+      "name": "@windmill-labs/chat-sdk",
+      "version": "1.830.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@ai-sdk/react": "^4.0.102",
diff --git a/chat-sdk/package.json b/chat-sdk/package.json
index 6a189eb31b..26f5f785be 100644
--- a/chat-sdk/package.json
+++ b/chat-sdk/package.json
@@ -1,7 +1,7 @@
 {
-  "name": "windmill-chat",
+  "name": "@windmill-labs/chat-sdk",
   "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.821.0",
+  "version": "1.830.0",
   "author": "Ruben Fiszel",
   "license": "Apache-2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",
diff --git a/cli/src/commands/app/app.ts b/cli/src/commands/app/app.ts
index 0d4ad634c8..470f0f4b11 100644
--- a/cli/src/commands/app/app.ts
+++ b/cli/src/commands/app/app.ts
@@ -32,6 +32,8 @@ export interface AppFile {
   guests?: boolean;
   value: any;
   public?: boolean;
+  sandbox?: boolean;
+  frontend_api?: string[];
   summary: string;
   policy: Policy;
   // Mirrors granular ACLs on the app path. Omitted from app.yaml when no
@@ -160,6 +162,100 @@ export function executionModeForPush(
   }
   return deployedPolicy?.execution_mode === "viewer" ? "viewer" : "publisher";
 }
+/** Mirrors `FRONTEND_SDK_ALLOWED_SCOPES` in the backend's `apps.rs`, which stays
+ * the authority: this copy only fails a push before it bundles. */
+export const FRONTEND_API_SCOPES = [
+  "jobs:run",
+  "jobs:read",
+  "users:read",
+  "resources:read",
+  "variables:read",
+  "flow_conversations:read",
+  "flow_conversations:write",
+];
+
+export type AppIsolation = { sandbox: boolean; frontendApi: string[] };
+
+/** Write `sandbox` and `frontend_api` on a pulled app, only when they are on, so
+ * an app using neither keeps the file it had. Scopes of an unsandboxed app are
+ * inert and stay out: a file stating them without `sandbox` does not push. */
+export function markIsolationFromPolicy(app: any, rawApp: boolean) {
+  if (app?.["policy"]?.["sandbox"] !== true) {
+    return;
+  }
+  app.sandbox = true;
+  const scopes = app.policy.frontend_sdk_scopes;
+  if (rawApp && Array.isArray(scopes) && scopes.length > 0) {
+    app.frontend_api = scopes;
+  }
+}
+
+/** The isolation the tracked file states, or `undefined` when it has no `sandbox`
+ * key and the deployed policy carries over. A file that has the key states both
+ * fields: `sandbox: false` turns isolation off, and a missing `frontend_api`
+ * means no scopes. */
+export function statedIsolation(
+  localApp: any,
+  rawApp: boolean,
+): AppIsolation | undefined {
+  const sandbox = localApp?.["sandbox"];
+  const scopes = localApp?.["frontend_api"] ?? [];
+  if (sandbox !== undefined && typeof sandbox !== "boolean") {
+    throw new Error("'sandbox' must be true or false");
+  }
+  if (
+    !Array.isArray(scopes) ||
+    scopes.some((s: unknown) => typeof s !== "string")
+  ) {
+    throw new Error("'frontend_api' must be a list of scopes");
+  }
+  if (scopes.length > 0 && !rawApp) {
+    throw new Error("'frontend_api' is only available to full-code apps");
+  }
+  const seen = new Set<string>();
+  for (const scope of scopes) {
+    if (!FRONTEND_API_SCOPES.includes(scope)) {
+      throw new Error(
+        `Invalid frontend_api scope '${scope}'. Allowed scopes: ${FRONTEND_API_SCOPES.join(", ")}`,
+      );
+    }
+    if (seen.has(scope)) {
+      throw new Error(`Duplicate frontend_api scope '${scope}'`);
+    }
+    seen.add(scope);
+  }
+  if (scopes.length > 0 && sandbox !== true) {
+    throw new Error(
+      "'frontend_api' requires 'sandbox: true': an unsandboxed app gets no frontend API token",
+    );
+  }
+  return sandbox === undefined ? undefined : { sandbox, frontendApi: scopes };
+}
+
+/** Whether the deployed policy already has the stated isolation. The file's two
+ * keys are kept out of the superset comparison against the deployed app, which
+ * could not see a key the file dropped. */
+export function isolationUpToDate(
+  isolation: AppIsolation | undefined,
+  deployedPolicy: Policy | undefined,
+  rawApp: boolean,
+): boolean {
+  if (!isolation) {
+    return true;
+  }
+  if ((deployedPolicy?.sandbox === true) !== isolation.sandbox) {
+    return false;
+  }
+  if (!rawApp) {
+    return true;
+  }
+  const deployed = deployedPolicy?.frontend_sdk_scopes ?? [];
+  return (
+    deployed.length === isolation.frontendApi.length &&
+    deployed.every((s, i) => s === isolation.frontendApi[i])
+  );
+}
+
 export async function pushApp(
   workspace: string,
   remotePath: string,
@@ -198,6 +294,7 @@ export async function pushApp(
   }
   const path = localPath + "app.yaml";
   const localApp = (await yamlParseFile(path)) as AppFile;
+  const isolation = statedIsolation(localApp, false);
 
   replaceInlineScripts(localApp.value, localPath, true);
   // On create the backend applies folder defaults, so there is nothing to preserve.
@@ -210,17 +307,26 @@ export async function pushApp(
     localApp,
     remotePath,
     executionModeForPush(localApp, deployedPolicy),
-    basePolicy(localApp, deployedPolicy, !!preserveFields.preserve_on_behalf_of)
+    basePolicy(localApp, deployedPolicy, !!preserveFields.preserve_on_behalf_of),
+    isolation
   );
 
   // extra_perms goes through /acls/* — strip from the body so a perms-only
   // edit never bumps the app version (see applyExtraPermsDiff for details).
-  const { extra_perms: localPerms, ...localAppBody } = localApp as AppFile & {
+  const {
+    extra_perms: localPerms,
+    sandbox: _sandbox,
+    frontend_api: _frontendApi,
+    ...localAppBody
+  } = localApp as AppFile & {
     extra_perms?: Record<string, boolean>;
   };
 
   if (app) {
-    if (isSuperset(localAppBody, app)) {
+    if (
+      isSuperset(localAppBody, app) &&
+      isolationUpToDate(isolation, deployedPolicy, false)
+    ) {
       log.info(colors.green(`App ${remotePath} is up to date`));
     } else {
       log.info(colors.bold.yellow(`Updating app ${remotePath}...`));
@@ -269,12 +375,13 @@ export async function generatingPolicy(
   app: any,
   path: string,
   executionMode: AppExecutionMode,
-  base: Policy | undefined
+  base: Policy | undefined,
+  isolation?: AppIsolation
 ) {
   log.info(colors.gray(`Generating fresh policy for app ${path}...`));
   try {
     app.policy = await windmillUtils.updatePolicy(app.value, base);
-    finalizeDerivedPolicy(app.policy, executionMode);
+    finalizeDerivedPolicy(app.policy, executionMode, isolation);
   } catch (e) {
     log.error(colors.red(`Error generating policy for app ${path}: ${e}`));
     throw e;
@@ -332,10 +439,21 @@ export function preserveOnBehalfOfFields(
  * deployed app would keep being able to run runnables this push removed. */
 export function finalizeDerivedPolicy(
   policy: Policy,
-  executionMode: AppExecutionMode
+  executionMode: AppExecutionMode,
+  isolation?: AppIsolation,
+  rawApp: boolean = false
 ) {
   policy.triggerables = undefined;
   policy.execution_mode = executionMode;
+  if (isolation) {
+    // `false` is sent rather than left out: the server reads an omitted value as
+    // "no opinion" and may sandbox the app anyway, hiding that the file was refused.
+    policy.sandbox = isolation.sandbox;
+    if (rawApp) {
+      policy.frontend_sdk_scopes =
+        isolation.frontendApi.length > 0 ? isolation.frontendApi : undefined;
+    }
+  }
 }
 
 async function list(opts: GlobalOptions & { includeDraftOnly?: boolean; json?: boolean }) {
diff --git a/cli/src/commands/app/bundle.ts b/cli/src/commands/app/bundle.ts
index 286e878cfb..287d01ebed 100644
--- a/cli/src/commands/app/bundle.ts
+++ b/cli/src/commands/app/bundle.ts
@@ -58,10 +58,10 @@ function conditionsFor(svelte: boolean): string[] {
 /**
  * Detects which frontend frameworks are present in package.json
  */
-export function detectFrameworks(appDir: string): { svelte: boolean; vue: boolean } {
+export function detectFrameworks(appDir: string): { svelte: boolean } {
   const packageJsonPath = path.join(appDir, "package.json");
   if (!fs.existsSync(packageJsonPath)) {
-    return { svelte: false, vue: false };
+    return { svelte: false };
   }
 
   try {
@@ -73,10 +73,9 @@ export function detectFrameworks(appDir: string): { svelte: boolean; vue: boolea
 
     return {
       svelte: "svelte" in allDeps,
-      vue: "vue" in allDeps,
     };
   } catch {
-    return { svelte: false, vue: false };
+    return { svelte: false };
   }
 }
 
@@ -256,17 +255,6 @@ export async function createFrameworkPlugins(appDir: string): Promise<any[]> {
     plugins.push(createSveltePlugin(appDir));
   }
 
-  if (frameworks.vue) {
-    log.info(colors.blue("🔧 Vue detected, adding vue plugin..."));
-    throw new Error("Vue plugin not supported yet");
-    // try {
-    //   const esbuildPluginVue = await import("esbuild-plugin-vue3");
-    //   plugins.push(esbuildPluginVue.default());
-    // } catch (error: any) {
-    //   log.warn(colors.yellow(`Failed to load vue plugin: ${error.message}`));
-    // }
-  }
-
   return plugins;
 }
 
@@ -313,7 +301,7 @@ export async function createBundle(
   // Use the entryPoint's directory if provided, otherwise fall back to cwd.
   const appDir = options.entryPoint ? path.dirname(options.entryPoint) : process.cwd();
   const frameworks = detectFrameworks(appDir);
-  const defaultEntry = (frameworks.svelte || frameworks.vue) ? "index.ts" : "index.tsx";
+  const defaultEntry = frameworks.svelte ? "index.ts" : "index.tsx";
 
   const entryPoint = options.entryPoint ?? defaultEntry;
   const outDir = options.outDir ?? "dist";
@@ -331,7 +319,7 @@ export async function createBundle(
   // Ensure node_modules exists in the app directory
   await ensureNodeModules(appDir);
 
-  // Load framework-specific plugins (svelte, vue) based on package.json
+  // Load framework-specific plugins (svelte) based on package.json
   const frameworkPlugins = await createFrameworkPlugins(appDir);
 
   // Ensure output directory exists
diff --git a/cli/src/commands/app/bundle_command.ts b/cli/src/commands/app/bundle_command.ts
index bef13f4268..c4119aafb0 100644
--- a/cli/src/commands/app/bundle_command.ts
+++ b/cli/src/commands/app/bundle_command.ts
@@ -12,10 +12,10 @@ interface BundleOptions {
 }
 
 /** Every entry point a raw app may have, most specific first, with the
- * framework's preferred one promoted — Svelte and Vue mount from a `.ts`. */
+ * framework's preferred one promoted — Svelte mounts from a `.ts`. */
 function entryPointFor(appDir: string): string {
   const frameworks = detectFrameworks(appDir);
-  const candidates = frameworks.svelte || frameworks.vue
+  const candidates = frameworks.svelte
     ? ["index.ts", "index.tsx", "index.js"]
     : ["index.tsx", "index.ts", "index.js"];
   const entry = candidates.find((c) => fs.existsSync(path.join(appDir, c)));
diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index 2dac8639e2..fdf26fa7da 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -481,7 +481,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
 
   // Detect frameworks to determine default entry point
   const frameworks = detectFrameworks(process.cwd());
-  const defaultEntry = frameworks.svelte || frameworks.vue
+  const defaultEntry = frameworks.svelte
     ? "index.ts"
     : "index.tsx";
   const entryPoint = opts.entry ?? defaultEntry;
@@ -577,7 +577,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
 
   const buildOptions = getDevBuildOptions(entryPoint, frameworks.svelte);
 
-  // Load framework-specific plugins (svelte, vue) based on package.json
+  // Load framework-specific plugins (svelte) based on package.json
   const frameworkPlugins = await createFrameworkPlugins(appDir);
 
   const wmillPlugin = {
@@ -1602,7 +1602,7 @@ const command = new Command()
   })
   .option(
     "--entry <entry:string>",
-    "Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)",
+    "Entry point file (default: index.ts for Svelte, index.tsx otherwise)",
   )
   .option("--no-open", "Don't automatically open the browser")
   .option(
diff --git a/cli/src/commands/app/lint.ts b/cli/src/commands/app/lint.ts
index 9356b5dd3c..c90a22105d 100644
--- a/cli/src/commands/app/lint.ts
+++ b/cli/src/commands/app/lint.ts
@@ -9,6 +9,8 @@ import { GlobalOptions } from "../../types.ts";
 import { createBundle, detectFrameworks } from "./bundle.ts";
 import { APP_BACKEND_FOLDER } from "./app_metadata.ts";
 import { loadRunnablesFromBackend } from "./raw_apps.ts";
+import { inferSchema } from "../../utils/metadata.ts";
+import { statedIsolation } from "./app.ts";
 import {
   getFolderSuffix,
   hasFolderSuffix,
@@ -42,12 +44,62 @@ function validateRawAppYaml(appData: any): {
     errors.push("Field 'summary' must be a string");
   }
 
+  try {
+    statedIsolation(appData, true);
+  } catch (error: any) {
+    errors.push(error.message);
+  }
+
   // Note: 'runnables' is no longer required in raw_app.yaml
   // Runnables can be stored in separate files in the backend folder
 
   return { errors, warnings };
 }
 
+const SQL_LANGUAGES = new Set([
+  "postgresql",
+  "mysql",
+  "bigquery",
+  "snowflake",
+  "mssql",
+  "oracledb",
+  "duckdb",
+]);
+
+// The viewer properties a `ctx` field can supply. The Inputs tab of the app
+// editor hints on the same names (RawAppInlineScriptRunnable.svelte).
+const VIEWER_IDENTITY_ARGS = ["username", "email", "groups"];
+
+/**
+ * A SQL runnable argument named after a viewer property is most often a
+ * per-viewer filter. Left as a plain input it takes whatever the browser
+ * sends, so it has to be a `ctx` field for the server to fill it.
+ */
+export async function viewerIdentityInputWarnings(
+  runnables: Record<string, any>,
+): Promise<string[]> {
+  const warnings: string[] = [];
+  for (const [id, runnable] of Object.entries(runnables)) {
+    const { language, content } = runnable?.inlineScript ?? {};
+    if (!SQL_LANGUAGES.has(language) || typeof content !== "string") {
+      continue;
+    }
+    const { schema } = await inferSchema(language, content, {}, id);
+    for (const arg of VIEWER_IDENTITY_ARGS) {
+      const field = runnable.fields?.[arg];
+      const serverFilled = field?.ctx !== undefined ||
+        field?.value !== undefined;
+      if (arg in (schema?.properties ?? {}) && !serverFilled) {
+        warnings.push(
+          `Runnable '${id}': argument '${arg}' is a frontend input, so a viewer can send any value. ` +
+            `If it identifies the viewer, set 'fields: { ${arg}: { ctx: ${arg} } }' in backend/${id}.yaml (next to 'type: inline') so the server fills it.`,
+        );
+      }
+    }
+  }
+  return warnings;
+}
+
 /**
  * Validates that runnables exist either in backend/*.yaml files or in raw_app.yaml
  */
@@ -77,6 +129,7 @@ async function validateRunnables(
         "  - Or a 'runnables' field in raw_app.yaml (legacy format)",
     );
   } else if (hasBackendRunnables) {
+    warnings.push(...await viewerIdentityInputWarnings(runnablesFromBackend));
     log.info(
       colors.gray(
         `  Found ${
@@ -114,7 +167,7 @@ async function validateBuild(
 
     // Try to create a bundle - this will validate that all dependencies are in place
     const frameworks = detectFrameworks(appDir);
-    const entryFile = frameworks.svelte || frameworks.vue ? "index.ts" : "index.tsx";
+    const entryFile = frameworks.svelte ? "index.ts" : "index.tsx";
     const entryPoint = path.join(appDir, entryFile);
     await createBundle({
       entryPoint,
diff --git a/cli/src/commands/app/new.ts b/cli/src/commands/app/new.ts
index 87d40f161b..40cc2a4416 100644
--- a/cli/src/commands/app/new.ts
+++ b/cli/src/commands/app/new.ts
@@ -85,21 +85,6 @@ const app = mount(App, { target: document.getElementById("root")! });
 export default app;
 `;
 
-const appVue = `<template>
-  <h1>Hello {{ msg }}</h1>
-</template>
-
-<script setup>
-import { ref } from 'vue';
-const msg = ref('world');
-</script>`;
-
-const indexVue = `import { createApp } from 'vue'
-import App from './App.vue'
-import "./index.css";
-
-createApp(App).mount('#root')`;
-
 const indexCss = `body {
     margin: 0;
     font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
@@ -171,21 +156,6 @@ const templates: Record<string, FrameworkTemplate> = {
         "svelte": "^5.55.5",
         "windmill-client": "^1"
     }
-}`,
-    },
-  },
-  vue: {
-    name: "Vue 3",
-    files: {
-      "/index.ts": indexVue,
-      "/App.vue": appVue,
-      "/index.css": indexCss,
-      "/package.json": `{
-    "dependencies": {
-        "core-js": "3.26.1",
-        "vue": "3.5.13",
-        "windmill-client": "^1"
-    }
 }`,
     },
   },
@@ -251,7 +221,7 @@ interface DataConfig {
   schema?: string;
 }
 
-type FrameworkKey = "react19" | "react18" | "svelte5" | "vue";
+type FrameworkKey = "react19" | "react18" | "svelte5";
 
 interface NewAppOptions extends GlobalOptions {
   /** App summary (short description). Skips the prompt when provided. */
@@ -384,7 +354,7 @@ async function newApp(opts: NewAppOptions) {
   }
 
   // Ask for framework (skipped if --framework is provided)
-  const VALID_FRAMEWORKS: FrameworkKey[] = ["react19", "react18", "svelte5", "vue"];
+  const VALID_FRAMEWORKS: FrameworkKey[] = ["react19", "react18", "svelte5"];
   let framework: string;
   if (opts.framework !== undefined) {
     if (!VALID_FRAMEWORKS.includes(opts.framework)) {
@@ -403,7 +373,6 @@ async function newApp(opts: NewAppOptions) {
         { name: "React 19 (Recommended)", value: "react19" },
         { name: "React 18", value: "react18" },
         { name: "Svelte 5", value: "svelte5" },
-        { name: "Vue 3", value: "vue" },
       ],
     });
   }
@@ -900,7 +869,7 @@ const command = new Command()
   )
   .option(
     "--framework <framework:string>",
-    "Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode."
+    "Framework template: react19 | react18 | svelte5. Skips the prompt when provided. Triggers non-interactive mode."
   )
   .option(
     "--datatable <datatable:string>",
@@ -908,7 +877,7 @@ const command = new Command()
   )
   .option(
     "--schema <schema:string>",
-    "Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist."
+    "Schema to use with --datatable. If it doesn't exist yet, a sql_to_apply/ migration (CREATE SCHEMA IF NOT EXISTS) is written for it."
   )
   .option(
     "--overwrite",
diff --git a/cli/src/commands/app/raw_apps.ts b/cli/src/commands/app/raw_apps.ts
index 36c8260e25..4c3d8d5215 100644
--- a/cli/src/commands/app/raw_apps.ts
+++ b/cli/src/commands/app/raw_apps.ts
@@ -20,13 +20,16 @@ import { deepEqual, readTextFile } from "../../utils/utils.ts";
 
 import {
   type AppExecutionMode,
+  type AppIsolation,
   basePolicy,
   executionModeForPush,
   finalizeDerivedPolicy,
+  isolationUpToDate,
   markAccessFromPolicy,
   preserveOnBehalfOfFields,
   replaceInlineScripts,
   repopulateFields,
+  statedIsolation,
 } from "./app.ts";
 import type { PermissionedAsContext } from "../../core/permissioned_as.ts";
 import { buildPermissionedAsContext } from "../../core/permissioned_as.ts";
@@ -49,6 +52,8 @@ export interface AppFile {
   runnables?: any;
   custom_path?: string;
   public?: boolean;
+  sandbox?: boolean;
+  frontend_api?: string[];
   summary: string;
   policy: Policy;
   data?: {
@@ -402,6 +407,7 @@ export async function pushRawApp(
   }
   const appFilePath = localPath + "raw_app.yaml";
   const localApp = (await yamlParseFile(appFilePath)) as AppFile;
+  const isolation = statedIsolation(localApp, true);
 
   // Load runnables from separate YAML files in the backend folder
   // Falls back to reading from raw_app.yaml if no separate files exist (backward compat)
@@ -454,6 +460,7 @@ export async function pushRawApp(
       deployedPolicy,
       !!preserveFields.preserve_on_behalf_of,
     ),
+    isolation,
   );
 
   const files = await collectAppFiles(localPath);
@@ -461,7 +468,7 @@ export async function pushRawApp(
     log.info(colors.yellow.bold(`Creating raw app ${remotePath} bundle...`));
     // Detect frameworks to determine entry point
     const frameworks = detectFrameworks(localPath);
-    const entryFile = frameworks.svelte || frameworks.vue
+    const entryFile = frameworks.svelte
       ? "index.ts"
       : "index.tsx";
     const entryPoint = localPath + entryFile;
@@ -485,14 +492,21 @@ export async function pushRawApp(
   // to `<path>.raw_app.json`, not `<path>.app.json`. The backend granular_acls
   // handler routes "raw_app" to the `app` table (where v2 raw apps actually
   // live) while still dispatching DeployedObject::RawApp for git-sync.
-  const { extra_perms: localPerms, ...localAppNoPerms } = localApp as AppFile & {
+  const {
+    extra_perms: localPerms,
+    sandbox: _sandbox,
+    frontend_api: _frontendApi,
+    ...localAppNoPerms
+  } = localApp as AppFile & {
     extra_perms?: Record<string, boolean>;
   };
 
   if (app) {
     // Check both metadata/runnables AND files for changes
     // Files need separate comparison because isSuperset only checks if local keys exist in remote
-    const metadataUpToDate = isSuperset({ ...localAppNoPerms, runnables }, app);
+    const metadataUpToDate =
+      isSuperset({ ...localAppNoPerms, runnables }, app) &&
+      isolationUpToDate(isolation, deployedPolicy, true);
     const filesUpToDate = deepEqual(files, app.value?.files);
     if (metadataUpToDate && filesUpToDate) {
       log.info(colors.green(`App ${remotePath} is up to date`));
@@ -560,11 +574,12 @@ export async function generatingPolicy(
   path: string,
   executionMode: AppExecutionMode,
   base: Policy | undefined,
+  isolation?: AppIsolation,
 ) {
   log.info(colors.gray(`Generating fresh policy for app ${path}...`));
   try {
     app.policy = await windmillUtils.updateRawAppPolicy(app.runnables, base);
-    finalizeDerivedPolicy(app.policy, executionMode);
+    finalizeDerivedPolicy(app.policy, executionMode, isolation, true);
   } catch (e) {
     log.error(colors.red(`Error generating policy for app ${path}: ${e}`));
     throw e;
diff --git a/cli/src/commands/digest/digest.ts b/cli/src/commands/digest/digest.ts
new file mode 100644
index 0000000000..c293505bba
--- /dev/null
+++ b/cli/src/commands/digest/digest.ts
@@ -0,0 +1,219 @@
+import { createHash } from "node:crypto";
+import { stat } from "node:fs/promises";
+import { sep as SEP } from "node:path";
+
+import { Command } from "@cliffy/command";
+import * as log from "../../core/log.ts";
+import { mergeConfigWithConfigFile } from "../../core/conf.ts";
+import { GlobalOptions } from "../../types.ts";
+import { readLocalFlow } from "../flow/flow.ts";
+import {
+  findContentFile,
+  readModulesFromDisk,
+} from "../script/script.ts";
+import { replaceLock } from "../../utils/metadata.ts";
+import { listSyncCodebases, SyncCodebase } from "../../utils/codebase.ts";
+import { findCodebase } from "../sync/sync.ts";
+import {
+  extractFolderPath,
+  getModuleFolderSuffix,
+  isFlowPath,
+  isMissingDbtDescriptor,
+  isModuleEntryPoint,
+  scriptPathToRemotePath,
+} from "../../utils/resource_folders.ts";
+import { inferContentTypeFromFilePath } from "../../utils/script_common.ts";
+import { readTextFile } from "../../utils/utils.ts";
+import { yamlParseFile } from "../../utils/yaml.ts";
+
+// The server computes the same digests for the `digest` and `root_digest` claims of job
+// OIDC tokens (backend/windmill-common/src/item_digest.rs): both must hash the same bytes.
+
+/** RFC 8785 canonical JSON, with null and undefined object members left out. */
+export function canonicalJson(value: unknown): string {
+  if (value === null || value === undefined) return "null";
+  if (Array.isArray(value)) {
+    return "[" + value.map(canonicalJson).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    // Sorting strings in JS compares UTF-16 code units, as RFC 8785 requires.
+    const members = Object.entries(value as Record<string, unknown>)
+      .filter(([, v]) => v !== null && v !== undefined)
+      .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return (
+      "{" +
+      members
+        .map(([k, v]) => JSON.stringify(k) + ":" + canonicalJson(v))
+        .join(",") +
+      "}"
+    );
+  }
+  return JSON.stringify(value);
+}
+
+export function digestOf(value: unknown): string {
+  return createHash("sha256").update(canonicalJson(value), "utf8").digest("hex");
+}
+
+/** The inline scripts of a flow's steps, by step id. Only module positions are walked: a
+ * static input shaped like a step is data. */
+function inlineSteps(modules: any[] | undefined, steps: Record<string, string>) {
+  for (const m of modules ?? []) {
+    stepValue(m?.id, m?.value, steps);
+  }
+}
+
+function stepValue(id: unknown, v: any, steps: Record<string, string>) {
+  switch (v?.type) {
+    case "rawscript":
+      if (typeof id === "string") {
+        steps[id] = digestOf({ content: v.content, lock: v.lock });
+      }
+      break;
+    case "forloopflow":
+    case "whileloopflow":
+      inlineSteps(v.modules, steps);
+      break;
+    case "branchone":
+      inlineSteps(v.default, steps);
+      for (const b of v.branches ?? []) inlineSteps(b?.modules, steps);
+      break;
+    case "branchall":
+      for (const b of v.branches ?? []) inlineSteps(b?.modules, steps);
+      break;
+    case "aiagent":
+      for (const t of v.tools ?? []) {
+        if (t?.value?.tool_type === "flowmodule") stepValue(t.id, t.value, steps);
+      }
+      break;
+  }
+}
+
+export interface ItemDigest {
+  path: string;
+  kind: "script" | "flow";
+  digest: string;
+  /** For a flow, the digest of each step's inline script, by step id. */
+  steps?: Record<string, string>;
+}
+
+export async function flowDigest(folder: string): Promise<ItemDigest> {
+  const { flow, missingFiles } = await readLocalFlow(folder);
+  if (missingFiles.length > 0) {
+    throw new Error(`Missing inline script file(s): ${missingFiles.join(", ")}`);
+  }
+  const steps: Record<string, string> = {};
+  const value = flow.value as any;
+  inlineSteps(
+    [...(value.modules ?? []), value.failure_module, value.preprocessor_module].filter(Boolean),
+    steps
+  );
+  const path = folder
+    .replaceAll(SEP, "/")
+    .replace(/\/$/, "")
+    .replace(/(\.flow|__flow)$/, "");
+  return { path, kind: "flow", digest: digestOf(flow.value), steps };
+}
+
+export async function scriptDigest(
+  contentFile: string,
+  defaultTs?: "bun" | "deno",
+  codebases: SyncCodebase[] = []
+): Promise<ItemDigest> {
+  const moduleEntry = isModuleEntryPoint(contentFile);
+  const remotePath = scriptPathToRemotePath(contentFile);
+  const base = remotePath.replaceAll("/", SEP);
+  const language = inferContentTypeFromFilePath(contentFile, defaultTs);
+  const metaBase = moduleEntry ? base + getModuleFolderSuffix() + SEP + "script" : base + ".script";
+  let meta: any = undefined;
+  for (const ext of [".yaml", ".json"]) {
+    if (await stat(metaBase + ext).catch(() => undefined)) {
+      meta = await yamlParseFile(metaBase + ext);
+      break;
+    }
+  }
+  replaceLock(meta);
+  let content = "";
+  try {
+    content = await readTextFile(contentFile);
+  } catch (e) {
+    if (!isMissingDbtDescriptor(contentFile, e)) throw e;
+  }
+  // What `wmill sync push` sends: the codebase is derived from wmill.yaml, never read
+  // from the metadata file. Only bundling tells whether push adds `.tar`, so a pulled
+  // value that is this digest plus `.tar` is taken as is.
+  const codebase = language == "bun" ? findCodebase(contentFile, codebases) : undefined;
+  let codebaseDigest = codebase ? await codebase.getDigest() : undefined;
+  if (codebaseDigest && meta?.codebase === codebaseDigest + ".tar") {
+    codebaseDigest = meta.codebase;
+  }
+  const isDbt = language === "dbt";
+  const modules = await readModulesFromDisk(
+    base + getModuleFolderSuffix(language),
+    defaultTs,
+    moduleEntry,
+    isDbt
+  );
+  const digest = digestOf({
+    content,
+    lock: meta?.lock,
+    codebase: codebaseDigest,
+    modules: modules
+      ? Object.fromEntries(
+          Object.entries(modules).map(([p, m]) => [p, { content: m.content, lock: m.lock }])
+        )
+      : undefined,
+  });
+  return { path: remotePath, kind: "script", digest };
+}
+
+/** The item at a local path of a sync checkout: a flow folder, a script file, or a script's
+ * metadata file. Paths resolve against the current directory, which must be the
+ * checkout's root, as for `wmill sync push`. */
+export async function itemDigest(
+  localPath: string,
+  defaultTs?: "bun" | "deno",
+  codebases: SyncCodebase[] = []
+): Promise<ItemDigest> {
+  const folderPath = localPath.endsWith(SEP) ? localPath : localPath + SEP;
+  if (isFlowPath(folderPath)) {
+    return flowDigest(extractFolderPath(folderPath, "flow")!);
+  }
+  if (/\.script\.(yaml|json)$/.test(localPath) || /script\.(yaml|json)$/.test(localPath)) {
+    return scriptDigest(await findContentFile(localPath), defaultTs, codebases);
+  }
+  return scriptDigest(localPath, defaultTs, codebases);
+}
+
+async function digest(
+  opts: GlobalOptions & { json?: boolean },
+  ...paths: string[]
+) {
+  if (opts.json) log.setSilent(true);
+  const merged = await mergeConfigWithConfigFile(opts);
+  const codebases = listSyncCodebases(merged);
+  const results: ItemDigest[] = [];
+  for (const p of paths) {
+    results.push(await itemDigest(p, merged.defaultTs, codebases));
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(results, null, 2));
+    return;
+  }
+  for (const r of results) {
+    console.log(`${r.digest}  ${r.path}`);
+    for (const [id, d] of Object.entries(r.steps ?? {})) {
+      console.log(`${d}  ${r.path}/${id}`);
+    }
+  }
+}
+
+const command = new Command()
+  .description(
+    "Compute the content digest of local scripts and flows, as the `digest` and `root_digest` claims of job OIDC tokens carry it. Run from the root of a sync checkout, pulled after the deployment's dependency jobs completed: they write the lockfiles the digest covers. A flow also lists the digest of each inline step, as `<flow path>/<step id>`."
+  )
+  .arguments("<paths...:string>")
+  .option("--json", "Output the digests as JSON")
+  .action(digest as any);
+
+export default command;
diff --git a/cli/src/commands/flow/flow.ts b/cli/src/commands/flow/flow.ts
index 863690ce7d..a266834f41 100644
--- a/cli/src/commands/flow/flow.ts
+++ b/cli/src/commands/flow/flow.ts
@@ -52,6 +52,7 @@ export interface FlowFile {
   schema?: any;
   on_behalf_of_email?: string;
   has_on_behalf_of?: boolean;
+  job_token_scopes?: string[] | null;
   // Mirrors granular ACLs on the flow path. Omitted from flow.yaml when no
   // perms are set. The CLI applies diffs through /acls/add and /acls/remove
   // (see applyExtraPermsDiff) — never through update_flow — so a perm-only
@@ -170,28 +171,10 @@ function collectStepPaths(flowValue: any): string[] {
   return paths;
 }
 
-export async function pushFlow(
-  workspace: string,
-  remotePath: string,
-  localPath: string,
-  message?: string,
-  permissionedAsContext?: PermissionedAsContext
-): Promise<void> {
-  if (alreadySynced.includes(localPath)) {
-    return;
-  }
-  alreadySynced.push(localPath);
-  remotePath = remotePath.replaceAll(SEP, "/");
-  let flow: Flow | undefined = undefined;
-  try {
-    flow = await wmill.getFlowByPath({
-      workspace: workspace,
-      path: remotePath,
-    });
-  } catch {
-    // flow doesn't exist
-  }
-
+/** The flow in the folder `localPath`, with its inline scripts read back in. */
+export async function readLocalFlow(
+  localPath: string
+): Promise<{ flow: FlowFile; missingFiles: string[] }> {
   if (!localPath.endsWith(SEP)) {
     localPath += SEP;
   }
@@ -214,6 +197,32 @@ export async function pushFlow(
   if (localFlow.value.preprocessor_module) {
     await replaceInlineScripts([localFlow.value.preprocessor_module], fileReader, log, localPath, SEP, undefined, missingFiles);
   }
+  return { flow: localFlow, missingFiles };
+}
+
+export async function pushFlow(
+  workspace: string,
+  remotePath: string,
+  localPath: string,
+  message?: string,
+  permissionedAsContext?: PermissionedAsContext
+): Promise<void> {
+  if (alreadySynced.includes(localPath)) {
+    return;
+  }
+  alreadySynced.push(localPath);
+  remotePath = remotePath.replaceAll(SEP, "/");
+  let flow: Flow | undefined = undefined;
+  try {
+    flow = await wmill.getFlowByPath({
+      workspace: workspace,
+      path: remotePath,
+    });
+  } catch {
+    // flow doesn't exist
+  }
+
+  const { flow: localFlow, missingFiles } = await readLocalFlow(localPath);
   if (missingFiles.length > 0) {
     // Hard-fail rather than push the literal `!inline path` text as
     // rawscript.content. That string would be persisted in flow_version.value
@@ -265,12 +274,22 @@ export async function pushFlow(
   // so a perm-only edit never bumps the flow version. Strip the field from the
   // body that goes to update_flow / create_flow and treat it as a separate
   // step both for the up-to-date short-circuit and after the deploy.
-  const { extra_perms: localPerms, ...localFlowBody } = localFlow as FlowFile & {
+  const {
+    extra_perms: localPerms,
+    job_token_scopes: localJobTokenScopes,
+    ...localFlowBody
+  } = localFlow as FlowFile & {
     extra_perms?: Record<string, boolean>;
   };
+  // Always sent, unlike the other settings: the server keeps a restriction the body omits,
+  // so a flow.yaml without the key has to clear it explicitly.
+  const jobTokenScopes = localJobTokenScopes ?? null;
 
   if (flow) {
-    if (isSuperset(localFlowBody, flow)) {
+    if (
+      isSuperset(localFlowBody, flow) &&
+      JSON.stringify(jobTokenScopes) === JSON.stringify(flow.job_token_scopes ?? null)
+    ) {
       log.info(colors.green(`Flow ${remotePath} is up to date`));
     } else {
       log.info(colors.bold.yellow(`Updating flow ${remotePath}...`));
@@ -281,6 +300,7 @@ export async function pushFlow(
           path: remotePath.replaceAll(SEP, "/"),
           deployment_message: message,
           ...localFlowBody,
+          job_token_scopes: jobTokenScopes,
           ...preserveFields,
           // Preserve any user draft at this path (see backend skip_draft_deletion).
           skip_draft_deletion: true,
@@ -296,6 +316,7 @@ export async function pushFlow(
           path: remotePath.replaceAll(SEP, "/"),
           deployment_message: message,
           ...localFlowBody,
+          job_token_scopes: jobTokenScopes,
           ...preserveFields,
           // Preserve any user draft at this path (see backend skip_draft_deletion).
           skip_draft_deletion: true,
diff --git a/cli/src/commands/init/template.ts b/cli/src/commands/init/template.ts
index 8a433d69d4..540d8c7978 100644
--- a/cli/src/commands/init/template.ts
+++ b/cli/src/commands/init/template.ts
@@ -77,8 +77,8 @@ const WORKSPACE_CONFIG_SCHEMA = {
  */
 export const CONFIG_REFERENCE: ConfigOption[] = [
   // ── Core ──────────────────────────────────────────────────────────────
-  { name: "defaultTs", type: "string", enum: ["bun", "deno"], default: "bun", description: "Default TypeScript runtime for new scripts",
-    inlineComment: "bun or deno" },
+  { name: "defaultTs", type: "string", enum: ["bun", "deno"], default: "bun", description: "TypeScript runtime of a plain .ts script (bun when absent)",
+    skipInTemplate: true },
   { name: "includes", type: "array", items: { type: "string" }, default: '["f/**"]', description: "Glob patterns for files to include in sync",
     templateValue: '\n  - "f/**"', inlineComment: 'use ** for all, f/** for folder-scoped' },
   { name: "extraIncludes", type: "array", items: { type: "string" }, default: "[]", description: "Additional glob patterns merged with includes (useful in workspace overrides)",
diff --git a/cli/src/commands/instance/instance.ts b/cli/src/commands/instance/instance.ts
index 35530ddfd3..f2285a5316 100644
--- a/cli/src/commands/instance/instance.ts
+++ b/cli/src/commands/instance/instance.ts
@@ -685,6 +685,11 @@ async function getConfig(opts: InstanceSyncOptions & { outputFile?: string; show
     if (config.global_settings.license_key) config.global_settings.license_key = "***";
     if (config.global_settings.jwt_secret) config.global_settings.jwt_secret = "***";
   }
+  if (config?.global_settings && !config.global_settings.jwt_secret) {
+    log.infoStderr(
+      "jwt_secret, rsa_keys and the instance database secrets are not part of the export: the server withholds them (EXPORT_SERVER_SECRETS=false). This export cannot fully restore or migrate the instance."
+    );
+  }
 
   const yaml = yamlStringify(config as Record<string, unknown>);
   if (opts.outputFile) {
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index 06db3db1bf..4938b6aeb3 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -636,6 +636,9 @@ export async function handleFile(
       envs: typed?.envs,
       modules: modules,
       labels: typed?.labels,
+      // Always sent: the server keeps a restriction the body omits, so a script.yaml without
+      // the key has to clear it explicitly.
+      job_token_scopes: typed?.job_token_scopes ?? null,
     };
 
     const hasOnBehalfOf = (typed as any)?.has_on_behalf_of ?? !!typed?.on_behalf_of_email;
@@ -712,6 +715,7 @@ export async function handleFile(
             (hasOnBehalfOf ? true : typed.on_behalf_of_email == remote.on_behalf_of_email) &&
             deepEqual(typed.envs, remote.envs) &&
             deepEqual(typed.labels ?? null, remote.labels ?? null) &&
+            deepEqual(typed.job_token_scopes ?? null, remote.job_token_scopes ?? null) &&
             deepEqual(modules ?? null, remote.modules ?? null))
         ) {
           log.info(colors.green(`Script ${remotePath} is up to date`));
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 54887028f0..b9e373abad 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -149,7 +149,7 @@ import {
   extractCurrentMapping,
 } from "../../../windmill-utils-internal/src/inline-scripts/extractor.ts";
 import { generateFlowLockInternal } from "../flow/flow_metadata.ts";
-import { markAccessFromPolicy } from "../app/app.ts";
+import { markAccessFromPolicy, markIsolationFromPolicy } from "../app/app.ts";
 import {
   APP_BACKEND_FOLDER,
   generateAppLocksInternal,
@@ -1359,6 +1359,7 @@ export function ZipFSElement(
             }
 
             markAccessFromPolicy(app);
+            markIsolationFromPolicy(app, false);
             app.policy = undefined;
             yield {
               isDirectory: false,
@@ -1377,6 +1378,7 @@ export function ZipFSElement(
               throw error;
             }
             markAccessFromPolicy(rawApp);
+            markIsolationFromPolicy(rawApp, true);
             // console.log("rawApp", rawApp);
             rawApp.policy = undefined;
             // custom_path is derived from the file path, don't store it
diff --git a/cli/src/commands/user/user.ts b/cli/src/commands/user/user.ts
index b5ed0e3196..99bea072a8 100644
--- a/cli/src/commands/user/user.ts
+++ b/cli/src/commands/user/user.ts
@@ -1,6 +1,8 @@
 import { writeFile } from "node:fs/promises";
 
 import { requireLogin } from "../../core/auth.ts";
+import { resolveWorkspace } from "../../core/context.ts";
+import { mergeConfigWithConfigFile } from "../../core/conf.ts";
 import {
   GlobalOptions,
   isSuperset,
@@ -69,6 +71,32 @@ async function list(opts: GlobalOptions) {
     .render();
 }
 
+async function listWorkspaceUsers(opts: GlobalOptions & { json?: boolean }) {
+  if (opts.json) log.setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+
+  const users = await wmill.listUsers({ workspace: workspace.workspaceId });
+
+  if (opts.json) {
+    console.log(JSON.stringify(users));
+  } else {
+    new Table()
+      .header(["username", "email", "role"])
+      .padding(2)
+      .border(true)
+      .body(
+        users.map((u) => [
+          u.username,
+          u.email,
+          u.is_admin ? "admin" : u.operator ? "operator" : "developer",
+        ])
+      )
+      .render();
+  }
+}
+
 function rdString() {
   return Math.random().toString(36).slice(2, 7);
 }
@@ -518,6 +546,9 @@ export async function pushInstanceGroups(
 const command = new Command()
   .description("user related commands")
   .action(list as any)
+  .command("list", "List the users of the workspace")
+  .option("--json", "Output as JSON (for piping to jq)")
+  .action(listWorkspaceUsers as any)
   .command("add", "Create a user")
   .arguments("<email:string> [password:string]")
   .option("--superadmin", "Specify to make the new user superadmin.")
diff --git a/cli/src/commands/variable/variable.ts b/cli/src/commands/variable/variable.ts
index 8963f376d2..88ad108a1a 100644
--- a/cli/src/commands/variable/variable.ts
+++ b/cli/src/commands/variable/variable.ts
@@ -107,7 +107,8 @@ export interface VariableFile {
  * plaintext value a user authored by hand.
  *
  * Mirrors the server guard (windmill-store/src/variables.rs): workspace
- * ciphertext (AES-256-CBC, base64) is standard base64 decoding to a non-zero
+ * ciphertext (AES-256-GCM or legacy AES-256-CBC, base64) is standard base64
+ * decoding to a non-zero
  * multiple of the 16-byte block size. External secret-backend markers
  * ($vault:/$aws_sm:/$azure_kv:) are stored verbatim too, so they count as
  * already-encrypted. This is a shape check only — it never decrypts.
diff --git a/cli/src/core/conf.ts b/cli/src/core/conf.ts
index 455e876292..1ad0b69c1b 100644
--- a/cli/src/core/conf.ts
+++ b/cli/src/core/conf.ts
@@ -320,12 +320,6 @@ export async function readConfigFile(opts?: { warnIfMissing?: boolean }): Promis
     delete (conf as any)?.environments;
     delete conf?.git_branches;
 
-    if (conf?.defaultTs == undefined) {
-      log.warn(
-        "No defaultTs defined in your wmill.yaml. Using 'bun' as default."
-      );
-    }
-
     // Initialize global nonDottedPaths setting from config
     setNonDottedPaths(conf?.nonDottedPaths ?? false);
 
@@ -376,7 +370,6 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
   Required<
     Pick<
       SyncOptions,
-      | "defaultTs"
       | "includes"
       | "excludes"
       | "codebases"
@@ -401,7 +394,6 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
     >
   >
 > = {
-  defaultTs: "bun",
   includes: ["f/**"],
   excludes: [],
   codebases: [],
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 961a4474bd..21aeb07f60 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.821.0";
+export const VERSION = "1.830.0";
diff --git a/cli/src/core/permissioned_as.ts b/cli/src/core/permissioned_as.ts
index d0301373da..87ee37a8cb 100644
--- a/cli/src/core/permissioned_as.ts
+++ b/cli/src/core/permissioned_as.ts
@@ -34,10 +34,14 @@ export async function buildPermissionedAsContext(
     return undefined;
   }
   const user = await wmill.whoami({ workspace });
+  // A superadmin acts as admin in every workspace, so the backend preserves
+  // ownership for them even when their own `usr` row there is not an admin.
   const userIsAdminOrDeployer =
-    user.is_admin || (user.groups ?? []).includes("wm_deployers");
+    user.is_admin ||
+    user.is_super_admin ||
+    (user.groups ?? []).includes("wm_deployers");
   log.debug(
-    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
+    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, is_super_admin=${user.is_super_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
   );
   return {
     userCache: new Map(),
diff --git a/cli/src/core/settings.ts b/cli/src/core/settings.ts
index 57e89f5ded..75dfa3b8da 100644
--- a/cli/src/core/settings.ts
+++ b/cli/src/core/settings.ts
@@ -413,7 +413,7 @@ export async function pushWorkspaceSettings(
   const localOperatorSettings = localSettings.operator_settings && {
     ...localSettings.operator_settings,
   };
-  for (const key of ["builder_flows", "manage_schedules", "manage_triggers"] as const) {
+  for (const key of ["builder_flows", "builder_apps", "manage_schedules", "manage_triggers"] as const) {
     const remote = settings.operator_settings?.[key];
     if (localOperatorSettings && localOperatorSettings[key] === undefined && remote !== undefined) {
       localOperatorSettings[key] = remote;
diff --git a/cli/src/guidance/core.ts b/cli/src/guidance/core.ts
index 6060f6b8a5..dc2a2f8d84 100644
--- a/cli/src/guidance/core.ts
+++ b/cli/src/guidance/core.ts
@@ -90,7 +90,7 @@ A data pipeline is NOT a flow: it is a set of independent scripts in one folder,
 ## Raw App Development
 
 You MUST use the \`raw-app\` skill to create or modify raw apps.
-When a new app needs to be created, YOU run \`wmill app new\` yourself with \`--summary\`, \`--path\`, and \`--framework\` flags (and any other relevant flags). Do NOT ask the user to run it. If you don't have the values for those flags, ask the user via \`AskUserQuestion\` (one call, all missing fields) — never invent them. See the \`raw-app\` skill for the full procedure.
+When a new app needs to be created, YOU run \`wmill app new\` yourself with \`--summary\`, \`--path\`, and \`--framework\` flags (and any other relevant flags). Do NOT ask the user to run it. If you don't have a summary or a path, ask the user via \`AskUserQuestion\` (one call, all missing fields) — never invent them. The framework is not asked: \`react19\` unless the user or the project's existing apps say otherwise. An app that stores data also needs its data table and schema settled with the user first. See the \`raw-app\` skill for the full procedure.
 
 ## Triggers
 
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 8e87ed723e..d90a401260 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -98,6 +98,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -261,6 +262,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -384,6 +386,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -500,6 +503,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -763,21 +767,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -833,6 +839,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -1092,6 +1106,9 @@ async sleep(seconds: number): Promise<void>
  * \`fn\`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a \`Date\`
  * comes back as a string, a \`Map\` as \`{}\`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, \`fn\` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -1320,6 +1337,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -1595,21 +1613,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -1665,6 +1685,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -1924,6 +1952,9 @@ async sleep(seconds: number): Promise<void>
  * \`fn\`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a \`Date\`
  * comes back as a string, a \`Map\` as \`{}\`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, \`fn\` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -2152,6 +2183,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -2267,6 +2299,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -2532,21 +2565,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -2602,6 +2637,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -2861,6 +2904,9 @@ async sleep(seconds: number): Promise<void>
  * \`fn\`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a \`Date\`
  * comes back as a string, a \`Map\` as \`{}\`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, \`fn\` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -3089,6 +3135,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3238,6 +3285,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3370,6 +3418,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3489,6 +3538,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3601,6 +3651,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3716,6 +3767,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3832,6 +3884,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -3963,6 +4016,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -4077,6 +4131,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -4206,6 +4261,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -4417,10 +4473,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# \`\`retry\`\` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. \`\`{"constant": {"attempts": 3, "seconds": 10}}\`\`. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See \`\`run_script_by_path_async\`\` for \`\`retry\`\`.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -4593,6 +4653,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -5010,7 +5082,9 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 # 
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a \`\`datetime\`\` comes back as a
@@ -5096,12 +5170,15 @@ def workflow(func)
 # \`\`fn\`\`'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a \`\`datetime\`\` comes back as a string, a tuple as a list.
+# 
+# Called from inside a task body, \`\`fn\`\` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 # 
 # Inside a @workflow, the parent job suspends and auto-resumes after \`\`seconds\`\`.
-# Outside a workflow, falls back to \`\`asyncio.sleep\`\`.
+# Outside a workflow, or inside a task body, falls back to \`\`asyncio.sleep\`\`.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
@@ -5210,6 +5287,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -5369,6 +5447,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -5518,6 +5597,7 @@ Use \`wmill resource-type list --schema\` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -5545,6 +5625,27 @@ Name the parameters by adding comments before the statement:
 SELECT * FROM users WHERE name = ? AND age > ?;
 \`\`\`
 
+## Array parameters
+
+Declare a list with a \`[]\` suffix on the element type (\`(varchar[])\`,
+\`(int[])\`), or \`(array)\` for an untyped one. Snowflake cannot bind an array
+directly, so Windmill binds the list as JSON text: wrap the placeholder with
+\`PARSE_JSON(?)\`, and cast to \`ARRAY\` where a function expects one.
+
+\`\`\`sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+WHERE ARRAY_CONTAINS(o.owner_group::VARIANT, PARSE_JSON(?)::ARRAY);
+\`\`\`
+
+Or join on the elements with \`FLATTEN\`:
+
+\`\`\`sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+JOIN TABLE(FLATTEN(input => PARSE_JSON(?))) g ON g.value::STRING = o.owner_group;
+\`\`\`
+
 ## Receiving an S3Object as a script parameter
 
 Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
@@ -5687,6 +5788,7 @@ These are strict Windmill schema rules. Follow them exactly.
 - \`preprocessor_module\` and \`failure_module\` only support \`script\` or \`rawscript\`
 - \`preprocessor_module\` runs before normal modules and cannot reference \`results.*\`
 - \`failure_module\` can use the \`error\` object with \`error.message\`, \`error.step_id\`, \`error.name\`, and \`error.stack\`
+- A flow whose \`failure_module\` runs still ends as failed, unless the handler returns an object with \`recover: true\`: the flow then ends as a success. This also holds when the failing step is inside a loop, a branch or a subflow. \`recover\` never changes which steps run; whether a loop or branch carries on past a failure is still decided by its own settings (\`skip_failures\`, \`continue_on_error\`)
 
 Correct shape:
 
@@ -5842,6 +5944,98 @@ names, so neither is name-checked at all — leave those summaries as they are.
   whenever the name alone does not make that obvious; it overrides the description derived from the
   underlying script
 
+## AI Decision Modules
+
+An \`aidecision\` module asks a decision model (TypeSafe's Jev, Cloudflare's Clef or OpenAI's Decisions API) typed questions about a \`state\` and
+answers each with calibrated probabilities instead of text. Prefer it over an \`aiagent\` when the step
+is a judgment (classify, route, score or a yes/no check) that needs no tools and no free text: it
+is faster, cheaper, and its answers have a fixed shape.
+
+\`\`\`json
+{
+  "id": "triage",
+  "summary": "Classify the ticket",
+  "value": {
+    "type": "aidecision",
+    "input_transforms": {
+      "provider": {
+        "type": "static",
+        "value": { "kind": "typesafe", "resource": "$res:f/ai/typesafe", "model": "jev-latest" }
+      },
+      "state": { "type": "javascript", "expr": "flow_input.message" },
+      "questions": {
+        "type": "static",
+        "value": {
+          "intent": {
+            "type": "choice",
+            "instructions": "What does the customer want?",
+            "criteria": { "refund": "Money back", "bug": "Something is broken", "other": "Anything else" }
+          },
+          "urgency": {
+            "type": "score",
+            "instructions": "How urgent is the ticket?",
+            "criteria": ["Can wait", "This week", "Today", "Right now"]
+          },
+          "angry": { "type": "noul", "instructions": "Is the customer angry?" }
+        }
+      }
+    }
+  }
+}
+\`\`\`
+
+- \`provider.kind\` is \`typesafe\` (\`model\` \`jev-latest\` unless a version is pinned), \`cloudflare\`
+  (\`model\` \`clef\`, or \`clef-flash\` for faster answers) or \`openai\` (\`model\` \`gpt-6-luna\`, never a
+  chat model); the resource is of that same type
+- \`state\` is the content to evaluate: usually a text, such as the message to classify. To combine
+  several values, pass an object with descriptive keys holding only what the questions need
+  (\`({ message: flow_input.message, plan: results.get_account.plan })\`); an array of strings also works
+- \`questions\` maps each question name to \`{ type, instructions, criteria }\`:
+  - \`choice\`: \`criteria\` maps each option to its description (up to 255 options). The answer has
+    \`choice\`, \`probabilities\` and \`confidence\`
+  - \`score\`: \`criteria\` is an ordered array of 2 to 10 level descriptions. The answer has \`score\`,
+    \`legend\`, \`probabilities\` and \`confidence\`
+  - \`noul\`: yes/no, \`criteria\` optionally \`{ "true": ..., "false": ... }\` descriptions. The answer has
+    \`noul\`, the probability of yes from 0 to 1
+- The result is \`{ output, model, usage }\` with \`output\` keyed by question name, so a later step
+  reads \`results.triage.output.intent.choice\`, \`results.triage.output.urgency.score\` or
+  \`results.triage.output.angry.noul > 0.7\`
+- On \`openai\` the same \`questions\` are translated for its Decisions API and the answers read the
+  same way (\`choice\`, \`score\`, \`noul\`), except that \`probabilities\` is a list of
+  \`{ value, probability }\` (plus \`label\` on a score) and a score has no \`legend\`. A question OpenAI
+  refuses to answer fails the step. A \`state\` that is
+  an array of user messages (\`[{ role: "user", content: [{ type: "input_text", text }, { type: "input_image", image_url: "data:image/png;base64,..." }] }]\`)
+  is sent as is, which is how an image is evaluated; any other object or array is sent as JSON text
+
+### Branching on the Answers
+
+To route on the answers, put a \`branchone\` right after the decision, one branch per option, with
+each \`expr\` reading the decision by id:
+
+\`\`\`json
+{
+  "id": "route",
+  "value": {
+    "type": "branchone",
+    "branches": [
+      { "summary": "refund", "expr": "results.triage.output.intent.choice === 'refund'", "modules": [...] },
+      { "summary": "bug", "expr": "results.triage.output.intent.choice === 'bug'", "modules": [...] }
+    ],
+    "default": [...]
+  }
+}
+\`\`\`
+
+For a yes/no question, one branch with \`"expr": "results.triage.output.angry.noul >= 0.5"\` (tune the
+threshold as needed) and the \`default\` as the "no" path.
+
+### As an Agent Tool
+
+An \`aidecision\` can be a \`flowmodule\` tool of an \`aiagent\` (\`"tool_type": "flowmodule", "type":
+"aidecision"\`): set \`state\` to \`{ "type": "ai" }\` so the calling model supplies it, and only \`output\`
+goes back to the model. The Tool Naming Rules apply to its \`summary\`. Only a flow's own agent step
+can call one, not an agent used as a tool.
+
 ## Common Mistakes to Avoid
 
 - Missing \`input_transforms\` - Rawscript parameters won't receive values without them
@@ -5856,6 +6050,10 @@ names, so neither is name-checked at all — leave those summaries as they are.
 - \`results.step_id.property\` - Access specific property from a previous step output only when that step result is in scope
 - \`flow_input.iter.value\` - Current iteration value inside a \`forloopflow\`; in a \`whileloopflow\` it is just the iteration index (a plain number, same as \`flow_input.iter.index\`)
 - \`flow_input.iter.index\` - Current loop index when inside a loop (\`forloopflow\` or \`whileloopflow\`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - \`resume\` - the last resume payload (the resume form values); with \`continue_on_disapprove_timeout\`, a disapproval or timeout yields \`{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }\` instead
+  - \`resumes\` - every resume payload, in arrival order
+  - \`approvers\` - a plain array of strings, one per resume: for a resume through the \`resume\`/\`cancel\` URL from \`getResumeUrls(approver)\`, the \`approver\` passed there if any; otherwise (including the \`approvalPage\` link) the resuming user's username, else \`"anonymous"\`, e.g. \`approvers[0]\`. It is NOT the \`{ resume_id, approver }\` objects stored in the flow status, so \`approvers[0].approver\` is always undefined
 
 ## Loop Structure Rules
 
@@ -6072,6 +6270,10 @@ Unless the user asked for new code, look for a workspace script or flow that alr
 The step's \`input_transforms\` must cover the reused item's inputs, so read its input schema first.
 Find candidates in the local tree (a \`.script.yaml\` sits next to each script and holds its input schema, a \`flow.yaml\` in each flow folder) and on the workspace with \`wmill script list\` / \`wmill flow list\`; \`wmill script get <path>\` and \`wmill flow get <path>\` show an item's details.
 
+## Additional Prompt for AI
+
+A flow's input schema may carry a top-level \`prompt_for_ai\` string, as a script's can: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that flow, and keep it when you rewrite the schema.
+
 ## Organizing Flows: Groups and Notes
 
 Groups and notes shape how a flow reads in the editor; neither changes what it does.
@@ -6163,7 +6365,7 @@ Reference a specific resource using \`$res:\` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \\u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \\u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\\nstate with calibrated probabilities, instead of generating text.\\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\\nthe answers, follow it with a branchone whose branch exprs read\\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\\nsupplies the state.\\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\\nAn object with descriptive keys holding only what the questions need works best.\\nExample: { message: flow_input.message, plan: results.a.plan }\\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\\n- 'choice': criteria maps each option to its description (up to 255); the answer\\n  has choice, probabilities and confidence\\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\\n  has score, legend, probabilities and confidence\\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\\n  noul, the probability of yes (0 to 1)\\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default \`flow\`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
 `,
   "raw-app": `---
 name: raw-app
@@ -6178,47 +6380,53 @@ This guide covers raw apps from the terminal: scaffolding via \`wmill app new\`,
 
 **You — the AI agent — create the app yourself by running \`wmill app new\` with the right flags. Do NOT tell the user to "run \`wmill app new\` and follow the prompts" or wait for them to do it.** The bare \`wmill app new\` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
 
-### Step 1 — Gather the three required values by asking the user
+### Step 1 — Settle the setup
 
-You need three things to run the command:
+You need three values to run the command:
 
 1. **summary** — a short description of the app
 2. **path** — the windmill path, e.g. \`f/folder/my_app\` or \`u/username/my_app\`
-3. **framework** — one of \`react19\` (recommended), \`react18\`, \`svelte5\`, \`vue\`
+3. **framework** — one of \`react19\` (recommended), \`react18\`, \`svelte5\`
 
-If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+**summary and path**: if the user's request did not supply them, ask. Do not guess values and do not invent paths.
 
-Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+**framework**: never ask. Use the one the user named, otherwise the one the project's existing apps use, otherwise \`react19\` (see "Starting a new app" in the authoring guide).
+
+**data setup**: when the app has to store data and the user did not say where, ask which data table, which schema and which tables, as "Data setup" in the authoring guide lays out. \`wmill datatable list\` gives the data tables to offer.
+
+Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group everything missing into a single round-trip so the user answers at once:
 
-- For \`framework\` — multiple-choice with the four allowed values; mark \`react19\` as \`(Recommended)\` and put it first.
 - For \`summary\` and \`path\` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+- For the data setup — the choices the authoring guide lists, the default first.
 
-Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+Only proceed once every value is concrete. If the user replies with something ambiguous, ask again rather than guessing.
 
 ### Step 2 — Run the command yourself
 
-Once you have summary + path + framework, run it:
+Once the setup is settled, run it:
 
 \`\`\`bash
 wmill app new \\
   --summary "Customer dashboard" \\
   --path f/sales/dashboard \\
-  --framework react19
+  --framework react19 \\
+  --datatable main \\
+  --schema app1
 \`\`\`
 
-That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of \`--summary\`/\`--path\`/\`--framework\` puts the command in non-interactive mode.
+\`--summary\`, \`--path\` and \`--framework\` are the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of them puts the command in non-interactive mode, so the data setup only reaches the app through the flags below.
 
 ### Optional flags
 
-Layer these in only when the user asked for them:
-
 | Flag | When to add it |
 |---|---|
-| \`--datatable <name>\` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
-| \`--schema <name>\` | Together with \`--datatable\`. Creates the schema with \`CREATE SCHEMA IF NOT EXISTS\` if it doesn't already exist. |
+| \`--datatable <name>\` | The app stores data: the data table settled in step 1. Without it, the app is created with no datatable. |
+| \`--schema <name>\` | Together with \`--datatable\`, when the app's tables go in a schema, new or existing. If the schema doesn't exist yet, writes a \`sql_to_apply/\` migration with \`CREATE SCHEMA IF NOT EXISTS\`, applied like any other migration (see "SQL Migrations" below). Leave it out for \`public\`. |
 | \`--overwrite\` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
 | \`--no-open-in-desktop\` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
 
+Existing tables the app reuses have no flag: list them under \`data.tables\` in \`raw_app.yaml\` (see "Data tables" below).
+
 ### Step 3 — Offer the visual preview
 
 After \`wmill app new\` and any initial edits to \`App.tsx\` / \`index.tsx\`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a \`launch.json\` entry when an embedded preview tool is in play) the user should consent to.
@@ -6229,8 +6437,9 @@ For apps the preview command runs from the app folder (\`cd <app_path>__raw_app
 
 - ❌ Running \`wmill app new\` with no flags (the prompt will hang).
 - ❌ Telling the user to "run \`wmill app new\` and follow the prompts" — that's a step backwards from what you can do directly.
-- ❌ Inventing a path/summary/framework instead of asking the user.
-- ❌ Defaulting to \`react19\` because the user didn't say — even sensible defaults must be confirmed.
+- ❌ Inventing a path or summary instead of asking the user.
+- ❌ Asking which framework to use — \`react19\` is the default when nothing says otherwise.
+- ❌ Creating a schema or tables for a new app before the user has said where its data goes.
 - ❌ Passing \`--overwrite\` automatically when the directory exists — confirm with the user first.
 
 ### Interactive (only when a human is at the terminal)
@@ -6249,7 +6458,7 @@ my_app{{RAW_APP_SUFFIX}}/
 ├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
 ├── raw_app.yaml           # App configuration (summary, path, data settings)
 ├── index.tsx              # Frontend entry point
-├── App.tsx                # Main React/Svelte/Vue component
+├── App.tsx                # Main React/Svelte component
 ├── index.css              # Styles
 ├── package.json           # Frontend dependencies
 ├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
@@ -6348,7 +6557,7 @@ data:
 - \`<datatable>/<table>\` — Specific table in public schema
 - \`<datatable>/<schema>:<table>\` — Table in specific schema
 
-**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. \`roles\` records the role the app uses each datatable through; the app's code must pass the same role: \`wmill.datatable('main', { role: 'analyst' })\` in TypeScript, \`wmill.datatable('main', role='analyst')\` in Python. A datatable without an entry is used as its default role.
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. \`roles\` records the role the app uses each datatable through; the app's code must pass the same role: \`wmill.datatable('main', { role: 'analyst' })\` in TypeScript, \`wmill.datatable('main', role='analyst')\` in Python. A datatable without an entry is used as its default role, if it has one, plus the roles of whoever is using the app unless that default is \`admin\`.
 
 ## SQL Migrations (sql_to_apply/)
 
@@ -6407,7 +6616,7 @@ For the rest, tell the user which command fits their intent and let them run it
 
 # Windmill Raw Apps
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+Raw apps let you build custom frontends with React or Svelte that connect to Windmill backend runnables and datatables.
 
 ## App shape
 
@@ -6417,11 +6626,43 @@ A raw app has three logical parts:
 - **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
 - **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
 
+## Starting a new app
+
+A new app gets the setup Windmill's own new-app dialog gives one: a framework, then where its data lives.
+
+### Framework
+
+Use the framework the user named. When they named none, follow what there is to follow: the app being edited, or the apps the request points at. With nothing to follow, use **React 19**, the recommended default, **without asking**. React 18 and Svelte 5 are for when they are asked for. These three are the only frameworks the raw app bundler builds. When the user asks to build or convert an app in another framework, write no code in it: say it is not available and offer these three instead.
+
+### Data setup
+
+When a new app has to store data and the user did not say where, **ask before creating anything**: no app, no schema, no table. Where the data lives is the user's decision, and tables created in the wrong place stay there. Look up the workspace's data tables first so every choice you offer exists, then ask, as proposed answers rather than open questions:
+
+1. **Data table**: which one to use, the default first (\`main\` when it exists, otherwise the first listed). Skip this one when the workspace has a single data table.
+2. **Schema**: where the app's new tables go.
+   - A **new schema**, the usual choice, offered first. Suggest the first unused name among \`app1\`, \`app2\`, …
+   - An **existing schema** of that data table, by name.
+   - **None**: the tables go in \`public\`.
+3. **Tables**: only when that data table already holds tables the app could use, whether to **reuse** them (name them) or **create new ones**.
+
+Do not ask when:
+
+- the user already said where the data goes. A part they left out takes its default above: the default data table, a new \`appN\` schema, new tables;
+- the app, or its saved draft, already carries a data config (\`data.datatable\`, \`data.schema\` or \`data.tables\`). That config is the answer;
+- the app stores nothing.
+
+With no data table in the workspace there is nothing to choose: say that one has to be configured in the workspace settings before the app can store data.
+
+A question left unanswered or dismissed is not a go-ahead for the defaults: stop there and say what is still needed.
+
+Then build what was chosen: the data table and schema become the app's \`data.datatable\` and \`data.schema\`, the tables it uses, reused or new, go in \`data.tables\`, and a new schema is created (\`CREATE SCHEMA IF NOT EXISTS\`) before the tables that go in it.
+\`wmill app new --datatable <name> --schema <name>\` records both and, for a schema that does not exist yet, writes the migration in \`sql_to_apply/\` that creates it: nothing exists in the database until \`wmill app dev\` applies that migration, so the app's table migrations come after it.
+
 ## Frontend
 
 ### Entrypoint
 
-The entrypoint is \`index.tsx\` for React and \`index.ts\` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty \`<div id="root">\` and auto-renders nothing, so the entrypoint must mount a top-level \`App\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` / \`App.vue\` and keep the entrypoint as the mount shim.
+The entrypoint is \`index.tsx\` for React and \`index.ts\` for Svelte. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty \`<div id="root">\` and auto-renders nothing, so the entrypoint must mount a top-level \`App\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` and keep the entrypoint as the mount shim.
 
 React (\`index.tsx\`):
 
@@ -6433,7 +6674,7 @@ import App from './App'
 createRoot(document.getElementById('root')!).render(<App />)
 \`\`\`
 
-Svelte (\`index.ts\`): \`mount(App, { target: document.getElementById('root')! })\`. Vue (\`index.ts\`): \`createApp(App).mount('#root')\`.
+Svelte (\`index.ts\`): \`mount(App, { target: document.getElementById('root')! })\`.
 
 **Never replace the entrypoint with a bare component** (\`export default function App() { ... }\` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts \`App\` into \`#root\`.
 
@@ -6506,16 +6747,16 @@ Apply it to customer data, internal notes and anything else a viewer of the demo
 
 ### Chat UIs over a flow in chat mode
 
-A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add \`windmill-chat\` to \`package.json\` and use it directly, it detects the app's Windmill and credential.
+A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add \`@windmill-labs/chat-sdk\` to \`package.json\` and use it directly, it detects the app's Windmill and credential.
 
 \`\`\`tsx
-import { useWindmillChat } from 'windmill-chat/react'
+import { useWindmillChat } from '@windmill-labs/chat-sdk/react'
 
 const chat = useWindmillChat({ flowPath: 'f/support/assistant' })
 // chat.messages ({ role, content, pending, success, tool? }), chat.status, chat.sendMessage(text), chat.stop()
 \`\`\`
 
-\`windmill-chat/ai-sdk\` gives a \`ChatTransport\` for the Vercel AI SDK's \`useChat\`, \`windmill-chat/assistant-ui\` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs \`jobs:run\` in its frontend SDK scopes, plus \`flow_conversations:write\` for the conversation sidebar; without them the chat keeps history in the browser.
+\`@windmill-labs/chat-sdk/ai-sdk\` gives a \`ChatTransport\` for the Vercel AI SDK's \`useChat\`, \`@windmill-labs/chat-sdk/assistant-ui\` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs \`jobs:run\` in its frontend SDK scopes, plus \`flow_conversations:write\` for the conversation sidebar; without them the chat keeps history in the browser.
 
 ## Backend runnables
 
@@ -6599,6 +6840,18 @@ A draft app is reachable by nobody; deploying is what exposes it, and its backen
 Either one lets those people run the app's backend runnables, so never open an app up unless the user asks.
 \`public: true\` in \`raw_app.yaml\` deploys the app for anonymous users, and \`guests: true\` for guests. Remove the line and the next push closes the app again.
 
+## Sandbox isolation and frontend API access
+
+By default a deployed app's frontend runs with the viewer's own Windmill session. A sandboxed app is isolated from it: the frontend reaches Windmill only through its backend runnables, plus whatever frontend API scopes the app declares, which each viewer approves before the app runs. The scopes are \`jobs:run\`, \`jobs:read\`, \`users:read\`, \`resources:read\`, \`variables:read\`, \`flow_conversations:read\` and \`flow_conversations:write\`; grant only the ones the frontend calls.
+In \`raw_app.yaml\`:
+
+\`\`\`yaml
+sandbox: true
+frontend_api: [jobs:run, users:read]
+\`\`\`
+
+A file with a \`sandbox\` key states both settings: \`sandbox: false\` turns isolation off, and a missing \`frontend_api\` means no scopes. A file without the key leaves the deployed app's isolation and scopes as they are, so removing \`sandbox: true\` does not unsandbox it. \`frontend_api\` needs \`sandbox: true\`; the push fails otherwise.
+
 ## Data Tables
 
 Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the \`wmill\` client; the frontend never queries them directly. **When the app needs to store or persist data** (user data, settings, application state, records, logs), use a data table.
@@ -6610,6 +6863,7 @@ Data tables are PostgreSQL databases managed by Windmill. Backend runnables quer
 3. **No DDL inside runnables**: runnables only read and write rows (SELECT, INSERT, UPDATE, DELETE) on existing tables. Never CREATE, ALTER or DROP a table from a runnable.
 4. **Qualify table names**: an unqualified name means the \`public\` schema, so write every other table as \`schema.table\`, in table creation and queries alike. The app's \`data\` config sets the default datatable and schema its tables go in; use them consistently across runnables.
 5. **Pass the role**: when the app's \`data.roles\` gives a data table a role, every \`wmill.datatable\` call on it passes that role (\`wmill.datatable('main', { role: 'analyst' })\` in TypeScript, \`wmill.datatable('main', role='analyst')\` in Python). The role only reaches what it was granted, so a query outside it fails with \`permission denied\`.
+6. **Per-viewer rows**: a data table with no entry in \`data.roles\` is called with no role. Unless its default role is \`admin\`, the connection then holds the default role, if it has one, plus every role the person using the app is a tenant of, and is refused when that is none. Row-level security policies written as \`pg_has_role(current_user, '<role>', 'member')\` return that viewer's rows with nothing added to the runnable. A role pins the connection to that one role for every viewer, so where rows should differ per viewer give the data table no \`data.roles\` entry.
 
 \`wmill datatable list\` lists the workspace's data tables. Create or change tables with a migration in \`sql_to_apply/\` (see "SQL Migrations" above), then add them to \`data.tables\` in \`raw_app.yaml\`.
 
@@ -6663,7 +6917,7 @@ def main(user_id: str):
 7. **Mark sensitive UI with \`data-wm-no-record\`** — it is what keeps that data out of a recorded demo; passwords are handled for you.
 8. **Reach for \`backendAsync\` + \`waitJob\`** for long work — never a hand-written job-polling runnable.
 9. **Deploy what a path runnable points at** — a path runnable aimed at a draft fails at runtime; tell the user what needs deploying.
-10. **Use \`windmill-chat\` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
+10. **Use \`@windmill-labs/chat-sdk\` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
 `,
   "triggers": `---
 name: triggers
@@ -7230,6 +7484,8 @@ async def enrich(customer_id: str):
 
 In TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with \`@task()\` or \`@task\`.
 
+Only the workflow body dispatches steps. A task runs as a single job, so a task or \`step()\` called from inside a task body runs in place in that job, as a plain function call: no child job, no checkpoint, and its task options (retry, timeout, tag) do not apply. \`sleep()\` there waits in the job, and \`taskScript()\` / \`taskFlow()\` / \`waitForApproval()\` (\`task_script()\` / \`task_flow()\` / \`wait_for_approval()\`) throw. To get separate jobs, call the tasks one after another from the workflow body and pass results between them.
+
 For existing scripts:
 
 \`\`\`typescript
@@ -7395,8 +7651,9 @@ export async function getResumeUrls(approver?: string, flowLevel?: boolean): Pro
  * const call_api = task(fetchOrders, { retry: { attempts: 3, delay: 30, multiplier: 2 } });
  *
  * Inside a \`workflow()\`, calling a task dispatches it as a step.
- * Outside a workflow, the function body executes directly and
- * {@link TaskOptions} — retry included — does not apply.
+ * Outside a workflow, or called from inside another task, the function body
+ * executes directly and {@link TaskOptions} — retry included — does not apply:
+ * a task runs as a single job, so the tasks it calls run in that same job.
  *
  * A task runs as its own job, so its result is always encoded as JSON and
  * decoded back before the caller sees it: a \`Date\` comes back as a string, a
@@ -7440,6 +7697,9 @@ export function workflow<T>(fn: (...args: any[]) => Promise<T>)
  * \`fn\`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a \`Date\`
  * comes back as a string, a \`Map\` as \`{}\`. {@link Jsonified} is that shape.
+ *
+ * Called from inside a task body, \`fn\` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 export async function step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -7538,7 +7798,9 @@ def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 #
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 #
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a \`\`datetime\`\` comes back as a
@@ -7624,12 +7886,15 @@ def workflow(func)
 # \`\`fn\`\`'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a \`\`datetime\`\` comes back as a string, a tuple as a list.
+#
+# Called from inside a task body, \`\`fn\`\` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 #
 # Inside a @workflow, the parent job suspends and auto-resumes after \`\`seconds\`\`.
-# Outside a workflow, falls back to \`\`asyncio.sleep\`\`.
+# Outside a workflow, or inside a task body, falls back to \`\`asyncio.sleep\`\`.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
@@ -7709,10 +7974,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **\`duckdb\`** node that materializes its output into a **DuckLake** table with \`-- materialize ducklake://<name>/<table>\` (in a DuckDB node the annotation uses SQL \`--\` comment syntax; write the body as a bare \`SELECT\` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - \`postgresql\` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- \`bun\` / \`python3\` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- \`bun\` / \`python3\` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with \`wmill.ducklake()\`, or into a data table with \`wmill.datatable()\`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+\`\`\`python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+\`\`\`
+
+\`\`\`ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake\`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(\${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)\`.fetch()
+}
+\`\`\`
+
+- Use \`INSERT INTO <table> SELECT ...\` instead of \`CREATE OR REPLACE\` to append (an incremental pull), with a one-time \`CREATE TABLE IF NOT EXISTS\` first.
+- Assign the client to a variable (\`lake = wmill.ducklake()\`) and keep the SQL a **string literal** (Python) or a template without \`sql.raw\` (TS): that is what lets the graph record the node's write to \`ducklake://main/<table>\`. A chained \`wmill.ducklake().query(...)\` or SQL built in a variable records no output, so the downstream edge never forms.
+- \`wmill.ducklake("<name>")\` targets a non-default catalog; \`wmill.datatable("<name>")\` writes a Postgres data table the same way (Python \`db.query(sql, *args)\` with \`$1\` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: \`-- on ducklake://main/stripe_charges\`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and \`s3://\` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -7756,7 +8059,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the output via the SDK (\`wmill.writeS3File(...)\`, ducklake helpers, …) and let it be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
+> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the table itself with \`wmill.ducklake()\` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, where \`<warehouse>\` is a warehouse the workspace configures under Settings → dbt. \`manual\` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql \`CREATE TABLE\` / \`INSERT\`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a \`source\`: the declared relation and the dbt model land on ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when the ingestion node completes.
 
@@ -7858,7 +8161,7 @@ app related commands
 - \`app dev [app_folder:string]\` - Start a development server for building apps with live reload and hot module replacement
   - \`--port <port:number>\` - Port to run the dev server on (will find next available port if occupied)
   - \`--host <host:string>\` - Host to bind the dev server to
-  - \`--entry <entry:string>\` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
+  - \`--entry <entry:string>\` - Entry point file (default: index.ts for Svelte, index.tsx otherwise)
   - \`--no-open\` - Don't automatically open the browser
   - \`--recording\` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - \`app lint [app_folder:string]\` - Lint a raw app folder to validate structure and buildability
@@ -7869,9 +8172,9 @@ app related commands
 - \`app new\` - create a new raw app from a template
   - \`--summary <summary:string>\` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - \`--path <path:string>\` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
-  - \`--framework <framework:string>\` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.
+  - \`--framework <framework:string>\` - Framework template: react19 | react18 | svelte5. Skips the prompt when provided. Triggers non-interactive mode.
   - \`--datatable <datatable:string>\` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.
-  - \`--schema <schema:string>\` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.
+  - \`--schema <schema:string>\` - Schema to use with --datatable. If it doesn't exist yet, a sql_to_apply/ migration (CREATE SCHEMA IF NOT EXISTS) is written for it.
   - \`--overwrite\` - Overwrite the target directory if it already exists, without prompting.
   - \`--no-open-in-desktop\` - Do not prompt to open the new app in Claude Desktop.
 - \`app generate-agents [app_folder:string]\` - regenerate AGENTS.md and DATATABLES.md from remote workspace
@@ -7952,6 +8255,15 @@ Watch local file changes and live-reload the dev page for preview. Does NOT depl
 - \`--path <path:string>\` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)
 - \`--no-open\` - Do not open the browser automatically
 
+### digest
+
+Compute the content digest of local scripts and flows, as the \`digest\` and \`root_digest\` claims of job OIDC tokens carry it. Run from the root of a sync checkout, pulled after the deployment's dependency jobs completed: they write the lockfiles the digest covers. A flow also lists the digest of each inline step, as \`<flow path>/<step id>\`.
+
+**Arguments:** \`<paths...:string>\`
+
+**Options:**
+- \`--json\` - Output the digests as JSON
+
 ### docs
 
 Search Windmill documentation.
@@ -8546,6 +8858,8 @@ user related commands
 
 **Subcommands:**
 
+- \`user list\` - List the users of the workspace
+  - \`--json\` - Output as JSON (for piping to jq)
 - \`user add <email:string> [password:string]\` - Create a user
   - \`--superadmin\` - Specify to make the new user superadmin.
   - \`--company <company:string>\` - Specify to set the company of the new user.
@@ -8896,7 +9210,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -8907,7 +9222,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -8995,7 +9311,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9006,7 +9323,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9079,7 +9397,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9090,7 +9409,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9200,7 +9520,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9211,7 +9532,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9363,7 +9685,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9374,7 +9697,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9532,7 +9856,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9543,7 +9868,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9658,7 +9984,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9669,7 +9996,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9756,7 +10084,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9767,7 +10096,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9848,7 +10178,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9859,7 +10190,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -9946,7 +10278,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -9957,7 +10290,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -10097,7 +10431,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -10108,7 +10443,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
@@ -10298,7 +10634,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -10309,7 +10646,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/cli/src/main.ts b/cli/src/main.ts
index fa894b6f2d..762f800ffe 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -25,6 +25,7 @@ import protectionRules from "./commands/protection-rules/protection-rules.ts";
 import instance from "./commands/instance/instance.ts";
 import workerGroups from "./commands/worker-groups/worker-groups.ts";
 import lint from "./commands/lint/lint.ts";
+import digest from "./commands/digest/digest.ts";
 
 import dev from "./commands/dev/dev.ts";
 import { GlobalOptions } from "./types.ts";
@@ -203,6 +204,7 @@ const command = new Command()
   .command("dev", dev)
   .command("sync", sync)
   .command("lint", lint)
+  .command("digest", digest)
   .command("gitsync-settings", gitsyncSettings)
   .command("protection-rules", protectionRules)
   .command("instance", instance)
diff --git a/cli/src/utils/metadata.ts b/cli/src/utils/metadata.ts
index 1f2ef86769..15c53043b9 100644
--- a/cli/src/utils/metadata.ts
+++ b/cli/src/utils/metadata.ts
@@ -987,7 +987,21 @@ export async function inferSchema(
       currentSchema.properties[arg.name].originalType = (arg as any).otyp
     }
 
-    currentSchema.properties[arg.name].default = arg.default;
+    // Most languages cannot write a resource default in code, so one picked in the
+    // schema (`$res:` path) is kept while the code sets none and the arg is still that
+    // resource type; any code default wins.
+    const old = oldProperties[arg.name];
+    const format = currentSchema.properties[arg.name].format;
+    const keepResourceDefault =
+      arg.default == null &&
+      typeof old?.default == "string" &&
+      old.default.startsWith("$res:") &&
+      currentSchema.properties[arg.name].type == "object" &&
+      format?.startsWith("resource-") &&
+      format == old.format;
+    if (!keepResourceDefault) {
+      currentSchema.properties[arg.name].default = arg.default;
+    }
 
     if (!arg.has_default && !currentSchema.required.includes(arg.name)) {
       currentSchema.required.push(arg.name);
diff --git a/cli/src/utils/script_common.ts b/cli/src/utils/script_common.ts
index 611268c27c..e3deabb6a7 100644
--- a/cli/src/utils/script_common.ts
+++ b/cli/src/utils/script_common.ts
@@ -189,6 +189,8 @@ const LANG_ANNOTATIONS: Partial<Record<ScriptLanguage, string[]>> = {
     "py311",
     "py312",
     "py313",
+    "py314",
+    "py315",
     "sandbox",
   ],
   bun: ["npm", "nodejs", "native", "nobundling", "sandbox"],
@@ -208,7 +210,7 @@ const LANG_ANNOTATIONS: Partial<Record<ScriptLanguage, string[]>> = {
  *
  * `# py: <specifier>` is the exception the macro does not cover: the python
  * import parser reads it directly (`windmill-parser-py-imports`, alongside the
- * `py310`..`py313` flags) to pick the interpreter, which changes what resolves.
+ * `py310`..`py315` flags) to pick the interpreter, which changes what resolves.
  */
 export function hasLockAffectingAnnotation(
   scriptContent: string,
diff --git a/cli/test/app_isolation_unit.test.ts b/cli/test/app_isolation_unit.test.ts
new file mode 100644
index 0000000000..201c4a52a4
--- /dev/null
+++ b/cli/test/app_isolation_unit.test.ts
@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import {
+  finalizeDerivedPolicy,
+  isolationUpToDate,
+  markIsolationFromPolicy,
+  statedIsolation,
+} from "../src/commands/app/app.ts";
+
+function pushed(file: any, deployed: any, rawApp = true) {
+  const policy = { ...deployed };
+  finalizeDerivedPolicy(policy, "publisher", statedIsolation(file, rawApp), rawApp);
+  return policy;
+}
+
+test("a pull writes isolation only when it is on, and a push deploys what was pulled", () => {
+  const off: any = { policy: { sandbox: false, frontend_sdk_scopes: ["jobs:run"] } };
+  markIsolationFromPolicy(off, true);
+  expect("sandbox" in off).toBe(false);
+  expect("frontend_api" in off).toBe(false);
+
+  const on: any = { policy: { sandbox: true, frontend_sdk_scopes: ["jobs:run"] } };
+  markIsolationFromPolicy(on, true);
+  expect(on.sandbox).toBe(true);
+  expect(on.frontend_api).toEqual(["jobs:run"]);
+  // Into a workspace where the app does not exist yet.
+  const fresh = pushed(on, undefined);
+  expect(fresh.sandbox).toBe(true);
+  expect(fresh.frontend_sdk_scopes).toEqual(["jobs:run"]);
+});
+
+test("the file wins when it states sandbox, the deployed policy carries over when it does not", () => {
+  const deployed = { sandbox: true, frontend_sdk_scopes: ["jobs:run"] };
+
+  const silent = pushed({}, deployed);
+  expect(silent.sandbox).toBe(true);
+  expect(silent.frontend_sdk_scopes).toEqual(["jobs:run"]);
+  expect(isolationUpToDate(statedIsolation({}, true), deployed, true)).toBe(true);
+
+  // A file with the key states the scopes too: none here.
+  const narrowed = pushed({ sandbox: true }, deployed);
+  expect(narrowed.sandbox).toBe(true);
+  expect(narrowed.frontend_sdk_scopes).toBeUndefined();
+  expect(isolationUpToDate(statedIsolation({ sandbox: true }, true), deployed, true)).toBe(false);
+
+  const opened = pushed({ sandbox: false }, deployed);
+  expect(opened.sandbox).toBe(false);
+  expect(opened.frontend_sdk_scopes).toBeUndefined();
+});
+
+test("scopes are refused without sandbox, outside the allowlist, or repeated", () => {
+  expect(() => statedIsolation({ frontend_api: ["jobs:run"] }, true)).toThrow("requires 'sandbox: true'");
+  expect(() => statedIsolation({ sandbox: false, frontend_api: ["jobs:run"] }, true)).toThrow(
+    "requires 'sandbox: true'",
+  );
+  expect(() => statedIsolation({ sandbox: true, frontend_api: ["apps:write"] }, true)).toThrow("Invalid");
+  expect(() => statedIsolation({ sandbox: true, frontend_api: ["jobs:run", "jobs:run"] }, true)).toThrow(
+    "Duplicate",
+  );
+  expect(() => statedIsolation({ sandbox: true, frontend_api: ["jobs:run"] }, false)).toThrow("full-code");
+});
diff --git a/cli/test/app_lint_viewer_identity_unit.test.ts b/cli/test/app_lint_viewer_identity_unit.test.ts
new file mode 100644
index 0000000000..f328ffe4e2
--- /dev/null
+++ b/cli/test/app_lint_viewer_identity_unit.test.ts
@@ -0,0 +1,24 @@
+import { expect, test } from "bun:test";
+// app.ts first: it is the entry the CLI loads lint.ts through, and loading
+// lint.ts ahead of it trips their import cycle.
+import "../src/commands/app/app.ts";
+import { viewerIdentityInputWarnings } from "../src/commands/app/lint.ts";
+
+const sql = (content: string, fields?: Record<string, any>) => ({
+  type: "inline",
+  inlineScript: { language: "duckdb", content },
+  ...(fields ? { fields } : {}),
+});
+
+test("app lint warns on a SQL viewer-identity argument the server does not fill", async () => {
+  const content =
+    "-- $username (text)\n-- $limit (int)\nSELECT * FROM orders WHERE owner = $username LIMIT $limit";
+
+  const warnings = await viewerIdentityInputWarnings({
+    open: sql(content),
+    filled: sql(content, { username: { ctx: "username" } }),
+  });
+
+  expect(warnings).toHaveLength(1);
+  expect(warnings[0]).toContain("Runnable 'open': argument 'username'");
+});
diff --git a/cli/test/fixtures/item_digest_vectors.json b/cli/test/fixtures/item_digest_vectors.json
new file mode 100644
index 0000000000..6924157d60
--- /dev/null
+++ b/cli/test/fixtures/item_digest_vectors.json
@@ -0,0 +1,67 @@
+{
+  "script": {
+    "path": "f/digest/script",
+    "language": "bun",
+    "content": "import { helper } from \"./helper.ts\";\r\n\r\nexport async function main(name = \"wörld 🌍\") {\n  return helper(name);\n}\n",
+    "lock": "{\n  \"dependencies\": {}\n}\n//bun.lock\n<empty>",
+    "modules": {
+      "helper.ts": {
+        "content": "export const helper = (s: string) => `hi ${s}\\t`;\n",
+        "language": "bun"
+      }
+    },
+    "digest": "fcf85b60c3d9aef073e6911f417fdd19bedeb6d9e0f36b2589df07900997f29d"
+  },
+  "flow": {
+    "path": "f/digest/flow",
+    "value": {
+      "modules": [
+        {
+          "id": "a",
+          "value": {
+            "type": "rawscript",
+            "content": "export async function main(x: number) {\n  return x * 1.5;\n}\n",
+            "language": "bun",
+            "lock": "{\n  \"dependencies\": {}\n}\n//bun.lock\n<empty>",
+            "input_transforms": {
+              "x": { "type": "static", "value": 1.0 },
+              "y": { "type": "static", "value": [92.46585493017267, 15624.632993405901, 1e-7] },
+              "z": { "type": "static", "value": [{ "type": "flowscript", "id": 1, "modules_node": 2 }, { "id": "a", "value": { "type": "rawscript", "content": "data" } }] }
+            }
+          },
+          "summary": "Multiply",
+          "retry": { "constant": { "attempts": 2, "seconds": 5 } }
+        },
+        {
+          "id": "b",
+          "value": {
+            "type": "forloopflow",
+            "iterator": { "type": "javascript", "expr": "[1, 2, 3]" },
+            "skip_failures": false,
+            "parallel": true,
+            "modules": [
+              {
+                "id": "c",
+                "value": {
+                  "type": "rawscript",
+                  "content": "def main(x: int):\n    return {\"é\": x}\n",
+                  "language": "python3",
+                  "input_transforms": {
+                    "x": { "type": "javascript", "expr": "flow_input.iter.value" }
+                  },
+                  "tag": null
+                }
+              }
+            ]
+          }
+        }
+      ],
+      "same_worker": false
+    },
+    "digest": "0d8ae0dd8eb7272264ee802481a5abfe67501a759268fb2aa7e8277f0a2ab44c",
+    "steps": {
+      "a": "abf4646174c8d6984ea9f6d9c6746b61c3d95cd0cb91a4ca89b884b0f61600ae",
+      "c": "ee70e41e8647bab22bc4f7ac943c76355e2157015e71538a8f3adbb492c76a45"
+    }
+  }
+}
diff --git a/cli/test/generate_metadata_unit.test.ts b/cli/test/generate_metadata_unit.test.ts
index f8b1cbf997..55962d611a 100644
--- a/cli/test/generate_metadata_unit.test.ts
+++ b/cli/test/generate_metadata_unit.test.ts
@@ -228,3 +228,27 @@ describe("generate-metadata invalid input handling", () => {
     });
   }
 });
+
+describe("generate-metadata keeps schema defaults code cannot express", () => {
+  const content = `type Postgresql = object;\ntype Mysql = object;\nexport async function main(db?: Postgresql, other?: Mysql, list?: Postgresql[], n: number = 1) {\n  return db;\n}\n`;
+
+  test("a $res: default survives while the resource type holds, a code default still wins", async () => {
+    const result = await inferSchema(
+      "bun",
+      content,
+      {
+        properties: {
+          db: { type: "object", format: "resource-postgresql", default: "$res:f/x/pg" },
+          other: { type: "object", format: "resource-postgresql", default: "$res:f/x/pg" },
+          list: { type: "object", format: "resource-postgresql", default: "$res:f/x/pg" },
+          n: { type: "number", default: "$res:f/x/other" },
+        },
+      },
+      "test.ts"
+    );
+    expect(result.schema.properties.db.default).toEqual("$res:f/x/pg");
+    expect(result.schema.properties.other.default ?? null).toBeNull();
+    expect(result.schema.properties.list.default ?? null).toBeNull();
+    expect(result.schema.properties.n.default).toEqual(1);
+  });
+});
diff --git a/cli/test/init_no_git_sync.test.ts b/cli/test/init_no_git_sync.test.ts
index d16c9e771f..189e82562f 100644
--- a/cli/test/init_no_git_sync.test.ts
+++ b/cli/test/init_no_git_sync.test.ts
@@ -56,8 +56,6 @@ test("Init: createWorkspaceProfile includes defaults when no repositories exist"
   expect(Array.isArray(workspaceProfile.excludes)).toBeTruthy();
   expect(workspaceProfile.excludes.length).toEqual(0);
 
-  expect(workspaceProfile.defaultTs).toEqual('bun');
-
   console.log('Workspace profile correctly includes default sync settings when no repositories exist');
 });
 
@@ -74,8 +72,6 @@ test("Init: verify DEFAULT_SYNC_OPTIONS has expected values", () => {
   expect(Array.isArray(DEFAULT_SYNC_OPTIONS.excludes)).toBeTruthy();
   expect(DEFAULT_SYNC_OPTIONS.excludes.length).toEqual(0);
 
-  expect(DEFAULT_SYNC_OPTIONS.defaultTs).toEqual('bun');
-
   console.log('DEFAULT_SYNC_OPTIONS has expected values');
 });
 
@@ -178,7 +174,7 @@ test.skipIf(shouldSkipOnCI())("Init: --use-default bypasses backend settings che
 
     // Should have default settings, not backend settings
     expect(wmillYaml).toContain("includes:\n  - f/**");
-    expect(wmillYaml).toContain("defaultTs: bun");
+    expect(wmillYaml).not.toContain("defaultTs");
 
     // Should NOT have backend-specific settings
     expect(wmillYaml.includes("f/should-be-ignored/**")).toEqual(false);
diff --git a/cli/test/init_template_unit.test.ts b/cli/test/init_template_unit.test.ts
index 227fc271a2..7070de63c8 100644
--- a/cli/test/init_template_unit.test.ts
+++ b/cli/test/init_template_unit.test.ts
@@ -90,7 +90,6 @@ describe("generateCommentedTemplate", () => {
 
   test("default values match expected defaults", () => {
     const config = parse(generateCommentedTemplate("main"));
-    expect(config.defaultTs).toBe("bun");
     expect(config.skipSecrets).toBe(true);
     expect(config.nonDottedPaths).toBe(true);
     expect(config.codebases).toEqual([]);
diff --git a/cli/test/item_digest_unit.test.ts b/cli/test/item_digest_unit.test.ts
new file mode 100644
index 0000000000..cf2435f81c
--- /dev/null
+++ b/cli/test/item_digest_unit.test.ts
@@ -0,0 +1,88 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import JSZip from "jszip";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import {
+  readDirRecursiveWithIgnore,
+  ZipFSElement,
+} from "../src/commands/sync/sync.ts";
+import { itemDigest } from "../src/commands/digest/digest.ts";
+import vectors from "./fixtures/item_digest_vectors.json";
+
+// The server hashes the same vectors in backend/tests/job_provenance.rs, so a checkout
+// `wmill sync pull` writes for them must digest to the values the job OIDC claims carry.
+
+const originalCwd = process.cwd();
+beforeAll(() => {
+  process.chdir(mkdtempSync(join(tmpdir(), "wmill-digest-")));
+});
+afterAll(() => {
+  process.chdir(originalCwd);
+});
+
+/** The workspace export of the vectors, as `GET .../workspaces/tarball` writes it. */
+function exportZip(): JSZip {
+  const zip = new JSZip();
+  const file = (path: string, content: string) =>
+    zip.file(path, content, { createFolders: false });
+  const { script, flow } = vectors;
+  file(`${script.path}.ts`, script.content);
+  file(
+    `${script.path}.script.json`,
+    JSON.stringify({
+      summary: "",
+      description: "",
+      schema: {},
+      lock: script.lock,
+      kind: "script",
+      modules: script.modules,
+    })
+  );
+  file(
+    `${flow.path}.flow.json`,
+    JSON.stringify({ summary: "", description: "", value: flow.value, schema: {} })
+  );
+  return zip;
+}
+
+async function writeTree(el: any) {
+  for await (const e of readDirRecursiveWithIgnore(() => false, el)) {
+    if (!e.isDirectory) {
+      mkdirSync(dirname(e.path), { recursive: true });
+      writeFileSync(e.path, await e.getContentText());
+    }
+  }
+}
+
+beforeAll(async () => {
+  await writeTree(ZipFSElement(exportZip(), true, "bun", {}, {}, false, true));
+});
+
+// On Windows the pull leaves a multi-file script's entry point outside its `__mod/` folder
+// (`ZipFSElement` matches module bases against `/`-separated zip names), a layout neither
+// push nor this command reads back.
+test.skipIf(process.platform === "win32")(
+  "a pulled script digests to the server's digest",
+  async () => {
+    const script = await itemDigest("f/digest/script__mod/script.ts", "bun");
+    expect(script).toEqual({
+      path: vectors.script.path,
+      kind: "script",
+      digest: vectors.script.digest,
+    });
+    expect(
+      (await itemDigest("f/digest/script__mod/script.yaml", "bun")).digest
+    ).toBe(vectors.script.digest);
+  }
+);
+
+test("a pulled flow digests to the server's digests", async () => {
+  const flow = await itemDigest(join("f", "digest", "flow.flow"), "bun");
+  expect(flow).toEqual({
+    path: vectors.flow.path,
+    kind: "flow",
+    digest: vectors.flow.digest,
+    steps: vectors.flow.steps,
+  });
+});
diff --git a/cli/test/permissioned_as_context_unit.test.ts b/cli/test/permissioned_as_context_unit.test.ts
new file mode 100644
index 0000000000..33a24bf3a1
--- /dev/null
+++ b/cli/test/permissioned_as_context_unit.test.ts
@@ -0,0 +1,27 @@
+/**
+ * Regression guard: a superadmin whose `usr` row in the workspace is not an
+ * admin still preserves ownership on the backend, so the CLI must not refuse
+ * their push as if it would reassign every item to them.
+ */
+
+import { expect, test } from "bun:test";
+import { mockServices } from "./mock_services.ts";
+
+mockServices({
+  whoami: async () => ({
+    email: "super@windmill.dev",
+    username: "super",
+    is_admin: false,
+    is_super_admin: true,
+    groups: [],
+  }),
+});
+
+const { buildPermissionedAsContext } = await import(
+  "../src/core/permissioned_as.ts"
+);
+
+test("a superadmin with a non-admin membership counts as able to preserve", async () => {
+  const ctx = await buildPermissionedAsContext("w", "v1");
+  expect(ctx?.userIsAdminOrDeployer).toBe(true);
+});
diff --git a/cli/windmill-utils-internal/src/deploy.ts b/cli/windmill-utils-internal/src/deploy.ts
index 0d70e231cf..71447c6b1f 100644
--- a/cli/windmill-utils-internal/src/deploy.ts
+++ b/cli/windmill-utils-internal/src/deploy.ts
@@ -458,6 +458,8 @@ export async function deployItem(
           path,
           requestBody: {
             ...flow,
+            // Sent even when unset: the backend keeps a restriction an omitted field leaves out.
+            job_token_scopes: flow.job_token_scopes ?? null,
             preserve_on_behalf_of: preserveOnBehalfOf,
             on_behalf_of_email: onBehalfOf,
             // Usernames are per-workspace, so the source's principal names nobody in
@@ -471,6 +473,8 @@ export async function deployItem(
           workspace: workspaceTo,
           requestBody: {
             ...flow,
+            // Sent even when unset: the backend keeps a restriction an omitted field leaves out.
+            job_token_scopes: flow.job_token_scopes ?? null,
             preserve_on_behalf_of: preserveOnBehalfOf,
             on_behalf_of_email: onBehalfOf,
             // Usernames are per-workspace, so the source's principal names nobody in
@@ -498,6 +502,7 @@ export async function deployItem(
         requestBody: {
           ...script,
           lock: script.lock,
+          job_token_scopes: script.job_token_scopes ?? null,
           parent_hash: parentHash,
           preserve_on_behalf_of: preserveOnBehalfOf,
           on_behalf_of_email: onBehalfOf,
@@ -889,6 +894,7 @@ export async function getItemValue(
         summary: flow.summary,
         description: flow.description,
         value: flow.value,
+        job_token_scopes: flow.job_token_scopes ?? null,
       };
     } else if (kind === "script") {
       const script = await provider.getScriptByPath({ workspace, path });
@@ -898,6 +904,7 @@ export async function getItemValue(
         schema: script.schema,
         summary: script.summary,
         language: script.language,
+        job_token_scopes: script.job_token_scopes ?? null,
       };
     } else if (kind === "app" || kind === "raw_app") {
       return await provider.getAppByPath({ workspace, path });
diff --git a/cli/wmill.schema.json b/cli/wmill.schema.json
index 022156e5c9..145a75fd26 100644
--- a/cli/wmill.schema.json
+++ b/cli/wmill.schema.json
@@ -10,7 +10,7 @@
         "bun",
         "deno"
       ],
-      "description": "Default TypeScript runtime for new scripts"
+      "description": "TypeScript runtime of a plain .ts script (bun when absent)"
     },
     "includes": {
       "type": "array",
diff --git a/docker/DockerfileExtra b/docker/DockerfileExtra
index 8aa24206a4..1d8d0003da 100644
--- a/docker/DockerfileExtra
+++ b/docker/DockerfileExtra
@@ -44,9 +44,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN set -eux; \
     arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
     case "$arch" in \
-    'amd64') targz='go1.26.0.linux-amd64.tar.gz' ;; \
-    'arm64') targz='go1.26.0.linux-arm64.tar.gz' ;; \
-    'armhf') targz='go1.26.0.linux-armv6l.tar.gz' ;; \
+    'amd64') targz='go1.27.1.linux-amd64.tar.gz' ;; \
+    'arm64') targz='go1.27.1.linux-arm64.tar.gz' ;; \
+    'armhf') targz='go1.27.1.linux-armv6l.tar.gz' ;; \
     *) echo >&2 "error: unsupported architecture '$arch'"; exit 1 ;; \
     esac; \
     wget "https://golang.org/dl/$targz" -nv && tar -C /usr/local -xzf "$targz" && rm "$targz"
@@ -71,7 +71,7 @@ ENV XDG_CACHE_HOME=/pyls/.cache
 RUN uv pip install --system --break-system-packages pipenv tornado python-lsp-jsonrpc ruff==0.16.0 Cython
 
 # Install Node-based language servers
-RUN npm install -g diagnostic-languageserver pyright
+RUN npm install -g pyright
 
 # Setup LSP working directory
 WORKDIR /pyls
diff --git a/docker/DockerfileFull b/docker/DockerfileFull
index 8ef6be78bb..c3a82c8312 100644
--- a/docker/DockerfileFull
+++ b/docker/DockerfileFull
@@ -1,6 +1,9 @@
 ARG BASE_IMAGE=ghcr.io/windmill-labs/windmill:dev
 FROM ${BASE_IMAGE}
 
+# Deno
+COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno
+
 # Rust
 COPY --from=rust:1.97.0 /usr/local/cargo /usr/local/cargo
 COPY --from=rust:1.97.0 /usr/local/rustup /usr/local/rustup
@@ -12,7 +15,9 @@ RUN RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo /usr/local/cargo/b
 # ansible there leaves its venv interpreter as a dangling symlink at runtime, so every
 # ansible-* executable fails with ENOENT ("ansible-galaxy not found"). Pin the tool's
 # interpreter to a persistent image path so the install stays self-contained.
-RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
+# The version is explicit because uv otherwise downloads its newest stable Python, which
+# ansible-core may not support yet: the install succeeds and every executable fails on import.
+RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install --python 3.14 ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
 
 # C#
 RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
diff --git a/docker/DockerfileFullEe b/docker/DockerfileFullEe
index 88ed619c19..bb83195f62 100644
--- a/docker/DockerfileFullEe
+++ b/docker/DockerfileFullEe
@@ -21,6 +21,9 @@ RUN if [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
 
 FROM ${BASE_IMAGE}
 
+# Deno
+COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno
+
 # Rust
 COPY --from=rust:1.97.0 /usr/local/cargo /usr/local/cargo
 COPY --from=rust:1.97.0 /usr/local/rustup /usr/local/rustup
@@ -32,7 +35,9 @@ RUN RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo /usr/local/cargo/b
 # ansible there leaves its venv interpreter as a dangling symlink at runtime, so every
 # ansible-* executable fails with ENOENT ("ansible-galaxy not found"). Pin the tool's
 # interpreter to a persistent image path so the install stays self-contained.
-RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
+# The version is explicit because uv otherwise downloads its newest stable Python, which
+# ansible-core may not support yet: the install succeeds and every executable fails on import.
+RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install --python 3.14 ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
 # dotnet SDK
 RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
     && chmod +x dotnet-install.sh \
diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim
index 45986bbd5f..a37ced0eca 100644
--- a/docker/DockerfileSlim
+++ b/docker/DockerfileSlim
@@ -58,7 +58,7 @@ RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmo
 ENV TZ=Etc/UTC
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtime to temp location (will copy with world-writable perms later)
 # --compile-bytecode precompiles the stdlib to .pyc so jobs don't recompile it on every run
diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe
index 5ac24f5c1d..687b1506ce 100644
--- a/docker/DockerfileSlimEe
+++ b/docker/DockerfileSlimEe
@@ -58,7 +58,7 @@ RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmo
 ENV TZ=Etc/UTC
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtime to temp location (will copy with world-writable perms later)
 # --compile-bytecode precompiles the stdlib to .pyc so jobs don't recompile it on every run
diff --git a/docker/entrypoint-extra.sh b/docker/entrypoint-extra.sh
index 84b337a8a1..c7d04c33e0 100644
--- a/docker/entrypoint-extra.sh
+++ b/docker/entrypoint-extra.sh
@@ -134,7 +134,7 @@ fi
 # Setup Monaco temp directory for LSP
 mkdir -p /tmp/monaco
 if [ ! -f /tmp/monaco/go.mod ]; then
-    echo -e "module mymod\ngo 1.26" > /tmp/monaco/go.mod
+    echo -e "module mymod\ngo 1.27" > /tmp/monaco/go.mod
 fi
 
 echo "[entrypoint] Starting Windmill Extra Services"
diff --git a/docker/test_windmill_extra.ts b/docker/test_windmill_extra.ts
index 5fd1a74108..c5884c2dd4 100644
--- a/docker/test_windmill_extra.ts
+++ b/docker/test_windmill_extra.ts
@@ -121,6 +121,60 @@ async function testLspWebSocket(): Promise<void> {
 	})
 }
 
+async function testLspShellDiagnostics(): Promise<void> {
+	return new Promise((resolve, reject) => {
+		const timeout = setTimeout(() => {
+			ws.close()
+			reject(new Error('no shellcheck diagnostics within 10s'))
+		}, 10000)
+
+		const ws = new WebSocket(`ws://${HOST}:${LSP_PORT}/ws/diagnostic`)
+		const send = (msg: object) => ws.send(JSON.stringify({ jsonrpc: '2.0', ...msg }))
+
+		ws.onopen = () => {
+			// Editors still send a linter definition; the server's own configuration
+			// applies, so the diagnostics below have to come from shellcheck.
+			send({
+				id: 1,
+				method: 'initialize',
+				params: {
+					capabilities: {},
+					initializationOptions: {
+						linters: { shellcheck: { command: 'true', sourceName: 'shellcheck' } },
+						filetypes: { shell: 'shellcheck' }
+					}
+				}
+			})
+			send({
+				method: 'textDocument/didOpen',
+				params: {
+					textDocument: {
+						uri: 'file:///tmp/monaco/test.sh',
+						languageId: 'shell',
+						version: 1,
+						text: '#!/bin/bash\necho "$unassigned"\n'
+					}
+				}
+			})
+		}
+
+		ws.onmessage = (event) => {
+			const msg = JSON.parse(event.data.toString())
+			if (msg.method !== 'textDocument/publishDiagnostics') return
+			clearTimeout(timeout)
+			ws.close()
+			const codes = msg.params.diagnostics.map((d: { code: string }) => d.code)
+			if (codes.includes('SC2154')) resolve()
+			else reject(new Error(`expected SC2154, got ${JSON.stringify(msg.params.diagnostics)}`))
+		}
+
+		ws.onerror = () => {
+			clearTimeout(timeout)
+			reject(new Error('LSP WebSocket connection failed'))
+		}
+	})
+}
+
 async function runLspTests(): Promise<boolean> {
 	log('\n=== LSP Service Tests (Port ' + LSP_PORT + ') ===')
 
@@ -132,6 +186,7 @@ async function runLspTests(): Promise<boolean> {
 	let passed = true
 	passed = (await runTest('LSP health check', testLspHealth)) && passed
 	passed = (await runTest('LSP WebSocket connection (pyright)', testLspWebSocket)) && passed
+	passed = (await runTest('LSP shell diagnostics', testLspShellDiagnostics)) && passed
 
 	return passed
 }
diff --git a/docs/auth-surface.md b/docs/auth-surface.md
index 15f2538cc5..3b8cfbcfbf 100644
--- a/docs/auth-surface.md
+++ b/docs/auth-surface.md
@@ -52,6 +52,32 @@ Symbols, not line numbers, are cited: they drift less.
   with that reader's permissions, outside the folder too. `ai_skill` bodies are likewise in play
   for every reader until turned off. The resource ACL is the only control, so granting write on a
   folder grants that influence.
+- **Restricted job tokens** (`job_token_scopes` on scripts and flows): a job's effective scopes
+  are stored on its `job_perms` row at push and minted into its token
+  (`create_token_for_owner`); an empty set is minted as `NO_API_ACCESS_SCOPE`, since
+  `scopes: Some([])` reads as unscoped. Every `push` takes a `scope_ceiling`, and the job gets the
+  ceiling ∩ the target's own setting: flow steps take their flow job's, agent tools their agent's,
+  WAC children their parent's, retries the run they replace, and API pushes the calling job's
+  (`caller_scope_ceiling`) — a scoped user or webhook token caps nothing. The row is swept once a
+  job leaves the queue, so a restart of a completed flow takes the flow's current setting. Schedules,
+  triggers and error/success handlers start from the target's own setting. A restricted token
+  keeps only the runtime routes about its own job (`is_own_job_runtime_route`) and the reads of
+  its own flow run (`flow_run_read_route_job`, checked against its lineage: the orchestrator
+  evaluates a step's `results.x` with the token of the step that just finished). That lineage is
+  trusted, so a restricted job token, even an admin's, can only place a job it starts in its own
+  run (`unclaimable_run_lineage`); a route that
+  authenticates a token itself instead of through the route layer must call
+  `check_job_token_scope`. A restricted job never runs on a dedicated worker, which uses its own
+  unscoped token for every job. `$var:`/`$res:` args are resolved through the API with the job's
+  own token, so they need read scopes. A deploy that omits the setting keeps the deployed value
+  and `null` clears it, so an unaware client cannot drop a restriction; setting one is refused
+  until every worker supports it, since an older worker mints without it. The OIDC
+  `job_token_scopes` claim is the presented token's scopes, not the runnable's setting, so a
+  verifier sees what the job could reach and a token minted without the restriction shows as
+  unrestricted. The setting belongs to
+  the deployed version: an older script hash run by hash runs with that version's setting (a
+  restricted caller still caps it). Write scopes on scripts, flows, schedules or triggers let a
+  job escape its restriction.
 - **A remote deploy token is a credential for another instance**, held per account and workspace
   (`remote_deploy_token`, encrypted under the workspace key, re-keyed by `set_encryption_key`).
   Its `email` references `password(email)` with `ON DELETE/UPDATE CASCADE`, so whatever deletes or
diff --git a/docs/datatable-viewer-roles.md b/docs/datatable-viewer-roles.md
new file mode 100644
index 0000000000..9855e4f97a
--- /dev/null
+++ b/docs/datatable-viewer-roles.md
@@ -0,0 +1,93 @@
+# Data table connections and the viewer's roles
+
+A data table under roles (Enterprise Edition) resolves a connection that names a role to that
+role alone. A connection that names none is resolved from the data table's default role:
+
+| Default role | A connection naming no role holds |
+|---|---|
+| `admin` (until changed) | `admin`, as before viewer roles existed |
+| another role | that role when the job's own identity may use it, plus **every role the job's viewer is a tenant of** |
+| none (`NO_DEFAULT_DATATABLE_ROLE`) | the viewer's roles only |
+
+A connection left with no role at all is refused. Postgres row-level security can then answer
+per viewer from a backend runnable that runs as the app's publisher, with nothing written in the
+runnable.
+
+Policies test membership, which is true for a role's own login too, so one policy serves a named
+connection and an unnamed one:
+
+```sql
+CREATE POLICY emea ON orders FOR SELECT
+  USING (region = 'emea' AND pg_has_role(current_user, 'sales_emea', 'member'));
+```
+
+A policy names its role as text, so renaming the role breaks it.
+
+## Code
+
+| Where | What |
+|---|---|
+| `windmill-common/src/workspaces.rs` | `DatatableAccess`, `get_datatable_resource_from_db` |
+| `windmill-common/src/datatable_roles_ee.rs` | `resolve_datatable_role_connection`, `viewer_role_ids`, `ensure_role_set_login`, `retire_role_set_logins_of`, `sweep_unused_role_set_logins` |
+| `windmill-api-jobs/src/execution.rs` | `run_end_user_email`, where a run's viewer is recorded |
+| `frontend/.../workspaceSettings/DataTablePermissionsButton.svelte` | the roles drawer, which warns while the default is `admin` |
+
+## What holds it together
+
+- **A default of `admin` is not a floor.** `admin` owns the tables and bypasses row-level
+  security, so nothing could be added to it, and it is the default until someone changes it.
+  Such a data table resolves exactly as it did before viewer roles existed. Nothing ever sets a
+  default back to `admin`: removing or deleting the default role leaves none.
+- **The default role is tenant-checked against the job's own identity**, the publisher for a
+  publisher-mode app, and held only when that passes. The viewer's roles are added either way.
+- **No role at all is a refusal, never an empty answer.** There is no login that would read
+  nothing: what a role sees is up to each table's grants and policies. A job without a recorded
+  viewer (anonymous app viewer, schedule, trigger, a tool job started by an AI agent step), or
+  whose viewer is not a member of the governing workspace, therefore needs a default it may use
+  or a named role.
+- **A set login owns what it creates.** Postgres gives a new object to `current_user`, and
+  default privileges go by the creating role, so a table created over a connection that holds
+  several roles belongs to that set's login: no other role or viewer reaches it, and it passes to
+  `custom_instance_user` when the login is swept. Unnamed connections are for rows. To create an
+  object, name a role or run `SET ROLE <role>` first, which a set login may do for any role it
+  holds. Migrations are not affected: one that declares no role runs as `admin`.
+- **The viewer is `job_perms.end_user_email`, and nothing else.** The server records it when the
+  run starts: the session behind an app request, the caller of a direct run or preview, and for a
+  job started with another job's token, that job's viewer. No argument reaches it.
+- **A cached result belongs to one viewer.** `cached_result_path` hashes the run's recorded viewer
+  into the key, since a cache hit returns before any connection is resolved. Runs with no viewer
+  recorded keep sharing one entry.
+- **Only a tenant list naming the viewer counts.** A workspace admin may *use* every role,
+  `admin` included. The viewer's roles are those whose tenants name them (user, group, folder,
+  `*`), and never `admin`.
+- **One role is that role's login. Several are a login per distinct set.** `wm_set_<hash>` is a
+  member of exactly those roles, with `INHERIT`; the hash is over their catalog ids, so a rename
+  moves nothing and a change in someone's groups resolves them to another login instead of
+  editing one. Its privileges are its memberships, so `SET ROLE` only narrows and `RESET ROLE`
+  comes back to it. The prefix is reserved in `validate_role_name`.
+- **Resolving stays cheap where no viewer could add anything.** The viewer is only looked up when
+  some role other than the default and `admin` has tenants on that data table.
+- **A `datatable_role_set` row with a password names a login that can authenticate with it.** The
+  row is written after the login exists and removed, in its own commit, before the login is
+  dropped or made `NOLOGIN`. A login without a row is taken back with a new password on next use,
+  and so is one whose row has an empty password: that is what a sweep leaves when it could
+  neither drop a login nor let it back in, so the next sweep still finds it.
+- **Set logins are bounded by use, not by the number of role combinations.** One exists only for
+  a set some viewer actually connected with, so there are at most as many as (viewer, data table)
+  pairs. `last_used_at` is recorded at most once a day, and `sweep_unused_role_set_logins`, run
+  from the monitor loop, drops those unused for 30 days; a dropped one is made again on demand.
+  The sweep goes by this instance's rows, never by the cluster's `wm_set_*` roles: a cluster can
+  serve several Windmill instances.
+- **Disabling or dropping a role retires every set login holding it.** `NOLOGIN` on a role does
+  not reach a login that is a member of it.
+- **A worker or server that predates this connects as the default role alone**, so a mixed fleet
+  shows a viewer fewer rows, never more. It refuses a data table with no default role, whose
+  marker it reads as a role the data table lacks.
+
+## Trust
+
+A job that names no role runs its author's code with the viewer's reach into the data table, the
+same trust as an app in viewer execution mode or a script someone else wrote and you run. Whoever
+can deploy a publisher-mode app, or a script that others run, can therefore read through the
+non-`admin` roles of the people who use it. Naming a role in the code is how an author pins the
+connection to one role instead.
diff --git a/docs/feature-telemetry.md b/docs/feature-telemetry.md
index c0d7b9c027..8e658eda3f 100644
--- a/docs/feature-telemetry.md
+++ b/docs/feature-telemetry.md
@@ -4,8 +4,8 @@
 anonymous usage-stats payload. It answers "does anyone use this, and which variant do they pick"
 without any identifying data leaving the instance.
 
-It currently carries 61 registered actions across twenty features (`ai_session`, `ai_chat`,
-`ai_fix`, `ai_agent`, `ai_agent_eval`, `app_sandbox`, `datatable`, `db_manager`, `flow_editor`,
+It currently carries 62 registered actions across twenty-one features (`ai_session`, `ai_chat`,
+`ai_fix`, `ai_agent`, `ai_decision`, `ai_agent_eval`, `app_sandbox`, `datatable`, `db_manager`, `flow_editor`,
 `flow_run`, `flow_step`, `home`, `run_form`, `debugger`, `trigger`, `command_script`,
 `hub_script`, `usage_meter`, `sso_groups_claim`, `cloud_trial_offer`). Nearly all of the
 product is uninstrumented, so new user-facing work is the opportunity to change that.
diff --git a/docs/operator-builder-rights.md b/docs/operator-builder-rights.md
index 4db2a69511..4f844beebf 100644
--- a/docs/operator-builder-rights.md
+++ b/docs/operator-builder-rights.md
@@ -1,13 +1,25 @@
 # Operator builder rights
 
-`operator_settings.builder_flows` lets every operator of a workspace compose flows out of runnables
-that already exist. It does not make them authors: the boundary the operator role draws is
-**authoring code and running arbitrary code**, and this does not move it.
+Two workspace settings, `operator_settings.builder_flows` and `operator_settings.builder_apps`,
+that let every operator of that workspace compose flows and full-code apps out of runnables that
+already exist. Neither lets them author backend code or run arbitrary code on a worker, the
+boundary the operator role draws. The app right does let them write the app's frontend code,
+which runs in the viewer's browser and is why that right rests on sandbox isolation.
 
-It is a write right, unlike the visibility flags beside it, and unlike the withdrawable rights in
-`docs/operator-write-rights.md` it is granted on request and costs a seat. Read it with
-`windmill_common::workspaces::operator_can_build_flows` (60s cache, shared with the withdrawable
-rights) and gate a write with `check_operator_can_build_flows`.
+They are granted **independently**, because the two are not equally verifiable. A composed flow is
+checked in full server-side (`check_flow_is_composition_only` refuses everything carrying code).
+A full-code app is a browser-built bundle no server-side check can read, and rests instead on
+forced `sandbox` isolation plus the viewer consent prompt. An admin may reasonably want the first
+without the second, so **never gate on "either"**: a gate that does authorizes the kind its
+workspace never granted, which is the whole point of the split. `BuilderKind` exists to make each
+call site say which one it means.
+
+These are write rights, unlike the visibility flags beside them, and unlike the withdrawable
+rights in `docs/operator-write-rights.md` they are granted on request and cost a seat. Read them
+with `windmill_common::workspaces::operator_builder_rights` (60s cache, shared with the
+withdrawable rights), which returns an `OperatorBuilderRights { flows, apps }`, and gate a write
+with `check_operator_can_build`, naming the `BuilderKind`. `.any()` is only for surfaces that are
+genuinely not per-kind: the seat a membership costs, and listing drafts.
 
 ## What the check has to cover
 
@@ -49,25 +61,131 @@ Call it on every write **and** every preview: `run_preview_flow_job` and
 it the way to run what the write path refuses. A flow draft goes through `validate_operator_flow`
 too: a developer who loads a builder's draft in the editor runs its code as themselves.
 
+The same reasoning applies to a builder-authored app, with one extra step. `execute_component`
+resolves the runnable it runs on the root handle, so `validate_operator_composed_app` checks every
+referenced path under the caller's RLS and refuses hub ones. For a script it checks the version a
+run would pick: grants are per version, and a path reused after its versions were archived starts
+with none while the archived ones keep theirs. But it has to check **two** surfaces,
+because they are not the same list: the policy's `script/<path>` and `flow/<path>` triggerables,
+and the by-path entries of the app value's `runnables` map, which is what the editor resolves a
+`runnable_id` against and sends. Read only that map, and refuse an entry whose `type`, `path` or
+`runType` is not text.
+
+Reading a triggerable key is not a `split_once(':')`: `execute_component` looks up
+`format!("{component}:{path}")` with an unrestricted component string, so `a:b:script/x` resolves
+at run time for `component = "a:b"`. Every colon is a possible split, so the check validates every
+suffix that parses as a runnable rather than guessing which one a request will use.
+
+What makes those checks bind is that **`ExecutionMode::Viewer` is refused for a builder app**. In
+Viewer mode `execute_component` falls back to a default triggerable for any `script/`/`flow/`
+path, so the policy stops being the list of what the app may invoke, and the job runs as the
+*viewer*: an admin who merely opened the app would run anything in the workspace as themselves.
+`Publisher`, `Guest` and `Anonymous` have no such fallback; all three run as the publisher. If you ever relax the Viewer refusal, the
+deploy-time path checks above stop being an authorization boundary.
+
+## The two raw-app deploy paths are not equivalent
+
+`create_app_raw` / `update_app_raw` are multipart: the browser already built the bundle, and
+nothing server-side compiles anything. Builders use these.
+
+`create_app_raw_source` / `update_app_raw_source` push a bundler CLI over caller-supplied `files`
+as a job **on a worker**, which is arbitrary code execution and is why they already require
+`jobs:run` on top of `apps:write`. They stay closed to operators, builder rights or not. Do not
+"tidy" the exception away: it costs builders nothing, because the browser and the CLI both bundle
+locally and deploy through the multipart endpoints.
+
+A builder-authored app is forced to `policy.sandbox = true`. That is what makes it safe to let an
+operator publish a bundle nobody reviewed: without it the bundle runs same-origin with each
+viewer's Windmill session. The same check refuses a `rawscript/<sha>` key in either triggerables
+map, since that key is the deployed app's authorization to run caller-supplied `raw_code` hashing
+to it. It reads the value as stored, NUL escapes stripped: a stripped NUL can turn a key it
+ignored into `inlineScript`.
+
+`update_app` takes a builder too, but settings only: the deploy panel saves a deployed full-code
+app's access and frontend scopes through it with no value. It reaches the same check, so a builder
+can no more switch the sandbox off there than on deploy.
+
+A builder's **draft** goes through the same `check_operator_composed_app` as its deploy, with
+`BuilderAppWrite::Draft`: an admin may open it in the editor or deploy it as it stands, so any
+rule added for deploys must hold for drafts too. Where the two differ, `write` decides: a deploy
+fills in an omitted sandbox or mode, since it stores the policy it checked, while a draft skips
+`triggerables_v2` and must not name another user's run identity. Every frontend writer of a
+builder draft must conform the policy first with `conformBuilderAppPolicy`, since a policy loaded
+from someone else's app breaks these rules: the editor and the AI chat do. The AI Sessions raw-app
+editor, open to operators only behind a per-browser opt-in, does not, so its autosaves are refused.
+
+The raw-app editor previews an app isolated only when its policy has `sandbox`, and otherwise runs
+the bundle same-origin with the session of whoever opens it. A builder's draft is therefore
+held to the same rule as its deploy: `update_draft` refuses one whose `policy.sandbox` is not
+`true`, so whatever an admin opens of an operator's, deployed or drafted, previews isolated.
+Turning the sandbox off in their own editor stays that admin's explicit choice. It also refuses
+a draft naming a runnable the builder cannot read, or a hub one, like the deploy: the editor
+preview runs them as whoever opens it, and admits any path for an admin. That covers the
+policy's legacy `triggerables` too, `rawscript/` keys included: every deploy of a draft
+carries it through untouched, so an admin deploying the draft would publish it. Its
+`triggerables_v2` is not checked: every deploy of a draft rebuilds it from the runnables, the
+preview never reads it, and a copy gone stale since the last deploy would otherwise block
+autosave. `Viewer` mode is refused in a draft as on deploy: the deploy panel shows it as
+members-only, so an admin deploying the draft would publish it unawares. The builder's editor
+switches it to `Publisher` on load, since that panel offers no way out of it. A draft naming a
+run identity other than its builder is refused for the same reason: a builder's own deploy resets
+it, but an admin's one-click draft deploy preserves it without showing it. The builder's editor
+drops another user's identity on load, which an app that user deployed carries. A builder in
+`wm_deployers` is the exception: like any member, their deploy may keep another identity, which
+was judged acceptable for operators in that group (WIN-2536) and is the same for composed flows.
+
+Reading a triggerable key at every colon copies it once per colon, so the check refuses a key
+over 512 bytes before splitting: a quadratic walk otherwise lets a sub-megabyte key allocate
+gigabytes. A 255-character path plus a component name stays well under it.
+
 ## Billing
 
-An operator of a builder workspace consumes a full author seat: composing deployable artifacts
-makes them an author, and there is no half-author. `consumes_operator_seat` is the seat-role
-helper; the EE counting queries share `OPERATOR_SEAT_SQL` so the displayed, enforced and reported
-numbers agree. The one exception is `get_user_usage` in `stats_ee.rs`: it is a compile-checked
-`query!`, which cannot interpolate the constant, so it spells the predicate out. Change both
-together.
+An operator of a builder workspace consumes a full author seat. This is the one place that reads
+"either right", and deliberately so: either one makes an operator an author of deployable
+artifacts, and there is no half-author, so granting both costs no more than granting one. Do not
+introduce per-right pricing — it turns one boolean into a capability matrix that billing, the cap
+check and the displayed count would each have to agree on.
 
-On cloud, `billable_seats` applies the same rule; see its doc for the out-of-repo invoice it must
-match.
+`consumes_operator_seat` is the seat-role helper; the EE counting queries share
+`OPERATOR_SEAT_SQL` so the displayed, enforced and reported numbers agree. The one exception is
+`get_user_usage` in `stats_ee.rs`: it is a compile-checked `query!`, which cannot interpolate the
+constant, so it spells the predicate out. Change both together. On cloud, `billable_seats` applies
+the same rule; see its doc for the out-of-repo invoice it must match.
 
-Granting the right runs `check_seat_cap_for_operator_builder`, which prices the change by counting
-seats twice rather than by counting the workspace's operators: an operator who already authors
-elsewhere must not be charged again, so re-saving settings that already have the right on is a
-zero delta and never blocks.
+Granting the first right runs `check_seat_cap_for_operator_builder`, which prices the change by
+counting seats twice rather than by counting the workspace's operators: an operator who already
+authors elsewhere must not be charged again. Adding the second right later, or re-saving settings
+that already have one on, is a zero delta and never blocks.
 
 ## Accepted risks
 
+- A builder raw app may declare `frontend_sdk_scopes`, and `mint_raw_app_sdk_token` mints as the
+  *viewer*. A consenting admin therefore hands the bundle a 12h admin-identity token within the
+  curated scope list. The viewer consent prompt is the gate, shown by the editor preview as well
+  as the deployed app, before any token is minted. The lever, if this is ever revisited,
+  is dropping `variables:read` / `resources:read` / `jobs:run` from `FRONTEND_SDK_ALLOWED_SCOPES`
+  for builder apps.
+- The raw-app editor preview runs an app's runnables as whoever has the editor open, where the
+  deployed app runs them as its publisher. An admin opening a builder's app in the editor lets its
+  frontend code run, with the admin's rights, any runnable the builder can read. Running as the
+  draft's author instead would need a preview that ignores unsaved edits to the runnable list.
+- A builder may make an app public (`ExecutionMode::Anonymous`): anyone with the URL runs the
+  runnables its policy names, as the builder. Refusing it is the workspace's call, through the
+  `RestrictAnonymousAppDeployment` protection rule. A `Guest` app is the same with a login in
+  front: anyone the instance's identity provider admits, member or not, once guest access is
+  enabled. `RestrictGuestAppDeployment` refuses it.
+- A builder raw app may set `allow_user_resources` on a runnable's inputs, and the bundle picks the
+  `$res:` path it sends. `build_args` resolves that path as the *viewer*, with no prompt, into a
+  job that runs as the builder. Getting a value out takes a guessable path and a readable script
+  that returns, logs or sends its input. Developers can do the same; the lever is refusing a
+  non-empty `allow_user_resources` (and `s3_inputs[].allow_user_resources`) for builders.
+- A builder's delete or settings-only update reads the app's kind before the write, not under a
+  lock held through it. An admin converting that app to low-code in between lets the builder's
+  request land on the low-code app; the builder already has write access to its path.
+- A builder's draft carries no run identity other than the builder's own, and deploying one that
+  carries none makes the deployer its run identity, as any deploy does. An admin deploying such a
+  draft, from the editor or Compare & Deploy, therefore publishes the builder's code running as
+  that admin; the deploy is the admin's explicit act, as it is for a developer's draft.
 - All-or-nothing per workspace: there is no per-user builder role.
 - `operator_settings` is git-synced, so a pull can flip every operator's class in a workspace and
   the billed seat count with it.
diff --git a/docs/pipeline-local-dev.md b/docs/pipeline-local-dev.md
index e05acec9f0..fb8d49b296 100644
--- a/docs/pipeline-local-dev.md
+++ b/docs/pipeline-local-dev.md
@@ -69,7 +69,7 @@ makes the client own the whole cascade so the backend dispatcher never double-fi
 - `frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts` — reusable run primitives
   (`makeLaunch`, `makeWaitJobTerminal`, `runDownstreamCascade`, `runBoundedCascade`) wrapping
   `cascadeOrchestrator` + `graphTraversal`.
-- `frontend/src/lib/components/assets/AssetGraph/PipelineDevView.svelte` + `frontend/src/routes/pipeline_dev/+page.svelte`.
+- `frontend/src/lib/components/assets/AssetGraph/PipelineDevView.svelte` + `frontend/src/routes/(styled)/pipeline_dev/+page.svelte`.
 
 **Modified**
 - `cli/src/commands/pipeline/pipeline.ts` — `--local` on `show`/`run`; `show` split into graph
diff --git a/flake.nix b/flake.nix
index f005644e3d..2a1d2699c8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -78,15 +78,16 @@
         ];
 
         # ---------------------------------------------------------------
-        # Prebuilt V8 binary (must match version in Cargo.toml)
+        # Prebuilt V8 binary (must match the `v8` pin in backend/Cargo.toml).
+        # The simdutf variant: deno_core enables that feature of the v8 crate.
         # ---------------------------------------------------------------
 
         rustyV8Archive = let
-          version = "137.1.0";
+          version = "150.4.0";
           target = stdenv.hostPlatform.rust.rustcTarget;
           sha256 = {
             x86_64-linux =
-              "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
+              "sha256-9IdiyhDR8fxgWkQcWuQw7Izh6egPFNePvELLh4wwtHY=";
             aarch64-linux = lib.fakeHash;
             x86_64-darwin = lib.fakeHash;
             aarch64-darwin = lib.fakeHash;
@@ -94,7 +95,7 @@
         in pkgs.fetchurl {
           name = "librusty_v8-${version}";
           url =
-            "https://github.com/denoland/rusty_v8/releases/download/v${version}/librusty_v8_release_${target}.a.gz";
+            "https://github.com/denoland/rusty_v8/releases/download/v${version}/librusty_v8_simdutf_release_${target}.a.gz";
           inherit sha256;
         };
 
diff --git a/frontend/e2e/global-setup.ts b/frontend/e2e/global-setup.ts
index db27741a5a..6d10c53d92 100644
--- a/frontend/e2e/global-setup.ts
+++ b/frontend/e2e/global-setup.ts
@@ -47,18 +47,10 @@ async function globalSetup(config: FullConfig) {
 	await page.waitForURL('**/')
 
 	if (!process.env.SKIP_HUB_SYNC) {
-		await page.locator('#home-search-input').waitFor({ state: 'visible' })
-		await page.locator('#home-search-input').fill('u/admin/hub_sync')
-
-		const hubSyncBtn = page.locator('text=u/admin/hub_sync').first()
-		await hubSyncBtn.waitFor({ state: 'visible' })
-		await hubSyncBtn.click()
-
-		const runBtn = page.locator('#run-form-run-button')
-		await runBtn.waitFor({ state: 'visible' })
-		await runBtn.click()
-		await page.waitForURL(/\/run\/.+/)
-		await page.locator('text=Success').waitFor({ timeout: 30000, state: 'visible' })
+		const res = await page.request.post(`${baseURL}/api/settings/sync_cached_resource_types`)
+		if (!res.ok()) {
+			throw new Error(`Resource type sync failed: ${await res.text()}`)
+		}
 	}
 	// Save the authenticated state
 	await context.storageState({ path: './e2e/auth.json' })
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 12227052a2..c8250f9eca 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.821.0",
+	"version": "1.830.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.821.0",
+			"version": "1.830.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
@@ -20,6 +20,7 @@
 				"@codingame/monaco-vscode-standalone-languages": "=25.0.0",
 				"@codingame/monaco-vscode-standalone-typescript-language-features": "=25.0.0",
 				"@floating-ui/core": "^1.3.1",
+				"@jitl/quickjs-wasmfile-release-sync": "^0.32.0",
 				"@json2csv/plainjs": "^7.0.6",
 				"@leeoniya/ufuzzy": "^1.0.8",
 				"@melt-ui/svelte": "^0.86.2",
@@ -60,7 +61,6 @@
 				"mdast-util-find-and-replace": "^3.0.2",
 				"mermaid": "^11.16.1",
 				"minimatch": "^10.2.3",
-				"modern-screenshot": "^4.7.0",
 				"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 				"monaco-languageclient": "10.6.0",
 				"monaco-vim": "^0.4.1",
@@ -70,6 +70,7 @@
 				"p-limit": "^6.1.0",
 				"panzoom": "^9.4.3",
 				"pdfjs-dist": "4.8.69",
+				"quickjs-emscripten-core": "^0.32.0",
 				"quicktype-core": "^23.2.6",
 				"quill": "^2.0.3",
 				"rehype-github-alerts": "^3.0.0",
@@ -1431,6 +1432,21 @@
 				"node": ">=18.0.0"
 			}
 		},
+		"node_modules/@jitl/quickjs-ffi-types": {
+			"version": "0.32.0",
+			"resolved": "https://registry.npmjs.org/@jitl/quickjs-ffi-types/-/quickjs-ffi-types-0.32.0.tgz",
+			"integrity": "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg==",
+			"license": "MIT"
+		},
+		"node_modules/@jitl/quickjs-wasmfile-release-sync": {
+			"version": "0.32.0",
+			"resolved": "https://registry.npmjs.org/@jitl/quickjs-wasmfile-release-sync/-/quickjs-wasmfile-release-sync-0.32.0.tgz",
+			"integrity": "sha512-BKNDI/TPBfGlLNGYpLrhcDGXmIk4xHm4MRAisOBnOzpXVn9HZWsfmMAc9WMBrAHjvvds6HOikKeaOBKdPdpVrg==",
+			"license": "MIT",
+			"dependencies": {
+				"@jitl/quickjs-ffi-types": "0.32.0"
+			}
+		},
 		"node_modules/@jridgewell/gen-mapping": {
 			"version": "0.3.13",
 			"resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -9640,12 +9656,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/modern-screenshot": {
-			"version": "4.7.0",
-			"resolved": "https://registry.npmjs.org/modern-screenshot/-/modern-screenshot-4.7.0.tgz",
-			"integrity": "sha512-9YxN+ddPSMMlhylOv25VHzXrl9u67QRxoh7+SEewGtgUw7t6hHTrjptSDJUSne9oG4Xk/h2cwG15nIt4Hc9ujg==",
-			"license": "MIT"
-		},
 		"node_modules/monaco-editor": {
 			"name": "@codingame/monaco-vscode-editor-api",
 			"version": "25.0.0",
@@ -11432,6 +11442,15 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/quickjs-emscripten-core": {
+			"version": "0.32.0",
+			"resolved": "https://registry.npmjs.org/quickjs-emscripten-core/-/quickjs-emscripten-core-0.32.0.tgz",
+			"integrity": "sha512-QFnPfjFey8EqknSrSxe1hZrf1/8z7/6s1QzGOmKo6++02r7QRRX7ZoyNaZh7JuVjWsVW87KnQrbZqnHkOAzUyg==",
+			"license": "MIT",
+			"dependencies": {
+				"@jitl/quickjs-ffi-types": "0.32.0"
+			}
+		},
 		"node_modules/quickselect": {
 			"version": "2.0.0",
 			"resolved": "https://registry.npmjs.org/quickselect/-/quickselect-2.0.0.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index 13602b01f9..ddfc6b410b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.821.0",
+	"version": "1.830.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
@@ -86,6 +86,7 @@
 		"@codingame/monaco-vscode-standalone-languages": "=25.0.0",
 		"@codingame/monaco-vscode-standalone-typescript-language-features": "=25.0.0",
 		"@floating-ui/core": "^1.3.1",
+		"@jitl/quickjs-wasmfile-release-sync": "^0.32.0",
 		"@json2csv/plainjs": "^7.0.6",
 		"@leeoniya/ufuzzy": "^1.0.8",
 		"@melt-ui/svelte": "^0.86.2",
@@ -126,7 +127,6 @@
 		"mdast-util-find-and-replace": "^3.0.2",
 		"mermaid": "^11.16.1",
 		"minimatch": "^10.2.3",
-		"modern-screenshot": "^4.7.0",
 		"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 		"monaco-languageclient": "10.6.0",
 		"monaco-vim": "^0.4.1",
@@ -136,6 +136,7 @@
 		"p-limit": "^6.1.0",
 		"panzoom": "^9.4.3",
 		"pdfjs-dist": "4.8.69",
+		"quickjs-emscripten-core": "^0.32.0",
 		"quicktype-core": "^23.2.6",
 		"quill": "^2.0.3",
 		"rehype-github-alerts": "^3.0.0",
diff --git a/frontend/scripts/dev-supervisor.mjs b/frontend/scripts/dev-supervisor.mjs
index 4a2c92e1a0..9dc7248d9f 100644
--- a/frontend/scripts/dev-supervisor.mjs
+++ b/frontend/scripts/dev-supervisor.mjs
@@ -339,8 +339,12 @@ class Target {
 					client.destroy()
 					upstream.destroy()
 				}
+				// An upstream close must not destroy the client: `destroy` drops bytes still queued
+				// toward a slow client, truncating the response body. `pipe` already ends the client
+				// once those bytes are flushed.
 				upstream.on('error', teardown)
-				upstream.on('close', teardown)
+				client.on('error', teardown)
+				upstream.on('close', () => this.liveSockets.delete(client))
 				client.on('close', teardown)
 			},
 			(err) => {
diff --git a/frontend/scripts/fix-svelte-module-imports.js b/frontend/scripts/fix-svelte-module-imports.js
index 9cec6265a0..fe4fde4959 100644
--- a/frontend/scripts/fix-svelte-module-imports.js
+++ b/frontend/scripts/fix-svelte-module-imports.js
@@ -16,9 +16,22 @@
 //    tarball. Copy the registry into the package and rewrite those imports
 //    to point at it (mirrors how package-system-prompts.js bundles
 //    `$system_prompts`).
+//
+// 3. Chat SDK: the `windmill-chat` alias (svelte.config.js) points at
+//    `chat-sdk/src/index.ts`, which escapes the package root the same way.
+//    Compile that entry point into the package and rewrite those imports.
+//
+// 4. `$lib/utils` from inside `utils/`: svelte-package turns it into `./`,
+//    which is the `utils/` directory (no index) rather than `utils.js`.
+//    Point a directory specifier with no index at its sibling module.
+//
+// A relative import that still escapes the package root, or an
+// `import.meta.glob` left on an alias, fails the build: either one
+// publishes fine and only breaks in the consumer's bundler.
+import { execFileSync } from 'child_process'
 import { copyFileSync, existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'fs'
 import { fileURLToPath } from 'url'
-import { dirname, join, relative, resolve } from 'path'
+import { dirname, join, relative, resolve, sep } from 'path'
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = dirname(__filename)
@@ -29,8 +42,37 @@ const oauthConnectDest = join(packageDir, 'oauth_connect.json')
 
 copyFileSync(oauthConnectSrc, oauthConnectDest)
 
-const IMPORT_SPECIFIER_RE = /(\bfrom\s*|\bimport\s*\(?\s*)(['"])(\.\.?\/[^'"]*\.(?:svelte|json))\2/g
+const chatSdkSrc = resolve(__dirname, '..', '..', 'chat-sdk', 'src', 'index.ts')
+const chatSdkDest = join(packageDir, 'chat-sdk')
+
+// File arguments make tsc ignore every tsconfig and emit only what the entry
+// point reaches, which leaves out the React and AI SDK adapters.
+execFileSync(
+	'npx',
+	[
+		'tsc',
+		chatSdkSrc,
+		'--outDir',
+		chatSdkDest,
+		'--rootDir',
+		dirname(chatSdkSrc),
+		'--declaration',
+		'--target',
+		'ES2021',
+		'--module',
+		'ESNext',
+		'--moduleResolution',
+		'bundler',
+		'--skipLibCheck'
+	],
+	{ stdio: 'inherit', cwd: resolve(__dirname, '..') }
+)
+
+const IMPORT_SPECIFIER_RE = /(\bfrom\s*|\bimport\s*\(?\s*)(['"])(\.\.?(?:\/[^'"]*)?)\2/g
 const OAUTH_CONNECT_RE = /^(\.\.\/)+backend\/oauth_connect\.json$/
+const CHAT_SDK_RE = /^(\.\.\/)+chat-sdk\/src\/index\.ts$/
+const DIRECTORY_RE = /(^|\/)\.\.?$|\/$/
+const ALIASED_GLOB_RE = /import\.meta\.glob(?:<[^>]*>)?\(\s*\[?\s*['"]\$/
 
 function* walk(dir) {
 	for (const entry of readdirSync(dir)) {
@@ -50,9 +92,13 @@ function relativeSpecifier(fromFile, toFile) {
 
 let rewrittenFiles = 0
 let rewrittenImports = 0
+const unresolvable = []
 
 for (const file of walk(packageDir)) {
 	const content = readFileSync(file, 'utf-8')
+	if (ALIASED_GLOB_RE.test(content)) {
+		unresolvable.push(`${relative(packageDir, file)}: import.meta.glob on an alias`)
+	}
 	let changed = false
 	const updated = content.replace(IMPORT_SPECIFIER_RE, (match, prefix, quote, specifier) => {
 		if (OAUTH_CONNECT_RE.test(specifier)) {
@@ -60,10 +106,27 @@ for (const file of walk(packageDir)) {
 			rewrittenImports++
 			return `${prefix}${quote}${relativeSpecifier(file, oauthConnectDest)}${quote}`
 		}
+		if (CHAT_SDK_RE.test(specifier)) {
+			changed = true
+			rewrittenImports++
+			return `${prefix}${quote}${relativeSpecifier(file, join(chatSdkDest, 'index.js'))}${quote}`
+		}
+		const target = resolve(dirname(file), specifier)
+		if (target !== packageDir && !target.startsWith(packageDir + sep)) {
+			unresolvable.push(`${relative(packageDir, file)}: ${specifier}`)
+			return match
+		}
+		if (DIRECTORY_RE.test(specifier)) {
+			if (!existsSync(join(target, 'index.js')) && existsSync(target + '.js')) {
+				changed = true
+				rewrittenImports++
+				return `${prefix}${quote}${relativeSpecifier(file, target + '.js')}${quote}`
+			}
+			return match
+		}
 		if (!specifier.endsWith('.svelte')) {
 			return match
 		}
-		const target = resolve(dirname(file), specifier)
 		// A real `.svelte` component file: leave the import alone.
 		if (existsSync(target)) {
 			return match
@@ -82,6 +145,14 @@ for (const file of walk(packageDir)) {
 	}
 }
 
+if (unresolvable.length > 0) {
+	console.error(
+		`fix-svelte-module-imports: ${unresolvable.length} import(s) a consumer cannot resolve:\n` +
+			unresolvable.join('\n')
+	)
+	process.exit(1)
+}
+
 console.log(
 	`fix-svelte-module-imports: rewrote ${rewrittenImports} import(s) in ${rewrittenFiles} file(s)`
 )
diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index 8940f265ce..c82e327126 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "9fddc52",
-	"sha256": "b45558951f3d4c9dce7b88b5139d66b0f5f01fe561a22efcb0b8400a13240522"
+	"version": "d3fdb70",
+	"sha256": "8c894b3f02d5d1872a966c37d43314f05ce42900f7330bdcf45a18a772deb2b9"
 }
diff --git a/frontend/src/app.html b/frontend/src/app.html
index aad967fd91..3c9e232e0f 100644
--- a/frontend/src/app.html
+++ b/frontend/src/app.html
@@ -12,6 +12,17 @@
 				fill: #3b82f6;
 			}
 
+			/* Public app pages render their shell before app.css loads, if at all. */
+			html[data-wm-public-app] #svelte-global-loader {
+				display: none;
+			}
+			html[data-wm-public-app] body {
+				margin: 0;
+			}
+			html[data-wm-public-app='dark'] body {
+				background-color: #3b4252;
+			}
+
 			/* Background color for dark mode */
 			@media (prefers-color-scheme: dark) {
 				#mainbg {
@@ -123,6 +134,64 @@
 				}
 			})()
 		</script>
+		<script>
+			// Public app pages (`/public/<ws>/<secret>`, `/a/<custom path>`): skip the loading
+			// screen, and start the API calls the page makes first so they overlap the module
+			// download instead of following it. `publicAppApi.ts` takes these responses by URL,
+			// so each URL here must be exactly what it requests. Only the cookie credential is
+			// prefetched: a share link carrying a JWT, or the opaque viewer frame (`wm_embed`),
+			// sends its own and fetches normally. The bundle of an unsandboxed raw app is
+			// requested as soon as its secret is known, for the iframe to find in the HTTP cache.
+			;(function () {
+				var path = location.pathname
+				var pub = /^\/public\/([^/]+)\/([^/]+)\/?$/.exec(path)
+				var custom = /^\/a\/(.+?)\/?$/.exec(path)
+				if (!pub && !custom && !/^\/public\//.test(path)) return
+				// Dark as PublicApp decides it, painted before any stylesheet so that a dark app
+				// does not load over a white page.
+				var dark = false
+				try {
+					var mode = localStorage.getItem('dark-mode')
+					dark = mode ? mode === 'dark' : matchMedia('(prefers-color-scheme: dark)').matches
+				} catch (_) {}
+				document.documentElement.setAttribute('data-wm-public-app', dark ? 'dark' : '')
+				if (new URLSearchParams(location.search).get('wm_embed') === '1') return
+				var prefetched = (window.__wmPublicAppPrefetch = {})
+				function get(url) {
+					var res = fetch(url)
+					res.catch(function () {})
+					prefetched[url] = res
+					return res
+				}
+				function warmBundle(appRes, workspace) {
+					appRes
+						.then(function (r) {
+							return r.ok ? r.clone().json() : null
+						})
+						.then(function (app) {
+							if (!app || !app.raw_app || !app.bundle_secret || (app.policy || {}).sandbox) return
+							var ws = workspace || app.workspace_id
+							var v = '/api/w/' + ws + '/apps_u/get_data/v/' + app.bundle_secret
+							fetch(v + '.css').catch(function () {})
+							fetch(v + '.js').catch(function () {})
+						})
+						.catch(function () {})
+				}
+				if (pub) {
+					var w = '/api/w/' + pub[1]
+					get(w + '/apps_u/embed_token/' + pub[2])
+					warmBundle(get(w + '/apps_u/public_app/' + pub[2]), pub[1])
+					get(w + '/apps_u/guest_entry/' + pub[2])
+					get(w + '/users/whoami')
+				} else if (custom && custom[1].indexOf('.') === -1) {
+					// A `.` marks a trailing JWT segment, which no custom path contains.
+					get('/api/apps_u/embed_token_by_custom_path/' + custom[1])
+					warmBundle(get('/api/apps_u/public_app_by_custom_path/' + custom[1]))
+					get('/api/apps_u/guest_entry_by_custom_path/' + custom[1])
+				}
+				get('/api/ee_license')
+			})()
+		</script>
 		%sveltekit.head%
 	</head>
 	<body data-sveltekit-preload-code="viewport" class="outline-none focus:outline-none">
diff --git a/frontend/src/lib/apiBaseUrl.svelte.ts b/frontend/src/lib/apiBaseUrl.svelte.ts
new file mode 100644
index 0000000000..242a6aa9e0
--- /dev/null
+++ b/frontend/src/lib/apiBaseUrl.svelte.ts
@@ -0,0 +1,21 @@
+import { fromStore } from 'svelte/store'
+import { instanceUi } from '$lib/instanceUi'
+
+const ui = fromStore(instanceUi)
+
+/**
+ * Base of every URL shown for an external client to call (webhooks, HTTP routes, push
+ * trigger endpoints, the CLI remote): the `api_base_url` instance setting, else the
+ * origin being browsed. Append `/api/...` to it.
+ *
+ * Not for URLs the editor itself calls or opens (captures, previews, OAuth popups, links
+ * to pages): those must stay on the browsing origin, where the session cookie lives.
+ *
+ * Reactive: the setting lands after page load, so read it inside a `$derived` or the
+ * template rather than caching the result.
+ */
+export function apiBaseUrl(): string {
+	const setting = ui.current?.api_base_url
+	const configured = typeof setting === 'string' ? setting.trim() : ''
+	return configured || window.location.origin
+}
diff --git a/frontend/src/lib/base.ts b/frontend/src/lib/base.ts
deleted file mode 100644
index 0e8f2d71f6..0000000000
--- a/frontend/src/lib/base.ts
+++ /dev/null
@@ -1 +0,0 @@
-export let base: string = import.meta.env.VITE_BASE_URL ?? ''
diff --git a/frontend/src/lib/components/AIProviderPicker.svelte b/frontend/src/lib/components/AIProviderPicker.svelte
index f69bb6e8f4..67afad9be6 100644
--- a/frontend/src/lib/components/AIProviderPicker.svelte
+++ b/frontend/src/lib/components/AIProviderPicker.svelte
@@ -1,7 +1,12 @@
 <script lang="ts">
-	import { type Snippet } from 'svelte'
+	import { type Snippet, untrack } from 'svelte'
 	import Select from './select/Select.svelte'
-	import { fetchAvailableModels, AI_PROVIDERS } from './copilot/lib'
+	import {
+		fetchAvailableModels,
+		AI_PROVIDERS,
+		DECISION_AI_PROVIDERS,
+		aiProviderDetails
+	} from './copilot/lib'
 	import type { AIProvider, ProviderConfig } from '$lib/gen'
 	import ResourcePicker from './ResourcePicker.svelte'
 	import Toggle from './Toggle.svelte'
@@ -19,13 +24,17 @@
 		 *  other than the one being navigated. Resources and the models read off them are per
 		 *  workspace, so without it this offers what the wrong one holds. */
 		workspace?: string | undefined
+		/** Offer the decision providers (TypeSafe, Cloudflare, OpenAI) and their decision models in
+		 *  place of the chat ones, for an AI decision. */
+		decision?: boolean
 	}
 
 	let {
 		value: _uncheckedValue = $bindable(),
 		disabled = false,
 		actions,
-		workspace = undefined
+		workspace = undefined,
+		decision = false
 	}: Props = $props()
 
 	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
@@ -44,12 +53,15 @@
 	let modelsCache = new Map<string, string[]>()
 
 	// The resource picker offers every provider type at once and the pick is what names the kind.
-	// One string for the component's life: it is what the picker queries with.
-	const providerResourceTypes = Object.keys(AI_PROVIDERS).join(',')
+	// One list for the component's life: it is what the picker queries with.
+	const offeredProviders = Object.keys(
+		untrack(() => decision) ? DECISION_AI_PROVIDERS : AI_PROVIDERS
+	)
+	const providerResourceTypes = offeredProviders.join(',')
 
 	if (!_uncheckedValue) {
 		_uncheckedValue = {
-			kind: 'openai',
+			kind: untrack(() => decision) ? 'typesafe' : 'openai',
 			resource: '',
 			model: ''
 		}
@@ -72,6 +84,15 @@
 		return r
 	})
 
+	// A decision provider's models are the ones Windmill knows: none has a listing of its decision
+	// models, and an OpenAI resource's lists its chat models.
+	function defaultModels(provider: AIProvider): string[] {
+		return decision
+			? ((DECISION_AI_PROVIDERS as Record<string, { defaultModels: string[] }>)[provider]
+					?.defaultModels ?? [])
+			: aiProviderDetails(provider).defaultModels
+	}
+
 	async function loadModels(signal?: AbortSignal) {
 		const provider = value?.kind
 		const resourceValue = value?.resource
@@ -80,6 +101,11 @@
 		if (!provider || !resourcePath) {
 			return
 		}
+		if (decision) {
+			availableModels = defaultModels(provider)
+			loading = false
+			return
+		}
 
 		loading = true
 		const cacheKey = `${effectiveWorkspace}:${provider}:${resourcePath}`
@@ -101,8 +127,7 @@
 				return
 			}
 			// Fall back to default models for this provider
-			const defaultModels = AI_PROVIDERS[provider]?.defaultModels || []
-			availableModels = defaultModels
+			availableModels = defaultModels(provider)
 		} finally {
 			if (!signal?.aborted) {
 				loading = false
@@ -118,7 +143,7 @@
 	function onResourcePicked(_path: string | undefined, type: string | undefined) {
 		// An empty type is the placeholder the picker keeps for a saved path it could not find. It
 		// says nothing about the provider, so the kind stands.
-		if (!value || !type || !(type in AI_PROVIDERS)) {
+		if (!value || !type || !offeredProviders.includes(type)) {
 			return
 		}
 		if (value.kind === type) {
@@ -166,8 +191,7 @@
 		if (provider && resourcePath) {
 			loadModels(abortController.signal)
 		} else {
-			const defaultModels = provider ? AI_PROVIDERS[provider]?.defaultModels || [] : []
-			availableModels = defaultModels
+			availableModels = provider ? defaultModels(provider) : []
 			loading = false
 		}
 
@@ -226,7 +250,7 @@
 		/>
 	</div>
 
-	{#if value?.model}
+	{#if value?.model && !decision}
 		<div class="flex flex-col gap-1">
 			<span class="text-xs font-normal text-secondary">Reasoning effort</span>
 			<AIReasoningEffortPicker
@@ -237,21 +261,24 @@
 		</div>
 	{/if}
 
-	<div class="flex justify-end">
-		<Toggle
-			disabled={disabled || !value?.kind || !value?.resource || !value?.model}
-			bind:checked={useAsDefault}
-			options={{ right: 'Use as personal default for other new agents' }}
-			size="xs"
-			on:change={(e) => {
-				if (!e.detail) {
-					removeConfig()
-				} else {
-					saveConfig(value)
-				}
-			}}
-		/>
-	</div>
+	<!-- The default seeds new agents, which a decision provider cannot run. -->
+	{#if !decision}
+		<div class="flex justify-end">
+			<Toggle
+				disabled={disabled || !value?.kind || !value?.resource || !value?.model}
+				bind:checked={useAsDefault}
+				options={{ right: 'Use as personal default for other new agents' }}
+				size="xs"
+				on:change={(e) => {
+					if (!e.detail) {
+						removeConfig()
+					} else {
+						saveConfig(value)
+					}
+				}}
+			/>
+		</div>
+	{/if}
 
 	{@render actions?.()}
 </div>
diff --git a/frontend/src/lib/components/AgentTrace.svelte b/frontend/src/lib/components/AgentTrace.svelte
index 7f2a90e621..3d671f46c8 100644
--- a/frontend/src/lib/components/AgentTrace.svelte
+++ b/frontend/src/lib/components/AgentTrace.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { ExternalLink, Globe } from 'lucide-svelte'
 	import { JobService, type Job } from '$lib/gen'
-	import { base } from '$lib/base'
 	import { msToReadableTimeShort } from '$lib/utils'
 	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
 	import ToolContentDisplay from './copilot/chat/ToolContentDisplay.svelte'
@@ -141,7 +140,7 @@
 				{:else if entry.jobId}
 					<a
 						class="text-2xs text-accent inline-flex items-center gap-1 w-fit hover:underline"
-						href="{base}/run/{entry.jobId}?workspace={workspaceId ?? $operatingWorkspace}"
+						href="/run/{entry.jobId}?workspace={workspaceId ?? $operatingWorkspace}"
 						target="_blank"
 						rel="noreferrer"
 					>
diff --git a/frontend/src/lib/components/AiDecisionQuestionsEditor.svelte b/frontend/src/lib/components/AiDecisionQuestionsEditor.svelte
new file mode 100644
index 0000000000..24df43af6d
--- /dev/null
+++ b/frontend/src/lib/components/AiDecisionQuestionsEditor.svelte
@@ -0,0 +1,323 @@
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import { Plus, Trash2, X } from 'lucide-svelte'
+	import { Button } from './common'
+	import TextInput from './text_input/TextInput.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import Toggle from './Toggle.svelte'
+	import {
+		branchableQuestions,
+		emptyQuestion,
+		optionNameError,
+		questionNameError,
+		questionsFitRows,
+		questionsToRows,
+		rowsToQuestions,
+		type DecisionQuestionType,
+		type QuestionRow
+	} from './flows/aiDecisionQuestions'
+	import { getAiDecisionStep } from './flows/aiDecisionBranching'
+	import AiDecisionQuestionRouting from './flows/content/AiDecisionQuestionRouting.svelte'
+
+	interface Props {
+		value: any
+		disabled?: boolean
+		onModeChange?: (mode: 'form' | 'json') => void
+	}
+
+	let { value = $bindable(), disabled = false, onModeChange }: Props = $props()
+
+	const decisionStep = getAiDecisionStep()
+
+	// Whether the cards can hold the value: TypeSafe also takes structured instructions and
+	// descriptions, which the cards would flatten to text, so such questions stay in JSON.
+	let fitsRows = $state(questionsFitRows(untrack(() => value)))
+	let mode: 'form' | 'json' = $state(untrack(() => fitsRows) ? 'form' : 'json')
+	$effect(() => onModeChange?.(mode))
+	let jsonCode = $state(
+		JSON.stringify(
+			untrack(() => value),
+			null,
+			2
+		)
+	)
+	// The code editor reads `code` only when it is created, so a replaced value recreates it.
+	let jsonEditorKey = $state(0)
+
+	let rows: QuestionRow[] = $state(questionsToRows(untrack(() => value)))
+	// What the rows last wrote or were read from. Rows hold drafts the value leaves out (an unnamed
+	// question), so only an edit writes; opening the editor leaves the stored value untouched.
+	let synced = JSON.stringify(rowsToQuestions(untrack(() => rows)))
+	let written = JSON.stringify(untrack(() => value) ?? {})
+
+	function readRows() {
+		rows = questionsToRows(value)
+		synced = JSON.stringify(rowsToQuestions(rows))
+	}
+
+	function readJson() {
+		jsonCode = JSON.stringify(value, null, 2)
+		jsonEditorKey++
+	}
+
+	$effect(() => {
+		const questions = rowsToQuestions(rows)
+		const json = JSON.stringify(questions)
+		untrack(() => {
+			if (mode === 'form' && json !== synced) {
+				synced = json
+				written = json
+				value = questions
+			}
+		})
+	})
+
+	// A value replaced from elsewhere (an undo, the AI chat) is read into both views, and moves the
+	// editor to JSON when the cards cannot hold it.
+	$effect(() => {
+		const json = JSON.stringify(value ?? {})
+		untrack(() => {
+			if (json !== written) {
+				written = json
+				fitsRows = questionsFitRows(value)
+				if (!fitsRows) mode = 'json'
+				readJson()
+				readRows()
+			}
+		})
+	})
+
+	function switchTo(next: 'form' | 'json') {
+		if (next === mode || (next === 'form' && !fitsRows)) return
+		if (next === 'form') readRows()
+		else readJson()
+		mode = next
+	}
+
+	function addQuestion() {
+		let i = rows.length + 1
+		while (rows.some((r) => r.name === `question_${i}`)) i++
+		rows.push(emptyQuestion(`question_${i}`))
+	}
+
+	const TYPES: { value: DecisionQuestionType; label: string }[] = [
+		{ value: 'choice', label: 'Choice' },
+		{ value: 'score', label: 'Score' },
+		{ value: 'noul', label: 'Yes/no' }
+	]
+</script>
+
+{#snippet label(text: string)}
+	<span class="text-xs font-semibold text-emphasis">{text}</span>
+{/snippet}
+
+{#snippet error(text: string | undefined)}
+	{#if text}
+		<span class="text-2xs text-red-600 dark:text-red-400">{text}</span>
+	{/if}
+{/snippet}
+
+<div class="flex flex-col gap-2 w-full">
+	<div class="flex justify-end">
+		<Toggle
+			size="xs"
+			lightMode
+			disabled={disabled || !fitsRows}
+			checked={mode === 'json'}
+			options={{
+				right: 'JSON',
+				rightTooltip: fitsRows
+					? 'Edit the questions as JSON'
+					: 'These questions use structured instructions or descriptions, which only JSON can show'
+			}}
+			on:change={(e) => switchTo(e.detail ? 'json' : 'form')}
+		/>
+	</div>
+	{#if mode === 'json'}
+		<div class="w-full">
+			{#key jsonEditorKey}
+				{#await import('./JsonEditor.svelte') then Module}
+					<Module.default
+						bind:code={jsonCode}
+						{disabled}
+						on:changeValue={(e) => {
+							written = JSON.stringify(e.detail ?? {})
+							fitsRows = questionsFitRows(e.detail)
+							value = e.detail
+						}}
+					/>
+				{/await}
+			{/key}
+		</div>
+		{#if decisionStep?.id}
+			{@const id = decisionStep.id}
+			{#each branchableQuestions(value) as q (q.name)}
+				<AiDecisionQuestionRouting decisionId={id} question={q.name} named />
+			{/each}
+		{/if}
+	{:else}
+		<div class="flex flex-col gap-3 w-full">
+			{#each rows as row, i (i)}
+				<div class="flex flex-col gap-3 rounded-md bg-surface-tertiary p-3 shadow-sm">
+					<div class="flex items-start gap-2">
+						<div class="flex flex-col gap-1 grow">
+							{@render label('Name')}
+							<TextInput
+								size="sm"
+								bind:value={row.name}
+								error={questionNameError(rows, i)}
+								inputProps={{ disabled, placeholder: 'intent' }}
+							/>
+							{@render error(questionNameError(rows, i))}
+						</div>
+						<div class="flex flex-col gap-1">
+							{@render label('Answer')}
+							<ToggleButtonGroup
+								noWFull
+								{disabled}
+								selected={row.type}
+								onSelected={(v) => (row.type = v as DecisionQuestionType)}
+							>
+								{#snippet children({ item })}
+									{#each TYPES as t (t.value)}
+										<ToggleButton value={t.value} label={t.label} {item} small />
+									{/each}
+								{/snippet}
+							</ToggleButtonGroup>
+						</div>
+						<div class="pt-5">
+							<Button
+								variant="subtle"
+								unifiedSize="sm"
+								destructive
+								iconOnly
+								{disabled}
+								startIcon={{ icon: Trash2 }}
+								title="Delete question"
+								onClick={() => rows.splice(i, 1)}
+							/>
+						</div>
+					</div>
+
+					<div class="flex flex-col gap-1">
+						{@render label('Question')}
+						<TextInput
+							size="sm"
+							underlyingInputEl="textarea"
+							bind:value={row.instructions}
+							autosizeParams={{ minHeight: 0 }}
+							inputProps={{ disabled, placeholder: 'What does the customer want?', rows: 1 }}
+						/>
+					</div>
+
+					{#if row.type === 'choice'}
+						<div class="flex flex-col gap-1">
+							{@render label('Options')}
+							<span class="text-xs text-secondary"
+								>What each option means helps the model choose</span
+							>
+							{#each row.options as option, j (j)}
+								<div class="flex gap-2 items-start">
+									<div class="w-1/3 shrink-0 flex flex-col gap-1">
+										<TextInput
+											size="sm"
+											bind:value={option.name}
+											error={optionNameError(row, j)}
+											inputProps={{ disabled, placeholder: 'refund' }}
+										/>
+										{@render error(optionNameError(row, j))}
+									</div>
+									<TextInput
+										size="sm"
+										bind:value={option.description}
+										inputProps={{ disabled, placeholder: 'What this option means' }}
+									/>
+									<Button
+										variant="subtle"
+										unifiedSize="sm"
+										iconOnly
+										disabled={disabled || row.options.length <= 2}
+										startIcon={{ icon: X }}
+										title="Remove option"
+										onClick={() => row.options.splice(j, 1)}
+									/>
+								</div>
+							{/each}
+							<Button
+								variant="subtle"
+								unifiedSize="sm"
+								wrapperClasses="self-start"
+								{disabled}
+								startIcon={{ icon: Plus }}
+								onClick={() => row.options.push({ name: '', description: '' })}
+							>
+								Add option
+							</Button>
+						</div>
+					{:else if row.type === 'score'}
+						<div class="flex flex-col gap-1">
+							{@render label('Levels')}
+							<span class="text-xs text-secondary">Lowest first</span>
+							{#each row.levels as _, j (j)}
+								<div class="flex gap-2 items-center">
+									<span class="text-xs text-secondary w-4 text-right">{j}</span>
+									<TextInput
+										size="sm"
+										bind:value={row.levels[j]}
+										inputProps={{ disabled, placeholder: j === 0 ? 'Can wait' : 'Right now' }}
+									/>
+									<Button
+										variant="subtle"
+										unifiedSize="sm"
+										iconOnly
+										disabled={disabled || row.levels.length <= 2}
+										startIcon={{ icon: X }}
+										title="Remove level"
+										onClick={() => row.levels.splice(j, 1)}
+									/>
+								</div>
+							{/each}
+							<Button
+								variant="subtle"
+								unifiedSize="sm"
+								wrapperClasses="self-start"
+								disabled={disabled || row.levels.length >= 10}
+								startIcon={{ icon: Plus }}
+								onClick={() => row.levels.push('')}
+							>
+								Add level
+							</Button>
+						</div>
+					{:else}
+						<div class="grid grid-cols-2 gap-2">
+							<div class="flex flex-col gap-1">
+								{@render label('Yes means')}
+								<TextInput size="sm" bind:value={row.yes} inputProps={{ disabled }} />
+								<span class="text-2xs text-hint">Optional</span>
+							</div>
+							<div class="flex flex-col gap-1">
+								{@render label('No means')}
+								<TextInput size="sm" bind:value={row.no} inputProps={{ disabled }} />
+								<span class="text-2xs text-hint">Optional</span>
+							</div>
+						</div>
+					{/if}
+					{#if decisionStep?.id && row.type !== 'score' && row.name.trim()}
+						<AiDecisionQuestionRouting decisionId={decisionStep.id} question={row.name.trim()} />
+					{/if}
+				</div>
+			{/each}
+			<Button
+				variant="default"
+				unifiedSize="sm"
+				wrapperClasses="self-start"
+				{disabled}
+				startIcon={{ icon: Plus }}
+				onClick={addQuestion}
+			>
+				Add question
+			</Button>
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/AppConnectInner.svelte b/frontend/src/lib/components/AppConnectInner.svelte
index bea6023073..56bff89d8f 100644
--- a/frontend/src/lib/components/AppConnectInner.svelte
+++ b/frontend/src/lib/components/AppConnectInner.svelte
@@ -33,7 +33,6 @@
 	import { sendUserToast } from '$lib/toast'
 	import OauthScopes from './OauthScopes.svelte'
 	import autosize from '$lib/autosize'
-	import { base } from '$lib/base'
 	import Required from './Required.svelte'
 	import Toggle from './Toggle.svelte'
 	import { Pen, Search } from 'lucide-svelte'
@@ -1403,7 +1402,7 @@
 						<img
 							class="m-auto max-h-60"
 							alt="connect"
-							src={base + apiTokenApps[resourceType].img}
+							src={apiTokenApps[resourceType].img}
 						/>
 					</div>
 				{/if}
diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index 756b827105..ce64d7d231 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -8,6 +8,7 @@
 		debounce,
 		emptySchema,
 		emptyString,
+		escapeHtml,
 		getSchemaFromProperties,
 		type DynamicInput as DynamicInputTypes
 	} from '$lib/utils'
@@ -40,9 +41,9 @@
 	import MultiSelect from './select/MultiSelect.svelte'
 	import { safeSelectItems } from './select/utils.svelte'
 	import S3ArgInput from './common/fileUpload/S3ArgInput.svelte'
-	import { base } from '$lib/base'
 	import { getJsonSchemaFromResource } from './schema/jsonSchemaResource.svelte'
 	import AIProviderPicker from './AIProviderPicker.svelte'
+	import AiDecisionQuestionsEditor from './AiDecisionQuestionsEditor.svelte'
 	import TextInput from './text_input/TextInput.svelte'
 	import FileInput from './common/fileInput/FileInput.svelte'
 	import { randomUUID } from '$lib/utils/uuid'
@@ -257,6 +258,7 @@
 	// never reaches `value`, so without this the field would stay valid on its last parsed value.
 	let jsonError: string = $state('')
 	let isListJson = $state(false)
+	let questionsInJson = $state(false)
 	let hasIsListJsonChanged = $state(false)
 
 	let el: HTMLTextAreaElement | undefined = $state(undefined)
@@ -606,7 +608,7 @@
 			{#if value && typeof value == 'string' && value?.startsWith('$res:')}
 				Linked to resource <a
 					target="_blank"
-					href="{base}/resources#/resource/{value.slice(5)}"
+					href="/resources#/resource/{value.slice(5)}"
 					class="text-blue-500 underline"
 					>{value.slice(5)} <span class="inline-block -mb-0.5"><ExternalLink size={14} /></span></a
 				>
@@ -698,7 +700,9 @@
 
 	{#if description}
 		<div class={twMerge('text-xs text-secondary', css?.description?.class)}>
-			<pre class="font-main whitespace-normal">{description}</pre>
+			<pre class="font-main whitespace-normal"
+				>{description}{#if inputCat == 'ai-decision-questions' && questionsInJson}{': { <name>: { type: choice | score | noul, instructions, criteria } }'}{/if}</pre
+			>
 		</div>
 	{/if}
 
@@ -1382,6 +1386,7 @@
 							dispatch('blur')
 						}}
 						code={rawValue}
+						placeholder={placeholder && escapeHtml(placeholder)}
 						bind:error={jsonError}
 						on:changeValue={(e) => {
 							setNewValueFromCode(e.detail)
@@ -1484,7 +1489,19 @@
 				{showSchemaExplorer}
 			/>
 		{:else if inputCat == 'ai-provider'}
-			<AIProviderPicker bind:value {disabled} {actions} {workspace} />
+			<AIProviderPicker
+				bind:value
+				{disabled}
+				{actions}
+				{workspace}
+				decision={format === 'ai-decision-provider'}
+			/>
+		{:else if inputCat == 'ai-decision-questions'}
+			<AiDecisionQuestionsEditor
+				bind:value
+				{disabled}
+				onModeChange={(mode) => (questionsInJson = mode === 'json')}
+			/>
 		{:else if inputCat == 'email'}
 			<input
 				{autofocus}
diff --git a/frontend/src/lib/components/AuthSettings.svelte b/frontend/src/lib/components/AuthSettings.svelte
index 7bf7718e49..f211650df2 100644
--- a/frontend/src/lib/components/AuthSettings.svelte
+++ b/frontend/src/lib/components/AuthSettings.svelte
@@ -96,7 +96,8 @@
 		'apify',
 		'docusign',
 		'salesforce',
-		'outreach'
+		'outreach',
+		'notion'
 	]
 	// Providers whose registry entry (`backend/oauth_connect.json`) carries a
 	// `sandbox` URL block. Each one gets a sibling `<name>_sandbox` dropdown
diff --git a/frontend/src/lib/components/AutosaveIndicator.svelte b/frontend/src/lib/components/AutosaveIndicator.svelte
index 76dc030c58..1e318ed9b2 100644
--- a/frontend/src/lib/components/AutosaveIndicator.svelte
+++ b/frontend/src/lib/components/AutosaveIndicator.svelte
@@ -142,7 +142,13 @@
 	let hintTimer: ReturnType<typeof setTimeout> | undefined
 
 	const kindLabel = $derived(
-		itemKind === 'flow' ? 'flow' : itemKind === 'app' || itemKind === 'raw_app' ? 'app' : 'script'
+		itemKind === 'flow'
+			? 'flow'
+			: itemKind === 'app' || itemKind === 'raw_app'
+				? 'app'
+				: itemKind === 'data_pipeline'
+					? 'pipeline'
+					: 'script'
 	)
 
 	// Each false → true transition fires a hint (others > loaded). Seeded to
diff --git a/frontend/src/lib/components/BatchLoadProgress.svelte b/frontend/src/lib/components/BatchLoadProgress.svelte
index 16cf2d7212..a41151b210 100644
--- a/frontend/src/lib/components/BatchLoadProgress.svelte
+++ b/frontend/src/lib/components/BatchLoadProgress.svelte
@@ -6,6 +6,8 @@
 		loaded: number
 		total: number
 		itemsLabel: string
+		/** Replaces the default "Loading … of …" text, for progress that is not a count of items. */
+		label?: string
 		batchSize?: number | null
 		/** Largest batch the caller can fetch in one request, when that is below the page size. */
 		batchSizeCap?: number
@@ -17,6 +19,7 @@
 		loaded,
 		total,
 		itemsLabel,
+		label,
 		batchSize = null,
 		batchSizeCap,
 		onBatchSizeChange,
@@ -30,7 +33,12 @@
 </script>
 
 <div class="flex items-center gap-3 text-xs text-secondary">
-	<span class="whitespace-nowrap shrink-0">Loading {itemsLabel}: {loaded} of {total}...</span>
+	{#if label}
+		<!-- A custom label has no bounded length: it gives way before the bar and Stop do. -->
+		<span class="min-w-0 truncate" title={label}>{label}</span>
+	{:else}
+		<span class="whitespace-nowrap shrink-0">Loading {itemsLabel}: {loaded} of {total}...</span>
+	{/if}
 	<div class="flex-1 min-w-8 bg-surface-hover rounded-full h-1.5">
 		<div
 			class="bg-blue-500 h-1.5 rounded-full transition-all duration-300"
diff --git a/frontend/src/lib/components/BreadcrumbItemContent.svelte b/frontend/src/lib/components/BreadcrumbItemContent.svelte
new file mode 100644
index 0000000000..9e945586c7
--- /dev/null
+++ b/frontend/src/lib/components/BreadcrumbItemContent.svelte
@@ -0,0 +1,16 @@
+<!--
+@component
+The inside of one breadcrumb part: an optional leading icon and the label.
+
+Every part of the header's breadcrumb renders this, whether its dropdown is a melt menu or a
+popover, so they share one look. Separators are the host's job — a part must not contain the
+slash before it, or hovering the part would highlight the separator too.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+
+	let { label, icon }: { label: string; icon?: Snippet } = $props()
+</script>
+
+{@render icon?.()}
+<span class="truncate">{label}</span>
diff --git a/frontend/src/lib/components/BreadcrumbSegment.svelte b/frontend/src/lib/components/BreadcrumbSegment.svelte
index 8a266e4fc4..4d55675f26 100644
--- a/frontend/src/lib/components/BreadcrumbSegment.svelte
+++ b/frontend/src/lib/components/BreadcrumbSegment.svelte
@@ -6,7 +6,7 @@ state — switching popovers relies on melt-ui's `closeOnOtherPopoverOpen` to
 close siblings.
 -->
 <script lang="ts">
-	import { ChevronRight } from 'lucide-svelte'
+	import BreadcrumbItemContent from './BreadcrumbItemContent.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import WorkspaceItemDrillPicker, {
 		type Scope
@@ -15,7 +15,8 @@ close siblings.
 
 	interface Props {
 		label: string
-		withChevron?: boolean
+		/** Leading glyph, e.g. the folder or user a path scope names. */
+		icon?: import('svelte').Snippet
 		extraClass?: string
 		disabled?: boolean
 		/** Where the picker lands when this segment is clicked. */
@@ -33,7 +34,7 @@ close siblings.
 
 	let {
 		label,
-		withChevron = false,
+		icon,
 		extraClass = '',
 		disabled = false,
 		initialScope,
@@ -71,8 +72,7 @@ close siblings.
 	{disabled}
 >
 	{#snippet trigger()}
-		{#if withChevron}<ChevronRight size={10} class="shrink-0" /><span class="truncate">{label}</span
-			>{:else}{label}{/if}
+		<BreadcrumbItemContent {label} {icon} />
 	{/snippet}
 	{#snippet content()}
 		<WorkspaceItemDrillPicker
diff --git a/frontend/src/lib/components/CenteredModal.svelte b/frontend/src/lib/components/CenteredModal.svelte
index 08234c25b1..3e922e73c7 100644
--- a/frontend/src/lib/components/CenteredModal.svelte
+++ b/frontend/src/lib/components/CenteredModal.svelte
@@ -16,6 +16,9 @@
 		containOverflow?: boolean
 		/** The Windmill version and update notice in the header. */
 		showVersion?: boolean
+		/** Set on the pages that render inside the app shell, under the page header: there the
+		 * window is not the card's box, and taking the whole of it pushes 44px past the bottom. */
+		inPage?: boolean
 		children?: import('svelte').Snippet
 	}
 
@@ -28,6 +31,7 @@
 		loading = false,
 		containOverflow = false,
 		showVersion = true,
+		inPage = false,
 		children
 	}: Props = $props()
 
@@ -37,7 +41,9 @@
 </script>
 
 <div
-	class="flex justify-center h-screen p-4 relative bg-surface-secondary {containOverflow
+	class="flex justify-center {inPage
+		? 'h-full'
+		: 'h-screen'} p-4 relative bg-surface-secondary {containOverflow
 		? 'overflow-hidden'
 		: 'overflow-auto'}"
 	class:items-center={centerVertically}
diff --git a/frontend/src/lib/components/CiTestResults.svelte b/frontend/src/lib/components/CiTestResults.svelte
index 82bc81ea19..44888f8a0b 100644
--- a/frontend/src/lib/components/CiTestResults.svelte
+++ b/frontend/src/lib/components/CiTestResults.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { ScriptService, type CiTestResult } from '$lib/gen'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
-	import { base } from '$lib/base'
 	import { CircleCheck, CircleX, Loader2, FlaskConical } from 'lucide-svelte'
 	import { resource } from 'runed'
 
@@ -57,14 +56,14 @@
 						<div class="w-3.5 h-3.5 rounded-full border border-tertiary"></div>
 					{/if}
 					<a
-						href="{base}/scripts/get/{test.test_script_path}?workspace={$operatingWorkspace}"
+						href="/scripts/get/{test.test_script_path}?workspace={$operatingWorkspace}"
 						class="text-secondary hover:text-primary truncate"
 					>
 						{test.test_script_path}
 					</a>
 					{#if test.job_id}
 						<a
-							href="{base}/run/{test.job_id}?workspace={$operatingWorkspace}"
+							href="/run/{test.job_id}?workspace={$operatingWorkspace}"
 							class="text-tertiary hover:text-secondary text-2xs"
 						>
 							view run
diff --git a/frontend/src/lib/components/CliHelpBox.svelte b/frontend/src/lib/components/CliHelpBox.svelte
index 0bee33825c..e91b039328 100644
--- a/frontend/src/lib/components/CliHelpBox.svelte
+++ b/frontend/src/lib/components/CliHelpBox.svelte
@@ -2,10 +2,11 @@
 	import ClipboardPanel from './details/ClipboardPanel.svelte'
 	import Section from './Section.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
 
-	let url = $derived(`${window.location.protocol}//${window.location.hostname}/`)
+	let url = $derived(`${apiBaseUrl()}/`)
 </script>
 
 <Section label="CLI quick setup">
diff --git a/frontend/src/lib/components/CompareWorkspaces.svelte b/frontend/src/lib/components/CompareWorkspaces.svelte
index 375e73480e..18c765e13b 100644
--- a/frontend/src/lib/components/CompareWorkspaces.svelte
+++ b/frontend/src/lib/components/CompareWorkspaces.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
 	import {
 		AlertTriangle,
-		ArrowDownRight,
+		ArrowDown,
 		ArrowRight,
-		ArrowUpRight,
+		ArrowUp,
 		Building,
 		CircleCheck,
 		CircleX,
@@ -16,7 +16,7 @@
 		RefreshCw,
 		UserPlus
 	} from 'lucide-svelte'
-	import { untrack } from 'svelte'
+	import { onDestroy, untrack } from 'svelte'
 	import type { CiTestResult } from '$lib/gen'
 	import { Alert, Badge } from './common'
 	import {
@@ -65,7 +65,6 @@
 	import WorkspaceDeployLayout from './WorkspaceDeployLayout.svelte'
 	import DeploymentRequestPanel from './deploymentRequest/DeploymentRequestPanel.svelte'
 	import { userStore } from '$lib/stores'
-	import { base } from '$lib/base'
 	import CompareModeToggle, { type CompareMode } from './CompareModeToggle.svelte'
 	import CompareTargetPicker from './CompareTargetPicker.svelte'
 	import { displayDate } from '$lib/utils'
@@ -97,6 +96,8 @@
 		onRetry?: () => void
 		onSelectTarget?: (target: string) => void
 		comparison: WorkspaceComparison | undefined
+		/** The comparison is still in flight, so an empty list says nothing yet. */
+		comparisonLoading?: boolean
 		/** Set when the comparison request failed (e.g. not an admin of the target). */
 		comparisonError?: string
 		/** Initial merge direction; lets the page restore the chosen direction when
@@ -144,6 +145,7 @@
 		onRetry,
 		onSelectTarget,
 		comparison,
+		comparisonLoading = false,
 		comparisonError,
 		initialMergeIntoParent = true,
 		deployCount = 0,
@@ -486,6 +488,12 @@
 	// Summary cache: stores summaries from both workspaces
 	type SummaryCache = Record<string, { current?: string; parent?: string; loading?: boolean }>
 	let summaryCache = $state<SummaryCache>({})
+	// What has already been asked for. Deliberately not `$state`: the fetchers below run inside an
+	// effect, and a guard that reads reactive state makes that effect depend on what it writes —
+	// which is a loop. A plain Set is also what tells "asked, and the answer was nothing" from
+	// "never asked", which a value map cannot when the value for both is `undefined`.
+	const summariesRequested = new Set<string>()
+	const onBehalfOfRequested = new Set<string>()
 
 	// On-behalf-of tracking for flows and scripts
 	// Source workspace on_behalf_of emails (keyed by workspace/kind:path)
@@ -499,51 +507,101 @@
 		return `${diff.kind}:${diff.path}`
 	}
 
+	/** The two things a row needs from an item — the name it shows and who it runs as — are fields
+	 *  of the same object, so it is read once per item per workspace and awaited by both loops.
+	 *
+	 *  `SHARED_READ_KINDS` is the kinds that carry both. A folder has a summary and no identity; a
+	 *  schedule or a trigger has an identity read from its own endpoint, which `getOnBehalfOf`
+	 *  dispatches. */
+	const SHARED_READ_KINDS = ['script', 'flow', 'app', 'raw_app']
+	type ItemRead = { summary?: string; onBehalfOf?: string }
+	const itemReads = new Map<string, Promise<ItemRead>>()
+
+	function readItem(kind: string, path: string, workspace: string): Promise<ItemRead> {
+		const key = `${workspace}/${kind}:${path}`
+		let pending = itemReads.get(key)
+		if (!pending) {
+			// A failure is not an answer, so it is not kept: held, it would read as "this item has
+			// no identity", which is what decides whether the deploy offers to preserve one — and
+			// an item deployed without it silently becomes the deployer's. Each caller swallows its
+			// own, as both did before they shared a read.
+			pending = loadItem(kind, path, workspace).catch((error) => {
+				itemReads.delete(key)
+				throw error
+			})
+			itemReads.set(key, pending)
+		}
+		return pending
+	}
+
+	async function loadItem(kind: string, path: string, workspace: string): Promise<ItemRead> {
+		if (kind === 'script') {
+			const script = await ScriptService.getScriptByPath({ workspace, path })
+			return { summary: script.summary, onBehalfOf: script.on_behalf_of_email }
+		} else if (kind === 'flow') {
+			const flow = await FlowService.getFlowByPath({ workspace, path })
+			return { summary: flow.summary, onBehalfOf: flow.on_behalf_of_email }
+		} else if (kind === 'app' || kind === 'raw_app') {
+			const app = await AppService.getAppByPath({ workspace, path })
+			return { summary: app.summary, onBehalfOf: app.policy?.on_behalf_of_email }
+		} else if (kind === 'folder') {
+			const folder = await FolderService.getFolder({ workspace, name: path.replace(/^f\//, '') })
+			return { summary: folder.summary }
+		}
+		return {}
+	}
+
 	async function fetchSummary(
 		kind: string,
 		path: string,
 		workspace: string
 	): Promise<string | undefined> {
 		try {
-			if (kind === 'script') {
-				const script = await ScriptService.getScriptByPath({ workspace, path })
-				return script.summary
-			} else if (kind === 'flow') {
-				const flow = await FlowService.getFlowByPath({ workspace, path })
-				return flow.summary
-			} else if (kind === 'app' || kind === 'raw_app') {
-				const app = await AppService.getAppByPath({ workspace, path })
-				return app.summary
-			} else if (kind === 'folder') {
-				const folder = await FolderService.getFolder({ workspace, name: path.replace(/^f\//, '') })
-				return folder.summary
-			}
+			return (await readItem(kind, path, workspace)).summary
 		} catch (error) {
 			console.error(`Failed to fetch summary for ${kind}:${path}`, error)
+			return undefined
 		}
-		return undefined
 	}
 
+	// Both loops below run one item at a time and outlive the mount that started them: the page
+	// remounts this component when either side of the pair changes, and whatever was in flight then
+	// still resolves. It must not be stored — the summary key is kind and path, which the other
+	// pair spells the same way — and the loop must not keep asking for a pair nobody is looking at.
+	let alive = true
+	onDestroy(() => {
+		alive = false
+	})
+
 	async function fetchSummaries(diffs: WorkspaceItemDiff[]) {
 		// Only fetch summaries for scripts, flows, and apps
 		const itemsToFetch = diffs.filter((diff) =>
 			['script', 'flow', 'app', 'raw_app', 'folder'].includes(diff.kind)
 		)
+		// Read once, so every request in this pass names the pair the pass was started for. Named
+		// the way the diff names the two sides: `exists_in_fork` is this workspace, `exists_in_source`
+		// the one it is compared against.
+		const forkWs = currentWorkspaceId
+		const sourceWs = parentWorkspaceId
 
 		for (const diff of itemsToFetch) {
+			if (!alive) return
 			const key = getItemKey(diff)
 
-			// Skip if already cached or loading
-			if (summaryCache[key]) continue
+			// Asked for already — including one still in flight, and one whose answer was nothing.
+			if (summariesRequested.has(key)) continue
+			summariesRequested.add(key)
 
-			// Mark as loading
 			summaryCache[key] = { loading: true }
 
-			// Fetch from both workspaces in parallel
+			// Only the sides that have the item. An item that is only ahead does not exist in the
+			// other workspace, so asking it there is a 404 by construction — a guaranteed-failing
+			// request per one-sided row, and a console error for each.
 			const [currentSummary, parentSummary] = await Promise.all([
-				fetchSummary(diff.kind, diff.path, currentWorkspaceId),
-				fetchSummary(diff.kind, diff.path, parentWorkspaceId)
+				diff.exists_in_fork ? fetchSummary(diff.kind, diff.path, forkWs) : undefined,
+				diff.exists_in_source ? fetchSummary(diff.kind, diff.path, sourceWs) : undefined
 			])
+			if (!alive) return
 
 			summaryCache[key] = {
 				current: currentSummary,
@@ -561,18 +619,32 @@
 			(d) =>
 				['flow', 'script', 'app', 'raw_app'].includes(d.kind) || isTriggerOrScheduleKind(d.kind)
 		)
+		const pair = [
+			{ workspace: currentWorkspaceId, side: 'fork' as const },
+			{ workspace: parentWorkspaceId, side: 'source' as const }
+		]
 		for (const diff of itemsWithOnBehalfOf) {
-			for (const workspace of [currentWorkspaceId, parentWorkspaceId]) {
+			for (const { workspace, side } of pair) {
+				if (!alive) return
 				const workspacedKey = getWorkspacedKey(workspace, getItemKey(diff))
-				if (onBehalfOfInfo[workspacedKey] !== undefined) continue
+				// Marked before the request, not after it answers: a guard keyed on the value it
+				// stores (`undefined` either way) would ask again on every pass, forever.
+				if (onBehalfOfRequested.has(workspacedKey)) continue
+				onBehalfOfRequested.add(workspacedKey)
+				// The side that does not have the item has nothing to say about who it runs as, and
+				// asking produces a 404 rather than an answer.
+				if (!(side === 'fork' ? diff.exists_in_fork : diff.exists_in_source)) continue
 
 				try {
-					onBehalfOfInfo[workspacedKey] = await getOnBehalfOf(
-						diff.kind as Kind,
-						diff.path,
-						workspace
-					)
+					// The same read the summary loop does, for the kinds that answer both from one
+					// object; the rest keep their own endpoint.
+					const email = SHARED_READ_KINDS.includes(diff.kind)
+						? (await readItem(diff.kind, diff.path, workspace)).onBehalfOf
+						: await getOnBehalfOf(diff.kind as Kind, diff.path, workspace)
+					if (!alive) return
+					onBehalfOfInfo[workspacedKey] = email
 				} catch {
+					if (!alive) return
 					onBehalfOfInfo[workspacedKey] = undefined
 				}
 			}
@@ -1004,11 +1076,16 @@
 		)
 	)
 
-	// Fetch summaries and on_behalf_of_email when comparison data loads
+	// Fetch summaries and on_behalf_of_email when comparison data loads. `untrack`: both fetchers
+	// write the state they also read, and without this the effect depends on their writes and
+	// re-runs on each one.
 	$effect(() => {
-		if (comparison?.diffs) {
-			fetchSummaries(comparison.diffs)
-			fetchOnBehalfOfInfo(comparison.diffs)
+		const diffs = comparison?.diffs
+		if (diffs) {
+			untrack(() => {
+				fetchSummaries(diffs)
+				fetchOnBehalfOfInfo(diffs)
+			})
 		}
 	})
 
@@ -1229,6 +1306,7 @@
 				onSelectAll={selectAll}
 				onDeselectAll={deselectAll}
 				emptyMessage={emptyDeployMessage}
+				loading={comparisonLoading}
 			>
 				{#snippet header()}
 					<div class="flex items-center justify-between bg-surface-tertiary">
@@ -1382,7 +1460,7 @@
 									<span class="text-secondary">{test.test_script_path}</span>
 									{#if test.job_id}
 										<a
-											href="{base}/run/{test.job_id}?workspace={currentWorkspaceId}"
+											href="/run/{test.job_id}?workspace={currentWorkspaceId}"
 											class="text-tertiary hover:text-secondary text-2xs"
 										>
 											view run
@@ -1650,13 +1728,13 @@
 							{#if isConflict || existsInBothWorkspaces}
 								{#if diff.ahead > 0}
 									<Badge color="green" size="xs">
-										<ArrowUpRight class="w-3 h-3 inline" />
+										<ArrowUp class="w-3 h-3 inline" />
 										{diff.ahead} ahead
 									</Badge>
 								{/if}
 								{#if diff.behind > 0}
 									<Badge color="blue" size="xs">
-										<ArrowDownRight class="w-3 h-3 inline" />
+										<ArrowDown class="w-3 h-3 inline" />
 										{diff.behind} behind
 									</Badge>
 								{/if}
diff --git a/frontend/src/lib/components/ContextBridge.svelte b/frontend/src/lib/components/ContextBridge.svelte
new file mode 100644
index 0000000000..069bec0f42
--- /dev/null
+++ b/frontend/src/lib/components/ContextBridge.svelte
@@ -0,0 +1,18 @@
+<!--
+@component
+Re-exposes contexts from one component tree inside another.
+
+A snippet handed to the page header renders under the header, not under the page that wrote it, so
+any component it creates looks its contexts up in the header's tree and finds nothing. The page
+passes the entries its buttons need and this sets them again around the render.
+-->
+<script lang="ts">
+	import { setContext, type Snippet } from 'svelte'
+
+	let { contexts, children }: { contexts?: Map<any, any>; children: Snippet } = $props()
+
+	// setContext only takes effect during init, so this instance is keyed on `contexts` by callers.
+	if (contexts) for (const [key, value] of contexts) setContext(key, value)
+</script>
+
+{@render children()}
diff --git a/frontend/src/lib/components/CronBuilder.svelte b/frontend/src/lib/components/CronBuilder.svelte
index bcf8508c12..3bceabb417 100644
--- a/frontend/src/lib/components/CronBuilder.svelte
+++ b/frontend/src/lib/components/CronBuilder.svelte
@@ -15,7 +15,7 @@
 	contentClasses="p-4"
 >
 	{#snippet trigger()}
-		<Button variant="accent" size="xs" nonCaptureEvent={true} startIcon={{ icon: Clock }}>
+		<Button variant="default" unifiedSize="sm" nonCaptureEvent={true} startIcon={{ icon: Clock }}>
 			Cron builder
 		</Button>
 	{/snippet}
diff --git a/frontend/src/lib/components/DBManager.svelte b/frontend/src/lib/components/DBManager.svelte
index 5204a876b9..5b34c66bc5 100644
--- a/frontend/src/lib/components/DBManager.svelte
+++ b/frontend/src/lib/components/DBManager.svelte
@@ -45,7 +45,12 @@
 	import { favoriteManager } from './sidebar/FavoriteMenu.svelte'
 	import DatatableRoleBadge from './DatatableRoleBadge.svelte'
 	import type { AclTarget, Asset, DataTableTables } from '$lib/gen'
-	import { ADMIN_DATATABLE_ROLE, datatableNameTakesRole, type DatatableRowAction } from './dbTypes'
+	import {
+		ADMIN_DATATABLE_ROLE,
+		datatableNameTakesRole,
+		namedDefaultRole,
+		type DatatableRowAction
+	} from './dbTypes'
 	import TextInput from './text_input/TextInput.svelte'
 	import Checkbox from './common/checkbox/Checkbox.svelte'
 	import DbSchemaDiagram from './dbdiagram/DbSchemaDiagram.svelte'
@@ -375,7 +380,8 @@
 			}
 		if (!isInstanceDatatable(datatable))
 			return {
-				reason: 'Only data tables stored in the instance database have roles and grants.',
+				reason:
+					"Roles and grants are not supported on data tables backed by a Postgres resource. Store the data table on Windmill's database or on an external Postgres instance (set up by a superadmin in instance settings) to use them.",
 				ee: false
 			}
 		if (needsAdmin && !canManageDatatable)
@@ -416,7 +422,10 @@
 		if (!entry?.permissioned || !datatableNameTakesRole(datatable)) return undefined
 		const roles = entry.usable_roles
 		if (roles.length === 0) return { kind: 'none' }
-		const role = (datatable === currentDatatable ? currentRole : undefined) ?? entry.default_role
+		const role =
+			(datatable === currentDatatable ? currentRole : undefined) ??
+			namedDefaultRole(entry.default_role) ??
+			roles[0]
 		if (roles.length === 1 && roles[0] === ADMIN_DATATABLE_ROLE && role === ADMIN_DATATABLE_ROLE) {
 			return undefined
 		}
@@ -458,6 +467,11 @@
 	// default to open — actually be folded; a plain "expanded" set could never
 	// close them, since the default would keep winning.
 	// What the permissions drawer is open on, if anything: a schema, or a table.
+	let aclEditor = $state<PgAclEditor | undefined>(undefined)
+	/** The open access editor lists the data table's roles, which the roles drawer can change. */
+	export function refreshAcl() {
+		aclEditor?.refresh()
+	}
 	let aclDrawer = $state<{ datatable: string | undefined; target: AclTarget } | undefined>(
 		undefined
 	)
@@ -1466,7 +1480,7 @@
 <Portal>
 	<Drawer open={!!aclDrawer} size="900px" on:close={() => (aclDrawer = undefined)}>
 		<DrawerContent
-			title="Access — {aclLabel(aclDrawer?.target)}"
+			title="Access: {aclLabel(aclDrawer?.target)}"
 			on:close={() => (aclDrawer = undefined)}
 			tooltip="Who owns this, and what each role may do with it."
 		>
@@ -1474,7 +1488,18 @@
 				{@const dt = aclDrawer.datatable ?? currentDatatable}
 				{#if dt}
 					{#key `${dt}~${JSON.stringify(aclDrawer.target)}`}
-						<PgAclEditor {workspace} datatable={dt} target={aclDrawer.target} />
+						<PgAclEditor
+							bind:this={aclEditor}
+							{workspace}
+							datatable={dt}
+							target={aclDrawer.target}
+							manageRoles={onDatatableAction
+								? {
+										open: () => onDatatableAction?.(dt, 'roles'),
+										blocker: accessBlocker(dt, true)?.reason
+									}
+								: undefined}
+						/>
 					{/key}
 				{/if}
 			{/if}
diff --git a/frontend/src/lib/components/DBManagerDrawer.svelte b/frontend/src/lib/components/DBManagerDrawer.svelte
index bd016544b0..30fc93377d 100644
--- a/frontend/src/lib/components/DBManagerDrawer.svelte
+++ b/frontend/src/lib/components/DBManagerDrawer.svelte
@@ -311,6 +311,7 @@
 	function refreshRoles() {
 		datatables.refetch()
 		usableRoles.refetch()
+		dbManagerContent?.dbManager()?.refreshAcl()
 	}
 
 	async function handleExportSchema(explicitSource?: string) {
diff --git a/frontend/src/lib/components/DBTableEditor.svelte b/frontend/src/lib/components/DBTableEditor.svelte
index 4eb07aea5f..21cca65f63 100644
--- a/frontend/src/lib/components/DBTableEditor.svelte
+++ b/frontend/src/lib/components/DBTableEditor.svelte
@@ -105,7 +105,7 @@
 	const defaultColumnType = (
 		{
 			postgresql: 'BIGSERIAL',
-			snowflake: 'varchar',
+			snowflake: 'VARCHAR',
 			ms_sql_server: 'varchar',
 			bigquery: 'string',
 			mysql: 'varchar',
diff --git a/frontend/src/lib/components/DatatablePicker.svelte b/frontend/src/lib/components/DatatablePicker.svelte
index 53617acf36..17ad6f3361 100644
--- a/frontend/src/lib/components/DatatablePicker.svelte
+++ b/frontend/src/lib/components/DatatablePicker.svelte
@@ -17,6 +17,9 @@
 		selectInputClass?: string
 		class?: string
 		onClear?: () => void
+		/** Size the input to its content, like Path's folder picker. */
+		useContentEditable?: boolean
+		RightIcon?: any
 	}
 
 	let {
@@ -27,7 +30,9 @@
 		placeholder = undefined,
 		selectInputClass = '',
 		class: className = '',
-		onClear = undefined
+		onClear = undefined,
+		useContentEditable = false,
+		RightIcon = undefined
 	}: Props = $props()
 
 	let datatables = usePromise(() =>
@@ -47,6 +52,8 @@
 		{placeholder}
 		inputClass={selectInputClass}
 		{onClear}
+		{useContentEditable}
+		{RightIcon}
 	/>
 	{#if showSchemaExplorer && value && assetCanBeExplored({ kind: 'datatable', path: value })}
 		<ExploreAssetButton class="mt-1 w-fit" asset={{ kind: 'datatable', path: value }} />
diff --git a/frontend/src/lib/components/DefaultScriptsInner.svelte b/frontend/src/lib/components/DefaultScriptsInner.svelte
index b062fb4c49..29136e42f7 100644
--- a/frontend/src/lib/components/DefaultScriptsInner.svelte
+++ b/frontend/src/lib/components/DefaultScriptsInner.svelte
@@ -16,11 +16,13 @@
 	let { small = false }: Props = $props()
 
 	function computeLangs(defaultScripts: WorkspaceDefaultScripts | undefined): Script['language'][] {
-		const allLangs = Object.keys(defaultScriptLanguages) as Script['language'][]
+		const allLangs = (Object.keys(defaultScriptLanguages) as Script['language'][]).filter(
+			(l) => l != 'deno'
+		)
 		if (!defaultScripts || defaultScripts.order == undefined) return allLangs
 		return defaultScripts.order
 			?.concat(allLangs.filter((l) => !defaultScripts.order?.includes(l)))
-			.filter((x) => x != 'nativets') as Script['language'][]
+			.filter((x) => x != 'nativets' && x != 'deno') as Script['language'][]
 	}
 
 	async function changePosition(i: number, up: boolean) {
@@ -31,6 +33,10 @@
 			;[norder[i], norder[i + 1]] = [norder[i + 1], norder[i]]
 		}
 		defaultScripts.update((s) => ({ ...s, order: norder }))
+		await persist()
+	}
+
+	async function persist() {
 		await WorkspaceService.editDefaultScripts({
 			workspace: $operatingWorkspace!,
 			requestBody: $defaultScripts
@@ -76,7 +82,7 @@
 					size="xs"
 					color="red"
 					checked={$defaultScripts?.hidden?.includes(lang)}
-					on:change={(e) => {
+					on:change={async (e) => {
 						let toggled = e.detail
 						if (toggled) {
 							defaultScripts.update((s) => ({
@@ -89,6 +95,7 @@
 								hidden: (s?.hidden ?? []).filter((h) => h != lang)
 							}))
 						}
+						await persist()
 					}}
 				/>
 			</div>
diff --git a/frontend/src/lib/components/DefaultTagsInner.svelte b/frontend/src/lib/components/DefaultTagsInner.svelte
index 9e890696ec..87cfa0f89b 100644
--- a/frontend/src/lib/components/DefaultTagsInner.svelte
+++ b/frontend/src/lib/components/DefaultTagsInner.svelte
@@ -8,8 +8,10 @@
 		DEFAULT_TAGS_PER_WORKSPACE_SETTING,
 		DEFAULT_TAGS_WORKSPACES_SETTING,
 		FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING,
-		PREVIEW_TAGS_OVERRIDE_SETTING
+		PREVIEW_TAGS_OVERRIDE_SETTING,
+		DEPENDENCY_JOB_TAG_SETTING
 	} from '$lib/consts'
+	import TextInput from './text_input/TextInput.svelte'
 	import Toggle from './Toggle.svelte'
 	import MultiSelect from './select/MultiSelect.svelte'
 	import { safeSelectItems } from './select/utils.svelte'
@@ -31,12 +33,14 @@
 	let limitToWorkspaces = $state(false)
 	let previewTagsOverride = $state(false)
 	let forkAppendForkSuffix = $state(false)
+	let dependencyJobTag = $state('')
 
 	// Change detection
 	let originalDefaultTagPerWorkspace = $state<boolean | undefined>(defaultTagPerWorkspace)
 	let originalDefaultTagWorkspaces = $state<string[]>(defaultTagWorkspaces)
 	let originalPreviewTagsOverride = $state(false)
 	let originalForkAppendForkSuffix = $state(false)
+	let originalDependencyJobTag = $state('')
 
 	// Detect changes
 	let hasChanges = $derived(
@@ -44,7 +48,8 @@
 			JSON.stringify($state.snapshot(originalDefaultTagWorkspaces)?.sort() || []) !==
 				JSON.stringify($state.snapshot(defaultTagWorkspaces)?.sort() || []) ||
 			originalPreviewTagsOverride !== previewTagsOverride ||
-			originalForkAppendForkSuffix !== forkAppendForkSuffix
+			originalForkAppendForkSuffix !== forkAppendForkSuffix ||
+			originalDependencyJobTag.trim() !== dependencyJobTag.trim()
 	)
 
 	let workspaces: string[] = $state([])
@@ -70,6 +75,11 @@
 			})) as any
 			forkAppendForkSuffix = forkSetting ?? false
 			originalForkAppendForkSuffix = forkAppendForkSuffix
+			dependencyJobTag =
+				((await SettingService.getGlobal({
+					key: DEPENDENCY_JOB_TAG_SETTING
+				})) as any) ?? ''
+			originalDependencyJobTag = dependencyJobTag
 		} catch (err) {
 			sendUserToast(`Could not load default tags: ${err}`, true)
 		}
@@ -104,11 +114,19 @@
 			}
 		})
 
+		await SettingService.setGlobal({
+			key: DEPENDENCY_JOB_TAG_SETTING,
+			requestBody: {
+				value: dependencyJobTag.trim() || undefined
+			}
+		})
+
 		// Update original state after save
 		originalDefaultTagPerWorkspace = defaultTagPerWorkspace
 		originalDefaultTagWorkspaces = [...(defaultTagWorkspaces || [])]
 		originalPreviewTagsOverride = previewTagsOverride
 		originalForkAppendForkSuffix = forkAppendForkSuffix
+		originalDependencyJobTag = dependencyJobTag
 
 		loadDefaultTags()
 		sendUserToast('Saved')
@@ -218,6 +236,33 @@
 					disabled={!$enterpriseLicense}
 				/>
 			</div>
+			<div class="flex flex-col gap-1 max-w-md">
+				<span class="text-xs font-semibold text-emphasis">Dependency job tag</span>
+				<span class="text-2xs text-secondary">
+					Route every dependency job (lockfile resolution at deploy and relocks triggered by an
+					imported script changing, for scripts, flows and apps) to this tag, whatever tag the
+					runnable itself runs on. Supports <code>$workspace</code>. Dedicated workers still build
+					their own locks, and Bun native scripts still build their bundle on the bun tag.
+				</span>
+				<span class="text-2xs text-secondary">
+					Leave empty for the default routing: a script's dependency job runs on the script's own
+					tag, or on its language's default tag (e.g. <code
+						>{defaultTagPerWorkspace ? 'python3-$workspace' : 'python3'}</code
+					>) when it has none; flow and app dependency jobs run on
+					<code>{defaultTagPerWorkspace ? 'dependency-$workspace' : 'dependency'}</code>.
+					<a
+						href="https://www.windmill.dev/docs/core_concepts/worker_groups"
+						target="_blank"
+						class="gap-1 items-baseline"
+						>Worker groups <ExternalLink size={12} class="inline-block" /></a
+					>
+				</span>
+				<TextInput
+					bind:value={dependencyJobTag}
+					size="sm"
+					inputProps={{ placeholder: 'e.g. dependency', disabled: !$enterpriseLicense }}
+				/>
+			</div>
 		</div>
 
 		<div class="flex gap-2 items-center mb-1">
@@ -240,6 +285,17 @@
 					</div>
 				</div>
 			{/each}
+			{#if dependencyJobTag.trim()}
+				<div class="flex gap-2 items-center">
+					<div class="w-36">
+						<Badge color="transparent">all dependency jobs</Badge>
+					</div>
+					<div class="w-6 flex justify-center text-secondary">&rightarrow;</div>
+					<div class="flex-1">
+						<Badge color="blue">{dependencyJobTag.trim()}</Badge>
+					</div>
+				</div>
+			{/if}
 			{#if previewTagsOverride}
 				<div class="flex gap-2 items-center">
 					<div class="w-36">
diff --git a/frontend/src/lib/components/DeployWorkspace.svelte b/frontend/src/lib/components/DeployWorkspace.svelte
index 53ca12cf03..7913240188 100644
--- a/frontend/src/lib/components/DeployWorkspace.svelte
+++ b/frontend/src/lib/components/DeployWorkspace.svelte
@@ -5,7 +5,6 @@
 		aiAgentModuleDependencies,
 		collectTransformRefs
 	} from './deployDependencies'
-	import { base } from '$lib/base'
 	import { enterpriseLicense, superadmin } from '$lib/stores'
 	import {
 		AppService,
@@ -538,7 +537,7 @@
 	>
 {:else}
 	<Alert type="info" title="Shareable page"
-		>Share this <a href="{base}/deploy/{kind}/{initialPath}">link</a> to have another properly permissioned
+		>Share this <a href="/deploy/{kind}/{initialPath}">link</a> to have another properly permissioned
 		user do the deployment</Alert
 	>
 
@@ -580,7 +579,7 @@
 				connection={remoteStatus?.connection}
 				returnTo={kind === 'trigger'
 					? undefined
-					: `${base}/deploy/${kind}/${initialPath}?workspace=${encodeURIComponent($operatingWorkspace!)}`}
+					: `/deploy/${kind}/${initialPath}?workspace=${encodeURIComponent($operatingWorkspace!)}`}
 				onChange={loadDestinations}
 			/>
 		</div>
diff --git a/frontend/src/lib/components/DevWorkspaceBadge.svelte b/frontend/src/lib/components/DevWorkspaceBadge.svelte
new file mode 100644
index 0000000000..e86e4593c8
--- /dev/null
+++ b/frontend/src/lib/components/DevWorkspaceBadge.svelte
@@ -0,0 +1,56 @@
+<!--
+@component
+The badge naming a dev workspace's environment, wherever one is shown.
+
+A fork that has a colour wears it: the badge is filled with that hue at the lightest shade white
+still reads on (`forkAccentStyle`), so a yellow workspace says "dev" in dark yellow rather than in
+a blue that belongs to no workspace in particular. A fork with no colour keeps whatever its host
+gave it — `fallbackColor` and `fallbackClass`, which is what every dev workspace looked like
+before a colour could be picked.
+-->
+<script lang="ts">
+	import { Badge } from '$lib/components/common'
+	import type { BadgeColor } from '$lib/components/common/badge/model'
+	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import { forkAccentStyle } from '$lib/utils/forkColor'
+	import { twMerge } from 'tailwind-merge'
+
+	interface Props {
+		/** The workspace's `dev_workspace_label`; spelled the way `devBadgeText` spells it. Nullable
+		 *  because that is what the workspace rows carry. */
+		label?: string | null
+		/** The fork's own colour. Without one — or with an unparsable one — the badge falls back. */
+		color?: string | null
+		/** The badge's colour when the fork has none of its own. */
+		fallbackColor?: BadgeColor
+		/** Extra classes for that same case, for a host that tuned the uncoloured badge. */
+		fallbackClass?: string
+		/** Size and spacing, which the row around the badge decides either way. */
+		class?: string
+	}
+
+	let {
+		label,
+		color,
+		fallbackColor = 'dark-blue',
+		fallbackClass,
+		class: className
+	}: Props = $props()
+
+	// Set on the badge itself rather than read from an ancestor: a host that paints a coloured chip
+	// around it already defines these, and defining them again costs nothing and makes the badge
+	// work the same in a row that has no chip.
+	const accent = $derived(forkAccentStyle(color))
+</script>
+
+<Badge
+	color={fallbackColor}
+	small
+	style={accent}
+	class={twMerge(
+		accent
+			? 'bg-[color:var(--fork-accent-badge)] dark:bg-[color:var(--fork-accent-badge)] text-white dark:text-white'
+			: fallbackClass,
+		className
+	)}>{devBadgeText(label)}</Badge
+>
diff --git a/frontend/src/lib/components/DevWorkspaceSetting.svelte b/frontend/src/lib/components/DevWorkspaceSetting.svelte
index e148d90c22..5346cab7b0 100644
--- a/frontend/src/lib/components/DevWorkspaceSetting.svelte
+++ b/frontend/src/lib/components/DevWorkspaceSetting.svelte
@@ -1,13 +1,13 @@
 <script lang="ts">
 	import { workspaceStore, userWorkspaces, usersWorkspaceStore, superadmin } from '$lib/stores'
 	import { WorkspaceService, type ProtectionRuleset } from '$lib/gen'
-	import { Badge, Button } from '$lib/components/common'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
+	import { Button } from '$lib/components/common'
 	import Select from '$lib/components/select/Select.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { switchWorkspace } from '$lib/storeUtils'
 	import { goto } from '$app/navigation'
-	import { base } from '$lib/base'
 	import {
 		findCanonicalDevWorkspace,
 		findWorkspaceAncestors,
@@ -17,7 +17,6 @@
 	import { getUserExt } from '$lib/user'
 	import {
 		DEV_WORKSPACE_LABELS,
-		devBadgeText,
 		devLabelKey,
 		devLabelNoun,
 		type DevWorkspaceLabelKey
@@ -239,7 +238,7 @@
 	// scratch rather than from the current query so no stale `?workspace=<dev>` survives a switch.
 	function rulesetsHref(name?: string): string {
 		const rule = name ? `&rule=${encodeURIComponent(name)}` : ''
-		return `${base}/workspace_settings?tab=rulesets${rule}`
+		return `/workspace_settings?tab=rulesets${rule}`
 	}
 
 	function openRulesets(name?: string) {
@@ -531,7 +530,7 @@
 				<Button
 					variant="default"
 					startIcon={{ icon: GitFork }}
-					onclick={() => goto(`${base}/user/fork_workspace?dev=true`)}
+					onclick={() => goto('/user/fork_workspace?dev=true')}
 				>
 					Create a new dev workspace
 				</Button>
@@ -554,7 +553,11 @@
 			<b>{parentId}</b>. Promote changes from the home page banner or the Compare &amp; Deploy page.
 		</p>
 		<div class="text-2xs text-secondary">
-			Environment: <Badge color="indigo" small>{devBadgeText(currentLabel)}</Badge>
+			Environment: <DevWorkspaceBadge
+				label={currentLabel}
+				color={currentWs?.color}
+				fallbackColor="indigo"
+			/>
 			<span class="ml-1">
 				Set when the workspace is created or attached. Git sync deploys to the
 				<span class="font-mono">{currentLabel}</span> branch.
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index a49f09bb02..afadcb5741 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -7,7 +7,6 @@
 	import { parseDbtRun } from '$lib/components/dbt/parseDbtRun'
 	import { copyToClipboard, parseS3Object, roughSizeOfObject } from '$lib/utils'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
-	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
 	import { Badge, Button, Drawer, DrawerContent } from './common'
@@ -254,7 +253,7 @@
 	)
 	let resultDownloadHref = $derived(
 		resultApiPath
-			? `${base}/api${resultApiPath}`
+			? `/api${resultApiPath}`
 			: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`
 	)
 	let resultDownloadName = $derived(`${filename ?? 'result'}.json`)
@@ -856,7 +855,6 @@
 							{workspaceId}
 							{jobId}
 							{nodeId}
-							{base}
 							{result}
 							{disableTooltips}
 							on:open-drawer={() => openDrawer()}
diff --git a/frontend/src/lib/components/DisplayResultControlBar.svelte b/frontend/src/lib/components/DisplayResultControlBar.svelte
index 45011d2db1..6af502a1b8 100644
--- a/frontend/src/lib/components/DisplayResultControlBar.svelte
+++ b/frontend/src/lib/components/DisplayResultControlBar.svelte
@@ -14,7 +14,6 @@
 		workspaceId?: string | undefined
 		jobId?: string | undefined
 		nodeId?: string | undefined
-		base: string
 		result: any
 		disableTooltips?: boolean
 	}
@@ -25,7 +24,6 @@
 		workspaceId = undefined,
 		jobId = undefined,
 		nodeId = undefined,
-		base,
 		result,
 		disableTooltips = false
 	}: Props = $props()
@@ -67,7 +65,7 @@
 				download={downloadName}
 				class="text-current"
 				href={resultApiPath
-					? `${base}/api${resultApiPath}`
+					? `/api${resultApiPath}`
 					: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
 			>
 				<Download size={14} />
diff --git a/frontend/src/lib/components/DropdownV2Inner.svelte b/frontend/src/lib/components/DropdownV2Inner.svelte
index 31fd9426f5..70ed83398d 100644
--- a/frontend/src/lib/components/DropdownV2Inner.svelte
+++ b/frontend/src/lib/components/DropdownV2Inner.svelte
@@ -107,9 +107,19 @@
 				<DropdownSubmenuItem {item} {builders} {meltItem} close={close ?? (() => {})} />
 			{:else if item.disabled && item.tooltip}
 				<!-- Wrapper carries the native `title`; the disabled button's `pointer-events-none`
-				     lets the hover reach it so the user learns why the item is disabled. -->
-				<div title={item.tooltip} class="w-full">
-					{@render menuItem(item)}
+				     lets the hover reach it so the user learns why the item is disabled. The ⓘ sits
+				     outside the disabled button, the only place it can receive a hover. -->
+				<div class="relative w-full">
+					<div title={item.tooltip} class="w-full pr-6">
+						{@render menuItem(item)}
+					</div>
+					<div class="absolute right-3 top-1/2 -translate-y-1/2 flex">
+						<Tooltip>
+							{#snippet text()}
+								{item.tooltip}
+							{/snippet}
+						</Tooltip>
+					</div>
 				</div>
 			{:else}
 				{@render menuItem(item)}
diff --git a/frontend/src/lib/components/DucklakePicker.svelte b/frontend/src/lib/components/DucklakePicker.svelte
index 3a6f2bf739..d6ed4d0cdf 100644
--- a/frontend/src/lib/components/DucklakePicker.svelte
+++ b/frontend/src/lib/components/DucklakePicker.svelte
@@ -17,6 +17,9 @@
 		selectInputClass?: string
 		class?: string
 		onClear?: () => void
+		/** Size the input to its content, like Path's folder picker. */
+		useContentEditable?: boolean
+		RightIcon?: any
 	}
 
 	let {
@@ -27,7 +30,9 @@
 		placeholder = undefined,
 		selectInputClass = '',
 		class: className = '',
-		onClear = undefined
+		onClear = undefined,
+		useContentEditable = false,
+		RightIcon = undefined
 	}: Props = $props()
 
 	let ducklakes = usePromise(() =>
@@ -45,6 +50,8 @@
 		{placeholder}
 		inputClass={selectInputClass}
 		{onClear}
+		{useContentEditable}
+		{RightIcon}
 	/>
 	{#if showSchemaExplorer && value && assetCanBeExplored({ kind: 'ducklake', path: value })}
 		<ExploreAssetButton class="mt-1 w-fit" asset={{ kind: 'ducklake', path: value }} />
diff --git a/frontend/src/lib/components/Editor.svelte b/frontend/src/lib/components/Editor.svelte
index f9df8adcef..03bf5ce87e 100644
--- a/frontend/src/lib/components/Editor.svelte
+++ b/frontend/src/lib/components/Editor.svelte
@@ -1523,6 +1523,9 @@
 		} catch (e) {
 			console.log('error initializing services', e)
 		}
+		// Unmounted while the services loaded: the container is detached, and
+		// creating the editor on it throws.
+		if (destroyed || !divEl?.isConnected) return
 
 		// vscode.languages.registerDefinitionProvider('*', {
 		// 	provideDefinition(document, position, token) {
diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index 81ef6c1c96..429c99c4a6 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -22,7 +22,6 @@
 <script lang="ts">
 	import { ResourceService, VariableService, WorkspaceService, type Script } from '$lib/gen'
 
-	import { base } from '$lib/base'
 	import type Editor from './Editor.svelte'
 	import ItemPicker from './ItemPicker.svelte'
 	import VariableEditor from './VariableEditor.svelte'
@@ -105,6 +104,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 			| 'wac_python'
 			| 'wac_typescript'
 			| 'ci_test_bun'
@@ -844,7 +844,7 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 				startIcon={{ icon: Plus }}
 				target="_blank"
 				variant="accent"
-				href="{base}/resources?connect_app=undefined"
+				href="/resources?connect_app=undefined"
 			>
 				Add resource
 			</Button>
@@ -903,7 +903,7 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 					startIcon={{ icon: Settings }}
 					target="_blank"
 					variant="accent"
-					href="{base}/workspace_settings?tab=ducklake"
+					href="/workspace_settings?tab=ducklake"
 				>
 					Go to settings
 				</Button>
@@ -946,7 +946,7 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 					startIcon={{ icon: Settings }}
 					target="_blank"
 					variant="accent"
-					href="{base}/workspace_settings?tab=windmill_data_tables"
+					href="/workspace_settings?tab=windmill_data_tables"
 				>
 					Go to settings
 				</Button>
diff --git a/frontend/src/lib/components/EditorHeader.svelte b/frontend/src/lib/components/EditorHeader.svelte
index 25291fa5f0..a44568560c 100644
--- a/frontend/src/lib/components/EditorHeader.svelte
+++ b/frontend/src/lib/components/EditorHeader.svelte
@@ -1,10 +1,7 @@
 <script lang="ts">
-	import { Pencil } from 'lucide-svelte'
-	import { Alert, Button } from '$lib/components/common'
+	import { ChevronRight } from 'lucide-svelte'
 	import EditableInput from '$lib/components/common/EditableInput.svelte'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
-	import Path from '$lib/components/Path.svelte'
-	import Label from '$lib/components/Label.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
 	import {
 		dirKey,
 		KIND_LABEL_LOWER,
@@ -14,17 +11,7 @@
 		type WorkspaceItemKind
 	} from '$lib/components/workspacePicker'
 	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
-	import { isOwner } from '$lib/utils'
-	import { userStore } from '$lib/stores'
-	import {
-		useOperatingUser,
-		useOperatingWorkspace
-	} from '$lib/components/operatingWorkspace.svelte'
-
-	const operatingWorkspace = useOperatingWorkspace()
-	const operatingUser = useOperatingUser()
-	const actingUser = $derived(operatingUser.current)
-
+	import { splitItemPath } from '$lib/components/breadcrumbPath'
 	interface Props {
 		summary?: string
 		path?: string
@@ -75,55 +62,17 @@
 		workspaceId
 	}: Props = $props()
 
-	let pathPopoverOpen = $state(false)
-	/** Snapshot of `path` taken when the pen popover opens; cleared on close.
-	 * While set, the breadcrumb derives from it instead of `path` so the pen
-	 * anchor doesn't reflow as the user types in the popover (which would drag
-	 * the popover with it via floating-ui's auto-update). */
+	/** Held by the pen popover while it is open, so the trail below — and the pen anchored to its
+	 * end — does not reflow as the user types. */
 	let snapshotPath = $state<string | undefined>(undefined)
 
-	function setPathPopoverOpen(open: boolean) {
-		pathPopoverOpen = open
-		// Only snapshot when there's a path to freeze. New flows / scripts open
-		// the popover with `path === ''` and rely on `Path.reset()` to seed a
-		// path; if we snapshot the empty value the breadcrumb stays blank for
-		// the whole popover lifetime. Leaving `snapshotPath` undefined lets
-		// `displayPath` track the live seeded path instead.
-		snapshotPath = open && path ? path : undefined
-	}
-
 	// Path segments. e.g. "f/demo/weather_report" → scope "f/demo", slug "weather_report".
 	// `snapshotPath` keeps the breadcrumb frozen while the pen popover is open
 	// so the trigger doesn't drift mid-edit. Outside of that, the breadcrumb
 	// follows the live `path` — coherent with the picker because we inject a
 	// virtual current-item entry at that same live path (see `currentItem`).
 	let displayPath = $derived(snapshotPath ?? path ?? '')
-	/** Breakdown for breadcrumb rendering. Top-level dirs (scopes) come first
-	 * — `f/<folder>` or `u/<user>` — then any number of subfolders, then the
-	 * item name. Each dir entry's `fullPath` is the cumulative path up to
-	 * that level, used to key the picker's `initialOpen` / `initialHighlight`. */
-	let segments = $derived.by(() => {
-		const parts = displayPath.split('/')
-		if (parts.length < 3) return null
-		const scope = parts.slice(0, 2).join('/')
-		const slug = parts.slice(2)
-		const dirs: { name: string; fullPath: string }[] = []
-		// Top-level scope is a dir.
-		dirs.push({ name: scope, fullPath: scope })
-		// Intermediate slug parts (everything except the last one).
-		let acc = scope
-		for (let i = 0; i < slug.length - 1; i++) {
-			acc = `${acc}/${slug[i]}`
-			dirs.push({ name: slug[i], fullPath: acc })
-		}
-		const leaf = { name: slug[slug.length - 1], fullPath: displayPath }
-		return { dirs, leaf }
-	})
-
-	// Treat an empty path as ownable so the pen popover lets a user pick the
-	// path for a brand-new item. `Path.reset()` then synthesizes a default
-	// under their own user/folder scope.
-	let own = $derived(!path || isOwner(path, actingUser, $operatingWorkspace))
+	let segments = $derived(splitItemPath(displayPath) ?? null)
 
 	// Virtual entry for the picker: surfaces the currently-edited item at its
 	// live path (which may differ from `savedPath` mid-rename, so the picker
@@ -145,7 +94,7 @@
 	}
 </script>
 
-<div class="inline-block max-w-full align-top group px-2 py-0.5 leading-tight">
+<div class="max-w-full group px-2 py-0.5 leading-tight inline-block align-top">
 	<!-- Path row -->
 	{#if !hidePath}
 		<div class="flex items-center max-w-full text-2xs text-secondary font-mono">
@@ -162,9 +111,9 @@
 				{#if segments}
 					{#each segments.dirs as dir, i (dir.fullPath)}
 						{@const dKey = dirKey('all', dir.fullPath)}
+						<ChevronRight size={10} class="shrink-0" />
 						<BreadcrumbSegment
 							label={dir.name}
-							withChevron
 							extraClass={i === 0 ? 'gap-0.5 min-w-0 max-w-[40%]' : 'gap-0.5 min-w-0'}
 							initialScope={i === 0
 								? { kind: 'all' }
@@ -175,11 +124,13 @@
 							onPick={handlePickerSelect}
 						/>
 					{/each}
+				{/if}
+				{#if segments?.leaf}
 					{@const leafKey = leafKeyFor(kind, segments.leaf.fullPath)}
 					{@const leafParent = segments.dirs[segments.dirs.length - 1]?.fullPath}
+					<ChevronRight size={10} class="shrink-0" />
 					<BreadcrumbSegment
 						label={segments.leaf.name}
-						withChevron
 						extraClass="gap-0.5 min-w-0"
 						initialScope={leafParent ? { kind: 'all', dir: leafParent } : { kind: 'all' }}
 						initialHighlight={leafKey}
@@ -191,65 +142,21 @@
 				{/if}
 			</nav>
 
-			<!-- Pen → path-edit popover. Skipped entirely when path editing is
-		     disabled so the user doesn't see an inert button. -->
+			<!-- Skipped entirely when path editing is disabled so the user doesn't see an inert
+			     button. -->
 			{#if pathEditable}
-				<Popover
-					placement="bottom-start"
-					contentClasses="p-4"
-					usePointerDownOutside
-					excludeSelectors=".drawer"
-					disableFocusTrap
-					closeOnOtherPopoverOpen
-					bind:isOpen={() => pathPopoverOpen, setPathPopoverOpen}
-				>
-					{#snippet trigger()}
-						<Button
-							variant="subtle"
-							unifiedSize="xs"
-							iconOnly
-							startIcon={{ icon: Pencil }}
-							title="Edit path"
-							aria-label="Edit path"
-							btnClasses={penVisibility === 'hover' && !pathPopoverOpen
-								? 'opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100'
-								: ''}
-						/>
-					{/snippet}
-					{#snippet content()}
-						<div class="flex flex-col gap-6 w-[480px]">
-							{#if own}
-								<Path
-									autofocus
-									bind:path
-									initialPath={snapshotPath ?? path ?? ''}
-									namePlaceholder={kind}
-									{kind}
-									size="sm"
-									drawerOffset={4000}
-									workspaceOverride={workspaceId}
-								/>
-								{#if savedPath && path && path !== savedPath}
-									<Alert
-										type="info"
-										size="xs"
-										title="Deploy the {kind} to make the path change effective."
-									/>
-								{/if}
-								{#if onBehalfOfEmail}
-									<Alert type="info" title="Run on behalf of" size="xs">
-										This flow will be redeployed on behalf of you ({$userStore?.email}) instead of {onBehalfOfEmail}
-									</Alert>
-								{/if}
-							{:else}
-								<Label label="Path">
-									<span class="text-xs font-mono text-secondary">{path}</span>
-									<p class="text-2xs text-tertiary mt-1">Only the owner can change the path</p>
-								</Label>
-							{/if}
-						</div>
-					{/snippet}
-				</Popover>
+				<!-- Path only: this bar carries its own summary field below, and `hidePath` would take
+				     the pen with it, leaving a condensed pane no way to name the item. -->
+				<PathEditPopover
+					bind:path
+					bind:snapshotPath
+					summaryEditable={false}
+					{savedPath}
+					{kind}
+					{workspaceId}
+					{onBehalfOfEmail}
+					{penVisibility}
+				/>
 			{/if}
 		</div>
 	{/if}
diff --git a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
index 0adb5dc690..c624b5a148 100644
--- a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
+++ b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
@@ -43,7 +43,6 @@
 	import ChannelSelector from '$lib/components/ChannelSelector.svelte'
 
 	import type { Schema, SupportedLanguage } from '$lib/common'
-	import { base } from '$lib/base'
 	import { enterpriseLicense } from '$lib/stores'
 	import MsTeamsIcon from '$lib/components/icons/MSTeamsIcon.svelte'
 	import { classNames, emptySchema, emptyString, sendUserToast, tryEvery } from '$lib/utils'
@@ -70,6 +69,8 @@
 	} from 'lucide-svelte'
 	import { hubPaths } from '$lib/hub'
 	import { isCloudHosted } from '$lib/cloud'
+	import { untrack } from 'svelte'
+	import { syncSlackBotArg } from './handlerSlackArg'
 	import SmtpConfigurationStatus from './common/smtp/SmtpConfigurationStatus.svelte'
 	import { SettingService } from '$lib/gen'
 	import { isSmtpSettingsValid } from './instanceSettings/SmtpSettings.svelte'
@@ -317,12 +318,13 @@
 		loadSmtpConfiguration()
 	})
 
+	let builtinArgs: Record<string, any> | undefined
 	$effect(() => {
-		if (handlerSelected === 'slack' && isSlackHandler(handlerPath)) {
-			handlerExtraArgs['slack'] = '$res:f/slack_bot/bot_token'
-		} else {
-			handlerExtraArgs['slack'] = undefined
-		}
+		const isSlackBuiltin = handlerSelected === 'slack' && isSlackHandler(handlerPath)
+		const args = handlerExtraArgs
+		// A replaced args object (Discard, reload) holds the stored config, not what the built-in set.
+		untrack(() => syncSlackBotArg(args, isSlackBuiltin, args === builtinArgs))
+		builtinArgs = isSlackBuiltin ? args : undefined
 	})
 
 	let lastHandlerSelected: ErrorHandler | undefined = $state(undefined)
@@ -543,7 +545,7 @@
 
 									<a
 										target="_blank"
-										href={`${base}/run/${connectionTestJob.uuid}?workspace=${effectiveWorkspace}`}
+										href={`/run/${connectionTestJob.uuid}?workspace=${effectiveWorkspace}`}
 										class="inline-flex items-center gap-1"
 									>
 										{connectionTestJob.uuid}
@@ -636,7 +638,7 @@
 								Message sent via Windmill job
 								<a
 									target="_blank"
-									href={`${base}/run/${connectionTestJob.uuid}?workspace=${effectiveWorkspace}`}
+									href={`/run/${connectionTestJob.uuid}?workspace=${effectiveWorkspace}`}
 								>
 									{connectionTestJob.uuid}
 								</a>
@@ -694,7 +696,7 @@
 					report is sent without adding an entry to the instance critical alert feed. Canceled jobs
 					are not reported.
 				</span>
-				<a class="text-xs w-fit" href="{base}/?workspace=admins#superadmin-settings">
+				<a class="text-xs w-fit" href="/?workspace=admins#superadmin-settings">
 					Configure the instance critical alert channels
 				</a>
 			</div>
diff --git a/frontend/src/lib/components/FilterSearchbar.svelte b/frontend/src/lib/components/FilterSearchbar.svelte
index b4bc4471a2..0a65701b06 100644
--- a/frontend/src/lib/components/FilterSearchbar.svelte
+++ b/frontend/src/lib/components/FilterSearchbar.svelte
@@ -303,7 +303,12 @@
 
 <script lang="ts">
 	import { twMerge } from 'tailwind-merge'
-	import { inputBaseClass, inputBorderClass, inputSizeClasses } from './text_input/TextInput.svelte'
+	import {
+		inputBaseClass,
+		inputBorderClass,
+		inputLeadingClasses,
+		inputSizeClasses
+	} from './text_input/TextInput.svelte'
 	import { MinusIcon, SearchIcon } from 'lucide-svelte'
 	import { assignObjInPlace, clone } from '$lib/utils'
 	import GenericDropdown from './select/GenericDropdown.svelte'
@@ -338,7 +343,7 @@
 		hideDropdownOnFreeText?: boolean
 		// Notified whenever the dropdown's effective visibility changes
 		onDropdownVisibleChange?: (visible: boolean) => void
-		size?: 'md' | 'lg'
+		size?: 'sm' | 'md' | 'lg'
 		// On the right the icon gives way to the clear button once there is text; on the left
 		// it stays put.
 		searchIconPosition?: 'left' | 'right'
@@ -747,7 +752,11 @@
 			'overflow-x-auto !pr-24 bg-surface-input outline-none scrollbar-hidden text-nowrap flex-1 mr-2 mt-0.5',
 			inputBaseClass,
 			inputSizeClasses[size],
-			// The editable's fixed top padding centres the text at md height.
+			// The editable's own 2px top margin is what centres the text at md height, where its box
+			// is shorter than the row. At sm the two are the same height, so that margin only pushes
+			// the text below centre: drop it and take the leading the shared table defines, which is
+			// the row's height less its padding.
+			size === 'sm' && twMerge('!mt-0', inputLeadingClasses.sm),
 			size === 'lg' && '!pt-[0.7rem]',
 			searchIconPosition === 'left' && '!pl-1.5'
 		)}
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 289dfa21d4..1a468ac33a 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -28,7 +28,8 @@
 		userPathPrefix,
 		type Item,
 		type StateStore,
-		type Value
+		type Value,
+		emptyString
 	} from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
@@ -36,7 +37,10 @@
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 	import AIChangesWarningModal from '$lib/components/copilot/chat/flow/AIChangesWarningModal.svelte'
 
-	import { getContext, onDestroy, setContext, untrack } from 'svelte'
+	import { getContext, onDestroy, setContext, untrack, type Snippet } from 'svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import { writable } from 'svelte/store'
 	import CenteredPage from './CenteredPage.svelte'
 	import { Button } from './common'
@@ -106,13 +110,14 @@
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { setOpenInSessionHandoff } from './sessions/openInSessionContext'
 	import { getEditorStoragePath, setEditorStoragePath } from './editorStoragePathContext'
-	import { useOperatorBuilderFlows, useTriggerLock } from '$lib/operatorWriteRights'
+	import { useEditRights, useOperatorBuilderFlows, useTriggerLock } from '$lib/operatorWriteRights'
 	import {
 		useOperatingUser,
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
 	const triggerLock = useTriggerLock()
 	const operatorBuilderFlows = useOperatorBuilderFlows()
+	const editRights = useEditRights()
 
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
@@ -158,12 +163,16 @@
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
 		onTestJob,
-		condensedHeader = false
+		condensedHeader = false,
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader = false
 	}: FlowBuilderProps = $props()
 
 	// Top-bar button size + bar height. Condensed (session preview) uses the
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
-	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
+	// In the page header the buttons ride a 40px band, the same size the condensed session-pane
+	// header uses.
+	const headerBtnSize = $derived(condensedHeader || ownsPageHeader ? 'sm' : 'md')
 
 	// The workspace this editor operates on: deploy, save-draft, trigger loading
 	// and the AutosaveIndicator all target it. Falls back to the global store, so
@@ -216,8 +225,24 @@
 	// Top-bar responsive collapse. Measured via bind:clientWidth — we can't
 	// rely on viewport `md:` because the editor lives inside other panes
 	// (session pane, drawer, etc.) where the viewport stays wide.
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+	// In the page header the buttons share the row with the breadcrumb, so they collapse sooner:
+	// the trail and the summary take ~560px before either truncates, and the full group — the
+	// dropdown, Diff, the preview trio and Deploy — is ~610px.
+	const compactBelow = $derived(ownsPageHeader ? 1200 : 720)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar holds the trail and Deploy: the diff joins the menu and the preview buttons
+	// stand down, since there is no room to run a flow beside its own name.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	const diffEnabled = $derived(customUi?.topBar?.diff != false)
 	// Nothing to compare against until a deployed version exists.
@@ -228,7 +253,7 @@
 	// The narrow bar (sessions) and the width-collapsed one have no room for a Diff
 	// button, so it moves into the menu ahead of Deployment History instead of
 	// dropping out of reach.
-	const diffInMenu = $derived(condensedHeader || compactTopbar)
+	const diffInMenu = $derived(condensedHeader || compactTopbar || phoneTopbar)
 	const diffMenuItems: Item[] = $derived(
 		diffEnabled && diffInMenu
 			? [
@@ -336,7 +361,7 @@
 			savedValue: savedFlow,
 			modifiedValue: {
 				...flowStore.val,
-				// `$pathStore` is the live-edited path (the pen popover binds it).
+				// `$pathStore` is the live-edited path (the rename popover binds it).
 				// `flowStore.val.path` doesn't track those edits, so without this the
 				// rename wouldn't show up in the diff and the unsaved-changes warning
 				// wouldn't fire when leaving with a pending rename.
@@ -532,8 +557,14 @@
 				// flag that answer for it are per workspace, so the nav user would answer for the wrong
 				// membership when a session editor operates on another workspace.
 				const user = await getUserExt(opWorkspace ?? '').catch(() => undefined)
+				const operatorSettings = $userWorkspaces.find(
+					(w) => w.id === opWorkspace
+				)?.operator_settings
 				agentCanWrite = Object.fromEntries(
-					draftAgents.map((a) => [a.path, agentDraftCanWrite(a, user ?? $userStore ?? undefined)])
+					draftAgents.map((a) => [
+						a.path,
+						agentDraftCanWrite(a, user ?? $userStore ?? undefined, operatorSettings)
+					])
 				)
 				// The path is passed, so a draft that renames the agent is refused here too: a rename is
 				// the agent editor's to deploy, and this dialog lists the agent under the path the flow
@@ -618,7 +649,9 @@
 						on_behalf_of: flow.on_behalf_of,
 						preserve_on_behalf_of: $preserveOnBehalfOf || undefined,
 						deployment_message: deploymentMsg || undefined,
-						labels: (flow as any).labels
+						labels: (flow as any).labels,
+						// Sent explicitly: an omitted field keeps the deployed value.
+						job_token_scopes: flow.job_token_scopes ?? null
 					}
 				})
 				// Gated for operators without `manage_triggers`, who cannot have captures to move.
@@ -670,7 +703,9 @@
 						on_behalf_of: flow.on_behalf_of,
 						preserve_on_behalf_of: $preserveOnBehalfOf || undefined,
 						deployment_message: deploymentMsg || undefined,
-						labels: (flow as any).labels
+						labels: (flow as any).labels,
+						// Sent explicitly: an omitted field keeps the deployed value.
+						job_token_scopes: flow.job_token_scopes ?? null
 					}
 				})
 			}
@@ -1274,6 +1309,16 @@
 
 	setContext('FlowCopilotContext', flowCopilotContext)
 
+	// The header's action buttons render under the page header, not under this component, so the
+	// contexts they look up have to travel with them. Read back here, after every setContext above.
+	const headerContexts = new Map<any, any>([
+		['FlowEditorContext', getContext('FlowEditorContext')],
+		['TriggerContext', getContext('TriggerContext')],
+		['FlowGraphAssetContext', getContext('FlowGraphAssetContext')],
+		['FlowCopilotContext', flowCopilotContext],
+		['customUi', customUi]
+	])
+
 	let renderCount = $state(0)
 
 	let jsonViewerDrawer: Drawer | undefined = $state(undefined)
@@ -1522,7 +1567,7 @@
 <AIChangesWarningModal bind:open={aiChangesWarningOpen} onConfirm={aiChangesConfirmCallback} />
 
 {#key renderCount}
-	{#if !actingUser?.operator || $operatorBuilderFlows}
+	{#if editRights.roleCanAuthor('flow')}
 		{#if $pathStore}
 			<FlowHistory bind:this={flowHistory} path={$pathStore} {onHistoryRestore} />
 		{/if}
@@ -1533,81 +1578,220 @@
 		<FlowEditorDrawer bind:this={$flowEditorDrawer} />
 
 		<div bind:this={flowBuilderRoot} class="flex flex-col h-full">
-			<!-- Nav between steps-->
-			<div
-				bind:clientWidth={topbarWidth}
-				class="justify-between flex flex-row items-center pl-2 pr-4 space-x-4 scrollbar-hidden overflow-x-auto h-full relative {condensedHeader
-					? 'max-h-9'
-					: 'max-h-12'}"
-			>
-				<div class="flex flex-row items-center gap-2 min-w-0">
-					{#if customUi?.topBar?.path != false}
-						<div class="min-w-0 overflow-hidden">
-							<EditorHeader
-								bind:summary={flowStore.val.summary}
-								bind:path={$pathStore}
-								savedPath={initialPath}
-								onBehalfOfEmail={$savedOnBehalfOfEmail}
-								summaryEditable={customUi?.topBar?.editableSummary != false}
-								pathEditable={customUi?.topBar?.editablePath != false}
-								hidePath={condensedHeader}
-								workspaceId={autosaveWorkspace}
-								onNavigate={(item) => onNavigate?.(item)}
+			{#if ownsPageHeader}
+				<!-- The editor's own top bar is the page header on this route: its breadcrumb and
+				     summary are the header's, and its buttons are the header's actions. -->
+				<!-- `separator="none"`: the canvas right below the bar draws its own top line, and the
+				     bar's edge would be a second one on top of it. -->
+				<PageHeaderContent
+					item={{
+						// Frozen while the rename popover is open so the trail holds still as the user types.
+						kind: 'flow',
+						path: pathSnapshot ?? $pathStore,
+						summaryContent: flowSummary,
+						// Gated like the summary's own editor: a host that allows neither field keeps the
+						// band's segment, which copies the path.
+						pathTrigger:
+							customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false
+								? flowPathTrigger
+								: undefined
+					}}
+					actions={flowHeaderActions}
+					contexts={headerContexts}
+					separator="none"
+				/>
+			{:else}
+				<!-- Nav between steps-->
+				<div
+					bind:clientWidth={topbarWidth}
+					class="justify-between flex flex-row items-center pl-2 pr-4 space-x-4 scrollbar-hidden overflow-x-auto h-full relative {condensedHeader
+						? 'max-h-9'
+						: 'max-h-12'}"
+				>
+					<div class="flex flex-row items-center gap-2 min-w-0">
+						{#if customUi?.topBar?.path != false}
+							<div class="min-w-0 overflow-hidden">
+								<EditorHeader
+									bind:summary={flowStore.val.summary}
+									bind:path={$pathStore}
+									savedPath={initialPath}
+									onBehalfOfEmail={$savedOnBehalfOfEmail}
+									summaryEditable={customUi?.topBar?.editableSummary != false}
+									pathEditable={customUi?.topBar?.editablePath != false}
+									hidePath={condensedHeader}
+									workspaceId={autosaveWorkspace}
+									onNavigate={(item) => onNavigate?.(item)}
+								/>
+							</div>
+						{/if}
+						{#if opWorkspace && indicatorPath !== undefined}
+							<AutosaveIndicator
+								workspace={opWorkspace}
+								itemKind="flow"
+								path={indicatorPath}
+								draftOnly={newFlow}
+								{onResetToDeployed}
+								{loadedFromDraft}
+								{othersDraftsCount}
+								{onOpenOthersDrafts}
 							/>
-						</div>
-					{/if}
-					{#if opWorkspace && indicatorPath !== undefined}
-						<AutosaveIndicator
-							workspace={opWorkspace}
-							itemKind="flow"
-							path={indicatorPath}
-							draftOnly={newFlow}
-							{onResetToDeployed}
-							{loadedFromDraft}
-							{othersDraftsCount}
-							{onOpenOthersDrafts}
-						/>
-					{/if}
-				</div>
-				<div class="flex flex-row gap-2 items-center shrink-0">
-					{#if $enterpriseLicense && !newFlow && !inSessionPane}
-						<Awareness />
-					{/if}
-					<Dropdown items={getMoreItems} size={headerBtnSize} fixedHeight={!condensedHeader} />
-					{#if diffEnabled && !diffInMenu}
-						<!-- A disabled <button> fires no pointer events, so a title/tooltip on
+						{/if}
+					</div>
+					<div class="flex flex-row gap-2 items-center shrink-0">
+						{#if $enterpriseLicense && !newFlow && !inSessionPane}
+							<Awareness />
+						{/if}
+						<Dropdown items={getMoreItems} size={headerBtnSize} fixedHeight={!condensedHeader} />
+						{#if diffEnabled && !diffInMenu}
+							<!-- A disabled <button> fires no pointer events, so a title/tooltip on
 						     it never shows on hover. pointer-events-none on the button lets the
 						     hover reach this titled wrapper instead. -->
-						<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
-							<Button
-								variant="default"
-								unifiedSize={headerBtnSize}
-								on:click={() => openDiffDrawer()}
-								disabled={diffDisabled}
-								btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
-								title={diffTitle}
-								startIcon={{ icon: DiffIcon }}
-							>
-								Diff
-							</Button>
-						</div>
-					{/if}
-					{#if !compactTopbar}
-						{@render previewButtons()}
-					{/if}
+							<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
+								<Button
+									variant="default"
+									unifiedSize={headerBtnSize}
+									on:click={() => openDiffDrawer()}
+									disabled={diffDisabled}
+									btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
+									title={diffTitle}
+									startIcon={{ icon: DiffIcon }}
+								>
+									Diff
+								</Button>
+							</div>
+						{/if}
+						{#if !compactTopbar}
+							{@render previewButtons()}
+						{/if}
 
-					<DeployButton
-						on:save={async ({ detail }) => await handleSaveFlow(detail)}
-						{loading}
-						{loadingSave}
-						unifiedSize={headerBtnSize}
-						{dropdownItems}
-					/>
+						<DeployButton
+							on:save={async ({ detail }) => await handleSaveFlow(detail)}
+							{loading}
+							{loadingSave}
+							unifiedSize={headerBtnSize}
+							{dropdownItems}
+						/>
+					</div>
 				</div>
-			</div>
-			<!-- Rendered either inline in the top bar (wide) or as a graph overlay
-			     (compactTopbar). Crossing the 720px threshold remounts
-			     FlowPreviewButtons; any open preview state will reset. -->
+			{/if}
+
+			<!-- The summary's editor again, hung off the band's path segment so it opens under the
+			     path, with the cursor in the path field. `bind:` cannot be spread, so the slots are
+			     written out twice; both instances bind the same ones and only one is ever open. -->
+			{#snippet flowPathTrigger(pathLabel: Snippet, triggerClass: string)}
+				<!-- Gated the way the script editor gates its own, `{:else}` included: this renders from
+				     the band's tree, which outlives what it reads here by a flush, and the band has
+				     already given up its own segment by the time this decides. -->
+				{#if flowStore?.val}
+					<PathEditPopover
+						label={pathLabel}
+						{triggerClass}
+						focusField="path"
+						bind:summary={flowStore.val.summary}
+						summaryEditable={customUi?.topBar?.editableSummary != false}
+						pathEditable={customUi?.topBar?.editablePath != false}
+						bind:path={$pathStore}
+						bind:snapshotPath={pathSnapshot}
+						savedPath={initialPath}
+						kind="flow"
+						onBehalfOfEmail={$savedOnBehalfOfEmail}
+						workspaceId={autosaveWorkspace}
+					/>
+				{:else}
+					<span class={triggerClass}>{@render pathLabel()}</span>
+				{/if}
+			{/snippet}
+
+			{#snippet flowSummary()}
+				<!-- Not edited in place: clicking the name opens the summary and the path together, so
+				     the band reads as a name rather than a form. `title` for one it truncates. -->
+				<div class="flex items-center gap-1 min-w-0">
+					{#snippet summaryText()}
+						<span
+							class="min-w-0 truncate text-xs {emptyString(flowStore.val.summary)
+								? 'text-tertiary italic font-normal'
+								: 'font-medium text-emphasis'}"
+							title={flowStore.val.summary}
+							>{emptyString(flowStore.val.summary)
+								? 'Add a summary...'
+								: flowStore.val.summary}</span
+						>
+					{/snippet}
+					{#if customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false}
+						<PathEditPopover
+							label={summaryText}
+							bind:summary={flowStore.val.summary}
+							summaryEditable={customUi?.topBar?.editableSummary != false}
+							pathEditable={customUi?.topBar?.editablePath != false}
+							bind:path={$pathStore}
+							bind:snapshotPath={pathSnapshot}
+							savedPath={initialPath}
+							kind="flow"
+							onBehalfOfEmail={$savedOnBehalfOfEmail}
+							workspaceId={autosaveWorkspace}
+						/>
+					{:else}
+						{@render summaryText()}
+					{/if}
+				</div>
+			{/snippet}
+
+			{#snippet flowHeaderActions()}
+				<!-- Saving state, the autosave toggle and other people's drafts: the editor's own
+					     bar carries them beside the path, so the header has to carry them when it owns
+					     the bar — without them a full-page editor saves with no word either way. -->
+				{#if opWorkspace && indicatorPath !== undefined}
+					<AutosaveIndicator
+						workspace={opWorkspace}
+						itemKind="flow"
+						path={indicatorPath}
+						draftOnly={newFlow}
+						{onResetToDeployed}
+						{loadedFromDraft}
+						{othersDraftsCount}
+						{onOpenOthersDrafts}
+					/>
+				{/if}
+				{#if $enterpriseLicense && !newFlow && !inSessionPane}
+					<Awareness />
+				{/if}
+				<Dropdown items={getMoreItems} size={headerBtnSize} fixedHeight={!condensedHeader} />
+				{#if diffEnabled && !diffInMenu}
+					<!-- A disabled <button> fires no pointer events, so a title/tooltip on
+						     it never shows on hover. pointer-events-none on the button lets the
+						     hover reach this titled wrapper instead. -->
+					<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
+						<Button
+							variant="default"
+							unifiedSize={headerBtnSize}
+							on:click={() => openDiffDrawer()}
+							disabled={diffDisabled}
+							btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
+							title={diffTitle}
+							startIcon={{ icon: DiffIcon }}
+						>
+							Diff
+						</Button>
+					</div>
+				{/if}
+				{#if !compactTopbar && !phoneTopbar}
+					{@render previewButtons()}
+				{/if}
+
+				<DeployButton
+					on:save={async ({ detail }) => await handleSaveFlow(detail)}
+					{loading}
+					{loadingSave}
+					unifiedSize={headerBtnSize}
+					{dropdownItems}
+				/>
+			{/snippet}
+
+			<!-- Rendered either inline in the top bar (wide) or as a graph overlay. The two
+			     conditions are exact complements: testing the flow is reachable at every width,
+			     and FlowPreviewButtons — which owns the preview state and the handles the graph
+			     calls into — is mounted exactly once. Crossing a threshold remounts it, so any
+			     open preview resets. -->
 			{#snippet previewButtons()}
 				<FlowPreviewButtons
 					{suspendStatus}
@@ -1637,7 +1821,7 @@
 			{#if flowStateStore.val}
 				<FlowEditor
 					bind:this={flowEditor}
-					graphOverlay={compactTopbar ? previewButtons : undefined}
+					graphOverlay={compactTopbar || phoneTopbar ? previewButtons : undefined}
 					{disabledFlowInputs}
 					disableAi={disableAi || customUi?.stepInputs?.ai == false}
 					disableSettings={customUi?.settingsPanel === false}
diff --git a/frontend/src/lib/components/FlowGraphViewerStep.svelte b/frontend/src/lib/components/FlowGraphViewerStep.svelte
index 1081371b6f..f662f5280c 100644
--- a/frontend/src/lib/components/FlowGraphViewerStep.svelte
+++ b/frontend/src/lib/components/FlowGraphViewerStep.svelte
@@ -216,6 +216,11 @@
 				<h3 class="mb-1 font-semibold mt-2 text-xs text-emphasis">Step inputs</h3>
 				<InputTransformsViewer inputTransforms={stepDetail?.value?.input_transforms ?? {}} />
 			</div>
+		{:else if stepDetail.value.type == 'aidecision'}
+			<div class="text-xs">
+				<h3 class="mb-1 font-semibold mt-2 text-xs text-emphasis">Step inputs</h3>
+				<InputTransformsViewer inputTransforms={stepDetail.value.input_transforms ?? {}} />
+			</div>
 		{:else if stepDetail.value.type == 'forloopflow'}
 			<div>
 				<p class="font-medium text-secondary pb-2"> Iterator expression: </p>
diff --git a/frontend/src/lib/components/FlowGraphViewerStepHeader.svelte b/frontend/src/lib/components/FlowGraphViewerStepHeader.svelte
index 9fda9f23e5..b0d1bd7b36 100644
--- a/frontend/src/lib/components/FlowGraphViewerStepHeader.svelte
+++ b/frontend/src/lib/components/FlowGraphViewerStepHeader.svelte
@@ -54,6 +54,8 @@
 				return 'Workspace script'
 			case 'aiagent':
 				return 'AI Agent'
+			case 'aidecision':
+				return 'AI Decision'
 			default:
 				return stepDetail.id
 		}
diff --git a/frontend/src/lib/components/FlowLogViewer.svelte b/frontend/src/lib/components/FlowLogViewer.svelte
index 6a8db18a76..0efbdc332e 100644
--- a/frontend/src/lib/components/FlowLogViewer.svelte
+++ b/frontend/src/lib/components/FlowLogViewer.svelte
@@ -10,7 +10,6 @@
 		ExternalLink,
 		Keyboard
 	} from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import LogViewer from './LogViewer.svelte'
 	import FlowLogViewer from './FlowLogViewer.svelte'
@@ -98,7 +97,7 @@
 
 	function getJobLink(jobId: string | undefined): string {
 		if (!jobId) return ''
-		return `${base}/run/${jobId}?workspace=${workspaceId ?? $operatingWorkspace}`
+		return `/run/${jobId}?workspace=${workspaceId ?? $operatingWorkspace}`
 	}
 
 	function getStatusColor(status: FlowStatusModule['type'] | undefined): string {
diff --git a/frontend/src/lib/components/FlowMetadata.svelte b/frontend/src/lib/components/FlowMetadata.svelte
index 022fa874a2..b28e694bc3 100644
--- a/frontend/src/lib/components/FlowMetadata.svelte
+++ b/frontend/src/lib/components/FlowMetadata.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { type Job } from '$lib/gen'
-	import { base } from '$lib/base'
 	import JobStatus from '$lib/components/JobStatus.svelte'
 	import { flowPathToHref } from '$lib/scripts'
 	import { displayDate, truncateRev } from '$lib/utils'
@@ -58,7 +57,7 @@
 					<BarsStaggered size={SMALL_ICON_SIZE} class="min-w-3.5" />
 					<span class="whitespace-nowrap">
 						Step of flow
-						<a href={`${base}/run/${job.parent_job}?workspace=${$workspaceStore}`}>
+						<a href={`/run/${job.parent_job}?workspace=${$workspaceStore}`}>
 							{truncateRev(job.parent_job, 18)}
 						</a>
 					</span>
@@ -68,7 +67,7 @@
 					<Bot size={SMALL_ICON_SIZE} class="min-w-3.5" />
 					<span class="whitespace-nowrap">
 						Triggered by parent
-						<a href={`${base}/run/${job.parent_job}?workspace=${$workspaceStore}`}>
+						<a href={`/run/${job.parent_job}?workspace=${$workspaceStore}`}>
 							{job.parent_job}</a
 						>
 					</span>
@@ -96,7 +95,7 @@
 			{@const stem = `${job?.job_kind}s`}
 			{@const isScript = job?.job_kind === 'script'}
 			{@const viewHref = isScript
-				? `${base}/${stem}/get/${job?.script_hash}`
+				? `/${stem}/get/${job?.script_hash}`
 				: flowPathToHref(job?.script_path ?? '')}
 			<div class="flex flex-row gap-2 items-center">
 				{#if isScript}
@@ -128,6 +127,6 @@
 	</div>
 	<div class="text-secondary text-2xs pt-2 whitespace-nowrap">
 		run id:
-		<a href={`${base}/run/${job.id}?workspace=${job.workspace_id}`}> {job.id} </a>
+		<a href={`/run/${job.id}?workspace=${job.workspace_id}`}> {job.id} </a>
 	</div>
 </div>
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index 1d56c20b38..489d6c4769 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -15,7 +15,6 @@
 		type FlowNote,
 		type FlowValue
 	} from '$lib/gen'
-	import { base } from '$lib/base'
 	import FlowJobResult from './FlowJobResult.svelte'
 	import WorkflowTimeline from './WorkflowTimeline.svelte'
 	import DisplayResult from './DisplayResult.svelte'
@@ -69,6 +68,7 @@
 		retainLinkedToolsScope
 	} from './flows/linkedAgentToolsStore.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { AGENT_STEP_ID, agentStepLabel } from './flows/conversations/agentEditorChat'
 
 	const operatingWorkspace = useOperatingWorkspace()
 
@@ -1238,6 +1238,8 @@
 		id: string
 		type: FlowModuleValue['type']
 		suspend?: boolean
+		/** Shown in place of the id. */
+		label?: string
 	}
 
 	function allModulesForTimeline(
@@ -1250,7 +1252,8 @@
 				({
 					id: x.id,
 					type: x.value.type,
-					suspend: x.suspend != undefined
+					suspend: x.suspend != undefined,
+					label: x.id === AGENT_STEP_ID ? agentStepLabel(job?.script_path) : undefined
 				}) as FlowModuleForTimeline,
 			{
 				skipToolNodes: true
@@ -1933,7 +1936,7 @@
 							</Button>
 						{:else}
 							<Button
-								href="{base}/api{logsApiPath}"
+								href="/api{logsApiPath}"
 								download={logsName}
 								color="light"
 								size="xs"
@@ -2195,7 +2198,7 @@
 																				class="text-right text-xs"
 																				rel="noreferrer"
 																				target="_blank"
-																				href="{base}/run/{node.job_id ??
+																				href="/run/{node.job_id ??
 																					''}?workspace={job?.workspace_id}"
 																			>
 																				{truncateRev(node.job_id ?? '', 10)}
diff --git a/frontend/src/lib/components/FlowTimeline.svelte b/frontend/src/lib/components/FlowTimeline.svelte
index 4ed13c1df1..640c8728ce 100644
--- a/frontend/src/lib/components/FlowTimeline.svelte
+++ b/frontend/src/lib/components/FlowTimeline.svelte
@@ -179,12 +179,12 @@
 				/>
 			</div>
 		{/if}
-		{#each flowModules as { id: k, type: typ, suspend: isSuspend } (k)}
+		{#each flowModules as { id: k, type: typ, suspend: isSuspend, label } (k)}
 			{@const subItems = items?.[k]?.filter((x) => x.created_at && x.started_at)}
 			<div class="relative px-3 py-1.5">
 				<div class="flex items-center justify-between mb-0.5">
 					<div class="text-xs font-medium"
-						>{k.startsWith('subflow:') ? k.substring(8) : k}
+						>{label ?? (k.startsWith('subflow:') ? k.substring(8) : k)}
 						{#if localModuleStates[k]?.selectedForloop && (typ == 'forloopflow' || typ == 'whileloopflow')}
 							<span class="text-xs font-mono font-medium inline-flex items-center -my-2">
 								<button onclick={(e) => e.stopPropagation()}>
diff --git a/frontend/src/lib/components/ForkWorkspaceBanner.svelte b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
index 940c579fd7..11779afb11 100644
--- a/frontend/src/lib/components/ForkWorkspaceBanner.svelte
+++ b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
@@ -1,14 +1,16 @@
 <script lang="ts">
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
+	import { Badge } from './common'
+	import { AlertTriangle, ArrowDown, ArrowUp, Pencil } from 'lucide-svelte'
 	import { workspaceStore, userWorkspaces, userStore, type UserExt } from '$lib/stores'
-	import { ScriptService } from '$lib/gen'
 	import type { WorkspaceComparison } from '$lib/gen'
 	import { fetchWorkspaceComparison } from '$lib/workspaceComparison'
 	import { Button } from './common'
-	import { AlertTriangle, GitFork, CircleCheck, CircleX, Loader2 } from 'lucide-svelte'
 	import { goto } from '$app/navigation'
 	import { onMount, untrack } from 'svelte'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
-	import { childWorkspaceNoun, devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import { childWorkspaceNoun } from '$lib/utils/devWorkspaceLabel'
 	import { diffActionableInDirection } from '$lib/utils_workspace_deploy'
 
 	let loading = $state(false)
@@ -20,12 +22,10 @@
 
 	let currentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === $workspaceStore))
 	let parentWorkspaceId = $derived(currentWorkspaceData?.parent_workspace_id)
-	let parentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === parentWorkspaceId))
 	// Detect fork/dev workspaces by their parent link, not the `wm-fork-` id prefix (dev
 	// workspaces have an ordinary, prefix-less id). Keying on the parent (rather than the
 	// prefix) also avoids a parentless "Fork of ()" banner when the linkage is dropped.
 	let isFork = $derived(parentWorkspaceId != null)
-	let isDevWorkspace = $derived(currentWorkspaceData?.is_dev_workspace ?? false)
 	let currentNoun = $derived(childWorkspaceNoun(currentWorkspaceData))
 	// Operators run scripts and flows, they never deploy a fork, so the banner and
 	// its CTA are noise for them. Gates the fetches too, not just the markup: the
@@ -57,6 +57,11 @@
 	}
 	const hasAnswer = $derived(isAnswerable(comparison, loading))
 
+	/** Bar width from which each badge says what it counts. Below it they keep the icon and the
+	 *  number, which is the part a reader scans for; the tooltip names them either way. */
+	const BAR_FITS_COUNT_LABELS = 1280
+	const compactCounts = $derived(pageHeader.barWidth < BAR_FITS_COUNT_LABELS)
+
 	// Fork is fully in sync with its parent (comparison ran, no ahead/behind diffs).
 	function isUpToDate(c: WorkspaceComparison | undefined): boolean {
 		return !!c && !c.skipped_comparison && c.summary.total_diffs === 0
@@ -67,14 +72,12 @@
 	let showDraftsOnly = $derived(upToDate && draftCount > 0)
 
 	// Leaving for a workspace with no comparison of its own has to invalidate whatever
-	// is in flight too, or that response lands as this one's answer — and its CI counts
-	// would be fetched for paths this workspace may not even have.
+	// is in flight too, or that response lands as this one's answer.
 	function dropComparison() {
 		requestSeq++
 		comparison = undefined
 		comparisonFor = undefined
 		loading = false
-		resetCiTestSummary()
 	}
 
 	// `isNotOperator` is a dependency of its own: it only turns true once this
@@ -113,7 +116,6 @@
 		if (comparisonFor !== ws) {
 			comparison = undefined
 			comparisonFor = undefined
-			resetCiTestSummary()
 		}
 		const seq = ++requestSeq
 		loading = true
@@ -142,6 +144,18 @@
 
 	// Opens the direction the button offers, so the label and the list agree: a fork
 	// with nothing to deploy lands on the update side, not on an empty deploy list.
+	/** The compare page opened on one direction, for a badge that counts exactly that. The button
+	 *  beside them still chooses on the reader's behalf; a badge means the one thing it names. */
+	function openCompareDir(dir: 'deploy_to' | 'update') {
+		if (!parentWorkspaceId || !$workspaceStore) return
+		goto(
+			'/forks/compare?workspace_id=' +
+				encodeURIComponent($workspaceStore) +
+				(dir === 'update' ? '&dir=update' : ''),
+			{ replaceState: true }
+		)
+	}
+
 	function openComparisonDrawer() {
 		if (parentWorkspaceId && $workspaceStore) {
 			const dir = hasAnswer && changesAhead === 0 ? '&dir=update' : ''
@@ -159,68 +173,6 @@
 		}
 	}
 
-	let ciTestPassing = $state(0)
-	let ciTestFailing = $state(0)
-	let ciTestRunning = $state(0)
-	let ciTestTotal = $state(0)
-
-	// These describe the rows of one comparison, so they are dropped with it.
-	function resetCiTestSummary() {
-		ciTestPassing = 0
-		ciTestFailing = 0
-		ciTestRunning = 0
-		ciTestTotal = 0
-	}
-
-	async function fetchCiTestSummary() {
-		if (!$workspaceStore || !comparison?.diffs) return
-		const items = comparison.diffs
-			.filter((d) => d.kind === 'script' || d.kind === 'flow' || d.kind === 'resource')
-			.map((d) => ({ path: d.path, kind: d.kind as 'script' | 'flow' | 'resource' }))
-		if (items.length === 0) return
-		// Counted for the comparison current at call time — the poll below outlives a
-		// fork switch, and a slow batch for the fork we left would repaint this one's.
-		const seq = requestSeq
-		try {
-			const batch = await ScriptService.getCiTestResultsBatch({
-				workspace: $workspaceStore,
-				requestBody: { items }
-			})
-			if (seq !== requestSeq) return
-			let passing = 0
-			let failing = 0
-			let running = 0
-			let total = 0
-			for (const results of Object.values(batch)) {
-				for (const r of results) {
-					total++
-					if (r.status === 'success') passing++
-					else if (r.status === 'failure' || r.status === 'canceled') failing++
-					else if (r.status === 'running' || (r.job_id && !r.status)) running++
-				}
-			}
-			ciTestPassing = passing
-			ciTestFailing = failing
-			ciTestRunning = running
-			ciTestTotal = total
-		} catch (e) {
-			console.error('Failed to fetch CI test summary:', e)
-		}
-	}
-
-	$effect(() => {
-		if (comparison && comparison.summary.total_diffs > 0) {
-			fetchCiTestSummary()
-		}
-	})
-
-	// Poll while any CI test is still running
-	$effect(() => {
-		if (ciTestRunning <= 0) return
-		const interval = setInterval(fetchCiTestSummary, 3000)
-		return () => clearInterval(interval)
-	})
-
 	// Counted with the compare page's own predicate so the banner never advertises a
 	// direction whose list is empty: the `ahead`/`behind` sums in the summary include
 	// rows a direction does not carry, and miss a parent-only row that the update
@@ -246,191 +198,113 @@
 </script>
 
 {#if showBanner}
-	<!-- Side padding mirrors the page content container below, so the banner
-	     stays aligned with it instead of bleeding to the viewport edges. -->
-	<div class="w-full text-xs max-w-7xl mx-auto px-4 sm:px-8 pt-2">
-		<div class="bg-blue-50 dark:bg-blue-900 rounded-md px-4 py-2">
-			<!-- The summary wraps inside its own column while the CTA keeps its width and
-			     stays on the first line: laid out as one non-wrapping row, the summary is
-			     long enough on a laptop-width viewport to push the button out of the
-			     banner instead of getting shorter. -->
-			<div class="flex items-center justify-between gap-x-3">
-				<div class="flex items-center flex-wrap gap-x-3 gap-y-1 min-w-0">
-					<GitFork class="w-4 h-4 text-accent shrink-0" />
-					<div class="text-sm min-w-0">
-						<span class="font-medium text-blue-900 dark:text-blue-100">
-							{isDevWorkspace
-								? `${devLabelWord(currentWorkspaceData?.dev_workspace_label)} workspace of`
-								: 'Fork of'}
-							<b>{parentWorkspaceData?.name}</b
-							>{#if parentWorkspaceData?.name !== parentWorkspaceId}
-								({parentWorkspaceId}){/if}
-						</span>
-					</div>
-
-					{#if loading}
-						<span class="text-xs text-blue-600 dark:text-blue-400"> Checking for changes... </span>
-					{:else if error}
-						<span class="text-xs text-red-600 dark:text-red-400">
-							{error}
-						</span>
-					{:else if comparison}
-						<div class="flex items-center flex-wrap gap-x-4 gap-y-1 text-xs min-w-0">
-							{#if comparison.summary.total_diffs > 0}
-								<span class="text-blue-700 dark:text-blue-100">
-									{forkAheadBehindMessage(changesAhead, changesBehind)}
-									<span class="font-semibold underline">{parentWorkspaceId}</span> over {comparison
-										.summary.total_diffs} items<span class="hidden lg:inline">:</span>
-								</span>
-								<!-- The per-kind breakdown is the first thing to go on a narrow
-								     viewport: the item total above already sizes the change set, and
-								     the compare page carries the detail. -->
-								<div
-									class="hidden lg:flex items-center flex-wrap gap-x-2 gap-y-1 whitespace-nowrap"
-								>
-									{#if comparison.summary.scripts_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.scripts_changed} script{comparison.summary
-												.scripts_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.flows_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.flows_changed} flow{comparison.summary.flows_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.apps_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.apps_changed} app{comparison.summary.apps_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.resources_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.resources_changed} resource{comparison.summary
-												.resources_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.variables_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.variables_changed} variable{comparison.summary
-												.variables_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.resource_types_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.resource_types_changed} resource type{comparison.summary
-												.resource_types_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.folders_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.folders_changed} folder{comparison.summary
-												.folders_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.schedules_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.schedules_changed} schedule{comparison.summary
-												.schedules_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-									{#if comparison.summary.triggers_changed > 0}
-										<span class="text-blue-700 dark:text-blue-100">
-											{comparison.summary.triggers_changed} trigger{comparison.summary
-												.triggers_changed !== 1
-												? 's'
-												: ''}
-										</span>
-									{/if}
-								</div>
-
-								{#if ciTestTotal > 0}
-									-
-									{#if ciTestFailing > 0}
-										<div
-											class="flex items-center gap-1 text-red-600 dark:text-red-400 whitespace-nowrap"
-										>
-											<CircleX class="w-3 h-3" />
-											<span>CI: {ciTestFailing} failing</span>
-										</div>
-									{:else if ciTestRunning > 0}
-										<div
-											class="flex items-center gap-1 text-yellow-600 dark:text-yellow-400 whitespace-nowrap"
-										>
-											<Loader2 class="w-3 h-3 animate-spin" />
-											<span>CI: {ciTestRunning} running</span>
-										</div>
-									{:else}
-										<div
-											class="flex items-center gap-1 text-green-600 dark:text-green-400 whitespace-nowrap"
-										>
-											<CircleCheck class="w-3 h-3" />
-											<span>CI: {ciTestPassing} passing</span>
-										</div>
-									{/if}
-								{/if}
-
-								{#if comparison.summary.conflicts > 0}
-									-
-									<div
-										class="flex items-center gap-1 text-orange-600 dark:text-orange-400 whitespace-nowrap"
-									>
-										<AlertTriangle class="w-3 h-3" />
-										<span
-											>{comparison.summary.conflicts} conflict{comparison.summary.conflicts !== 1
-												? 's'
-												: ''}</span
-										>
-									</div>
-								{/if}
-							{:else if comparison.skipped_comparison}
-								<span class="text-blue-600 dark:text-blue-200">
-									This {currentNoun} was created before the addition of certain windmill features, and
-									therefore the changes with its parent workspace cannot be displayed.</span
-								>
-							{:else if showDraftsOnly}
-								<span class="text-blue-700 dark:text-blue-100">
-									This workspace has {draftCount} draft{draftCount !== 1 ? 's' : ''}
-								</span>
-							{:else}
-								<span class="text-blue-600 dark:text-blue-200"> Everything is up to date </span>
-							{/if}
-						</div>
-					{/if}
-				</div>
-
-				<div class="flex items-center gap-2 shrink-0">
-					<Button
-						variant="default"
-						unifiedSize="sm"
-						onclick={showDraftsOnly ? openDraftCompare : openComparisonDrawer}
-					>
-						{#if showDraftsOnly}
-							Review & deploy drafts
-						{:else if !hasAnswer || changesAhead > 0}
-							Review & Deploy Changes
-						{:else}
-							Review & Update {currentNoun}
-						{/if}
-					</Button>
-				</div>
-			</div>
-		</div>
-	</div>
+	<!-- In the band, not a banner: the breadcrumb already says which fork this is, so all this has
+	     to carry is how far it has drifted and the way to review that. The per-kind breakdown, the
+	     CI line and the conflict count live on the compare page the button opens. -->
+	<PageHeaderContent actions={forkAction} />
 {/if}
+
+{#snippet forkAction()}
+	{@const total = comparison?.summary.total_diffs ?? 0}
+	{@const conflicts = comparison?.summary.conflicts ?? 0}
+	<!-- What the comparison has to say is a mark beside the button, never instead of it: a fork
+	     still being counted, or one whose count failed, is exactly when a reader wants the page
+	     that does the counting properly. The button below renders in every state. -->
+	{#if loading}
+		<span class="text-2xs text-tertiary">Checking for changes…</span>
+	{:else if error}
+		<span class="text-2xs text-red-600 dark:text-red-400" title={error}>Comparison failed</span>
+	{:else if showDraftsOnly}
+		<Badge color="blue" small>
+			{draftCount} draft{draftCount !== 1 ? 's' : ''}
+		</Badge>
+	{:else if total > 0}
+		<!-- Which way the drift goes is the thing to know at a glance: ahead is what this fork has
+		     to give its parent, behind is what it has yet to take. -->
+		<!-- The colours and the icons the compare page gives these three, so the counts in the bar
+		     and the rows behind the button say the same thing the same way. -->
+		{#if changesAhead > 0}
+			<Badge
+				color="green"
+				small
+				clickable
+				onclick={() => openCompareDir('deploy_to')}
+				title="{changesAhead} ahead of {parentWorkspaceId} — review what this {currentNoun} has to give"
+			>
+				<ArrowUp class="w-3 h-3 inline" />
+				{changesAhead}{compactCounts ? '' : ' ahead'}
+			</Badge>
+		{/if}
+		{#if changesBehind > 0}
+			<Badge
+				color="blue"
+				small
+				clickable
+				onclick={() => openCompareDir('update')}
+				title="{changesBehind} behind {parentWorkspaceId} — review what this {currentNoun} has yet to take"
+			>
+				<ArrowDown class="w-3 h-3 inline" />
+				{changesBehind}{compactCounts ? '' : ' behind'}
+			</Badge>
+		{/if}
+		{#if conflicts > 0}
+			<!-- A conflict is ahead and behind at once, so it has no direction of its own; it opens
+			     the side the reader resolves it from before deploying. -->
+			<Badge
+				color="orange"
+				small
+				clickable
+				onclick={() => openCompareDir('deploy_to')}
+				title="{conflicts} conflicting item{conflicts !== 1 ? 's' : ''} — review them"
+			>
+				<AlertTriangle class="w-3 h-3 inline" />
+				{conflicts}{compactCounts ? '' : ` conflict${conflicts !== 1 ? 's' : ''}`}
+			</Badge>
+		{/if}
+		<!-- Drafts are a different axis from the drift beside them: ahead and behind count deployed
+		     items against the parent, this counts work in this fork that is not deployed anywhere
+		     yet. It shares blue with "behind" and is told apart by the pencil and by naming what it
+		     counts, rather than by an arrow that would read as a third direction. Clicking goes to
+		     the drafts half of the compare page rather than the drawer the button opens. It shows at
+		     every drift — a fork both behind and holding drafts said nothing about the drafts. -->
+		{#if draftCount > 0}
+			<Badge
+				color="blue"
+				small
+				clickable
+				onclick={openDraftCompare}
+				title="{draftCount} draft{draftCount !== 1
+					? 's'
+					: ''} in this {currentNoun}, not deployed anywhere yet — review and deploy"
+			>
+				<Pencil class="w-3 h-3 inline" />
+				{draftCount}{compactCounts ? '' : ` draft${draftCount !== 1 ? 's' : ''}`}
+			</Badge>
+		{/if}
+	{/if}
+	{#if showDraftsOnly}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			onclick={openDraftCompare}
+			title={`Review and deploy this workspace's drafts`}
+		>
+			Review & deploy drafts
+		</Button>
+	{:else}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			onclick={openComparisonDrawer}
+			title={hasAnswer
+				? `${forkAheadBehindMessage(changesAhead, changesBehind)} ${parentWorkspaceId} over ${total} items`
+				: `Review this ${currentNoun} against ${parentWorkspaceId}`}
+		>
+			{#if !hasAnswer || changesAhead > 0}
+				Review changes
+			{:else}
+				Review & Update {currentNoun}
+			{/if}
+		</Button>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/GitRepoViewer.svelte b/frontend/src/lib/components/GitRepoViewer.svelte
index 53ddea2a96..d00449f168 100644
--- a/frontend/src/lib/components/GitRepoViewer.svelte
+++ b/frontend/src/lib/components/GitRepoViewer.svelte
@@ -3,7 +3,6 @@
 	import { untrack } from 'svelte'
 	import { Alert, Button } from './common'
 	import S3FilePickerInner from './S3FilePickerInner.svelte'
-	import { base } from '$lib/base'
 	import { Loader, Loader2, ChevronDown, ChevronRight, ExternalLink } from 'lucide-svelte'
 	import { hubPaths } from '$lib/hub'
 	import { sleep } from '$lib/utils'
@@ -237,7 +236,7 @@
 			{#if runningJobId}
 				<a
 					class="inline-flex items-center gap-1 mt-2 text-sm underline"
-					href={`${base}/run/${runningJobId}?workspace=${ws}`}
+					href={`/run/${runningJobId}?workspace=${ws}`}
 					target="_blank"
 					rel="noreferrer noopener"
 				>
@@ -272,7 +271,7 @@
 				{#if runningJobId}
 					<a
 						class="inline-flex items-center gap-1 text-xs underline text-secondary"
-						href={`${base}/run/${runningJobId}?workspace=${ws}`}
+						href={`/run/${runningJobId}?workspace=${ws}`}
 						target="_blank"
 						rel="noreferrer noopener"
 					>
diff --git a/frontend/src/lib/components/GroupEditor.svelte b/frontend/src/lib/components/GroupEditor.svelte
index f8d0445840..b4229cf9f6 100644
--- a/frontend/src/lib/components/GroupEditor.svelte
+++ b/frontend/src/lib/components/GroupEditor.svelte
@@ -15,7 +15,7 @@
 	import Row from './table/Row.svelte'
 	import Cell from './table/Cell.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { canWrite } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import Label from './Label.svelte'
@@ -42,6 +42,7 @@
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
 	const actingUser = $derived(operatingUser.current)
+	const editRights = useEditRights()
 
 	const ROLE_TOOLTIPS = {
 		member:
@@ -92,7 +93,7 @@
 	// Derived for the same reason as the trigger editors: the acting user's role can land after
 	// the group does, and a snapshot taken first would stay read-only.
 	const can_write = $derived(
-		writeVerdict ?? (groupPerms !== undefined && canWrite(name, groupPerms, actingUser))
+		writeVerdict ?? (groupPerms !== undefined && editRights.canEditItem('group', name, groupPerms))
 	)
 	let group: Group | undefined
 	let instance_group: InstanceGroup | undefined = $state()
diff --git a/frontend/src/lib/components/HeaviestScriptsDrawer.svelte b/frontend/src/lib/components/HeaviestScriptsDrawer.svelte
new file mode 100644
index 0000000000..a4591924c9
--- /dev/null
+++ b/frontend/src/lib/components/HeaviestScriptsDrawer.svelte
@@ -0,0 +1,201 @@
+<script lang="ts">
+	import { WorkerService } from '$lib/gen'
+	import { resource } from 'runed'
+	import { Alert, Drawer, DrawerContent, Section, Skeleton } from './common'
+	import TextInput from './text_input/TextInput.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import Select from './select/Select.svelte'
+	import DataTable from './table/DataTable.svelte'
+	import Head from './table/Head.svelte'
+	import Cell from './table/Cell.svelte'
+	import { formatMemory, msToReadableTime } from '$lib/utils'
+	import { logFeatureUsage } from '$lib/utils/featureUsage'
+
+	interface Props {
+		workerGroups: string[]
+	}
+
+	let { workerGroups }: Props = $props()
+
+	const WINDOWS = {
+		'24h': 24 * 3600,
+		'7d': 7 * 24 * 3600,
+		'30d': 30 * 24 * 3600
+	}
+	const ORDERS = {
+		total_duration: 'Total runtime',
+		max_memory: 'Max memory',
+		cpu: 'CPU time'
+	} as const
+	type OrderBy = keyof typeof ORDERS
+	// The server gathers every run without a stable path (previews, dependency jobs) under this one.
+	const ADHOC_PATH = '<adhoc>'
+
+	let drawer: Drawer | undefined = $state()
+	let opened = $state(false)
+	let windowKey: keyof typeof WINDOWS = $state('24h')
+	let orderBy: OrderBy = $state('total_duration')
+	let workerGroup: string | undefined = $state()
+	let workspace = $state('')
+
+	export function openDrawer(group?: string) {
+		workerGroup = group
+		opened = true
+		drawer?.openDrawer()
+		logFeatureUsage('worker_resource_stats', 'opened')
+	}
+
+	const stats = resource(
+		() => ({ opened, windowKey, orderBy, workerGroup, workspace: workspace.trim() }),
+		async (q, _, { signal }) => {
+			if (!q.opened) return undefined
+			try {
+				return await WorkerService.getRunnableStats({
+					windowSecs: WINDOWS[q.windowKey],
+					orderBy: q.orderBy,
+					workerGroup: q.workerGroup || undefined,
+					workspace: q.workspace || undefined
+				})
+			} finally {
+				// A slower answer for filters no longer selected must not replace the current one:
+				// `resource` drops the abort error thrown in its place.
+				signal.throwIfAborted()
+			}
+		},
+		{ debounce: 200 }
+	)
+
+	// Many scripts run for well under a second, which `msToReadableTime` rounds to "0.0s".
+	function duration(ms: number) {
+		return ms < 1000 ? `${Math.round(ms)}ms` : msToReadableTime(ms, 1)
+	}
+
+	function cores(cpuMs: number, durationMs: number) {
+		return durationMs > 0 ? (cpuMs / durationMs).toFixed(2) : '-'
+	}
+</script>
+
+<Drawer bind:this={drawer} size="1100px" on:close={() => (opened = false)}>
+	<DrawerContent title="Heaviest scripts" on:close={drawer?.closeDrawer}>
+		<Section
+			label="Resource usage per script"
+			tooltip="Aggregated by the workers once an hour, per script and worker group, so the last hour is incomplete. Memory is the peak of the job's main process. CPU time counts that process and the child processes it waited for. Scripts run inside the worker process (SQL, native TypeScript) and jobs of dedicated workers report neither, and a killed job reports no CPU time."
+		>
+			{#snippet action()}
+				<ToggleButtonGroup bind:selected={windowKey} noWFull>
+					{#snippet children({ item })}
+						{#each Object.keys(WINDOWS) as key (key)}
+							<ToggleButton value={key} label={key} size="sm" {item} />
+						{/each}
+					{/snippet}
+				</ToggleButtonGroup>
+			{/snippet}
+
+			<div class="flex flex-wrap items-center gap-4 pb-4">
+				<div class="flex items-center gap-2">
+					<span class="text-xs text-secondary">Sort by</span>
+					<ToggleButtonGroup
+						bind:selected={
+							() => orderBy,
+							(v) => {
+								orderBy = v
+								logFeatureUsage('worker_resource_stats', 'sort', { key: v })
+							}
+						}
+						noWFull
+					>
+						{#snippet children({ item })}
+							{#each Object.entries(ORDERS) as [value, label] (value)}
+								<ToggleButton {value} {label} size="sm" {item} />
+							{/each}
+						{/snippet}
+					</ToggleButtonGroup>
+				</div>
+				<div class="w-48">
+					<Select
+						items={workerGroups.map((g) => ({ label: g, value: g }))}
+						bind:value={workerGroup}
+						placeholder="All worker groups"
+						clearable
+						size="sm"
+					/>
+				</div>
+				<div class="w-48">
+					<TextInput
+						bind:value={workspace}
+						inputProps={{ placeholder: 'Workspace id' }}
+						size="sm"
+					/>
+				</div>
+			</div>
+
+			{#if stats.error}
+				<Alert type="error" title="Failed to load the script statistics">
+					{stats.error.message}
+				</Alert>
+			{:else if stats.current === undefined}
+				<Skeleton layout={[[8]]} />
+			{:else if stats.current.length === 0}
+				<p class="text-secondary text-xs">No jobs were recorded for this selection.</p>
+			{:else}
+				<DataTable size="sm" noBorder={false} rounded={true}>
+					<Head>
+						<tr>
+							<Cell head first>Script</Cell>
+							<Cell head>Workspace</Cell>
+							<Cell head>Worker group</Cell>
+							<Cell head numeric>Jobs</Cell>
+							<Cell head numeric>Total runtime</Cell>
+							<Cell head numeric>Avg runtime</Cell>
+							<Cell head numeric>Max memory</Cell>
+							<Cell head numeric>Avg memory</Cell>
+							<Cell head numeric>CPU time</Cell>
+							<Cell head numeric last>Avg CPUs</Cell>
+						</tr>
+					</Head>
+					<tbody>
+						{#each stats.current as s (s.workspace_id + '\0' + s.runnable_path + '\0' + s.worker_group)}
+							<tr class="border-b last:border-b-0">
+								<Cell first class="text-xs text-primary">
+									{#if s.runnable_path === ADHOC_PATH}
+										<span class="text-secondary">Previews and other ad-hoc runs</span>
+									{:else}
+										<span class="font-mono">{s.runnable_path}</span>
+									{/if}
+								</Cell>
+								<Cell class="text-xs text-primary">{s.workspace_id}</Cell>
+								<Cell class="text-xs text-primary">{s.worker_group}</Cell>
+								<Cell numeric class="text-xs text-primary">{s.job_count}</Cell>
+								<Cell numeric class="text-xs text-primary">
+									{duration(s.total_duration_ms)}
+								</Cell>
+								<Cell numeric class="text-xs text-primary">
+									<!-- A workflow suspended and not yet completed has time recorded and no job. -->
+									{s.job_count > 0 ? duration(s.total_duration_ms / s.job_count) : '-'}
+								</Cell>
+								{#if s.memory_sample_count > 0}
+									<Cell numeric class="text-xs text-primary">
+										{formatMemory(s.max_memory_peak)}
+									</Cell>
+									<Cell numeric class="text-xs text-primary">
+										{formatMemory(Math.round(s.sum_memory_peak / s.memory_sample_count))}
+									</Cell>
+								{:else}
+									<Cell numeric class="text-xs text-secondary">-</Cell>
+									<Cell numeric class="text-xs text-secondary">-</Cell>
+								{/if}
+								<Cell numeric class="text-xs text-primary">
+									{duration(s.total_cpu_ms)}
+								</Cell>
+								<Cell numeric last class="text-xs text-primary">
+									{cores(s.total_cpu_ms, s.total_duration_ms)}
+								</Cell>
+							</tr>
+						{/each}
+					</tbody>
+				</DataTable>
+			{/if}
+		</Section>
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/lib/components/InputTransformForm.svelte b/frontend/src/lib/components/InputTransformForm.svelte
index 8d758ebf71..9f8c77ce77 100644
--- a/frontend/src/lib/components/InputTransformForm.svelte
+++ b/frontend/src/lib/components/InputTransformForm.svelte
@@ -12,7 +12,7 @@
 	import type { Schema } from '$lib/common'
 	import type { InputCat, DynamicInput as DynamicInputTypes } from '$lib/utils'
 	import { createEventDispatcher, getContext, onDestroy, untrack, type Snippet } from 'svelte'
-	import { computeShow } from '$lib/utils'
+	import { computeShow, quickjsSettled } from '$lib/utils/quickjsEval.svelte'
 
 	import ArgInput from './ArgInput.svelte'
 	import FieldHeader from './FieldHeader.svelte'
@@ -479,8 +479,9 @@
 				contextArgs[key] = otherArgValue
 			})
 
-			const shouldShow = computeShow(argName, schemaProperty.showExpr, contextArgs)
-			if (shouldShow || hasJavascript) {
+			const shouldShow = hasJavascript || computeShow(schemaProperty.showExpr, contextArgs)
+			if (shouldShow === undefined) return
+			if (shouldShow) {
 				hidden = false
 			} else if (!hidden) {
 				hidden = true
@@ -596,6 +597,7 @@
 		JSON.stringify(schema)
 		JSON.stringify(arg)
 		JSON.stringify(otherArgs)
+		quickjsSettled()
 
 		untrack(() => handleFieldVisibility(schema, arg, otherArgs))
 	})
diff --git a/frontend/src/lib/components/InstanceSettings.svelte b/frontend/src/lib/components/InstanceSettings.svelte
index 1476b9ad87..a1a0f214d3 100644
--- a/frontend/src/lib/components/InstanceSettings.svelte
+++ b/frontend/src/lib/components/InstanceSettings.svelte
@@ -29,6 +29,7 @@
 	import SettingsPageHeader from './settings/SettingsPageHeader.svelte'
 	import WorkspaceRegistries from './instanceSettings/WorkspaceRegistries.svelte'
 	import DbHealth from './instanceSettings/DbHealth.svelte'
+	import OidcSigningStatus from './instanceSettings/OidcSigningStatus.svelte'
 
 	interface Props {
 		tab?: string
@@ -1186,6 +1187,15 @@
 				description="On-demand database diagnostics. Analyze table sizes, job retention, connection pool health, vacuum status, and more."
 			/>
 			<DbHealth />
+		{:else if category == 'OIDC signing'}
+			<SettingsPageHeader
+				title="OIDC signing"
+				description="What signs the OIDC tokens Windmill issues, and the keys its JWKS serves to verifiers. Read-only: signing is configured with environment variables."
+				link="https://www.windmill.dev/docs/core_concepts/oidc#signing-key"
+			/>
+			{#if $enterpriseLicense}
+				<OidcSigningStatus />
+			{/if}
 		{:else if category == 'Auth/OAuth/SAML'}
 			<AuthSettings
 				bind:oauths
diff --git a/frontend/src/lib/components/JobArgs.svelte b/frontend/src/lib/components/JobArgs.svelte
index 64ca912608..e0712d66c7 100644
--- a/frontend/src/lib/components/JobArgs.svelte
+++ b/frontend/src/lib/components/JobArgs.svelte
@@ -15,6 +15,7 @@
 	import { isWindmillTooBigObject } from './job_args'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	interface Props {
 		id?: string | undefined
@@ -246,7 +247,7 @@ ${Object.entries(displayArgs)
 		If using the wmill client in your code, set the following env variables:
 		<pre
 			><code
-				>BASE_URL="{window.location.origin}"
+				>BASE_URL="{apiBaseUrl()}"
 WM_TOKEN="{'<TOKEN>'}"</code
 			></pre
 		>
diff --git a/frontend/src/lib/components/JobTokenScopesSetting.svelte b/frontend/src/lib/components/JobTokenScopesSetting.svelte
new file mode 100644
index 0000000000..6ef1ecf3c4
--- /dev/null
+++ b/frontend/src/lib/components/JobTokenScopesSetting.svelte
@@ -0,0 +1,89 @@
+<script lang="ts">
+	import Toggle from './Toggle.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import ScopeSelector from './settings/ScopeSelector.svelte'
+
+	interface Props {
+		/** `null`/`undefined`: the job token has the full permissions of the identity it runs as. */
+		value: string[] | null | undefined
+		kind: 'script' | 'flow' | 'step'
+		/** Match the toggles listed around it. */
+		size?: 'xs' | 'sm'
+		textClass?: string
+	}
+
+	let { value = $bindable(), kind, size = 'sm', textClass }: Props = $props()
+
+	const OIDC_ONLY = ['oidc:write']
+
+	type Mode = 'oidc_only' | 'no_api' | 'custom'
+
+	function modeOf(scopes: string[]): Mode {
+		if (scopes.length === 0) return 'no_api'
+		if (scopes.length === 1 && scopes[0] === OIDC_ONLY[0]) return 'oidc_only'
+		return 'custom'
+	}
+
+	// Derived from `value` so an edit made elsewhere (the flow YAML) shows here; the flag only
+	// keeps "Custom" selected while a custom list happens to equal a preset.
+	let customPicked = $state(false)
+	const mode: Mode = $derived(customPicked ? 'custom' : modeOf(value ?? OIDC_ONLY))
+
+	function setMode(next: Mode) {
+		customPicked = next === 'custom'
+		value =
+			next === 'oidc_only' ? [...OIDC_ONLY] : next === 'no_api' ? [] : [...(value ?? [])]
+	}
+</script>
+
+<div class="flex flex-col gap-2">
+	<Toggle
+		{size}
+		{textClass}
+		checked={value != null}
+		on:change={() => {
+			if (value != null) {
+				value = null
+			} else {
+				setMode('oidc_only')
+			}
+		}}
+		options={{
+			right: 'Restrict the job token',
+			rightTooltip:
+				"Limit what the WM_TOKEN of this " +
+				kind +
+				"'s jobs can do through the API, e.g. only mint an OIDC token. Use it for code that handles untrusted input, such as AI agents."
+		}}
+	/>
+	{#if value != null}
+		<ToggleButtonGroup selected={mode} onSelected={(v) => setMode(v)}>
+			{#snippet children({ item })}
+				<ToggleButton value="oidc_only" label="OIDC token only" {item} />
+				<ToggleButton value="no_api" label="No API access" {item} />
+				<ToggleButton value="custom" label="Custom" {item} />
+			{/snippet}
+		</ToggleButtonGroup>
+		{#if mode === 'custom'}
+			<ScopeSelector
+				bind:selectedScopes={() => value ?? [], (scopes) => (value = [...scopes])}
+				emptyLabel="No scopes selected. The job token can only reach its own job."
+			/>
+		{/if}
+		<p class="text-2xs text-secondary">
+			{#if kind === 'step'}
+				The <code>WM_TOKEN</code> of every job this step runs can only do what these scopes allow, on top
+				of the flow's own restriction. Loop and branch bodies, and AI agent tools, inherit it.
+			{:else}
+				The <code>WM_TOKEN</code> of every job of this {kind} can only do what these scopes allow. Jobs
+				it starts, {kind === 'flow' ? 'its steps, ' : ''}and AI agent tools inherit the restriction.
+			{/if}
+			Variables and resources passed as <code>$var:</code>/<code>$res:</code> inputs, an AI agent's provider
+			resource, relative imports and object storage each need a read scope, and script state
+			(<code>getState</code>/<code>setState</code>) needs <code>resources:write</code>. Write scopes on scripts,
+			flows, schedules or triggers let a job escape the restriction. Jobs with a restricted token never
+			run on dedicated workers.
+		</p>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/JsonEditor.svelte b/frontend/src/lib/components/JsonEditor.svelte
index 8a42200ea8..3d23d16623 100644
--- a/frontend/src/lib/components/JsonEditor.svelte
+++ b/frontend/src/lib/components/JsonEditor.svelte
@@ -19,6 +19,7 @@
 		class?: string | undefined
 		disabled?: boolean
 		fixedOverflowWidgets?: boolean
+		placeholder?: string
 	}
 
 	let {
@@ -30,7 +31,8 @@
 		loadAsync = false,
 		class: clazz = undefined,
 		disabled = false,
-		fixedOverflowWidgets = true
+		fixedOverflowWidgets = true,
+		placeholder = undefined
 	}: Props = $props()
 
 	let tooBig = $derived(code && code?.length > 1000000)
@@ -101,6 +103,7 @@
 				class={clazz}
 				{disabled}
 				{fixedOverflowWidgets}
+				{placeholder}
 				renderLineHighlight="none"
 			/>
 		</div>
diff --git a/frontend/src/lib/components/LabelsInput.svelte b/frontend/src/lib/components/LabelsInput.svelte
index cd85b9fd76..313c491349 100644
--- a/frontend/src/lib/components/LabelsInput.svelte
+++ b/frontend/src/lib/components/LabelsInput.svelte
@@ -17,6 +17,7 @@
 		 * button needs it: without it that text is invisible to the editor's dirty state,
 		 * so it is silently dropped on close and cannot even enable Save on its own. */
 		onPendingChange?: (pending: string) => void
+		disabled?: boolean
 	}
 
 	let {
@@ -24,7 +25,8 @@
 		onchange,
 		class: clazz = '',
 		workspace,
-		onPendingChange
+		onPendingChange,
+		disabled = false
 	}: Props = $props()
 
 	let adding = $state(false)
@@ -140,12 +142,14 @@
 	{#each labels ?? [] as label (label)}
 		<Badge color="blue" small>
 			{label}
-			<button class="ml-0.5 hover:text-red-500" onclick={() => removeLabel(label)}>
-				<X size={10} />
-			</button>
+			{#if !disabled}
+				<button class="ml-0.5 hover:text-red-500" onclick={() => removeLabel(label)}>
+					<X size={10} />
+				</button>
+			{/if}
 		</Badge>
 	{/each}
-	{#if adding}
+	{#if adding && !disabled}
 		<div class="relative">
 			<input
 				bind:this={inputEl}
@@ -189,7 +193,7 @@
 				</div>
 			{/if}
 		</div>
-	{:else}
+	{:else if !disabled}
 		<Button
 			variant="subtle"
 			unifiedSize="xs"
diff --git a/frontend/src/lib/components/LogSnippetViewer.svelte b/frontend/src/lib/components/LogSnippetViewer.svelte
index 8aa1ad9dec..ce913cb6c2 100644
--- a/frontend/src/lib/components/LogSnippetViewer.svelte
+++ b/frontend/src/lib/components/LogSnippetViewer.svelte
@@ -36,9 +36,10 @@
 	let html = highlightSnippet(untrack(() => content))
 </script>
 
-<button onclick={onClick} class="font-light !m-0 !p-0">
-	<pre
-		class="bg-surface-secondary hover:bg-surface px-2 py-1 text-secondary text-xs w-[100%] whitespace-pre border min-w-full text-start">
-{@html html}
-</pre>
-</button>
+<button
+	type="button"
+	onclick={onClick}
+	title="Show in context"
+	class="block w-full min-w-full px-3 py-0.5 text-left font-mono text-2xs text-primary whitespace-pre hover:bg-surface-hover focus-visible:bg-surface-hover focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-inset focus-visible:ring-border-accent"
+	>{@html html}</button
+>
diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index be4ecb5b36..f15b87f9ef 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -14,7 +14,6 @@
 	import { ClipboardCopy, Download, Expand, Loader2, Timer, Cpu } from 'lucide-svelte'
 	import { Button, Drawer, DrawerContent } from './common'
 	import { copyToClipboard } from '$lib/utils'
-	import { base } from '$lib/base'
 	import { withExternalDomain } from '$lib/externalDomain'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
@@ -253,7 +252,7 @@
 		}
 	})
 	let logsApiPath = $derived(appendViewToken(`/w/${$operatingWorkspace}/jobs_u/get_logs/${jobId}`))
-	let downloadHref = $derived(withExternalDomain(`${base}/api${logsApiPath}`))
+	let downloadHref = $derived(withExternalDomain(`/api${logsApiPath}`))
 	let downloadName = $derived(`windmill_logs_${jobId}.txt`)
 	let truncatedContent = $derived(
 		truncateContent(effectiveContent, loadedFromObjectStore, LOG_LIMIT)
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index 76f4a2b995..1199d01079 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -30,7 +30,6 @@
 	import { OauthService, UserService, WorkspaceService } from '$lib/gen'
 	import { usersWorkspaceStore, workspaceStore, userStore } from '$lib/stores'
 	import { emptyString, escapeHtml, parseQueryParams } from '$lib/utils'
-	import { base } from '$lib/base'
 	import { getUserExt } from '$lib/user'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
@@ -354,7 +353,7 @@
 				// See (root)/+layout.svelte for why /projects/import skips the picker.
 			} else if (
 				resolvedRd?.startsWith('/user/workspaces') ||
-				resolvedRd?.startsWith(`${base}/projects/import`)
+				resolvedRd?.startsWith('/projects/import')
 			) {
 				goto(resolvedRd)
 			} else if (resolvedRd == '/#user-settings') {
@@ -575,7 +574,7 @@
 		if (automatic) params.set('auto', 'true')
 		if (guestApp) params.set('guest_app', guestApp)
 		const query = params.size > 0 ? '?' + params.toString() : ''
-		let url = base + '/api/oauth/login/' + provider + query
+		let url = '/api/oauth/login/' + provider + query
 		console.log('storeRedirect', popup, url)
 
 		if (popup) {
@@ -856,7 +855,7 @@
 					{#if smtpConfigured}
 						<div class="text-center pt-2">
 							<a
-								href="{base}/user/forgot-password"
+								href="/user/forgot-password"
 								class="text-2xs text-blue-500 hover:text-blue-600 dark:text-blue-400 dark:hover:text-blue-300"
 							>
 								Forgot password?
diff --git a/frontend/src/lib/components/ModulePreview.svelte b/frontend/src/lib/components/ModulePreview.svelte
index be62557b81..ac13a8fced 100644
--- a/frontend/src/lib/components/ModulePreview.svelte
+++ b/frontend/src/lib/components/ModulePreview.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { setAiDecisionStep } from './flows/aiDecisionBranching'
 	import type { Schema } from '$lib/common'
 	import { type FlowModule, type Job } from '$lib/gen'
 	import { CornerDownLeft, Loader2 } from 'lucide-svelte'
@@ -43,6 +44,9 @@
 		runInputKeys = undefined
 	}: Props = $props()
 
+	// The test form takes sample questions, which are not the step's to branch on.
+	setAiDecisionStep({ id: undefined })
+
 	const { flowStore } = getContext<FlowEditorContext>('FlowEditorContext')
 	let moduleTest: ModuleTest | undefined = $state()
 
diff --git a/frontend/src/lib/components/ModulePreviewForm.svelte b/frontend/src/lib/components/ModulePreviewForm.svelte
index 093661c1e8..31fb46c97a 100644
--- a/frontend/src/lib/components/ModulePreviewForm.svelte
+++ b/frontend/src/lib/components/ModulePreviewForm.svelte
@@ -8,6 +8,7 @@
 	import { getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
 	import { evalValue } from './flows/utils.svelte'
+	import { quickjsReady, quickjsSettled } from '$lib/utils/quickjsEval.svelte'
 	import { memoryPropertyFor } from './flows/flowInfers'
 	import type { FlowModule } from '$lib/gen'
 	import type { PickableProperties } from './flows/previousResults'
@@ -155,9 +156,12 @@
 	loadResourceTypes()
 
 	let initialized = $state(false)
+	quickjsReady()
 
+	// Inputs mounted before the engine can evaluate fill in their defaults, which then read as
+	// manual edits and win over the evaluated values.
 	$effect.pre(() => {
-		if (!initialized) {
+		if (!initialized && quickjsSettled()) {
 			if (stepsInputArgs) {
 				stepsInputArgs?.updateStepArgs(mod.id, flowStateStore.val, flowStore?.val, previewArgs?.val)
 				initialized = true
diff --git a/frontend/src/lib/components/ModuleTest.svelte b/frontend/src/lib/components/ModuleTest.svelte
index e35ac291c9..8d2b51e8d0 100644
--- a/frontend/src/lib/components/ModuleTest.svelte
+++ b/frontend/src/lib/components/ModuleTest.svelte
@@ -2,6 +2,7 @@
 	import {
 		ScriptService,
 		type AiAgent,
+		type AiDecision,
 		type FlowModule,
 		type InputTransform,
 		type Job
@@ -21,6 +22,7 @@
 	import { AGENT_FLOW_LOCAL_KEYS } from './flows/agentResourceUtils'
 	import { agentTestInputTransforms } from './flows/agentFormFields'
 	import { sendUserToast } from '$lib/toast'
+	import { quickjsReady } from '$lib/utils/quickjsEval.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
@@ -67,7 +69,8 @@
 	// that follow each flow edit stay quiet, so without this a failing expression is silently
 	// `undefined` in what the run is built from. Manually edited args are preserved across the
 	// refresh by `initializeFromSchema`.
-	export function runTestWithStepArgs() {
+	export async function runTestWithStepArgs() {
+		await quickjsReady()
 		stepsInputArgs?.updateStepArgs(
 			mod.id,
 			flowStateStore.val,
@@ -212,6 +215,28 @@
 				callbacks,
 				previewBase
 			)
+		} else if (val.type == 'aidecision') {
+			const { schema } = await loadSchemaFromModule(mod, opWs)
+			const inputTransforms = Object.fromEntries(
+				Object.keys(args).map((key) => [key, { expr: `flow_input.${key}`, type: 'javascript' }])
+			) as AiDecision['input_transforms']
+			await jobLoader?.runFlowPreview(
+				args,
+				{
+					value: {
+						modules: [
+							{
+								id: mod.id,
+								value: { type: 'aidecision', input_transforms: inputTransforms, tag: val.tag }
+							}
+						]
+					},
+					summary: '',
+					schema
+				},
+				callbacks,
+				previewBase
+			)
 		} else {
 			throw Error('Not supported module type')
 		}
diff --git a/frontend/src/lib/components/NavBreadcrumb.svelte b/frontend/src/lib/components/NavBreadcrumb.svelte
new file mode 100644
index 0000000000..b053591fc0
--- /dev/null
+++ b/frontend/src/lib/components/NavBreadcrumb.svelte
@@ -0,0 +1,434 @@
+<!--
+@component
+The page header's breadcrumb: workspace / fork / kind / path, in one flat line.
+
+Every segment is a trigger for the picker that changes it — the workspace menu, the fork family
+picker, and the item drill picker for the kind and each path level — and all of them share one
+size and one icon size, so the line reads as one control rather than four.
+
+Two weights, not one: the segment that ends the trail is what the page is about and carries the
+weight, and everything leading to it is a step quieter. Which segment that is depends on the
+route — the workspace on home, a list page's own name, an item's summary (which the band draws,
+not this component) — so the lead can run the whole line.
+-->
+<script lang="ts">
+	import { Building, ChevronDown, Folder, GitFork, User } from 'lucide-svelte'
+	import WorkspaceItemKindIcon from './WorkspaceItemKindIcon.svelte'
+	import { Menu, Menubar } from '$lib/components/meltComponents'
+	import MeltButton from '$lib/components/meltComponents/MeltButton.svelte'
+	import BreadcrumbItemContent from './BreadcrumbItemContent.svelte'
+	import WorkspacePickerBody from '$lib/components/sidebar/WorkspacePickerBody.svelte'
+	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
+	import { userWorkspaces, workspaceStore, workspaceColor, superadmin } from '$lib/stores'
+	import { findWorkspaceRoot } from '$lib/utils/workspaceHierarchy'
+	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
+	import { twMerge } from 'tailwind-merge'
+	import { Badge } from '$lib/components/common'
+	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
+	import { forkAccentStyle } from '$lib/utils/forkColor'
+	import DevWorkspaceBadge from './DevWorkspaceBadge.svelte'
+	import { page } from '$app/state'
+	import { navPageFor } from './sidebar/navPages'
+	import { copyToClipboard, getContrastTextColor } from '$lib/utils'
+	import { KIND_LABEL_LOWER, kindKey } from '$lib/components/workspacePicker'
+	import type { PageHeaderItem, PageHeaderSection } from './pageHeaderRegistry.svelte'
+	import type { Snippet } from 'svelte'
+
+	let {
+		item,
+		section,
+		afterName,
+		actingWorkspaceId,
+		narrow = false,
+		nameOnly = false
+	}: {
+		item?: PageHeaderItem
+		section?: PageHeaderSection
+		/** What sits beside the page's name: a mark like a documentation tooltip, or a control
+		 *  that acts on the thing named. */
+		afterName?: Snippet
+		/** The workspace the page acts on, when it differs from the one the app is pointed at. */
+		actingWorkspaceId?: string
+		/** The bar is short of room: the path holds a tighter cap, so it cannot claim a third of the
+		 *  line before anything else has given way. The names truncate at every width either way. */
+		narrow?: boolean
+		/** Only the page's own name, with no workspace part and no picker — the band inside a
+		 *  session's preview frame, where the workspace is the host's and leading the reader out of
+		 *  it is exactly what that band must not offer. The page still has to say what it is. */
+		nameOnly?: boolean
+	} = $props()
+
+	const scopeId = $derived(actingWorkspaceId ?? $workspaceStore ?? undefined)
+	const homeHref = $derived(
+		actingWorkspaceId ? `/?workspace=${encodeURIComponent(actingWorkspaceId)}` : `/`
+	)
+
+	// With no item or section registered, the route still says where the user is: Runs, Variables,
+	// and the rest name themselves in the breadcrumb rather than leaving it at the workspace.
+	// Home is the root the workspace part already stands for, so it names no page of its own.
+	const routePage = $derived.by(() => {
+		if (item || section) return undefined
+		const found = navPageFor(page.url.pathname)
+		return found?.path === '/' ? undefined : found
+	})
+
+	/** One look for every segment, whichever picker it opens. */
+	const SEGMENT =
+		'flex items-center gap-1 min-w-0 px-1 py-0.5 rounded text-xs font-normal text-primary hover:bg-surface-hover hover:text-emphasis transition-colors'
+	/** The trail up to the last segment: where the thing lives, which the reader scans past. */
+	const LEAD = 'font-normal text-secondary'
+	/** The last segment: what the page is about, and the only part of the line with weight. */
+	const LAST = 'font-medium text-emphasis'
+	const ICON = 14
+	/** The workspace disc: the same glyph as the rest, with a ring of its own around it. */
+	const DISC = 20
+
+	/** Width of the name beside the chevron, so the picker can hang from the part's own left edge. */
+	let nameWidth = $state(0)
+	let workspaceMenu: Menu | undefined = $state(undefined)
+
+	// Its own confirmation under the path rather than the global toast: the answer belongs where
+	// the click was, and a toast for something this small is a lot of furniture.
+	let pathCopied = $state(false)
+	let copiedReset: ReturnType<typeof setTimeout> | undefined
+	async function copyPath() {
+		if (!item?.path || !(await copyToClipboard(item.path, false))) return
+		pathCopied = true
+		clearTimeout(copiedReset)
+		copiedReset = setTimeout(() => (pathCopied = false), 1500)
+	}
+
+	const family = $derived(findWorkspaceRoot(scopeId, $userWorkspaces ?? []))
+	const discColor = $derived(family?.color ?? $workspaceColor ?? 'rgb(var(--color-surface-sunken))')
+	const glyphColor = $derived(getContrastTextColor(discColor))
+
+	const forkable = useForkableWorkspaces({
+		workspaces: () => $userWorkspaces,
+		currentWorkspaceId: () => scopeId,
+		isSuperadmin: () => !!$superadmin
+	})
+	const forkableWorkspaces = $derived(forkable.current)
+	const currentWs = $derived(forkableWorkspaces.find((w) => w.id === scopeId))
+	const inFork = $derived(!!currentWs?.parent_workspace_id)
+	const showFork = $derived(inFork)
+	const familyName = $derived(family?.name ?? scopeId ?? '')
+	// The workspace the user actually stands in, which is the fork's own name inside a fork.
+	const scopeName = $derived(currentWs?.name ?? familyName)
+
+	// A fork wears its workspace colour and, for a dev workspace, its environment badge — the same
+	// two marks the fork chip carries everywhere else.
+	const forkAccent = $derived(inFork ? forkAccentStyle(currentWs?.color) : undefined)
+	// A dev workspace wears its environment; the root wears "prod", so which environment the user
+	// is standing in is answered the same way whichever one it is.
+	/** Whether this family has a dev workspace anywhere under it. */
+	const familyHasDev = $derived.by(() => {
+		const all = $userWorkspaces ?? []
+		const root = family?.id
+		return (
+			!!root && all.some((w) => w.is_dev_workspace && findWorkspaceRoot(w.id, all)?.id === root)
+		)
+	})
+	const envBadge = $derived.by(() => {
+		// "prod" only where a dev workspace exists to be the other half of the pair: a family with
+		// one environment gains nothing from naming it.
+		if (!inFork) return familyHasDev ? 'prod' : undefined
+		if (currentWs?.is_dev_workspace) return 'dev'
+		return undefined
+	})
+
+	// Which segment ends the trail, and so carries the weight. Everything before it is `LEAD`: on
+	// home that is nothing and the workspace itself is the subject, on a list page the page's name
+	// takes over, and on an item page the summary does — so the workspace, the fork and the path
+	// all step back to make room for it.
+	const namedAfterWorkspace = $derived(!!item || !!section || !!routePage)
+	const workspaceIsLast = $derived(!nameOnly && !namedAfterWorkspace)
+	// The summary is the band's, not the breadcrumb's (see PageHeaderBar), so the path reads as the
+	// last segment only for an item that has no summary to follow it.
+	const itemIsLast = $derived(!!item && !item.summaryContent && !item.summary)
+
+	// No hover fill: the chevron beside it is what reacts to the pointer. The accent stays on the
+	// fork's own name inside, so the family's name is not painted as if it were the fork.
+	//
+	// Inside a fork the family's name is the lead even where the workspace part ends the trail: the
+	// workspace the user stands in is the fork, and the family before it says which product that
+	// fork belongs to. Weighting both would name two workspaces as the subject.
+	const scopeChipClass = $derived(
+		twMerge(SEGMENT, 'hover:bg-transparent', workspaceIsLast && !showFork ? LAST : LEAD)
+	)
+
+	// Capped: a draft's path is a 40-character uuid slug, and the trail yields so grudgingly that
+	// one would push a page's buttons off the end of the bar.
+	const pathSegment = $derived(
+		twMerge(
+			SEGMENT,
+			'gap-1.5 overflow-hidden',
+			itemIsLast ? LAST : LEAD,
+			narrow ? 'max-w-[11rem]' : 'max-w-[16rem]'
+		)
+	)
+	// Copying is the one thing a segment does that leaves no mark on the page, so it is the one
+	// without a hover fill: the pointer and the confirmation under it are the affordance. A segment
+	// that opens the rename editor keeps the fill, which is what tells the two apart on sight.
+	const copyPathSegment = $derived(twMerge(pathSegment, 'hover:bg-transparent'))
+
+	// The chip keeps its colour wherever it is on the line — that colour is how a fork is told apart
+	// from its family. Only its weight follows the trail, dropping back once a page's name ends it.
+	const forkChipClass = $derived(
+		twMerge(
+			'flex items-center gap-1 min-w-0 px-1 rounded',
+			// A filled chip needs room around what it holds; an uncolored one is just the name and
+			// would only be pushed away from the slash before it.
+			forkAccent &&
+				'px-1.5 py-0.5 bg-[color:var(--fork-accent-bg)] dark:bg-[color:var(--fork-accent-bg-dark)] text-[color:var(--fork-accent-text)] dark:text-[color:var(--fork-accent-text-dark)]',
+			// Where the workspace part ends the trail, the fork is the segment that ends it, so it
+			// takes the weight on its own. Without a colour of its own it also has to take the text
+			// colour, since it would otherwise inherit the lead's from the link around it.
+			workspaceIsLast ? twMerge('font-semibold', !forkAccent && 'text-emphasis') : 'font-normal'
+		)
+	)
+
+	/** `f/demo` and `u/alice` name a folder and a user: the prefix becomes the path's icon. */
+	const scopeKind = $derived(item?.path?.split('/')[0])
+	/** The path's levels, the `f`/`u` prefix dropped — that is what the icon says. */
+	const pathLevels = $derived((item?.path ?? '').split('/').slice(1).filter(Boolean))
+</script>
+
+{#snippet workspaceDisc()}
+	<!-- The glyph is the same size as every other icon on the line; only the disc around it is
+	     larger, by the ring it needs to read as a disc at all. -->
+	<svg width={DISC} height={DISC} viewBox="0 0 {DISC} {DISC}" class="flex-shrink-0">
+		<circle cx={DISC / 2} cy={DISC / 2} r={DISC / 2} fill={discColor} />
+		<foreignObject x={(DISC - ICON) / 2} y={(DISC - ICON) / 2} width={ICON} height={ICON}>
+			<Building size={ICON} style={glyphColor ? `color: ${glyphColor}` : undefined} />
+		</foreignObject>
+	</svg>
+{/snippet}
+
+{#snippet itemKindIcon()}
+	<!-- No kind, no glyph: WorkspaceItemKindIcon falls through to the script icon, which would
+	     label an agent a script. -->
+	{#if item?.kind}<WorkspaceItemKindIcon kind={item.kind} size={ICON} />{/if}
+{/snippet}
+
+{#snippet sectionKindIcon()}
+	{#if section?.kind}<WorkspaceItemKindIcon kind={section.kind} size={ICON} />{/if}
+{/snippet}
+
+{#snippet folderIcon()}
+	<Folder size={ICON} class="flex-shrink-0 text-tertiary" />
+{/snippet}
+
+{#snippet userIcon()}
+	<User size={ICON} class="flex-shrink-0 text-tertiary" />
+{/snippet}
+
+{#snippet envBadgeMark()}
+	{#if envBadge === 'dev'}
+		<DevWorkspaceBadge
+			label={currentWs?.dev_workspace_label}
+			color={currentWs?.color}
+			fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+			class="text-3xs px-1 py-0"
+		/>
+	{:else if envBadge === 'prod'}
+		<Badge color="gray" small class="text-3xs px-1 py-0">prod</Badge>
+	{/if}
+{/snippet}
+
+{#snippet slash(extra = '')}
+	<!-- `extra` tops the workspace part's own 4px gap up to the 6px the breadcrumb puts around its
+	     other separators, so the slash before a fork is spaced like every other slash on the line. -->
+	<span class={twMerge('shrink-0 text-hint/40 text-xs', extra)} aria-hidden="true">/</span>
+{/snippet}
+
+<nav
+	aria-label="Breadcrumb"
+	class="flex items-center gap-1.5 min-w-0 text-xs font-normal text-primary"
+>
+	{#if !nameOnly}
+		<!-- One part for where the user is: the name of the workspace they are standing in — a fork
+	     included, in its own colour — leading home, and one chevron whose picker changes it. The
+	     picker lists the families and expands one to reach its forks, so a fork needs no part of
+	     its own here. -->
+		<!-- `shrink-[999]`: the whole trail can give width back, and this part gives it first. Flex
+		     takes it from the parts in proportion to what they ask for, so a factor this far above
+		     the rest means the names here are eaten down to their icons before the page's own name
+		     loses a character. -->
+		<div class="flex items-center min-w-0 shrink-[999]">
+			<!-- No hover fill on the name: the chevron beside it is the thing that lights up, and two
+		     boxes reacting to one pass of the pointer read as two controls fighting. -->
+			<!-- bind:clientWidth: the menu hangs from the chevron, so it is shifted back by the width of
+		     the name to line its left edge up with the disc. -->
+			<div class="flex items-center min-w-0" bind:clientWidth={nameWidth}>
+				<a
+					href={homeHref}
+					class={scopeChipClass}
+					title={showFork ? `${familyName} / ${scopeName}` : familyName}
+				>
+					<!-- The family's name goes before the fork's: the fork is where the work happens, the
+					     family is which product it is part of, and of the two that is the one a reader can
+					     do without. Both truncate to nothing rather than disappearing at a breakpoint —
+					     what is left then is what the part cannot be read without, the disc in the
+					     workspace's own colour, the fork mark and the environment. The hover title
+					     carries the names whole, and the picker beside it names them all. -->
+					<span class="flex items-center gap-1 min-w-0 shrink-[999]">
+						<BreadcrumbItemContent label={familyName} icon={workspaceDisc} />
+					</span>
+					{#if showFork}
+						{@render slash('mx-0.5')}
+						<span class={forkChipClass} style={forkAccent}>
+							<GitFork size={ICON} class="flex-shrink-0" />
+							<span class="truncate">{scopeName}</span>
+							{@render envBadgeMark()}
+						</span>
+					{:else}
+						{@render envBadgeMark()}
+					{/if}
+				</a>
+			</div>
+			<Menubar>
+				{#snippet children({ createMenu })}
+					<Menu
+						bind:this={workspaceMenu}
+						{createMenu}
+						usePointerDownOutside
+						placement="bottom-start"
+						class="h-auto"
+						contentStyle="margin-left: {-nameWidth}px"
+					>
+						{#snippet triggr({ trigger })}
+							<MeltButton
+								meltElement={trigger}
+								class="flex items-center h-9 px-1.5 rounded text-tertiary hover:bg-surface-hover hover:text-primary transition-colors"
+								title="Switch workspace"
+							>
+								<ChevronDown size={ICON} class="flex-shrink-0" />
+							</MeltButton>
+						{/snippet}
+						{#snippet children({ item: menuItem })}
+							<WorkspacePickerBody
+									item={menuItem}
+									collapseFamilies={actingWorkspaceId != undefined}
+									closeMenu={() => workspaceMenu?.close()}
+								/>
+						{/snippet}
+					</Menu>
+				{/snippet}
+			</Menubar>
+		</div>
+	{/if}
+
+	{#if !nameOnly && (item || section || routePage)}
+		{@render slash()}
+	{/if}
+
+	{#if item}
+		{#if item.path}
+			<!-- The path whole, as one label rather than a row of pickers: it is what a person reads
+			     to know which item this is, and what they reach for to paste somewhere else. -->
+			<div class="relative flex items-center min-w-0">
+				<!-- Past the cap the trail truncates; whatever the click does still has the path whole. -->
+				{#snippet pathLabel()}
+					{#if scopeKind === 'u'}
+						{@render userIcon()}
+					{:else}
+						{@render folderIcon()}
+					{/if}
+					{#each pathLevels as level, i (i)}
+						{#if i > 0}{@render slash()}{/if}
+						<!-- The scopes above the name absorb the squeeze, the name itself last: a path is
+						     read from its end, and which folder a thing is in is answerable from the
+						     picker while the thing's own name is not. -->
+						<span
+							class={i === pathLevels.length - 1
+								? 'truncate'
+								: 'truncate min-w-0 shrink-[999] max-w-[8rem]'}>{level}</span
+						>
+					{/each}
+				{/snippet}
+				{#if item.pathTrigger}
+					<!-- The page hangs its own rename off this segment, anchored here so the editor
+					     opens under the path rather than beside the summary. It wears the segment's
+					     own classes, so a clickable path reads the same as one that only copies. -->
+					{@render item.pathTrigger(pathLabel, pathSegment)}
+				{:else}
+					<button
+						class={copyPathSegment}
+						title="Copy path"
+						onclick={copyPath}
+						aria-label="Copy path {item.path}"
+					>
+						{@render pathLabel()}
+					</button>
+				{/if}
+				{#if afterName}{@render afterName()}{/if}
+				{#if pathCopied}
+					<span
+						class="absolute left-0 top-full mt-1 z-[6000] rounded-md border bg-surface px-2 py-1 text-2xs text-secondary shadow-md whitespace-nowrap"
+						role="status"
+					>
+						Path copied successfully
+					</span>
+				{/if}
+			</div>
+		{:else if item.kind}
+			<!-- The path is on its way: a page registers its kind as soon as it mounts and fills the
+			     path once it has loaded one. Naming the kind here reads as the answer and then jumps
+			     when the real path replaces it, so hold its place instead. The width is a plausible
+			     path's, which is what keeps the trail from shifting when it lands. -->
+			<span
+				class={twMerge(SEGMENT, 'hover:bg-transparent', itemIsLast ? LAST : LEAD)}
+				aria-label="Loading {KIND_LABEL_LOWER[item.kind]} path"
+				aria-busy="true"
+			>
+				{@render itemKindIcon()}
+				<Skeleton layout={[[{ h: 0.75, w: 100, minW: 96 }]]} class="w-24" />
+			</span>
+		{/if}
+	{:else if section?.kind}
+		<BreadcrumbSegment
+			label={KIND_LABEL_LOWER[section.kind]}
+			icon={sectionKindIcon}
+			extraClass={twMerge(SEGMENT, LAST)}
+			isCurrent
+			initialHighlight={kindKey(section.kind)}
+			initialScope={{ kind: section.kind }}
+			onPick={() => {}}
+		/>
+	{:else if section}
+		{#if section.parent}
+			<!-- Gives width back with the workspace part, before the section's own name does. -->
+			<span
+				class={twMerge(SEGMENT, LEAD, 'shrink-[999] hover:bg-transparent hover:text-secondary')}
+			>
+				<span class="truncate">{section.parent}</span>
+			</span>
+			{@render slash()}
+		{/if}
+		<!-- A section's own widget lays out as a row: its title, and whatever belongs with it. -->
+		<span
+			class={twMerge(
+				SEGMENT,
+				LAST,
+				'hover:bg-transparent hover:text-emphasis',
+				section.content ? '' : 'truncate'
+			)}
+			aria-current="page"
+		>
+			{#if section.content}{@render section.content()}{:else}{section.label}{/if}
+		</span>
+		{#if afterName}{@render afterName()}{/if}
+	{:else if routePage}
+		{@const RouteIcon = routePage.icon}
+		<!-- shrink-0: a page's own name is short and is the one part of the trail worth keeping
+		     whole, so the workspace and fork names give way first when the bar is full. -->
+		<span
+			class={twMerge(SEGMENT, LAST, 'shrink-0 hover:bg-transparent hover:text-emphasis')}
+			aria-current="page"
+		>
+			{#if RouteIcon}<RouteIcon size={ICON} class="flex-shrink-0 text-tertiary" />{/if}
+			<span class="truncate">{routePage.label}</span>
+		</span>
+		{#if afterName}{@render afterName()}{/if}
+	{/if}
+</nav>
diff --git a/frontend/src/lib/components/NoDirectDeployAlert.svelte b/frontend/src/lib/components/NoDirectDeployAlert.svelte
index d1017f7347..a3a249caf5 100644
--- a/frontend/src/lib/components/NoDirectDeployAlert.svelte
+++ b/frontend/src/lib/components/NoDirectDeployAlert.svelte
@@ -16,7 +16,8 @@
 	import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
 	import { devLabelKey, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
 	import { switchWorkspace } from '$lib/storeUtils'
-	import { Badge, Button } from './common'
+	import { Button, ButtonType } from './common'
+	import { twMerge } from 'tailwind-merge'
 	import Popover from './meltComponents/Popover.svelte'
 	import Toggle from './Toggle.svelte'
 	import { GitFork, Lock, ShieldOff } from 'lucide-svelte'
@@ -83,28 +84,35 @@
 				? `Edits in ${devLabelKey(canonicalDev.dev_workspace_label)}`
 				: 'Edits restricted'
 	)
+
+	// The Popover renders its trigger as a <button>, so this wears the design system's subtle
+	// button rather than containing one — a <Button> here would nest a button inside a button.
+	const triggerClass = twMerge(
+		'inline-flex items-center gap-1 rounded-md whitespace-nowrap transition-all',
+		ButtonType.VariantStyles.subtle,
+		ButtonType.UnifiedSizingClasses.sm,
+		ButtonType.UnifiedHeightClasses.sm,
+		ButtonType.UnifiedFontSizes.sm,
+		'text-xs'
+	)
 </script>
 
 {#if !operatingUser.current?.operator && activeDeployRulesets.length > 0}
 	<div class="my-2">
 		<Popover
 			placement="bottom-start"
-			class="inline-flex items-center"
+			class={triggerClass}
 			triggerAttrs={{ 'aria-label': badgeLabel }}
 		>
 			{#snippet trigger()}
-				<!-- `clickable` is unusable here: it renders the badge as a <button>, nested inside the
-				     one Popover wraps its trigger in. -->
-				<Badge small color={bypassActive ? 'yellow' : 'blue'} class="cursor-pointer">
-					{#if bypassActive}
-						<ShieldOff class="h-3 w-3" />
-					{:else if canonicalDev}
-						<GitFork class="h-3 w-3" />
-					{:else}
-						<Lock class="h-3 w-3" />
-					{/if}
-					{badgeLabel}
-				</Badge>
+				{#if bypassActive}
+					<ShieldOff size={ButtonType.UnifiedIconSizes.sm} class="shrink-0" />
+				{:else if canonicalDev}
+					<GitFork size={ButtonType.UnifiedIconSizes.sm} class="shrink-0" />
+				{:else}
+					<Lock size={ButtonType.UnifiedIconSizes.sm} class="shrink-0" />
+				{/if}
+				{badgeLabel}
 			{/snippet}
 			{#snippet content()}
 				<div class="flex flex-col gap-3 p-4 text-xs max-w-sm">
diff --git a/frontend/src/lib/components/PageHeaderBar.svelte b/frontend/src/lib/components/PageHeaderBar.svelte
new file mode 100644
index 0000000000..0cc47e58ca
--- /dev/null
+++ b/frontend/src/lib/components/PageHeaderBar.svelte
@@ -0,0 +1,227 @@
+<!--
+@component
+The bar every route wears, above the page content and beside the sidebar: the sidebar toggle, the
+workspace picker, then whatever the route registered — an item's breadcrumb and summary, or a
+section name — and the route's own buttons at the far end.
+
+The row's height matches the sidebar's own header row, so the two read as one band.
+-->
+<script lang="ts">
+	import { PanelLeft } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import { navDetached } from './sidebar/navDetached.svelte'
+	import { navHandleSlot } from './sidebar/navHandlePlacement.svelte'
+	import NavBreadcrumb from './NavBreadcrumb.svelte'
+	import { BAR_HEIGHT, pageHeader, PHONE_BAR } from './pageHeaderRegistry.svelte'
+	import ContextBridge from './ContextBridge.svelte'
+	import { afterNavigate } from '$app/navigation'
+	import { twMerge } from 'tailwind-merge'
+
+	let {
+		navHidden = false,
+		panelled = false
+	}: {
+		navHidden?: boolean
+		/** The sidebar is a panel over the page rather than a rail beside it — detached, or a
+		 *  window too narrow to seat one. Either way this bar carries the switch that opens it. */
+		panelled?: boolean
+	} = $props()
+
+	const content = $derived(pageHeader.content)
+	const actions = $derived(pageHeader.actions)
+
+	const item = $derived(content?.item)
+	const section = $derived(content?.section)
+	const hasSummary = $derived(!!item && !!(item.summaryContent || item.summary))
+
+	// Below this the trail holds a tighter cap on the path it draws. The names in it truncate on
+	// their own at any width (see NavBreadcrumb), so this is not a breakpoint the look changes at —
+	// it only stops a long path from claiming a third of a short bar before the squeeze starts.
+	const NARROW_BAR = 1000
+	const narrow = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < NARROW_BAR)
+	/** A phone's bar: the trail gives way before the page's buttons do (see the markup). */
+	const phone = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
+
+	// The band's edge is there to say "something is passing under me", so it is drawn only while
+	// something is. Scroll events do not bubble, but they do capture, so one listener on the window
+	// sees every box under the band — which matters because most pages scroll inside their own
+	// (the audit table, a detail page's panes) and never move this layout's own scroller.
+	let scrolledUnder = $state(false)
+	/** Sub-pixel layout and a border or two, between a box's top and the content box's. */
+	const AT_THE_TOP_PX = 4
+	function onScrollCapture(e: Event) {
+		const el = e.target as HTMLElement | null
+		if (!el || el.nodeType !== 1) return
+		const box = document.getElementById('content')
+		if (!box || !box.contains(el)) return
+		// The answer this event would give, before measuring anything. While it matches what the
+		// band already draws there is nothing to decide — which is the steady state of a scroll,
+		// and the two rects below each force a synchronous layout. This listener captures every
+		// scroller in the app (Monaco, the audit table, a run's logs), about once a frame while any
+		// of them moves, so the common path has to stay off the layout.
+		const next = el.scrollTop > 0
+		if (next === scrolledUnder) return
+		// Only a box that starts where the content does has anything passing under the band. The
+		// audit page's list begins 285px lower, behind its own chart and column headers, and a
+		// select's option list floats wherever it opens: neither moves anything under the header.
+		const top = el.getBoundingClientRect().top - box.getBoundingClientRect().top
+		if (top > AT_THE_TOP_PX) return
+		scrolledUnder = next
+	}
+	// A page left while scrolled would otherwise hand its edge to the next one, which may have
+	// nothing to scroll at all.
+	afterNavigate(() => (scrolledUnder = false))
+
+	const separator = $derived(pageHeader.content?.separator ?? 'onScroll')
+	const showEdge = $derived(separator === 'always' || (separator === 'onScroll' && scrolledUnder))
+</script>
+
+<svelte:window onscrollcapture={onScrollCapture} />
+
+<!-- The band owns its bottom edge, so a page never draws a second one under it. A page says which
+     rule it wants (see `separator` in the registry); the default shows the edge only while
+     something is passing under the bar. An inset shadow rather than a border: a border would make
+     the row 45px and every page below it would move a pixel the moment the edge appeared. -->
+<div
+	data-page-header
+	bind:clientWidth={() => pageHeader.barWidth, (w) => pageHeader.setBarWidth(w)}
+	class={twMerge(
+		'flex items-center gap-1 shrink-0 min-w-0 bg-surface transition-shadow duration-150',
+		// One row at every width. A wrapping row never squeezes anything — flex moves an item to the
+		// next line instead of taking it below its content width — so wrapping here would hand the
+		// trail a line of its own and leave it whole, which is the opposite of what a narrow bar
+		// wants: the trail truncating from its start.
+		phone ? `${BAR_HEIGHT} pl-1 pr-2` : `${BAR_HEIGHT} pl-2 pr-4`,
+		// The filling surface is what meets the right edge, so the bar keeps no gutter of its own
+		// there.
+		content?.actionsFill && 'pr-0',
+		// The small left padding is there to sit a button against: the sidebar handle, or the
+		// workspace disc, both of which carry their own visual margin. Embedded there is neither,
+		// and the page's name would start as bare text 8px from the edge.
+		navHidden && 'pl-4',
+		showEdge &&
+			'shadow-[inset_0_-1px_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_0_-1px_0_0_#374151] [html.github-dark_&]:shadow-[inset_0_-1px_0_0_rgb(var(--color-border-light))]'
+	)}
+>
+	{#if (navDetached.val || panelled) && !navHidden}
+		<!-- Reveals the hidden sidebar, and only that: the card follows the pointer, holding while it
+		     is on the handle, on the card, or in a menu either opened, and sliding back out when it
+		     leaves. Where no pointer hovers, a tap opens it and it stays until dismissed. Attaching
+		     it for good belongs to the toggle in the sidebar's own footer, where detaching it
+		     happened. Docked, the sidebar speaks for itself and nothing leads the bar. -->
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			data-nav-handle
+			onmouseenter={() => navHandleSlot.open()}
+			onmouseleave={() => navHandleSlot.scheduleClose()}
+		>
+			<!-- No tooltip: hovering here already slides the sidebar in, which says what the button
+			     does better than a label popping up over it. -->
+			<Button
+				variant="subtle"
+				unifiedSize="sm"
+				iconOnly
+				startIcon={{ icon: PanelLeft }}
+				aria-label="Show sidebar"
+				onclick={() => navHandleSlot.open()}
+			/>
+		</div>
+	{/if}
+
+	<!-- The breadcrumb yields width more slowly than the page's controls (shrink-[0.3]) but it does
+	     yield, at every width: the trail truncates from its start, so the squeeze is spent on the
+	     workspace and the folders before it ever reaches the name of the thing the page is about.
+	     The 5rem floor is what is left when every name in it has gone — the workspace disc, the
+	     fork mark and the environment badge, which is as small as the part can be and still say
+	     where the user is.
+	     An embed (`navHidden`) keeps the page's own name but drops the workspace part around it:
+	     the trail would offer to navigate the host's workspace, while the name is what says which
+	     page the controls beside it belong to.
+	     The 0.3 only holds against a summary or an actions box that shrinks too: alone, a factor
+	     sum below 1 makes flex hand out only that share of the overflow, and the bar overflows
+	     instead. -->
+	<div
+		class={twMerge(
+			'flex shrink-[0.3] min-w-[5rem]',
+			!hasSummary &&
+				(actions.length === 0 || (phone && !content?.actionsFlexible && !content?.actionsFill)) &&
+				'shrink'
+		)}
+	>
+		<!-- Bridged like the actions below: what a page hangs off its own name renders here, out of
+		     the tree that named it, and the rename editor in there asks that tree who the acting user
+		     is before it offers to rename anything. -->
+		<!-- Each fragment the band renders comes from another tree and reads that tree's state. The
+		     registry already tolerates a registration that cannot answer while its owner's data is
+		     being cleared (see `read`); the same window reaches rendering, and an error here would
+		     otherwise travel to the root and blank the app rather than the one fragment. A
+		     boundary per fragment keeps that to the fragment. -->
+		<svelte:boundary onerror={(e) => console.error('page header: breadcrumb failed to render', e)}>
+			{#key content?.contexts}
+				<ContextBridge contexts={content?.contexts}>
+					<NavBreadcrumb
+						{item}
+						{section}
+						{narrow}
+						nameOnly={navHidden}
+						afterName={content?.afterName}
+						actingWorkspaceId={content?.actingWorkspaceId}
+					/>
+				</ContextBridge>
+			{/key}
+		</svelte:boundary>
+	</div>
+
+	{#if item && hasSummary}
+		<!-- No kind icon: the page below is the item, and saying "this is a flow" above a flow
+		     editor tells the reader what they can already see. -->
+		<div class={twMerge('flex items-center gap-1 min-w-0', phone && 'shrink')}>
+			<!-- A dot rather than a slash: the summary names the same item the path just located, it
+			     is not another level of it. Inside this box so that it narrows with the summary. -->
+			<span class="shrink-0 text-hint/40 text-xs px-0.5" aria-hidden="true">·</span>
+			{#if item.summaryContent}
+				<svelte:boundary onerror={(e) => console.error('page header: summary failed to render', e)}>
+					{#key content?.contexts}
+						<ContextBridge contexts={content?.contexts}>
+							{@render item.summaryContent()}
+						</ContextBridge>
+					{/key}
+				</svelte:boundary>
+			{:else}
+				<span class="min-w-0 truncate text-xs font-medium text-emphasis">{item.summary}</span>
+			{/if}
+		</div>
+	{/if}
+
+	{#if actions.length > 0}
+		<!-- min-w-0, not shrink-0: a page whose actions are a filter row (Runs) puts a control in
+		     here that can give width back, and it can only do that if this box may shrink. A phone
+		     only tightens the gutter — pages fold their own buttons into a menu at that width, and
+		     a box that refused to shrink would make the one flexible field take its max instead. -->
+		<!-- `actionsFill`: the actions are a surface rather than a row, so they take the rest of the
+		     bar and run to its right edge, and they stretch its full height because that surface
+		     sits on the bottom edge. -->
+		<div
+			class={twMerge(
+				'flex',
+				// pl-4: the gap between the breadcrumb and the filling surface is bare bar, so it
+				// belongs here rather than inside that surface, where it would be filled.
+				content?.actionsFill
+					? 'flex-1 min-w-0 self-stretch items-stretch pl-4'
+					: 'ml-auto items-center',
+				!content?.actionsFill && (phone && !content?.actionsFlexible ? 'shrink-0' : 'min-w-0'),
+				!content?.actionsFill && (phone ? 'gap-1 pl-1' : 'gap-2 pl-4')
+			)}
+		>
+			{#each actions as entry, i (i)}
+				<svelte:boundary onerror={(e) => console.error('page header: actions failed to render', e)}>
+					{#key entry.contexts}
+						<ContextBridge contexts={entry.contexts}>
+							{@render entry.render()}
+						</ContextBridge>
+					{/key}
+				</svelte:boundary>
+			{/each}
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/PageHeaderContent.svelte b/frontend/src/lib/components/PageHeaderContent.svelte
new file mode 100644
index 0000000000..2630faf863
--- /dev/null
+++ b/frontend/src/lib/components/PageHeaderContent.svelte
@@ -0,0 +1,43 @@
+<!--
+@component
+Fills the layout's page header from the route that mounts it: the breadcrumb (an item's path, or a
+section name for a list) and the page's own buttons. Renders nothing itself.
+
+Only a route page mounts this. An editor nested in a session pane or a drawer must not take over
+the header, so nesting is decided by the caller rather than guessed from context.
+-->
+<script lang="ts">
+	import { onMount } from 'svelte'
+	import { pageHeader, type PageHeaderContent } from './pageHeaderRegistry.svelte'
+
+	let {
+		item,
+		section,
+		afterName,
+		actions,
+		actionsOrder,
+		actionsFlexible,
+		actionsFill,
+		separator,
+		contexts,
+		actingWorkspaceId,
+		barRightInset
+	}: PageHeaderContent = $props()
+
+	onMount(() => {
+		const id = pageHeader.register(() => ({
+			item,
+			section,
+			afterName,
+			actions,
+			actionsOrder,
+			actionsFlexible,
+			actionsFill,
+			separator,
+			contexts,
+			actingWorkspaceId,
+			barRightInset
+		}))
+		return () => pageHeader.release(id)
+	})
+</script>
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index f51d9b4536..da409b697a 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -8,7 +8,6 @@
 	import { twMerge } from 'tailwind-merge'
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { AppService, HelpersService } from '$lib/gen'
-	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { enterpriseLicense } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
@@ -267,7 +266,7 @@
 		{:else}
 			<a
 				target="_blank"
-				href="{base}/api{csvApiPath}"
+				href="/api{csvApiPath}"
 				class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
 				><div class="flex flex-row-reverse gap-2 items-center"><Download size={12} /> CSV</div></a
 			>
diff --git a/frontend/src/lib/components/PathEditPen.svelte b/frontend/src/lib/components/PathEditPen.svelte
new file mode 100644
index 0000000000..c74ea8dded
--- /dev/null
+++ b/frontend/src/lib/components/PathEditPen.svelte
@@ -0,0 +1,37 @@
+<!--
+@component
+The pen that opens an item's summary and path for editing, beside the breadcrumb that shows them.
+
+One affordance for both popovers behind it: an editor's, which edits the draft the next deploy
+writes, and a deployed page's, which saves straight away. They look the same because they mean
+the same thing to a reader — "rename this".
+-->
+<script lang="ts">
+	import { Pencil } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+
+	interface Props {
+		/** Names what the popover offers, for the tooltip and the accessible name. */
+		label: string
+		/** `hover` keeps the pen out of the way until the row is hovered, which is what the band
+		 *  wants beside a name; `always` is for a name with nothing else to point at, such as an
+		 *  item with no summary yet. */
+		visibility?: 'hover' | 'always'
+		/** Held visible while the popover it opens is open, whatever `visibility` says. */
+		open?: boolean
+	}
+
+	let { label, visibility = 'hover', open = false }: Props = $props()
+</script>
+
+<Button
+	variant="subtle"
+	unifiedSize="sm"
+	iconOnly
+	startIcon={{ icon: Pencil }}
+	title={label}
+	aria-label={label}
+	btnClasses={visibility === 'hover' && !open
+		? 'opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100'
+		: ''}
+/>
diff --git a/frontend/src/lib/components/PathEditPopover.svelte b/frontend/src/lib/components/PathEditPopover.svelte
new file mode 100644
index 0000000000..bcf6106be0
--- /dev/null
+++ b/frontend/src/lib/components/PathEditPopover.svelte
@@ -0,0 +1,227 @@
+<!--
+@component
+The editor behind an item's name: clicking the name it is given opens the summary and the path.
+A caller that has no name to give it — a bar with a summary field of its own — gets a pen instead.
+
+A caller that draws the path itself should render it from `snapshotPath ?? path`: while the
+popover is open this holds the path as it was when it opened, so the trail — and the popover
+anchored to it — does not reflow under the pointer as the user types, which floating-ui would
+follow.
+-->
+<script lang="ts">
+	import type { ComponentProps, Snippet } from 'svelte'
+	import { Alert } from '$lib/components/common'
+	import PathEditPen from '$lib/components/PathEditPen.svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { isOwner } from '$lib/utils'
+	import { userStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+
+	interface Props {
+		/** The item's human name. Committed trimmed, like the bar's own field did. */
+		summary?: string
+		/** When false the summary is shown but not editable, for a host whose `customUi` says so. */
+		summaryEditable?: boolean
+		/** When false the path is shown but not editable, the same way. A host may allow one and
+		 *  refuse the other, and the popover offers whichever it is given. */
+		pathEditable?: boolean
+		path?: string
+		/** The item's *saved* path on the server, so the popover can say a rename needs deploying. */
+		savedPath?: string
+		/** Scopes the path picker's validation, and names the item in the placeholder and the
+		 *  deploy note. An agent lives at a resource path, so this is wider than the three
+		 *  workspace item kinds. */
+		kind?: ComponentProps<typeof Path>['kind']
+		/** Workspace the path picker scopes to; defaults to the operating workspace. */
+		workspaceId?: string
+		/** When set, warns that a redeploy happens on behalf of the current user instead. */
+		onBehalfOfEmail?: string | undefined
+		/** Only read when there is no `label`, where the pen is the whole trigger. */
+		penVisibility?: 'hover' | 'always'
+		/** The path as it was when the popover opened, undefined while it is closed. See the
+		 *  component note: the caller draws its trail from this so it holds still mid-rename. */
+		snapshotPath?: string | undefined
+		/** The item's name, rendered inside the trigger so clicking it opens the editor. Without
+		 *  one the trigger is a pen, for a host that draws its name somewhere this cannot reach. */
+		label?: Snippet
+		/** The trigger's own classes, for a host that needs it to wear the look of the row it sits
+		 *  in — the band's path segment. The default is a name with a hover fill behind it: the
+		 *  click opens an editor here rather than going anywhere, and the fill is what says the
+		 *  name is a control at all now that no pen sits beside it. */
+		triggerClass?: string
+		/** Which field takes the cursor on open. A popover anchored under the path opens on the
+		 *  path, one under the summary opens on the summary: the click says which half of the name
+		 *  the user came to change. `Path` autofocuses itself, so 'path' is the absence of a
+		 *  claim on the summary rather than a claim of its own. */
+		focusField?: 'summary' | 'path'
+		/** The path field's verdict, for a host that refuses to deploy while it is non-empty.
+		 *  A host whose item has a second path field has to bind both to the same slot, or
+		 *  whichever one is unmounted leaves its last verdict standing. */
+		error?: string
+	}
+
+	let {
+		summary = $bindable(),
+		summaryEditable = true,
+		pathEditable = true,
+		path = $bindable(),
+		savedPath,
+		kind = 'flow',
+		workspaceId,
+		onBehalfOfEmail,
+		penVisibility = 'hover',
+		label,
+		triggerClass = 'inline-flex items-center gap-1.5 min-w-0 max-w-full px-1 py-0.5 rounded cursor-pointer text-left hover:bg-surface-hover transition-colors',
+		focusField = 'summary',
+		snapshotPath = $bindable(),
+		error = $bindable()
+	}: Props = $props()
+
+	const penLabel = $derived(
+		summaryEditable && pathEditable
+			? 'Edit summary and path'
+			: summaryEditable
+				? 'Edit summary'
+				: 'Edit path'
+	)
+
+	// The popover's own state: a host opens this editor by clicking the name it handed over, so
+	// there is nothing for one to drive from outside.
+	let open = $state(false)
+
+	// Treat an empty path as ownable so the popover lets a user pick the path for a brand-new
+	// item. `Path.reset()` then synthesizes a default under their own user/folder scope.
+	const own = $derived(pathEditable && (!path || isOwner(path, actingUser, $operatingWorkspace)))
+
+	/** The path's name field inside this popover. `Path` hardcodes `id="path"`, and melt resolves a
+	 *  string `openFocus` with a document-wide `querySelector`, so a popover portalled to the body
+	 *  would hand the keystrokes to whichever other `Path` the page happens to have mounted. */
+	const pathField = () =>
+		document.querySelector<HTMLInputElement>('[data-path-edit-path] #path') ?? null
+
+	function setOpen(v: boolean) {
+		open = v
+		// Only snapshot when there is a path to freeze. A new flow or script opens with `path === ''`
+		// and relies on `Path.reset()` to seed one; snapshotting the empty value would leave the
+		// trail blank for the popover's whole lifetime.
+		snapshotPath = v && path ? path : undefined
+	}
+</script>
+
+<!-- `openFocus`: without naming the path's field melt lands on the row's first button, so a
+     popover opened from the path would not be typing into the path. -->
+<Popover
+	placement="bottom-start"
+	contentClasses="p-4"
+	class={triggerClass}
+	triggerAttrs={{ title: penLabel, 'aria-label': penLabel }}
+	usePointerDownOutside
+	excludeSelectors=".drawer"
+	disableFocusTrap
+	closeOnOtherPopoverOpen
+	openFocus={focusField === 'path'
+		? pathField
+		: summaryEditable
+			? '[data-path-edit-summary]'
+			: undefined}
+	bind:isOpen={() => open, setOpen}
+>
+	{#snippet trigger()}
+		{#if label}
+			<!-- The name is the affordance; a pen next to it would be a second one for the same
+			     click, and the band keeps its line quiet. -->
+			{@render label()}
+		{:else}
+			<PathEditPen label={penLabel} visibility={penVisibility} {open} />
+		{/if}
+	{/snippet}
+	{#snippet content()}
+		<div class="flex flex-col gap-6 w-[480px]">
+			<!-- The summary first: it is the name a reader sees, and the path below is where that
+			     name lives. -->
+			{#if summaryEditable}
+				<Label label="Summary">
+					<TextInput
+						bind:value={summary}
+						inputProps={{
+							placeholder: 'Add a summary...',
+							'data-path-edit-summary': '',
+							// The popover sits in a page that binds keys of its own (the editors all do),
+							// and a summary is prose — it must not reach them. Enter commits the line and
+							// closes, which is what a one-line field reads as; the path below is reached
+							// with Tab, not Enter.
+							onkeydown: (e: KeyboardEvent) => {
+								e.stopPropagation()
+								if (e.key === 'Enter') {
+									e.preventDefault()
+									summary = summary?.trim()
+									setOpen(false)
+								}
+							},
+							onblur: () => (summary = summary?.trim())
+						}}
+						size="sm"
+					/>
+				</Label>
+			{:else if summary}
+				<Label label="Summary">
+					<span class="text-xs text-secondary">{summary}</span>
+				</Label>
+			{/if}
+			{#if own}
+				<!-- Both of these say the same thing — the item's own saved path is not a collision —
+				     and both are needed, because `Path` skips the whole existence check while the
+				     typed path equals `initialPath`. Seeding that from the working path instead
+				     would make a rename to a taken path look untaken the moment the popover is
+				     reopened on it. With no saved path there is nothing the item occupies, so every
+				     path is checked. -->
+				<div data-path-edit-path>
+					<Path
+						autofocus
+						bind:path
+						bind:error
+						initialPath={savedPath ?? path ?? ''}
+						allowedExistingPath={savedPath}
+						checkInitialPathExistence={savedPath == undefined}
+						namePlaceholder={kind}
+						{kind}
+						size="sm"
+						drawerOffset={4000}
+						workspaceOverride={workspaceId}
+					/>
+				</div>
+				{#if savedPath && path && path !== savedPath}
+					<Alert
+						type="info"
+						size="xs"
+						title="Deploy the {kind} to make the path change effective."
+					/>
+				{/if}
+				{#if onBehalfOfEmail}
+					<Alert type="info" title="Run on behalf of" size="xs">
+						This flow will be redeployed on behalf of you ({$userStore?.email}) instead of {onBehalfOfEmail}
+					</Alert>
+				{/if}
+			{:else}
+				<Label label="Path">
+					<span class="text-xs font-mono text-secondary">{path}</span>
+					<p class="text-2xs text-tertiary mt-1">
+						{pathEditable
+							? 'Only the owner can change the path'
+							: 'This path cannot be changed here'}
+					</p>
+				</Label>
+			{/if}
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/PersistentScriptDrawer.svelte b/frontend/src/lib/components/PersistentScriptDrawer.svelte
index 168169e937..e1bd3401bd 100644
--- a/frontend/src/lib/components/PersistentScriptDrawer.svelte
+++ b/frontend/src/lib/components/PersistentScriptDrawer.svelte
@@ -3,7 +3,6 @@
 	import { Badge, Button, Drawer } from './common'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import { createEventDispatcher, onDestroy } from 'svelte'
-	import { base } from '$lib/base'
 	import { displayDate, sleep, sendUserToast } from '$lib/utils'
 	import TableCustom from './TableCustom.svelte'
 	import { Hourglass, Loader2, Play, RefreshCw } from 'lucide-svelte'
@@ -141,7 +140,7 @@
 							<td class="text-xs">
 								<a
 									class="pr-3"
-									href="{base}/scripts/get/{scriptHash}?workspace={$operatingWorkspace}"
+									href="/scripts/get/{scriptHash}?workspace={$operatingWorkspace}"
 									target="_blank"
 								>
 									{scriptHash}
@@ -150,7 +149,7 @@
 							<td class="text-xs">
 								<a
 									class="pr-3"
-									href="{base}/run/{jobId}?workspace={$operatingWorkspace}"
+									href="/run/{jobId}?workspace={$operatingWorkspace}"
 									target="_blank">{jobId.substring(24)}</a
 								>
 							</td>
diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte
index 9847454aca..bd9d51638d 100644
--- a/frontend/src/lib/components/ResourceEditor.svelte
+++ b/frontend/src/lib/components/ResourceEditor.svelte
@@ -7,7 +7,8 @@
 		type Resource,
 		type ResourceType
 	} from '$lib/gen'
-	import { canWrite } from '$lib/utils'
+	import { canEditItem } from '$lib/editRights'
+	import { userWorkspaces } from '$lib/stores'
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { clearJsonSchemaResourceCache } from './schema/jsonSchemaResource.svelte'
@@ -261,8 +262,16 @@
 		if (!initialPath || !selected) return true
 		const r = fetchedResources[selected]
 		if (!r || !acting.resolved(selected)) return undefined
-		return canWrite(current?.path ?? initialPath, r.extra_perms ?? {}, acting.in(selected))
+		return canEditResourceIn(selected, current?.path ?? initialPath, r.extra_perms)
 	})
+	function canEditResourceIn(
+		ws: string,
+		path: string,
+		extraPerms: Record<string, boolean> | undefined
+	): boolean {
+		const settings = $userWorkspaces.find((w) => w.id === ws)?.operator_settings
+		return canEditItem('resource', path, extraPerms, acting.in(ws), settings)
+	}
 
 	const dirtyWorkspaces = $derived(
 		Object.keys(states).filter((ws) => !draftValuesEqual(states[ws].draft, initialStates[ws]))
@@ -423,9 +432,7 @@
 	const dirtyCanWrite = $derived(
 		dirtyWorkspaces.every((ws) => {
 			const r = fetchedResources[ws]
-			return (
-				!r || canWrite(states[ws]?.draft?.path ?? initialPath, r.extra_perms ?? {}, acting.in(ws))
-			)
+			return !r || canEditResourceIn(ws, states[ws]?.draft?.path ?? initialPath, r.extra_perms)
 		})
 	)
 
diff --git a/frontend/src/lib/components/RunForm.svelte b/frontend/src/lib/components/RunForm.svelte
index 2ae75f3c47..7be09785b1 100644
--- a/frontend/src/lib/components/RunForm.svelte
+++ b/frontend/src/lib/components/RunForm.svelte
@@ -152,8 +152,8 @@
 		 * form is embedded in a page that is not the runnable's own — an AI session preview
 		 * tab — since there the fragment would land on an unrelated URL. */
 		syncArgsToUrl?: boolean
-		/** Controls beside the Run button of a form that cannot schedule, in the row a
-		 *  schedulable one gives its Advanced options. */
+		/** Controls beside the Run button: left of Advanced on a schedulable form, in
+		 *  Advanced's place on one that cannot schedule. */
 		actions?: import('svelte').Snippet
 	}
 
@@ -405,6 +405,7 @@
 						{/snippet}
 					</Popover>
 				</div>
+				{@render actions?.()}
 			</div>
 			{@render unparseableError()}
 			{#if overrideTag}
diff --git a/frontend/src/lib/components/RunsPage.svelte b/frontend/src/lib/components/RunsPage.svelte
index 995517ef0d..7a130869b5 100644
--- a/frontend/src/lib/components/RunsPage.svelte
+++ b/frontend/src/lib/components/RunsPage.svelte
@@ -10,6 +10,7 @@
 	} from '$lib/gen'
 
 	import { sendUserToast } from '$lib/toast'
+	import { displayDate } from '$lib/utils'
 	import {
 		userStore,
 		workspaceStore,
@@ -18,15 +19,7 @@
 		devopsRole,
 		enterpriseLicense
 	} from '$lib/stores'
-	import {
-		Button,
-		ButtonType,
-		Drawer,
-		DrawerContent,
-		Skeleton,
-		Tab,
-		Tabs
-	} from '$lib/components/common'
+	import { Button, Drawer, DrawerContent, Skeleton, Tab, Tabs } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import RunChart from '$lib/components/RunChart.svelte'
 
@@ -43,17 +36,20 @@
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import RunsQueue from '$lib/components/runs/RunsQueue.svelte'
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
-	import { pageHref, RUNS_PATH } from '$lib/components/sessions/previewPaths'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
+	import { RUNS_PATH } from '$lib/components/sessions/previewPaths'
 	import { twMerge } from 'tailwind-merge'
 	import { computeJobKinds, useJobsLoader } from '$lib/components/runs/useJobsLoader.svelte'
 	import ConcurrentJobsChart from '$lib/components/ConcurrentJobsChart.svelte'
 	import BatchLoadProgress from '$lib/components/BatchLoadProgress.svelte'
 	import { pluralize, MAX_RESOLUTION_BATCH, MAX_RESOLUTION_NOTE_LEN } from '$lib/utils'
 	import type { BatchReRunOptions } from '$lib/components/runs/BatchReRunOptionsPane.svelte'
-	import { untrack } from 'svelte'
+	import { untrack, type Snippet } from 'svelte'
 	import { page } from '$app/state'
 	import Select from '$lib/components/select/Select.svelte'
 	import AnimatedPane from '$lib/components/splitPanes/AnimatedPane.svelte'
+	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
 	import { StaleWhileLoading, useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import {
 		Calendar,
@@ -62,7 +58,9 @@
 		CirclePlay,
 		Clock,
 		Hourglass,
-		TriangleAlertIcon
+		TriangleAlertIcon,
+		ArrowLeft,
+		Loader2
 	} from 'lucide-svelte'
 	import DropdownV2 from './DropdownV2.svelte'
 	import TimeframeSelect, {
@@ -189,6 +187,7 @@
 	}))
 	let batchProgress = $derived(jobsLoader.batchProgress)
 	let currentBatchSize = $derived(jobsLoader.currentBatchSize)
+	let scanProgress = $derived(jobsLoader.scanProgress)
 	let lastFetchWentToEnd = $derived(jobsLoader.lastFetchWentToEnd)
 	let queue_count = $derived(jobsLoader.queue_count)
 	let suspended_count = $derived(jobsLoader.suspended_count)
@@ -205,6 +204,7 @@
 	function reset() {
 		_timeframe.val = { ...runsTimeframes[0] }
 		selectedIds = []
+		openedRunId = undefined
 		delete filters.val.schedule_path
 		selectedWorkspace = undefined
 		jobsLoader?.loadJobs(true)
@@ -495,6 +495,9 @@
 		})
 
 		selectedIds = []
+		// Opened from the table's "Run again", the options are done; left open, the next selection
+		// of one run would show them again. The re-run selection mode keeps them for its next batch.
+		if (!manualSelectionMode) batchRerunOptionsIsOpen = false
 		jobsLoader?.loadJobs(true, true)
 	}
 
@@ -578,9 +581,270 @@
 	)
 
 	let manualSelectionMode: undefined | 'cancel' | 'rerun' | 'resolve' = $state()
+
+	// Below 1024px (Tailwind `lg`) the side pane leaves the table too little room, so what it would
+	// show becomes a page pushed over the list. Selection modes keep the split: their rows are
+	// picked in the list while the pane holds the action.
+	const pagedLayout = $derived(innerWidth < 1024 && !manualSelectionMode)
+	// Set only by a plain row click, a chart point or the arrow keys, never by a modifier click:
+	// a Ctrl/Cmd/Shift-click starting a multi-selection selects one run first, and opening it would
+	// hide the list before the second click.
+	let openedRunId: string | undefined = $state()
+	const runPageOpen = $derived(
+		// A confirmed re-run clears the selection but leaves the options flag set.
+		(batchRerunOptionsIsOpen && selectedIds.length > 0) ||
+			(selectedIds.length === 1 && selectedIds[0] === openedRunId)
+	)
+
+	// Clears the selection too: a re-run selection of one job would otherwise land on that job.
+	function backToList() {
+		batchRerunOptionsIsOpen = false
+		selectedIds = []
+		openedRunId = undefined
+	}
 	let resolutionNote = $state('')
+	const phone = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
 </script>
 
+{#snippet runsHint()}
+	<Tooltip
+		documentationLink="https://www.windmill.dev/docs/core_concepts/monitor_past_and_future_runs"
+	>
+		All past and schedule executions of scripts and flows, including previews. You only see your own
+		runs or runs of groups you belong to unless you are an admin.
+	</Tooltip>
+{/snippet}
+
+{#snippet headerActions()}
+	<!-- The page's own row inside the band's actions box: these controls are denser than a page's
+	     two or three buttons, so they take a wider gap than the band's own. `flex-1 min-w-0` passes
+	     the band's flexibility down to the search field, the one control here that gives width
+	     back; the rest keep theirs or drop out of the row entirely at a width. -->
+	<div class="flex items-center gap-3 flex-1 min-w-0">
+		<!-- Always the icon form: the bar has room for two counters, never for the two labelled
+		     blocks. pr-2 on top of the row's own gap because the counts hang outside their icons,
+		     so without it the badge butts against the first filter.
+		     A phone's bar has room for the filter field and the timeframe and nothing else: the
+		     counters are a glance, and the same numbers are on the chart below. -->
+		<div class="flex items-center pr-2 {phone ? 'hidden' : ''}">
+			<RunsQueue
+				success={filters.val.status ?? null}
+				{queue_count}
+				{suspended_count}
+				onJobsWaiting={() => {
+					jobsFilter('waiting')
+				}}
+				onJobsSuspended={() => {
+					jobsFilter('suspended')
+				}}
+				small
+			/>
+		</div>
+		<!-- The two groups are the widest thing in the bar: they appear only once the bar is wide
+		     enough to hold them next to the search field, below which the same filtering is reachable
+		     from the search field's own `kind` and `status` chips. -->
+		<div class="hidden min-[1500px]:flex gap-2">
+			<ToggleButtonGroup
+				tabListClass="hidden min-[1500px]:flex"
+				bind:selected={
+					() => filters.val.job_kinds ?? 'runs',
+					(v) => (v === 'runs' ? delete filters.val.job_kinds : (filters.val.job_kinds = v))
+				}
+			>
+				{#snippet children({ item })}
+					<ToggleButton size="sm" value="all" label="All" {item} />
+					<ToggleButton
+						size="sm"
+						value="runs"
+						label="Runs"
+						tooltip="Runs are jobs that have no parent jobs (flows are jobs that are parent of the jobs they start), they have been triggered through the UI, a schedule or webhook"
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value="dependencies"
+						label="Deps"
+						tooltip="Deploying a script, flow or an app launch a dependency job that create and then attach the lockfile to the deployed item. This mechanism ensure that logic is always executed with the exact same direct and indirect dependencies."
+						{item}
+					/>
+					<ToggleButtonMore
+						small
+						hideSelectedOption={innerWidth < smallScreenWidth}
+						togglableItems={[
+							{
+								label: 'Previews',
+								value: 'previews',
+								tooltip: "Previews are jobs that have been started in the editor as 'Tests'"
+							},
+							{
+								label: 'Sync',
+								value: 'deploymentcallbacks',
+								tooltip:
+									'Sync jobs that are triggered on every script deployment to sync the workspace with the Git repository configured in the the workspace settings'
+							}
+						]}
+						{item}
+						bind:selected={filters.val.job_kinds}
+					/>
+				{/snippet}
+			</ToggleButtonGroup>
+			<ToggleButtonGroup
+				bind:selected={
+					() => filters.val.status ?? 'all',
+					(v) => (v === 'all' ? delete filters.val.status : (filters.val.status = v))
+				}
+				id="status"
+			>
+				{#snippet children({ item })}
+					<ToggleButton size="sm" value={'all'} label="All" {item} />
+					<ToggleButton
+						size="sm"
+						value={'running'}
+						tooltip="Running"
+						class="whitespace-nowrap"
+						icon={CirclePlay}
+						iconProps={{
+							class:
+								'group-data-[state=on]:text-yellow-600 dark:group-data-[state=on]:text-yellow-400'
+						}}
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value={'success'}
+						tooltip="Success"
+						class="whitespace-nowrap"
+						icon={CircleCheck}
+						iconProps={{
+							class:
+								'group-data-[state=on]:text-green-500 dark:group-data-[state=on]:text-green-300'
+						}}
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value={'failure'}
+						tooltip="Failure"
+						class="whitespace-nowrap"
+						icon={CircleAlert}
+						iconProps={{
+							class: 'group-data-[state=on]:text-red-500 dark:group-data-[state=on]:text-red-300'
+						}}
+						{item}
+					/>
+					<ToggleButton
+						size="sm"
+						value={'canceled'}
+						tooltip="Canceled"
+						class="whitespace-nowrap"
+						icon={Hourglass}
+						selectedColor="gray"
+						{item}
+					/>
+					{#if filters.val.status == 'waiting'}
+						<ToggleButton
+							size="sm"
+							value={'waiting'}
+							tooltip="Waiting"
+							class="whitespace-nowrap"
+							icon={Hourglass}
+							selectedColor="blue"
+							{item}
+						/>
+					{:else if filters.val.status == 'suspended'}
+						<ToggleButton
+							size="sm"
+							value={'suspended'}
+							tooltip="Suspended"
+							class="whitespace-nowrap"
+							icon={Hourglass}
+							selectedColor="purple"
+							{item}
+						/>
+					{/if}
+				{/snippet}
+			</ToggleButtonGroup>
+		</div>
+
+		<div class="hidden xl:flex gap-2 items-center">
+			{#if !filters.val.job_trigger_kind || filters.val.job_trigger_kind === '!schedule'}
+				<div class="flex items-center gap-1" title="Show schedules">
+					<Toggle
+						size="xs"
+						id="show-schedules"
+						bind:checked={
+							() => filters.val.job_trigger_kind !== '!schedule',
+							(v) =>
+								v
+									? delete filters.val.job_trigger_kind
+									: (filters.val.job_trigger_kind = '!schedule')
+						}
+					/>
+					<Calendar size={14} />
+				</div>
+			{/if}
+			<div class="flex items-center gap-1" title="Show future jobs">
+				<Toggle
+					size="xs"
+					id="show-future-jobs"
+					bind:checked={
+						() => filters.val.show_future_jobs !== false,
+						(v) =>
+							v ? delete filters.val.show_future_jobs : (filters.val.show_future_jobs = false)
+					}
+				/>
+				<Clock size={14} />
+			</div>
+		</div>
+
+		<!-- The one control in the band that gives way: everything else keeps the width it asked
+		     for, or drops out of the row at a width, and this takes what is left. -->
+		<FilterSearchbar
+			class={twMerge(
+				// A width of its own, and only ever less. As `flex-1` the field was whatever the row
+				// had left over, so a chip appearing or a filter committing resized it under the
+				// cursor and the last pixels came off the breadcrumb. 18rem is its width whenever the
+				// row fits, and it still shrinks when the row runs short, which is what keeps the row
+				// inside a box the bar lets shrink (`actionsFlexible`). `min-w-0` is what makes that
+				// shrink unconditional: a flex item's floor is its min-content width, which the chips
+				// inside the field raise, so without it a typed filter would push the field wider
+				// again exactly when the row has no room to give.
+				'relative w-[18rem] min-w-0 max-w-full',
+				// A phone's bar cannot spare that much before the timeframe beside it.
+				phone && 'w-[10rem]'
+			)}
+			schema={runsFilterSearchbarSchema}
+			presets={buildRunsFilterPresets({
+				isSuperAdminOrDevops: !!$superadmin || !!$devopsRole,
+				isAdminsWorkspace: $workspaceStore === 'admins'
+			})}
+			bind:value={filters.val}
+			placeholder="Filter runs..."
+			size="sm"
+			autofocus
+		/>
+		<TimeframeSelect
+			unifiedSize="sm"
+			onClick={() => jobsLoader?.loadJobs(true)}
+			loading={jobsLoader?.loading}
+			items={runsTimeframes}
+			bind:value={_timeframe.val}
+		/>
+		<!-- The filters are shallow-routed, so the search has to come off `window.location` at click
+		     time — `page.url` never sees them. Always the canonical `/runs`: only that is a recognized
+		     preview page, and the `/runs/<path>` route mirrors its path into `?path=` anyway. -->
+		<div class={phone ? 'hidden' : 'contents'}>
+			<OpenInSessionButton
+				source={{
+					page: () => RUNS_PATH + window.location.search,
+					workspaceId: $workspaceStore ?? undefined
+				}}
+				btnProps={{ unifiedSize: 'sm' }}
+			/>
+		</div>
+	</div>
+{/snippet}
+
 <ConfirmationModal
 	title={askingForConfirmation?.title ?? ''}
 	confirmationText={askingForConfirmation?.confirmBtnText ?? ''}
@@ -648,224 +912,10 @@
 		<p>Page not available for operators</p>
 	</div>
 {:else}
-	<div class="w-full h-screen flex flex-col" bind:clientWidth={innerWidth}>
-		<!-- Header and filters -->
-		<div id="runs-filters-bar" class="flex flex-row items-start w-full px-4 gap-3 py-4 flex-wrap">
-			<div class="flex flex-row items-center gap-6">
-				<h1
-					class={twMerge(
-						'!text-2xl font-semibold leading-6 tracking-tight',
-						$userStore?.operator ? 'pl-10' : ''
-					)}
-				>
-					Runs
-				</h1>
-
-				<Tooltip
-					documentationLink="https://www.windmill.dev/docs/core_concepts/monitor_past_and_future_runs"
-				>
-					All past and schedule executions of scripts and flows, including previews. You only see
-					your own runs or runs of groups you belong to unless you are an admin.
-				</Tooltip>
-
-				<!-- Queue -->
-				<RunsQueue
-					success={filters.val.status ?? null}
-					{queue_count}
-					{suspended_count}
-					onJobsWaiting={() => {
-						jobsFilter('waiting')
-					}}
-					onJobsSuspended={() => {
-						jobsFilter('suspended')
-					}}
-					small={innerWidth < smallScreenWidth}
-				/>
-			</div>
-
-			<div class="hidden xl:flex gap-2 ml-6">
-				<ToggleButtonGroup
-					tabListClass="hidden xl:flex"
-					bind:selected={
-						() => filters.val.job_kinds ?? 'runs',
-						(v) => (v === 'runs' ? delete filters.val.job_kinds : (filters.val.job_kinds = v))
-					}
-				>
-					{#snippet children({ item })}
-						<ToggleButton value="all" label="All" {item} />
-						<ToggleButton
-							value="runs"
-							label="Runs"
-							tooltip="Runs are jobs that have no parent jobs (flows are jobs that are parent of the jobs they start), they have been triggered through the UI, a schedule or webhook"
-							{item}
-						/>
-						<ToggleButton
-							value="dependencies"
-							label="Deps"
-							tooltip="Deploying a script, flow or an app launch a dependency job that create and then attach the lockfile to the deployed item. This mechanism ensure that logic is always executed with the exact same direct and indirect dependencies."
-							{item}
-						/>
-						<ToggleButtonMore
-							hideSelectedOption={innerWidth < smallScreenWidth}
-							togglableItems={[
-								{
-									label: 'Previews',
-									value: 'previews',
-									tooltip: "Previews are jobs that have been started in the editor as 'Tests'"
-								},
-								{
-									label: 'Sync',
-									value: 'deploymentcallbacks',
-									tooltip:
-										'Sync jobs that are triggered on every script deployment to sync the workspace with the Git repository configured in the the workspace settings'
-								}
-							]}
-							{item}
-							bind:selected={filters.val.job_kinds}
-						/>
-					{/snippet}
-				</ToggleButtonGroup>
-				<ToggleButtonGroup
-					bind:selected={
-						() => filters.val.status ?? 'all',
-						(v) => (v === 'all' ? delete filters.val.status : (filters.val.status = v))
-					}
-					id="status"
-				>
-					{#snippet children({ item })}
-						<ToggleButton value={'all'} label="All" {item} />
-						<ToggleButton
-							value={'running'}
-							tooltip="Running"
-							class="whitespace-nowrap"
-							icon={CirclePlay}
-							iconProps={{
-								class:
-									'group-data-[state=on]:text-yellow-600 dark:group-data-[state=on]:text-yellow-400'
-							}}
-							{item}
-						/>
-						<ToggleButton
-							value={'success'}
-							tooltip="Success"
-							class="whitespace-nowrap"
-							icon={CircleCheck}
-							iconProps={{
-								class:
-									'group-data-[state=on]:text-green-500 dark:group-data-[state=on]:text-green-300'
-							}}
-							{item}
-						/>
-						<ToggleButton
-							value={'failure'}
-							tooltip="Failure"
-							class="whitespace-nowrap"
-							icon={CircleAlert}
-							iconProps={{
-								class: 'group-data-[state=on]:text-red-500 dark:group-data-[state=on]:text-red-300'
-							}}
-							{item}
-						/>
-						<ToggleButton
-							value={'canceled'}
-							tooltip="Canceled"
-							class="whitespace-nowrap"
-							icon={Hourglass}
-							selectedColor="gray"
-							{item}
-						/>
-						{#if filters.val.status == 'waiting'}
-							<ToggleButton
-								value={'waiting'}
-								tooltip="Waiting"
-								class="whitespace-nowrap"
-								icon={Hourglass}
-								selectedColor="blue"
-								{item}
-							/>
-						{:else if filters.val.status == 'suspended'}
-							<ToggleButton
-								value={'suspended'}
-								tooltip="Suspended"
-								class="whitespace-nowrap"
-								icon={Hourglass}
-								selectedColor="purple"
-								{item}
-							/>
-						{/if}
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-
-			<div class="hidden xl:flex gap-2 items-center min-h-8 ml-2">
-				{#if !filters.val.job_trigger_kind || filters.val.job_trigger_kind === '!schedule'}
-					<div class="flex items-center gap-1" title="Show schedules">
-						<Toggle
-							size="xs"
-							color="nord"
-							id="show-schedules"
-							bind:checked={
-								() => filters.val.job_trigger_kind !== '!schedule',
-								(v) =>
-									v
-										? delete filters.val.job_trigger_kind
-										: (filters.val.job_trigger_kind = '!schedule')
-							}
-						/>
-						<Calendar size={14} />
-					</div>
-				{/if}
-				<div class="flex items-center gap-1" title="Show future jobs">
-					<Toggle
-						size="xs"
-						color="nord"
-						id="show-future-jobs"
-						bind:checked={
-							() => filters.val.show_future_jobs !== false,
-							(v) =>
-								v ? delete filters.val.show_future_jobs : (filters.val.show_future_jobs = false)
-						}
-					/>
-					<Clock size={14} />
-				</div>
-			</div>
-
-			<TimeframeSelect
-				wrapperClasses="ml-auto"
-				onClick={() => jobsLoader?.loadJobs(true)}
-				loading={jobsLoader?.loading}
-				items={runsTimeframes}
-				bind:value={_timeframe.val}
-			/>
-			<FilterSearchbar
-				class={twMerge(
-					'flex-1 relative min-w-[18rem]',
-					Object.keys(filters.val).length <= 3
-						? 'max-w-[20rem] 2xl:max-w-[28rem]'
-						: 'max-w-[34rem]',
-					ButtonType.UnifiedMinHeightClasses.md
-				)}
-				schema={runsFilterSearchbarSchema}
-				presets={buildRunsFilterPresets({
-					isSuperAdminOrDevops: !!$superadmin || !!$devopsRole,
-					isAdminsWorkspace: $workspaceStore === 'admins'
-				})}
-				bind:value={filters.val}
-				placeholder="Filter runs..."
-				autofocus
-			/>
-			<!-- The filters are shallow-routed, so the search has to come off
-			     `window.location` at click time — `page.url` never sees them. Always the
-			     canonical `/runs`: only that is a recognized preview page, and the
-			     `/runs/<path>` route mirrors its path into `?path=` anyway. -->
-			<OpenInSessionButton
-				source={{
-					page: () => pageHref(RUNS_PATH) + window.location.search,
-					workspaceId: $workspaceStore ?? undefined
-				}}
-				btnProps={{ unifiedSize: 'md' }}
-			/>
-		</div>
+	<div class="w-full h-full flex flex-col" bind:clientWidth={innerWidth}>
+		<!-- `actionsFlexible`: the filter row holds a search field that can give width back, so the
+		     bar lets this box shrink on a phone instead of holding its content width. -->
+		<PageHeaderContent afterName={runsHint} actions={headerActions} actionsFlexible />
 
 		<!-- Graph -->
 		<div id="runs-chart" class="p-2 px-4 bg-surface-tertiary mx-4 border rounded-md">
@@ -919,6 +969,7 @@
 						_timeframe.val = buildManualTimeframe(zoom.min.toISOString(), zoom.max.toISOString())
 					}}
 					onPointClicked={(ids) => {
+						openedRunId = ids.length === 1 ? ids[0] : undefined
 						runsTable?.scrollToRun(ids)
 					}}
 				/>
@@ -936,242 +987,331 @@
 		</div>
 
 		<div class="grow min-h-0 bottom-splitpane-wrapper">
-			<Splitpanes>
-				<Pane minSize={40}>
-					<div class="h-full flex">
-						<div class="flex flex-col flex-1 m-4 mt-2 mr-2">
-							{#if batchProgress}
-								<div class="px-1 pb-2">
-									<BatchLoadProgress
-										loaded={batchProgress.loaded}
-										total={batchProgress.total}
-										itemsLabel="jobs"
-										batchSize={currentBatchSize}
-										batchSizeCap={1000}
-										onBatchSizeChange={(v) => jobsLoader.restreamWithBatchSize(v)}
-										onStop={() => jobsLoader.stopBatchLoading()}
-									/>
-								</div>
-							{/if}
-							<!-- Runs table. Add overflow-hidden because scroll is handled inside the runs table based on this wrapper height -->
-							<div class="grow min-h-0 overflow-y-hidden overflow-x-auto">
-								{#if jobs}
-									<RunsTable
-										{jobs}
-										externalJobs={externalJobs ?? []}
-										omittedObscuredJobs={extendedJobs?.omitted_obscured_jobs ?? false}
-										showExternalJobs={graph !== 'RunChart'}
-										activeLabel={filters.val.label}
-										{lastFetchWentToEnd}
-										loadingExtra={jobsLoader.loadingExtra}
-										bind:selectedIds
-										bind:selectedWorkspace
-										on:loadExtra={loadExtra}
-										on:filterByPath={filterByPath}
-										on:filterByUser={filterByUser}
-										on:filterByFolder={filterByFolder}
-										on:filterByLabel={filterByLabel}
-										on:filterByConcurrencyKey={filterByConcurrencyKey}
-										on:filterByTag={filterByTag}
-										on:filterBySchedule={filterBySchedule}
-										on:filterByWorker={filterByWorker}
-										bind:this={runsTable}
-										perPage={perPage.val}
-										bind:batchRerunOptionsIsOpen
-										onCancelJobs={onCancelSelectedJobs}
-										onSetJobsResolution={setJobsResolution}
-										{manualSelectionMode}
-									></RunsTable>
-								{:else}
-									<div class="gap-1 flex flex-col">
-										{#each new Array(8) as _}
-											<Skeleton layout={[[3]]} />
-										{/each}
-									</div>
-								{/if}
-							</div>
-							<div
-								class="bg-surface-tertiary border rounded-b-md flex text-xs px-2 py-1 items-center gap-4"
-							>
-								{#if !manualSelectionMode}
-									<DropdownV2
-										btnText="Batch actions"
-										size="xs"
-										items={[
-											{
-												displayName: 'Cancel jobs',
-												action: () => ((manualSelectionMode = 'cancel'), (selectedIds = []))
-											},
-											{
-												displayName: 'Re-run jobs',
-												action: () => {
-													manualSelectionMode = 'rerun'
-													selectedIds = []
-													batchRerunOptionsIsOpen = true
-												}
-											},
-											...(!$userStore?.operator
-												? [
-														{
-															// Operators are rejected by the endpoint, so offering it would only 403.
-															displayName: 'Resolve failed jobs',
-															action: () => (
-																(manualSelectionMode = 'resolve'),
-																(selectedIds = []),
-																(resolutionNote = '')
-															)
-														}
-													]
-												: []),
-											{
-												displayName: 'Cancel all jobs matching filters',
-												action: () => onCancelAllJobsMatchingFilters()
-											},
-											{
-												displayName: 'Re-run all jobs matching filters',
-												action: () => onRerunAllJobsMatchingFilters()
-											}
-										]}
-									/>
-								{:else}
-									<Button
-										size="xs"
-										destructive
-										onClick={() => {
-											manualSelectionMode = undefined
-											batchRerunOptionsIsOpen = false
-										}}
-									>
-										Exit selection mode
-									</Button>
-								{/if}
-								<div class="flex-1"></div>
-								<Toggle
-									size="xs"
-									color="nord"
-									bind:checked={autoRefresh.val}
-									options={{ right: 'Auto-refresh' }}
-									textClass="whitespace-nowrap"
-								/>
-								<Select
-									class="w-24"
-									bind:value={
-										() => perPage.val,
-										(newPerPage) => {
-											perPage.val = newPerPage
-											if (newPerPage > (jobs?.length ?? 1000)) loadExtra()
-										}
-									}
-									onCreateItem={(v) => (perPage.val = parseInt(v))}
-									items={[
-										{ value: 25, label: '25' },
-										{ value: 100, label: '100' },
-										{ value: 1000, label: '1000' },
-										{ value: 10000, label: '10000' }
-									]}
-									transformInputSelectedText={(_, v) => `${v} / page`}
-								/>
-							</div>
-						</div>
-					</div>
-				</Pane>
-				<AnimatedPane
-					size={40}
-					minSize={15}
-					class="flex flex-col"
-					opened={selectedIds.length > 0 || !!manualSelectionMode}
-				>
-					<div class="mt-12 overflow-y-auto pr-4 ml-2 relative flex-1">
-						{#if manualSelectionMode === 'cancel'}
-							<div
-								class="rounded-md bg-surface-tertiary border absolute inset-0 mb-4 flex flex-col items-center justify-center"
-							>
-								<Button
-									destructive
-									variant="accent"
-									disabled={!selectedIds.length}
-									onClick={() => onCancelSelectedJobs(selectedIds)}
-								>
-									Cancel {selectedIds.length} jobs
-								</Button>
-							</div>
-						{:else if manualSelectionMode === 'resolve'}
-							<div
-								class="rounded-md bg-surface-tertiary border absolute inset-0 mb-4 flex flex-col items-center justify-center gap-3 p-4"
-							>
-								<p class="text-xs text-secondary text-center max-w-xs">
-									Resolving keeps the run a failure but stops it showing as one in the runs list.
-								</p>
-								<TextInput
-									bind:value={resolutionNote}
-									inputProps={{
-										placeholder: $enterpriseLicense
-											? 'Why is this handled? (optional)'
-											: 'Notes and attribution require ee',
-										disabled: !$enterpriseLicense
-									}}
-									size="sm"
-								/>
-								<div class="flex flex-row gap-2">
-									<Button
-										variant="accent"
-										disabled={!selectedIds.length}
-										onClick={() => setJobsResolution(selectedIds, true, resolutionNote)}
-									>
-										Mark {selectedIds.length} resolved
-									</Button>
-									<Button
-										variant="default"
-										disabled={!selectedIds.length}
-										onClick={() => setJobsResolution(selectedIds, false)}
-									>
-										Unresolve {selectedIds.length}
-									</Button>
-								</div>
-							</div>
-						{:else if batchRerunOptionsIsOpen}
-							{#await import('$lib/components/runs/BatchReRunOptionsPane.svelte') then BatchReRunOptionsPane}
-								<BatchReRunOptionsPane.default
-									{selectedIds}
-									onCancel={() => (
-										(batchRerunOptionsIsOpen = false),
-										(manualSelectionMode = undefined)
-									)}
-									onConfirm={async (options) => {
-										await onReRunSelectedJobs(options)
-									}}
-								/>
-							{/await}
-						{:else if selectedIds.length === 1}
-							{#if selectedIds[0] === '-'}
-								<div class="p-4">There is no information available for this job</div>
-							{:else}
-								<!-- Dynamic, like the batch re-run pane: both only show once jobs are selected
-								     and each statically reaches hundreds of modules (flow graph, monaco). -->
-								{#await import('$lib/components/runs/JobRunsPreview.svelte') then JobRunsPreview}
-									<JobRunsPreview.default
-										id={selectedIds[0]}
-										workspace={selectedWorkspace}
-										on:filterByConcurrencyKey={filterByConcurrencyKey}
-										on:filterByWorker={filterByWorker}
-										onResolutionChanged={() => jobsLoader?.loadJobs(true, true)}
-									/>
-								{/await}
-							{/if}
-						{:else if selectedIds.length > 1}
-							<div
-								class="rounded-md bg-surface-tertiary border absolute inset-0 mb-4 flex items-center justify-center"
-							>
-								<div class="text-xs m-4"> {selectedIds.length} jobs selected</div>
-							</div>
-						{/if}
-					</div>
-				</AnimatedPane>
-			</Splitpanes>
+			{#if pagedLayout}
+				<!-- No `onNavigate`: its arrow keys are read at `window`, where they would take
+				     ArrowRight from the table's horizontal scroll and ArrowLeft from a modal or drawer
+				     opened over the run. -->
+				<PagedContent
+					class="h-full"
+					current={runPageOpen ? 'run' : 'list'}
+					pages={[
+						{ key: 'list', content: runsList },
+						{ key: 'run', content: runPage, placeholder: runPagePlaceholder }
+					]}
+				/>
+			{:else}
+				<Splitpanes>
+					<Pane minSize={40}>
+						{@render runsList()}
+					</Pane>
+					<AnimatedPane
+						size={40}
+						minSize={15}
+						class="flex flex-col"
+						opened={selectedIds.length > 0 || !!manualSelectionMode}
+					>
+						{@render sidePanel()}
+					</AnimatedPane>
+				</Splitpanes>
+			{/if}
 		</div>
 	</div>
 {/if}
 
+{#snippet runsList()}
+	<div class="h-full flex">
+		<div class="flex flex-col flex-1 min-w-0 m-4 mt-2 mr-2">
+			{#if scanProgress}
+				<div class="px-1 pb-2 flex items-center gap-2">
+					<Loader2 size={14} class="animate-spin shrink-0 text-accent" />
+					<div class="flex-1 min-w-0">
+						<BatchLoadProgress
+							loaded={Math.round(scanProgress.fraction * 100)}
+							total={100}
+							itemsLabel="runs"
+							label={`Slow search: runs since ${displayDate(scanProgress.scannedTo)} searched, ${jobs?.length ?? 0} found`}
+							onStop={() => jobsLoader.stopBatchLoading()}
+						/>
+					</div>
+				</div>
+			{/if}
+			{#if batchProgress}
+				<div class="px-1 pb-2">
+					<BatchLoadProgress
+						loaded={batchProgress.loaded}
+						total={batchProgress.total}
+						itemsLabel="jobs"
+						batchSize={currentBatchSize}
+						batchSizeCap={1000}
+						onBatchSizeChange={(v) => jobsLoader.restreamWithBatchSize(v)}
+						onStop={() => jobsLoader.stopBatchLoading()}
+					/>
+				</div>
+			{/if}
+			<!-- Runs table. Add overflow-hidden because scroll is handled inside the runs table based on this wrapper height -->
+			<div class="grow min-h-0 overflow-y-hidden overflow-x-auto">
+				{#if jobs}
+					<RunsTable
+						{jobs}
+						externalJobs={externalJobs ?? []}
+						omittedObscuredJobs={extendedJobs?.omitted_obscured_jobs ?? false}
+						showExternalJobs={graph !== 'RunChart'}
+						activeLabel={filters.val.label}
+						{lastFetchWentToEnd}
+						loadingExtra={jobsLoader.loadingExtra}
+						bind:selectedIds
+						bind:selectedWorkspace
+						on:select={() => (openedRunId = selectedIds.length === 1 ? selectedIds[0] : undefined)}
+						on:loadExtra={loadExtra}
+						on:filterByPath={filterByPath}
+						on:filterByUser={filterByUser}
+						on:filterByFolder={filterByFolder}
+						on:filterByLabel={filterByLabel}
+						on:filterByConcurrencyKey={filterByConcurrencyKey}
+						on:filterByTag={filterByTag}
+						on:filterBySchedule={filterBySchedule}
+						on:filterByWorker={filterByWorker}
+						bind:this={runsTable}
+						perPage={perPage.val}
+						bind:batchRerunOptionsIsOpen
+						onCancelJobs={onCancelSelectedJobs}
+						onSetJobsResolution={setJobsResolution}
+						{manualSelectionMode}
+					></RunsTable>
+				{:else}
+					<div class="gap-1 flex flex-col">
+						{#each new Array(8) as _}
+							<Skeleton layout={[[3]]} />
+						{/each}
+					</div>
+				{/if}
+			</div>
+			<div
+				class="bg-surface-tertiary border rounded-b-md flex text-xs px-2 py-1 items-center gap-4"
+			>
+				{#if !manualSelectionMode}
+					<DropdownV2
+						btnText="Batch actions"
+						size="xs"
+						items={[
+							{
+								displayName: 'Cancel jobs',
+								action: () => ((manualSelectionMode = 'cancel'), (selectedIds = []))
+							},
+							{
+								displayName: 'Re-run jobs',
+								action: () => {
+									manualSelectionMode = 'rerun'
+									selectedIds = []
+									batchRerunOptionsIsOpen = true
+								}
+							},
+							...(!$userStore?.operator
+								? [
+										{
+											// Operators are rejected by the endpoint, so offering it would only 403.
+											displayName: 'Resolve failed jobs',
+											action: () => (
+												(manualSelectionMode = 'resolve'),
+												(selectedIds = []),
+												(resolutionNote = '')
+											)
+										}
+									]
+								: []),
+							{
+								displayName: 'Cancel all jobs matching filters',
+								action: () => onCancelAllJobsMatchingFilters()
+							},
+							{
+								displayName: 'Re-run all jobs matching filters',
+								action: () => onRerunAllJobsMatchingFilters()
+							}
+						]}
+					/>
+				{:else}
+					<Button
+						size="xs"
+						destructive
+						onClick={() => {
+							manualSelectionMode = undefined
+							batchRerunOptionsIsOpen = false
+						}}
+					>
+						Exit selection mode
+					</Button>
+				{/if}
+				<div class="flex-1"></div>
+				<Toggle
+					size="xs"
+					color="nord"
+					bind:checked={autoRefresh.val}
+					options={{ right: 'Auto-refresh' }}
+					textClass="whitespace-nowrap"
+				/>
+				<Select
+					class="w-24"
+					bind:value={
+						() => perPage.val,
+						(newPerPage) => {
+							perPage.val = newPerPage
+							if (newPerPage > (jobs?.length ?? 1000)) loadExtra()
+						}
+					}
+					onCreateItem={(v) => (perPage.val = parseInt(v))}
+					items={[
+						{ value: 25, label: '25' },
+						{ value: 100, label: '100' },
+						{ value: 1000, label: '1000' },
+						{ value: 10000, label: '10000' }
+					]}
+					transformInputSelectedText={(_, v) => `${v} / page`}
+				/>
+			</div>
+		</div>
+	</div>
+{/snippet}
+
+{#snippet sidePanel()}
+	<div class="mt-12 overflow-y-auto pr-4 ml-2 relative flex-1">
+		{#if manualSelectionMode === 'cancel'}
+			<div
+				class="rounded-md bg-surface-tertiary border absolute inset-0 mb-4 flex flex-col items-center justify-center"
+			>
+				<Button
+					destructive
+					variant="accent"
+					disabled={!selectedIds.length}
+					onClick={() => onCancelSelectedJobs(selectedIds)}
+				>
+					Cancel {selectedIds.length} jobs
+				</Button>
+			</div>
+		{:else if manualSelectionMode === 'resolve'}
+			<div
+				class="rounded-md bg-surface-tertiary border absolute inset-0 mb-4 flex flex-col items-center justify-center gap-3 p-4"
+			>
+				<p class="text-xs text-secondary text-center max-w-xs">
+					Resolving keeps the run a failure but stops it showing as one in the runs list.
+				</p>
+				<TextInput
+					bind:value={resolutionNote}
+					inputProps={{
+						placeholder: $enterpriseLicense
+							? 'Why is this handled? (optional)'
+							: 'Notes and attribution require ee',
+						disabled: !$enterpriseLicense
+					}}
+					size="sm"
+				/>
+				<div class="flex flex-row gap-2">
+					<Button
+						variant="accent"
+						disabled={!selectedIds.length}
+						onClick={() => setJobsResolution(selectedIds, true, resolutionNote)}
+					>
+						Mark {selectedIds.length} resolved
+					</Button>
+					<Button
+						variant="default"
+						disabled={!selectedIds.length}
+						onClick={() => setJobsResolution(selectedIds, false)}
+					>
+						Unresolve {selectedIds.length}
+					</Button>
+				</div>
+			</div>
+		{:else if batchRerunOptionsIsOpen}
+			{@render batchRerunOptions()}
+		{:else if selectedIds.length === 1}
+			{#if selectedIds[0] === '-'}
+				<div class="p-4">There is no information available for this job</div>
+			{:else}
+				{@render jobPreview()}
+			{/if}
+		{:else if selectedIds.length > 1}
+			<div
+				class="rounded-md bg-surface-tertiary border absolute inset-0 mb-4 flex items-center justify-center"
+			>
+				<div class="text-xs m-4"> {selectedIds.length} jobs selected</div>
+			</div>
+		{/if}
+	</div>
+{/snippet}
+
+{#snippet runPage()}
+	{@render runPageFrame(runPageBody)}
+{/snippet}
+
+{#snippet runPagePlaceholder()}
+	{@render runPageFrame(runPageSkeleton)}
+{/snippet}
+
+{#snippet runPageFrame(body: Snippet)}
+	<!-- Margins and header row match the runs table's column header, so the back row sits where
+	     the column labels were. -->
+	<div class="h-full flex flex-col min-h-0 p-4 pt-2 pr-2">
+		<div class="flex min-h-6 my-2 items-end">
+			<Button
+				unifiedSize="xs"
+				variant="subtle"
+				startIcon={{ icon: ArrowLeft }}
+				btnClasses="-mb-1 gap-1 text-xs font-semibold leading-3"
+				onclick={backToList}
+			>
+				Runs list
+			</Button>
+		</div>
+		<div class="grow min-h-0 overflow-y-auto">
+			{@render body()}
+		</div>
+	</div>
+{/snippet}
+
+{#snippet runPageBody()}
+	{#if batchRerunOptionsIsOpen}
+		{@render batchRerunOptions()}
+	{:else if selectedIds[0] === '-'}
+		<div class="p-4">There is no information available for this job</div>
+	{:else if selectedIds.length === 1}
+		{@render jobPreview(runPageSkeleton)}
+	{/if}
+{/snippet}
+
+<!-- The shape of a run: its header card, then inputs and result. `mounted` skips the skeleton's
+     fade-in, which outlasts the slide it is drawn for. -->
+{#snippet runPageSkeleton()}
+	<Skeleton mounted layout={[[4.5], 1.5, [1], 0.5, [3], 1.5, [1], 0.5, [8]]} />
+{/snippet}
+
+{#snippet batchRerunOptions()}
+	{#await import('$lib/components/runs/BatchReRunOptionsPane.svelte') then BatchReRunOptionsPane}
+		<BatchReRunOptionsPane.default
+			{selectedIds}
+			onCancel={() => ((batchRerunOptionsIsOpen = false), (manualSelectionMode = undefined))}
+			onConfirm={async (options) => {
+				await onReRunSelectedJobs(options)
+			}}
+		/>
+	{/await}
+{/snippet}
+
+{#snippet jobPreview(pending?: Snippet)}
+	<!-- Dynamic, like the batch re-run pane: both only show once jobs are selected
+	     and each statically reaches hundreds of modules (flow graph, monaco). -->
+	{#await import('$lib/components/runs/JobRunsPreview.svelte')}
+		{@render pending?.()}
+	{:then JobRunsPreview}
+		<JobRunsPreview.default
+			id={selectedIds[0]}
+			workspace={selectedWorkspace}
+			on:filterByConcurrencyKey={filterByConcurrencyKey}
+			on:filterByWorker={filterByWorker}
+			onResolutionChanged={() => jobsLoader?.loadJobs(true, true)}
+		/>
+	{/await}
+{/snippet}
+
 <style>
 	:global(.bottom-splitpane-wrapper .splitpanes__splitter) {
 		background-color: transparent !important;
diff --git a/frontend/src/lib/components/S3FilePicker.svelte b/frontend/src/lib/components/S3FilePicker.svelte
index ce1af47118..a5e4849c57 100644
--- a/frontend/src/lib/components/S3FilePicker.svelte
+++ b/frontend/src/lib/components/S3FilePicker.svelte
@@ -105,6 +105,7 @@
 	size="1200px"
 >
 	<DrawerContent
+		noPadding
 		title={s3ResourcePath ? `Exploring ${s3ResourcePath}` : 'S3 file browser'}
 		on:close={() => {
 			s3FilePickerInner?.exit?.()
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index 1bf1b4358a..89c23e84ae 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -8,8 +8,35 @@
 		Loader2,
 		Download,
 		Trash,
-		MoveRight
+		MoveRight,
+		Ellipsis,
+		FileText,
+		FileCode,
+		FileJson,
+		FileSpreadsheet,
+		FileImage,
+		FileArchive,
+		FilePlay,
+		FileAudio,
+		Table2
 	} from 'lucide-svelte'
+	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import TextInput from './text_input/TextInput.svelte'
+	import Select from './select/Select.svelte'
+	import Toggle from './Toggle.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import type { IDbTableOps } from './dbOps'
+	import { resource } from 'runed'
+	import { staticDbTableOps } from './staticDbTableOps'
+	import {
+		fetchJsonTableRows,
+		isJsonFile,
+		JSON_TABLE_MAX_BYTES,
+		s3TableOps,
+		serverTableFormat,
+		type S3TableSource
+	} from './s3TableOps'
 	import {
 		CancelablePromise,
 		HelpersService,
@@ -28,21 +55,19 @@
 		type MoveS3FileData,
 		type MoveS3FileResponse
 	} from '$lib/gen'
-	import { base } from '$lib/base'
 	import {
 		displayDate,
 		displaySize,
 		emptyString,
 		parseS3Object,
 		sendUserToast,
-		type S3Object
+		type S3Object,
+		type IconType
 	} from '$lib/utils'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
-	import { Alert, Button } from './common'
-	import Section from './Section.svelte'
+	import { Alert, Button, CopyButton } from './common'
 	import { createEventDispatcher, untrack, type Snippet } from 'svelte'
 	import VirtualList from '@tutorlatin/svelte-tiny-virtual-list'
-	import TableSimple from './TableSimple.svelte'
 	import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte'
 	import FileUploadModal from './common/fileUpload/FileUploadModal.svelte'
 	import S3FilePreview from './S3FilePreview.svelte'
@@ -144,8 +169,14 @@
 	let rootPath = $state(initialRootPath)
 	let rootPathNestingLevel = $derived(1 * (rootPath.split('/').length - 1))
 
-	let csvSeparatorChar: string = $state(',')
+	let csvSeparatorChar: string | undefined = $state(undefined)
 	let csvHasHeader: boolean = $state(true)
+	const CSV_SEPARATORS = [
+		{ value: ',', label: ',' },
+		{ value: ';', label: ';' },
+		{ value: '\t', label: 'Tab' },
+		{ value: '|', label: '|' }
+	]
 
 	let dispatch = createEventDispatcher<{
 		close: { s3: string; storage: string | undefined } | undefined
@@ -179,6 +210,68 @@
 		  }
 		| undefined = $state(undefined)
 
+	let viewMode: 'table' | 'text' = $state('table')
+	/** The selected file, when it can be shown as a table. Its own requests can't read
+	 * files behind a custom listing (git repos), so those keep the text preview. */
+	let tableSource = $derived.by(() => {
+		if (hideS3SpecificDetails || !fileMetadata || !ws) return undefined
+		const fileKey = fileMetadata.fileKey
+		const inBrowser = isJsonFile(fileKey) && (fileMetadata.size ?? Infinity) <= JSON_TABLE_MAX_BYTES
+		if (!inBrowser && !serverTableFormat(fileKey)) return undefined
+		return {
+			workspace: ws,
+			fileKey,
+			storage,
+			s3ResourcePath,
+			csvSeparator: csvSeparatorChar,
+			csvHasHeader,
+			inBrowser
+		}
+	})
+	let tableKey = $derived(tableSource && JSON.stringify(tableSource))
+	let tableOps = resource(
+		() => (viewMode === 'table' ? tableSource : undefined),
+		async (source, _previous, { signal }) => {
+			if (!source) return undefined
+			const key = JSON.stringify(source)
+			// A response for a file or options since left must not replace the current one;
+			// the resource drops a fetch that throws an AbortError.
+			const superseded = () => new DOMException('Superseded', 'AbortError')
+			try {
+				const table = source.inBrowser ? await jsonTable(source) : await s3TableOps(source)
+				if (signal.aborted) throw superseded()
+				return { key, ops: table?.ops, csvSeparator: table?.csvSeparator }
+			} catch (e) {
+				throw signal.aborted ? superseded() : e
+			}
+		}
+	)
+	async function jsonTable(
+		source: S3TableSource
+	): Promise<{ ops: IDbTableOps; csvSeparator?: string } | undefined> {
+		const rows = await fetchJsonTableRows(source)
+		return rows && { ops: staticDbTableOps(rows, 'duckdb', source.fileKey.split('/').pop() ?? '') }
+	}
+	/** The loaded table, once it belongs to the selected file and options. */
+	let currentTable = $derived(tableOps.current?.key === tableKey ? tableOps.current : undefined)
+	/** A JSON file that turns out not to be an array has no table to show. */
+	let showTable = $derived(
+		viewMode === 'table' && !!tableSource && !(currentTable && !currentTable.ops)
+	)
+	// Each file starts on the separator the server guesses from its first bytes.
+	$effect(() => {
+		fileMetadata?.fileKey
+		untrack(() => {
+			csvSeparatorChar = undefined
+			detectedCsvSeparator = undefined
+		})
+	})
+	/** Kept while the file stays selected, so the text view still shows what was guessed. */
+	let detectedCsvSeparator: string | undefined = $state(undefined)
+	$effect(() => {
+		if (currentTable?.csvSeparator) detectedCsvSeparator = currentTable.csvSeparator
+	})
+
 	/** Identifies the metadata request that currently owns the preview pane. */
 	let metadataRequestId = 0
 
@@ -229,6 +322,25 @@
 	/** Per-level listing only makes sense while browsing; searching stays flat. */
 	let lazyMode = $derived(lazyFolders && filter.trim() === '')
 
+	/** `nestingLevel` counts two per folder depth. */
+	function treeRowIndent(nestingLevel: number): string {
+		return `padding-left: ${12 + (nestingLevel / 2) * 16}px;`
+	}
+
+	const FILE_ICONS: [RegExp, IconType][] = [
+		[/\.(csv|tsv|xlsx?|parquet|ods)$/i, FileSpreadsheet],
+		[/\.(json|jsonl|ndjson)$/i, FileJson],
+		[/\.(png|jpe?g|gif|webp|svg|bmp|ico|tiff?)$/i, FileImage],
+		[/\.(zip|tar|gz|tgz|bz2|xz|7z|rar|zst)$/i, FileArchive],
+		[/\.(mp4|mov|webm|mkv|avi)$/i, FilePlay],
+		[/\.(mp3|wav|ogg|flac|m4a)$/i, FileAudio],
+		[/\.(py|ts|js|go|rs|sh|sql|java|rb|php|ya?ml|toml|html|css|xml)$/i, FileCode],
+		[/\.(txt|md|log|pdf|docx?|rtf)$/i, FileText]
+	]
+	function fileIconFor(name: string): IconType {
+		return FILE_ICONS.find(([re]) => re.test(name))?.[1] ?? FileIcon
+	}
+
 	function nestingLevelOf(key: string): number {
 		const slashes = (key.match(/\//g) ?? []).length
 		return (key.endsWith('/') ? slashes - 1 : slashes) * 2
@@ -1047,41 +1159,50 @@
 	})
 </script>
 
+{#snippet tableLoading()}
+	<div class="flex items-center gap-2 p-3 text-xs text-tertiary">
+		<Loader2 size={14} class="animate-spin" /> Loading table...
+	</div>
+{/snippet}
+
 {#if workspaceSettingsInitialized === false}
-	{#if fromWorkspaceSettings}
-		<Alert type="error" title="Connection to remote S3 bucket unsuccessful">
-			<div class="flex flex-row gap-x-1 w-full items-center">
-				<p class="text-clip grow min-w-0"> Double check the S3 resource fields and try again. </p>
-			</div>
-		</Alert>
-	{:else if s3ResourcePath}
-		<Alert type="error" title="Could not connect to the object storage of {s3ResourcePath}">
-			<div class="flex flex-row gap-x-1 w-full items-center">
-				<p class="text-clip grow min-w-0">
-					Double check the resource fields and that its object storage is reachable, then try again.
-				</p>
-				<Button variant="default" on:click={reloadContent} startIcon={{ icon: RotateCw }} />
-			</div>
-		</Alert>
-	{:else}
-		<Alert type="error" title="Workspace not connected to any S3 storage">
-			<div class="flex flex-row gap-x-1 w-full items-center">
-				<p class="text-clip grow min-w-0">
-					The workspace needs to be connected to an S3 storage to use this feature. You can <a
-						target="_blank"
-						href="{base}/workspace_settings?tab=windmill_lfs">configure it here</a
-					>.
-				</p>
-				<Button variant="default" on:click={reloadContent} startIcon={{ icon: RotateCw }} />
-			</div>
-		</Alert>
-	{/if}
+	<div class="p-4">
+		{#if fromWorkspaceSettings}
+			<Alert type="error" title="Connection to remote S3 bucket unsuccessful">
+				<div class="flex flex-row gap-x-1 w-full items-center">
+					<p class="text-clip grow min-w-0"> Double check the S3 resource fields and try again. </p>
+				</div>
+			</Alert>
+		{:else if s3ResourcePath}
+			<Alert type="error" title="Could not connect to the object storage of {s3ResourcePath}">
+				<div class="flex flex-row gap-x-1 w-full items-center">
+					<p class="text-clip grow min-w-0">
+						Double check the resource fields and that its object storage is reachable, then try
+						again.
+					</p>
+					<Button variant="default" on:click={reloadContent} startIcon={{ icon: RotateCw }} />
+				</div>
+			</Alert>
+		{:else}
+			<Alert type="error" title="Workspace not connected to any S3 storage">
+				<div class="flex flex-row gap-x-1 w-full items-center">
+					<p class="text-clip grow min-w-0">
+						The workspace needs to be connected to an S3 storage to use this feature. You can <a
+							target="_blank"
+							href="/workspace_settings?tab=windmill_lfs">configure it here</a
+						>.
+					</p>
+					<Button variant="default" on:click={reloadContent} startIcon={{ icon: RotateCw }} />
+				</div>
+			</Alert>
+		{/if}
+	</div>
 {:else}
 	{#if fileListUnavailable == true}
 		{#if replaceUnauthorizedWarning}
 			{@render replaceUnauthorizedWarning()}
 		{:else}
-			<div class="mb-2">
+			<div class="p-3 border-b">
 				<Alert type="info" title="Access to S3 bucket restricted">
 					<p>
 						You don't have access to the S3 bucket resource and your administrator has restricted
@@ -1098,28 +1219,25 @@
 			</div>
 		{/if}
 	{/if}
-	<div class="flex flex-row border rounded-md h-full min-h-0 overflow-hidden">
+	<Splitpanes class="h-full min-h-0 overflow-hidden">
 		{#if !fileListUnavailable}
-			<div class="min-w-[30%] border-r flex flex-col min-h-0">
+			<Pane size={28} minSize={15} class="flex flex-col min-h-0">
 				{#if !rootPath}
-					<div class="w-full p-1 border-b">
-						<input
-							type="text"
-							placeholder="Search by path prefix"
+					<div class="mx-3 mt-3">
+						<TextInput
 							bind:value={filter}
-							class="text-xl"
+							inputProps={{ placeholder: 'Search by path prefix...' }}
 						/>
 					</div>
 				{/if}
 				{#if displayedFileKeys.length === 0}
 					{#if fileListLoading}
-						<div class="grow min-h-0 flex justify-center items-center">
-							<div class="flex text-secondary text-xs items-center">
-								<Loader2 size={12} class="animate-spin mr-1" /> Loading content
-							</div>
+						<div class="flex items-center gap-2 text-tertiary p-3">
+							<Loader2 class="animate-spin" size={14} />
+							<span class="text-xs">Loading...</span>
 						</div>
 					{:else}
-						<div class="p-4 text-primary text-xs text-center italic">
+						<div class="p-3 text-tertiary text-xs">
 							{#if filter.trim() !== ''}
 								No files starting with "{filter.trim()}"
 							{:else}
@@ -1131,19 +1249,19 @@
 							can remove every match. Without this the only control that could resume
 							the listing would be hidden behind the empty state. -->
 							<div class="flex justify-center pb-4">
-								<Button variant="default" size="xs2" on:click={() => loadNextFlatPage()}>
+								<Button variant="default" unifiedSize="xs" onClick={() => loadNextFlatPage()}>
 									Keep looking
 								</Button>
 							</div>
 						{/if}
 					{/if}
 				{:else}
-					<div class="grow min-h-0" bind:clientHeight={listDivHeight}>
+					<div class="grow min-h-0 mt-1.5" bind:clientHeight={listDivHeight}>
 						<VirtualList
 							width="100%"
 							height={listDivHeight}
 							itemCount={displayedFileKeys.length}
-							itemSize={42}
+							itemSize={32}
 						>
 							{#snippet header()}{/snippet}
 							{#snippet footer()}{/snippet}
@@ -1155,199 +1273,249 @@
 								{@const load_more_prefix = is_load_more ? item_key.slice(0, -1) : ''}
 								{@const file_info = allFilesByKey[item_key]}
 
-								<div
-									{style}
-									class={twMerge(
-										'hover:bg-surface-hover border-b',
-										index === displayedFileKeys.length - 1 && 'border-b-0'
-									)}
-								>
+								<div {style}>
 									{#if is_load_more}
 										<!-- Indented like the siblings it belongs to, so it must discount
 										the browsing root the same way entry rows do. -->
 										{@const loadMoreNesting =
 											nestingLevelOf(load_more_prefix + 'x') - 2 * rootPathNestingLevel}
 										{@const loadingMore = folderState[load_more_prefix]?.loading === true}
-										<!-- svelte-ignore a11y_click_events_have_key_events -->
-										<!-- svelte-ignore a11y_no_static_element_interactions -->
-										<div
+										<button
 											onclick={() => !loadingMore && loadMore(load_more_prefix)}
-											class={twMerge(
-												'flex flex-row h-full text-xs items-center justify-start text-secondary',
-												loadingMore ? 'cursor-default' : 'cursor-pointer'
-											)}
+											disabled={loadingMore}
+											class="w-full text-xs font-normal flex gap-2 items-center h-8 pr-1 text-secondary hover:bg-surface-hover cursor-pointer disabled:cursor-default disabled:hover:bg-transparent"
+											style={treeRowIndent(loadMoreNesting)}
 										>
-											<div
-												class="flex flex-row w-full gap-2 h-full items-center"
-												style={`margin-left: ${(2 + loadMoreNesting) * 0.25}rem;`}
-											>
-												<!-- Occupies the same slot as the sibling rows' file/folder icon so
-												the labels line up, and holds its width when the spinner swaps in. -->
-												<div class="w-4 shrink-0 flex items-center justify-center">
-													{#if loadingMore}
-														<Loader2 size={16} class="animate-spin" />
-													{:else}
-														<ChevronDown size={16} />
-													{/if}
-												</div>
-												<div class="truncate text-ellipsis w-56">Load more</div>
-											</div>
-										</div>
+											<span class="shrink-0 w-3.5"></span>
+											{#if loadingMore}
+												<Loader2 class="shrink-0 animate-spin" size={14} />
+											{:else}
+												<Ellipsis class="shrink-0" size={14} />
+											{/if}
+											<span class="truncate">Load more</span>
+										</button>
 									{:else if file_info}
 										{@const nestingLevel = file_info.nestingLevel - 2 * rootPathNestingLevel}
-										<!-- svelte-ignore a11y_click_events_have_key_events -->
-										<!-- svelte-ignore a11y_no_static_element_interactions -->
-										<div
+										{@const isSelected = selectedFileKey?.s3 === file_info.full_key}
+										{@const isFolder = file_info.type === 'folder'}
+										{@const RowIcon = isFolder
+											? file_info.collapsed
+												? FolderClosed
+												: FolderOpen
+											: fileIconFor(file_info.display_name)}
+										<button
 											onclick={() => selectItem(index)}
+											title={file_info.full_key.slice(rootPath.length)}
 											class={twMerge(
-												'flex flex-row h-full font-semibold text-xs items-center justify-start',
-												selectedFileKey !== undefined && selectedFileKey.s3 === file_info.full_key
-													? 'bg-surface-hover'
-													: ''
+												'w-full text-xs font-normal text-primary flex gap-2 items-center h-8 pr-1 cursor-pointer',
+												isSelected ? 'bg-surface-secondary' : 'hover:bg-surface-hover'
 											)}
+											style={treeRowIndent(nestingLevel)}
 										>
-											<div
-												class={`flex flex-row w-full gap-2 h-full items-center`}
-												style={`margin-left: ${(2 + nestingLevel) * 0.25}rem;`}
-											>
-												{#if file_info.type === 'folder'}
-													{#if folderState[file_info.full_key]?.loading}
-														<Loader2 size={16} class="animate-spin" />
-													{:else if file_info.collapsed}<FolderClosed size={16} />{:else}<FolderOpen
-															size={16}
-														/>{/if}
-													<div class="truncate text-ellipsis w-56">
-														<!-- An object-store key may contain an empty segment, so `a//` is a real
-														folder whose name is ''. Label it rather than rendering a blank row. -->
-														{#if file_info.display_name === ''}
-															<span class="italic text-secondary">(empty name)</span>
-														{:else}{file_info.display_name}{/if}
-														{#if !lazyMode}
-															({file_info.count}{count % 1000 === 0 &&
-															lastKeyFolders[file_info.nestingLevel / 2] === file_info.display_name
-																? '+'
-																: ''} item{file_info.count === 1 ? '' : 's'})
-														{/if}
-													</div>
+											{#if isFolder}
+												{#if folderState[file_info.full_key]?.loading}
+													<Loader2 class="shrink-0 text-secondary animate-spin" size={14} />
 												{:else}
-													<FileIcon size={16} />
-													<div class="truncate text-ellipsis w-56">
-														{file_info.display_name}
-													</div>
+													<ChevronDown
+														class={twMerge(
+															'shrink-0 text-secondary transition-transform',
+															file_info.collapsed && '-rotate-90'
+														)}
+														size={14}
+													/>
 												{/if}
-											</div>
-										</div>
+											{:else}
+												<span class="shrink-0 w-3.5"></span>
+											{/if}
+											<RowIcon class="shrink-0" size={14} />
+											<span class="truncate text-left">
+												<!-- An object-store key may contain an empty segment, so `a//` is a real
+												folder whose name is ''. Label it rather than rendering a blank row. -->
+												{#if file_info.display_name === ''}
+													<span class="italic text-secondary">(empty name)</span>
+												{:else}{file_info.display_name}{/if}
+											</span>
+											<span class="grow"></span>
+											{#if isFolder && !lazyMode}
+												<span
+													class="shrink-0 text-2xs text-tertiary mr-2"
+													title="Items inside this folder"
+												>
+													{file_info.count}{count % 1000 === 0 &&
+													lastKeyFolders[file_info.nestingLevel / 2] === file_info.display_name
+														? '+'
+														: ''}
+												</span>
+											{/if}
+										</button>
 									{/if}
 								</div>
 							{/snippet}
 						</VirtualList>
 					</div>
 					<div
-						class="flex flex-col gap-2 text-2xs justify-center items-center text-secondary w-full border-t py-1"
+						class="flex items-center justify-between gap-2 min-h-8 px-3 py-1 border-t text-2xs text-tertiary"
 					>
 						{#if fileListLoading === true}
-							<div class="flex text-secondary mt-1 text-xs justify-center items-center w-full">
-								<Loader2 size={12} class="animate-spin mr-1" /> Loading content
+							<div class="flex items-center gap-1.5">
+								<Loader2 size={12} class="animate-spin" /> Loading...
 							</div>
 						{:else if lazyMode}
 							<!-- Per-level listing: totals below the tree would be a count of what
 							happens to be expanded, and each folder carries its own Load more row. -->
 							<div>{displayedCount} item{displayedCount === 1 ? '' : 's'} shown</div>
 						{:else}
-							<div>
+							<div class="min-w-0">
 								{displayedCount}{flatHasMore ? '+' : ''}
 								{displayedCount !== count ? 'filtered ' : ''}items (including inside folders)
 							</div>
 
 							{#if flatHasMore}
-								<Button variant="default" size="xs2" on:click={() => loadNextFlatPage()}>
+								<Button variant="subtle" unifiedSize="xs" onClick={() => loadNextFlatPage()}>
 									Load more
 								</Button>
 							{/if}
 						{/if}
 					</div>
 				{/if}
-			</div>
+			</Pane>
 		{/if}
-		<div class="flex flex-col h-full w-full min-h-0 overflow-hidden">
-			{#if fileMetadata === undefined}
-				<div class="p-4">
-					{#if fileInfoLoading}
-						<Section label="Loading..." />
-					{:else if fileListUnavailable}
-						<Section label="No file to preview" />
-					{:else}
-						<Section label="Select a file to preview" />
-					{/if}
-				</div>
-			{:else}
-				<div class="px-3 py-2 flex flex-col gap-2">
-					<div class="flex flex-row items-center justify-between gap-2">
-						<h2 class="text-emphasis text-sm font-semibold break-all min-w-0">
-							{((p) => (p.startsWith(rootPath) ? p.slice(rootPath.length) : p))(
-								fileMetadata.fileKey
-							)}
-						</h2>
-						{#if filePreview !== undefined && (!hideS3SpecificDetails || !readOnlyMode || allowDelete)}
-							<div class="flex gap-2 shrink-0">
-								{#if !hideS3SpecificDetails}
-									{@const downloadApiPath = `/w/${ws}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}${s3ResourcePath ? `&s3_resource_path=${encodeURIComponent(s3ResourcePath)}` : ''}`}
-									{@const downloadName =
-										fileMetadata?.fileKey.split('/').pop() ?? 'unnamed_download.file'}
-									{#if shouldDownloadViaClient()}
-										<Button
-											title="Download file from S3"
-											variant="default"
-											on:click={() => downloadViaClient(downloadApiPath, downloadName)}
-											startIcon={{ icon: Download }}
-											iconOnly={true}
-										/>
-									{:else}
-										<Button
-											title="Download file from S3"
-											variant="default"
-											href={`${base}/api${downloadApiPath}`}
-											download={downloadName}
-											startIcon={{ icon: Download }}
-											iconOnly={true}
-										/>
-									{/if}
-								{/if}
-								{#if !readOnlyMode}
-									<Button
-										title="Move file"
-										variant="default"
-										on:click={() => {
-											moveDestKey = fileMetadata?.fileKey ?? ''
-											moveModalOpen = true
-										}}
-										startIcon={{ icon: MoveRight }}
-										iconOnly={true}
-									/>
-								{/if}
-								{#if !readOnlyMode || allowDelete}
-									<Button
-										title="Delete file"
-										variant="default"
-										on:click={() => {
-											deletionModalOpen = true
-										}}
-										startIcon={{ icon: Trash }}
-										iconOnly={true}
-									/>
-								{/if}
+		<Pane class="flex flex-col min-h-0 overflow-hidden">
+			<div
+				class="flex items-center gap-3 px-3 py-3 min-h-[3.75rem] shrink-0 border-b bg-surface-secondary"
+			>
+				{#if fileMetadata === undefined}
+					<div class="flex items-center gap-2 text-xs text-tertiary">
+						{#if fileInfoLoading}
+							<Loader2 size={14} class="animate-spin" /> Loading...
+						{:else if fileListUnavailable}
+							No file to preview
+						{:else}
+							Select a file to preview
+						{/if}
+					</div>
+				{:else}
+					{@const displayedKey = fileMetadata.fileKey.startsWith(rootPath)
+						? fileMetadata.fileKey.slice(rootPath.length)
+						: fileMetadata.fileKey}
+					{@const slash = displayedKey.lastIndexOf('/')}
+					{@const fileName = displayedKey.slice(slash + 1)}
+					{@const FileKindIcon = fileIconFor(fileName)}
+					{@const details = [
+						fileMetadata.mimeType,
+						fileMetadata.sizeStr,
+						fileMetadata.lastModified && `Modified ${fileMetadata.lastModified}`
+					].filter(Boolean)}
+					<div
+						class="shrink-0 flex items-center justify-center w-9 h-9 rounded-md border bg-surface text-secondary"
+					>
+						<FileKindIcon size={18} />
+					</div>
+					<div class="flex flex-col gap-0.5 min-w-0 grow">
+						<div class="flex items-center gap-1 min-w-0">
+							<span class="truncate text-sm font-semibold text-emphasis" title={displayedKey}>
+								{#if slash >= 0}<span class="font-normal text-tertiary"
+										>{displayedKey.slice(0, slash + 1)}</span
+									>{/if}{fileName}
+							</span>
+							<CopyButton value={displayedKey} title="Copy file key" class="shrink-0" />
+						</div>
+						{#if !hideS3SpecificDetails && details.length > 0}
+							<div class="flex flex-wrap items-center gap-x-1.5 text-xs text-secondary">
+								{#each details as detail, i}
+									{#if i > 0}<span class="text-tertiary">·</span>{/if}
+									<span>{detail}</span>
+								{/each}
 							</div>
 						{/if}
 					</div>
-					{#if !hideS3SpecificDetails}
-						<TableSimple
-							headers={['Last modified', 'Size', 'Type']}
-							data={[fileMetadata]}
-							keys={['lastModified', 'sizeStr', 'mimeType']}
-						/>
+					{#if tableSource}
+						<ToggleButtonGroup
+							noWFull
+							selected={viewMode}
+							onSelected={(v) => (viewMode = v)}
+							class="shrink-0"
+						>
+							{#snippet children({ item })}
+								<ToggleButton value="table" label="Table" icon={Table2} small {item} />
+								<ToggleButton value="text" label="Text" icon={FileText} small {item} />
+							{/snippet}
+						</ToggleButtonGroup>
 					{/if}
-				</div>
-			{/if}
+					{#if filePreview?.contentType === 'Csv'}
+						<div class="flex items-center gap-4 shrink-0 text-xs text-secondary">
+							<div class="flex items-center gap-2">
+								<span>Separator</span>
+								<Select
+									size="sm"
+									class="w-16"
+									RightIcon={ChevronDown}
+									items={CSV_SEPARATORS}
+									bind:value={csvSeparatorChar}
+									placeholder={CSV_SEPARATORS.find((s) => s.value === detectedCsvSeparator)
+										?.label ?? 'Auto'}
+								/>
+							</div>
+							<Toggle size="xs" bind:checked={csvHasHeader} options={{ right: 'Header row' }} />
+						</div>
+						<div class="w-px h-6 border-l shrink-0"></div>
+					{/if}
+					{#if filePreview !== undefined && (!hideS3SpecificDetails || !readOnlyMode || allowDelete)}
+						<div class="flex gap-1 shrink-0">
+							{#if !hideS3SpecificDetails}
+								{@const downloadApiPath = `/w/${ws}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata.fileKey)}${storage ? `&storage=${storage}` : ''}${s3ResourcePath ? `&s3_resource_path=${encodeURIComponent(s3ResourcePath)}` : ''}`}
+								{@const downloadName = fileName || 'unnamed_download.file'}
+								{#if shouldDownloadViaClient()}
+									<Button
+										title="Download"
+										variant="subtle"
+										unifiedSize="md"
+										onClick={() => downloadViaClient(downloadApiPath, downloadName)}
+										startIcon={{ icon: Download }}
+										iconOnly
+									/>
+								{:else}
+									<Button
+										title="Download"
+										variant="subtle"
+										unifiedSize="md"
+										href={`/api${downloadApiPath}`}
+										download={downloadName}
+										startIcon={{ icon: Download }}
+										iconOnly
+									/>
+								{/if}
+							{/if}
+							{#if !readOnlyMode}
+								<Button
+									title="Move"
+									variant="subtle"
+									unifiedSize="md"
+									onClick={() => {
+										moveDestKey = fileMetadata?.fileKey ?? ''
+										moveModalOpen = true
+									}}
+									startIcon={{ icon: MoveRight }}
+									iconOnly
+								/>
+							{/if}
+							{#if !readOnlyMode || allowDelete}
+								<Button
+									title="Delete"
+									variant="subtle"
+									unifiedSize="md"
+									destructive
+									onClick={() => {
+										deletionModalOpen = true
+									}}
+									startIcon={{ icon: Trash }}
+									iconOnly
+								/>
+							{/if}
+						</div>
+					{/if}
+				{/if}
+			</div>
 
 			<!-- Visual preview extracted to a standalone S3FilePreview component
 			     so the asset detail pane (and other surfaces) can render the
@@ -1356,17 +1524,40 @@
 			     above for the download/move toolbar; S3FilePreview does an
 			     independent load — fine on this non-hot path, and avoids
 			     plumbing pre-loaded state through component boundaries. -->
-			<S3FilePreview
-				fileKey={fileMetadata?.fileKey}
-				{storage}
-				{s3ResourcePath}
-				workspace={ws}
-				{loadFilePreviewRequest}
-				{loadFileMetadataRequest}
-				class="h-full"
-			/>
-		</div>
-	</div>
+			{#if showTable}
+				<div class="flex-1 min-h-0 relative">
+					{#if currentTable?.ops}
+						<!-- Lazy: the (logged) layout mounts this picker and DBTable reaches monaco. -->
+						{#await import('./DBTable.svelte')}
+							{@render tableLoading()}
+						{:then DBTable}
+							{#key currentTable.ops}
+								<DBTable.default dbTableOps={currentTable.ops} />
+							{/key}
+						{/await}
+					{:else if tableOps.error}
+						<div class="p-3 text-xs text-red-600 dark:text-red-400 break-words">
+							Could not read this file as a table: {tableOps.error.message}
+						</div>
+					{:else}
+						{@render tableLoading()}
+					{/if}
+				</div>
+			{:else}
+				<S3FilePreview
+					fileKey={fileMetadata?.fileKey}
+					{storage}
+					{s3ResourcePath}
+					workspace={ws}
+					{loadFilePreviewRequest}
+					{loadFileMetadataRequest}
+					class="flex-1 min-h-0"
+					csvOptions={{ separator: csvSeparatorChar, hasHeader: csvHasHeader }}
+					bodyClass="bg-transparent px-3"
+				/>
+			{/if}
+		</Pane>
+	</Splitpanes>
 {/if}
 
 <ConfirmationModal
diff --git a/frontend/src/lib/components/S3FilePreview.svelte b/frontend/src/lib/components/S3FilePreview.svelte
index 411592b936..4635d4f6c7 100644
--- a/frontend/src/lib/components/S3FilePreview.svelte
+++ b/frontend/src/lib/components/S3FilePreview.svelte
@@ -5,8 +5,10 @@
 	// renderings without dragging in the whole picker UI.
 	//
 	// The component owns its own metadata + preview loads — callers only
-	// need to hand it a `fileKey`. CSV separator/header are local state so
-	// the user can re-preview the same file with different parsing flags.
+	// need to hand it a `fileKey`. CSV separator/header are local state (unless
+	// the caller passes `csvOptions`) so the user can re-preview the same file
+	// with different parsing flags.
+	import { untrack } from 'svelte'
 	import { FileX2, Loader2 } from 'lucide-svelte'
 	import {
 		HelpersService,
@@ -46,6 +48,11 @@
 		// metadata out themselves (the picker already has its own).
 		showMetadata?: boolean
 		class?: string
+		/** CSV parsing options owned by the caller, which then renders its own controls:
+		 * the preview hides its own and reloads when these change. */
+		csvOptions?: { separator: string | undefined; hasHeader: boolean }
+		/** Merged onto the preview body, below the metadata strip. */
+		bodyClass?: string
 		// Bump this to force a re-fetch (metadata + preview). Used by the
 		// asset detail pane after an upstream producer run completes —
 		// without it, the "Asset not yet materialized" empty state stays
@@ -62,6 +69,8 @@
 		loadFileMetadataRequest = HelpersService.loadFileMetadata,
 		showMetadata = false,
 		class: className = '',
+		bodyClass = '',
+		csvOptions = undefined,
 		refreshKey
 	}: Props = $props()
 
@@ -179,8 +188,8 @@
 				fileKey: key,
 				fileSizeInBytes: size,
 				fileMimeType: mimeType,
-				csvSeparator: csvSeparatorChar,
-				csvHasHeader: csvHasHeader,
+				csvSeparator: csvOptions ? csvOptions.separator : csvSeparatorChar,
+				csvHasHeader: csvOptions?.hasHeader ?? csvHasHeader,
 				readBytesFrom: 0,
 				readBytesLength: 128 * 1024,
 				storage,
@@ -221,6 +230,16 @@
 			void reloadPreview(fileMetadata.fileKey, fileMetadata.size, fileMetadata.mimeType)
 		}
 	}
+
+	// Skips the first run: the file load already fetches the preview with these options.
+	let lastCsvOptionsKey: string | undefined
+	$effect(() => {
+		const key = csvOptions ? `${csvOptions.separator}|${csvOptions.hasHeader}` : undefined
+		if (lastCsvOptionsKey !== undefined && key !== lastCsvOptionsKey) {
+			untrack(onCsvControlsChanged)
+		}
+		lastCsvOptionsKey = key
+	})
 </script>
 
 <div class={twMerge('flex flex-col h-full w-full overflow-auto text-xs', className)}>
@@ -231,7 +250,7 @@
 			{#if fileMetadata.lastModified}<span>{fileMetadata.lastModified}</span>{/if}
 		</div>
 	{/if}
-	<div class="flex-1 min-h-0 overflow-auto p-4 bg-surface-secondary">
+	<div class={twMerge('flex-1 min-h-0 overflow-auto p-4 bg-surface-secondary', bodyClass)}>
 		{#if !fileKey}
 			<div class="text-tertiary text-xs">No file selected.</div>
 		{:else if fileInfoLoading && !fileMetadata && !notFound && !loadError}
@@ -291,32 +310,36 @@
 				<Loader2 size={12} class="animate-spin mr-1" /> File preview loading
 			</div>
 		{:else if fileMetadata !== undefined && filePreview !== undefined}
-			<div class="flex items-center text-primary mb-4">
-				{#if filePreview.contentType === 'Unknown'}
+			{#if filePreview.contentType === 'Unknown'}
+				<div class="flex items-center text-primary mb-4">
 					Type of file not supported for preview.
-				{:else if filePreview.contentType === 'Csv'}
-					Previewing a {filePreview.contentType?.toLowerCase()} file. Separator character:
-					<div class="inline-flex w-12 ml-2 mr-2">
-						<select class="h-8" bind:value={csvSeparatorChar} onchange={onCsvControlsChanged}>
-							<option value=",">,</option>
-							<option value=";">;</option>
-							<option value="\t">\t</option>
-							<option value="|">|</option>
-						</select>
-					</div>
-					Header row:
-					<div class="inline-flex item-center w-4 ml-2 mr-2">
-						<input
-							type="checkbox"
-							class="h-5"
-							bind:checked={csvHasHeader}
-							onchange={onCsvControlsChanged}
-						/>
-					</div>
-				{:else}
-					Previewing a {filePreview.contentType?.toLowerCase()} file.
-				{/if}
-			</div>
+				</div>
+			{:else if !csvOptions}
+				<div class="flex items-center text-primary mb-4">
+					{#if filePreview.contentType === 'Csv'}
+						Previewing a {filePreview.contentType?.toLowerCase()} file. Separator character:
+						<div class="inline-flex w-12 ml-2 mr-2">
+							<select class="h-8" bind:value={csvSeparatorChar} onchange={onCsvControlsChanged}>
+								<option value=",">,</option>
+								<option value=";">;</option>
+								<option value="\t">\t</option>
+								<option value="|">|</option>
+							</select>
+						</div>
+						Header row:
+						<div class="inline-flex item-center w-4 ml-2 mr-2">
+							<input
+								type="checkbox"
+								class="h-5"
+								bind:checked={csvHasHeader}
+								onchange={onCsvControlsChanged}
+							/>
+						</div>
+					{:else}
+						Previewing a {filePreview.contentType?.toLowerCase()} file.
+					{/if}
+				</div>
+			{/if}
 			<pre class="grow whitespace-no-wrap break-words"
 				>{#if !emptyString(filePreview.contentPreview)}{filePreview.contentPreview}{:else if filePreview.contentType !== undefined}Preview impossible.{/if}</pre
 			>
diff --git a/frontend/src/lib/components/SchemaForm.svelte b/frontend/src/lib/components/SchemaForm.svelte
index 872ed9711e..d05c3cce72 100644
--- a/frontend/src/lib/components/SchemaForm.svelte
+++ b/frontend/src/lib/components/SchemaForm.svelte
@@ -4,7 +4,8 @@
 	const bubble = createBubbler()
 	import type { Schema } from '$lib/common'
 	import { VariableService } from '$lib/gen'
-	import { allTrue, computeShow, type DynamicInput } from '$lib/utils'
+	import { allTrue, type DynamicInput } from '$lib/utils'
+	import { computeShow, quickjsSettled } from '$lib/utils/quickjsEval.svelte'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
 	import VariableEditor from './VariableEditor.svelte'
@@ -232,7 +233,9 @@
 				continue
 			}
 			if (prop?.showExpr) {
-				if (computeShow(x.value, prop.showExpr, args)) {
+				const show = computeShow(prop.showExpr, args)
+				if (show === undefined) continue
+				if (show) {
 					hidden[x.value] = false
 				} else if (!hidden[x.value]) {
 					hidden[x.value] = true
@@ -277,6 +280,7 @@
 			for (const key in args) {
 				args[key]
 			}
+			quickjsSettled()
 		}
 		untrack(() => handleHiddenFields(schema, args ?? {}))
 	})
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index 05d0f68496..601bf77799 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -72,7 +72,6 @@
 		Tag,
 		X
 	} from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import { parsePipelineAnnotations } from './assets/AssetGraph/parsePipelineAnnotations'
 	import DropdownV2 from './DropdownV2.svelte'
@@ -83,6 +82,7 @@
 	import { fade } from 'svelte/transition'
 	import Popover from './Popover.svelte'
 	import Toggle from './Toggle.svelte'
+	import JobTokenScopesSetting from './JobTokenScopesSetting.svelte'
 	import ScriptSchema from './ScriptSchema.svelte'
 	import Section from './Section.svelte'
 	import Label from './Label.svelte'
@@ -92,8 +92,11 @@
 	import { writable } from 'svelte/store'
 	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
 	import DefaultScripts from './DefaultScripts.svelte'
-	import { getContext, onDestroy, onMount, setContext, tick, untrack } from 'svelte'
+	import { getContext, onDestroy, onMount, setContext, tick, untrack, type Snippet } from 'svelte'
 	import EditorHeader from './EditorHeader.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import ScriptSettingsBadges from './ScriptSettingsBadges.svelte'
 	import Badge from './common/badge/Badge.svelte'
 	import Modal from './common/modal/Modal.svelte'
@@ -124,8 +127,9 @@
 	import WacExportDrawer from './scripts/WacExportDrawer.svelte'
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { useEditRights, useTriggerLock } from '$lib/operatorWriteRights'
 	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	let {
 		script = $bindable(),
@@ -161,12 +165,14 @@
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
-		condensedHeader = false
+		condensedHeader = false,
+		ownsPageHeader = false
 	}: ScriptBuilderProps = $props()
 
 	// Top-bar button size + bar height. Condensed (session preview) uses the
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
-	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
+	// In the page header the buttons ride a 44px band, which takes the same size.
+	const headerBtnSize = $derived(condensedHeader || ownsPageHeader ? 'sm' : 'md')
 
 	export function getInitialAndModifiedValues(): SavedAndModifiedValue {
 		return {
@@ -195,8 +201,24 @@
 	// right group (hide the ~200px tag select, icon-only Diff/Settings) before the
 	// full group crowds the path into heavy truncation; ~900 is where the path
 	// keeps a usable width given the right group's natural ~440px.
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 900)
+	// In the page header the buttons share the row with the breadcrumb, so they collapse sooner:
+	// the trail and the summary take ~560px before either truncates, and the full button group is
+	// ~515px — about 1100px between them, plus slack for a longer path than most.
+	const compactBelow = $derived(ownsPageHeader ? 1200 : 900)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar holds the trail and one button. Diff and Settings join the menu that compact
+	// already shows, and Deploy stays out: it is what this page is for.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	// The workspace this editor operates on: deploy, save-draft, trigger loading
 	// and the AutosaveIndicator all target it. Falls back to the full-page
@@ -219,7 +241,21 @@
 
 	function getCompactMenuItems(): Item[] {
 		const hasTags = (scriptWorkerTags?.length ?? 0) > 0
+		const isDraftOnly = savedScript?.no_deployed === true
 		return [
+			...(phoneTopbar && customUi?.topBar?.diff != false
+				? [
+						{
+							displayName: 'Diff',
+							icon: DiffIcon,
+							disabled: !savedScript || !diffDrawer || isDraftOnly,
+							action: () => openDiffDrawer()
+						}
+					]
+				: []),
+			...(phoneTopbar && customUi?.topBar?.settings != false
+				? [{ displayName: 'Settings', icon: Settings, action: () => (metadataOpen = true) }]
+				: []),
 			...(customUi?.topBar?.tagEdit != false && hasTags
 				? [
 						{
@@ -560,6 +596,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 			| 'wac_python'
 			| 'wac_typescript'
 			| 'ci_test_bun'
@@ -787,7 +824,9 @@
 					preserve_on_behalf_of: preserveOnBehalfOf || undefined,
 					assets: script.assets,
 					modules: script.modules,
-					labels: script.labels
+					labels: script.labels,
+					// Sent explicitly: an omitted field keeps the deployed value.
+					job_token_scopes: script.job_token_scopes ?? null
 				}
 			})
 
@@ -1346,7 +1385,7 @@
 	onCanceled={() => (perpetualRunsToConfirm = undefined)}
 />
 
-{#if !actingUser?.operator}
+{#if editRights.roleCanAuthor('script')}
 	<Drawer
 		placement="right"
 		bind:open={metadataOpen}
@@ -1505,10 +1544,12 @@
 														(lang == script.language &&
 															template != 'bunnative' &&
 															template != 'docker' &&
-															template != 'claudesandbox') ||
+															template != 'claudesandbox' &&
+															template != 'pisandbox') ||
 														(template == 'bunnative' && lang == 'bunnative') ||
 														(template == 'docker' && lang == 'docker') ||
-														(template == 'claudesandbox' && lang == 'bun')}
+														((template == 'claudesandbox' || template == 'pisandbox') &&
+															lang == 'bun')}
 													<Popover
 														disablePopup={!enterpriseLangs.includes(lang) || !!$enterpriseLicense}
 													>
@@ -1559,6 +1600,21 @@
 										>
 											Claude Sandbox
 										</Button>
+										<Button
+											unifiedSize="xs"
+											variant="default"
+											startIcon={{
+												icon: LanguageIcon,
+												props: { lang: 'pisandbox', width: 16, height: 16 }
+											} as ButtonType.Icon}
+											onclick={() => {
+												template = 'pisandbox'
+												script.language = 'bun'
+												initContent('bun', script.kind, template)
+											}}
+										>
+											Pi Sandbox
+										</Button>
 										<span title="Workflow-as-Code">
 											<Button
 												size="xs2"
@@ -2065,6 +2121,9 @@
 											/>
 										</div>
 									</Section>
+									<Section label="Job token">
+										<JobTokenScopesSetting bind:value={script.job_token_scopes} kind="script" />
+									</Section>
 									<Section
 										label={canPreserve
 											? 'Run on behalf of a specified user'
@@ -2243,164 +2302,298 @@
 	</Drawer>
 
 	<div class="flex flex-col h-full">
-		<div
-			bind:clientWidth={topbarWidth}
-			class="flex items-center px-4 {condensedHeader ? 'h-9' : 'h-12'}"
-		>
-			<div class="flex gap-2 lg:gap-2 w-full items-center">
-				<div class="flex flex-row items-center gap-2 min-w-0 shrink">
-					<button
-						disabled={customUi?.topBar?.settings == false}
-						class="shrink-0"
-						onclick={async () => {
-							metadataOpen = true
-						}}
-					>
-						<LanguageIcon lang={script.language} size={condensedHeader ? 18 : 24} />
-					</button>
-					{#if customUi?.topBar?.path != false}
-						<div class="min-w-0 overflow-hidden">
-							<EditorHeader
-								bind:summary={script.summary}
-								bind:path={script.path}
-								savedPath={initialPath}
-								kind="script"
-								summaryEditable={customUi?.topBar?.editableSummary != false}
-								pathEditable={customUi?.topBar?.editablePath != false}
-								hidePath={condensedHeader}
-								workspaceId={autosaveWorkspace}
-								onNavigate={(item) => onNavigate?.(item)}
-							/>
-						</div>
+		{#if ownsPageHeader}
+			<!-- The editor's own top bar is the page header on this route: the script's path and
+			     summary are the breadcrumb's, and its buttons are the header's actions. -->
+			<!-- `separator="none"`: the toolbar right below the bar draws its own `border-b`, and the
+			     bar's edge would be a second line on top of it. -->
+			<PageHeaderContent
+				item={{
+					// Frozen while the rename popover is open so the trail holds still as the user types.
+					kind: 'script',
+					// `script?`: this object is built inside a getter the band evaluates from its own
+					// tree, and `script` is a bindable prop. Deploying a new script clears the draft the
+					// route binds here and drops the `{#if}` around this editor in one flush, which
+					// invalidates the band before this component is torn down.
+					path: pathSnapshot ?? script?.path,
+					summaryContent: scriptSummary,
+					// Gated like the summary's own editor: a host that allows neither field keeps the
+					// band's segment, which copies the path.
+					pathTrigger:
+						customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false
+							? scriptPathTrigger
+							: undefined
+				}}
+				afterName={scriptMarks}
+				actions={scriptHeaderActions}
+				separator="none"
+			/>
+		{:else}
+			<div
+				bind:clientWidth={topbarWidth}
+				class="flex items-center px-4 {condensedHeader ? 'h-9' : 'h-12'}"
+			>
+				<div class="flex gap-2 lg:gap-2 w-full items-center">
+					<div class="flex flex-row items-center gap-2 min-w-0 shrink">
+						{@render languageButton(condensedHeader ? 18 : 24)}
+						{#if customUi?.topBar?.path != false}
+							<div class="min-w-0 overflow-hidden">
+								<EditorHeader
+									bind:summary={script.summary}
+									bind:path={script.path}
+									savedPath={initialPath}
+									kind="script"
+									summaryEditable={customUi?.topBar?.editableSummary != false}
+									pathEditable={customUi?.topBar?.editablePath != false}
+									hidePath={condensedHeader}
+									workspaceId={autosaveWorkspace}
+									onNavigate={(item) => onNavigate?.(item)}
+								/>
+							</div>
+						{/if}
+						{@render autosaveIndicator()}
+						{#if !condensedHeader}
+							{@render settingsBadges()}
+						{/if}
+					</div>
+
+					<!-- Separator -->
+					<div class="flex-1"></div>
+
+					{#if $enterpriseLicense && initialPath != '' && !inSessionPane}
+						<Awareness />
 					{/if}
-					{#if opWorkspace}
-						<AutosaveIndicator
-							workspace={opWorkspace}
-							itemKind="script"
-							path={indicatorPath}
-							draftOnly={savedScript?.no_deployed === true}
-							{onResetToDeployed}
-							{loadedFromDraft}
-							{othersDraftsCount}
-							{onOpenOthersDrafts}
-						/>
-					{/if}
-					{#if !condensedHeader}
-						{@const canOpenRuntime =
-							customUi?.topBar?.settings != false &&
-							customUi?.settingsPanel?.disableRuntime !== true}
-						<ScriptSettingsBadges
-							settings={script}
-							onclick={canOpenRuntime
-								? () => {
-										selectedTab = 'runtime'
-										metadataOpen = true
-									}
-								: undefined}
+
+					<!-- Separator -->
+					<div class="flex-1"></div>
+
+					{@render rightButtons()}
+				</div>
+			</div>
+		{/if}
+
+		{#snippet scriptSummary()}
+			<!-- Everything the band pulls from this editor is gated on `script`. It is a bindable prop,
+			     and these snippets render from the band's tree, where nothing orders the route clearing
+			     that prop against this component's teardown: deploying a new script discards the draft
+			     bound here and drops the `{#if}` around this editor in the same flush. -->
+			{#if script}
+				<!-- Not edited in place: clicking the name opens the summary and the path together, so
+				     the band reads as a name rather than a form. `title` for one it truncates. -->
+				<div class="flex items-center gap-1 min-w-0">
+					{#snippet summaryText()}
+						<span
+							class="min-w-0 truncate text-xs {emptyString(script.summary)
+								? 'text-tertiary italic font-normal'
+								: 'font-medium text-emphasis'}"
+							title={script.summary}
+							>{emptyString(script.summary) ? 'Add a summary...' : script.summary}</span
+						>
+					{/snippet}
+					{#if customUi?.topBar?.editablePath != false || customUi?.topBar?.editableSummary != false}
+						<PathEditPopover
+							label={summaryText}
+							bind:summary={script.summary}
+							summaryEditable={customUi?.topBar?.editableSummary != false}
+							pathEditable={customUi?.topBar?.editablePath != false}
+							bind:path={script.path}
+							bind:snapshotPath={pathSnapshot}
+							savedPath={initialPath}
+							kind="script"
+							workspaceId={autosaveWorkspace}
 						/>
+					{:else}
+						{@render summaryText()}
 					{/if}
 				</div>
+			{/if}
+		{/snippet}
 
-				<!-- Separator -->
-				<div class="flex-1"></div>
+		<!-- The same editor as the summary's, hung off the band's path segment: anchored there it
+		     opens under the path, and `focusField` puts the cursor in the field that half of the
+		     name belongs to. The bindings are written out again because `bind:` cannot be spread;
+		     both instances bind the same slots, and only one is ever open. -->
+		{#snippet scriptPathTrigger(pathLabel: Snippet, triggerClass: string)}
+			<!-- Gated like the summary beside it: `script` is a bindable prop the route can clear in
+			     the same flush that drops this editor, and this renders from the band's tree. The
+			     `{:else}` is not decoration: the band hands the segment over the moment a page offers
+			     a `pathTrigger`, so a gate that drew nothing would take the path off the trail. -->
+			{#if script}
+				<PathEditPopover
+					label={pathLabel}
+					{triggerClass}
+					focusField="path"
+					bind:summary={script.summary}
+					summaryEditable={customUi?.topBar?.editableSummary != false}
+					pathEditable={customUi?.topBar?.editablePath != false}
+					bind:path={script.path}
+					bind:snapshotPath={pathSnapshot}
+					savedPath={initialPath}
+					kind="script"
+					workspaceId={autosaveWorkspace}
+				/>
+			{:else}
+				<span class={triggerClass}>{@render pathLabel()}</span>
+			{/if}
+		{/snippet}
 
+		{#snippet scriptMarks()}
+			{#if script}
+				<!-- Concurrency, cache, a dedicated worker: settings that hold whatever the editor shows,
+				     so they belong with the script's name. The language icon the editor's own bar carried
+				     does not come along — the code under it says which language this is. -->
+				{@render settingsBadges('pl-1.5')}
+			{/if}
+		{/snippet}
+
+		{#snippet scriptHeaderActions()}
+			{#if script}
+				<!-- Saving state and other people's drafts: the editor's own bar carries them beside the
+				     path, so the header has to carry them when it owns the bar — without them a
+				     full-page editor saves with no word either way. -->
+				{@render autosaveIndicator()}
 				{#if $enterpriseLicense && initialPath != '' && !inSessionPane}
 					<Awareness />
 				{/if}
+				{@render rightButtons()}
+			{/if}
+		{/snippet}
 
-				<!-- Separator -->
-				<div class="flex-1"></div>
+		{#snippet languageButton(size: number)}
+			<button
+				disabled={customUi?.topBar?.settings == false}
+				class="shrink-0"
+				title="Settings"
+				onclick={async () => {
+					metadataOpen = true
+				}}
+			>
+				<LanguageIcon lang={script.language} {size} />
+			</button>
+		{/snippet}
 
-				{#snippet settingsButton()}
-					{#if customUi?.topBar?.settings != false}
-						<Button
-							aiId="script-builder-settings"
-							aiDescription="Script builder settings to configure metadata, runtime, triggers, and generated UI."
-							variant="default"
-							unifiedSize={headerBtnSize}
-							on:click={() => (metadataOpen = true)}
-							startIcon={{ icon: Settings }}
-							iconOnly={compactTopbar}
-							title="Settings"
-						>
-							<span> Settings </span>
-						</Button>
-					{/if}
-				{/snippet}
-				{#snippet diffButton()}
-					{#if customUi?.topBar?.diff != false}
-						{@const isDraftOnly = savedScript?.no_deployed === true}
-						{@const diffDisabled = !savedScript || !diffDrawer || isDraftOnly}
-						{@const diffTitle = isDraftOnly
-							? 'Deploy this script once to compare against the deployed version'
-							: 'Diff'}
-						<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
+		{#snippet autosaveIndicator()}
+			{#if opWorkspace}
+				<AutosaveIndicator
+					workspace={opWorkspace}
+					itemKind="script"
+					path={indicatorPath}
+					draftOnly={savedScript?.no_deployed === true}
+					{onResetToDeployed}
+					{loadedFromDraft}
+					{othersDraftsCount}
+					{onOpenOthersDrafts}
+				/>
+			{/if}
+		{/snippet}
+
+		{#snippet settingsBadges(className?: string)}
+			{@const canOpenRuntime =
+				customUi?.topBar?.settings != false && customUi?.settingsPanel?.disableRuntime !== true}
+			<ScriptSettingsBadges
+				class={className}
+				settings={script}
+				onclick={canOpenRuntime
+					? () => {
+							selectedTab = 'runtime'
+							metadataOpen = true
+						}
+					: undefined}
+			/>
+		{/snippet}
+
+		{#snippet rightButtons()}
+			{#snippet settingsButton()}
+				{#if customUi?.topBar?.settings != false}
+					<Button
+						aiId="script-builder-settings"
+						aiDescription="Script builder settings to configure metadata, runtime, triggers, and generated UI."
+						variant="default"
+						unifiedSize={headerBtnSize}
+						on:click={() => (metadataOpen = true)}
+						startIcon={{ icon: Settings }}
+						iconOnly={compactTopbar}
+						title="Settings"
+					>
+						<span> Settings </span>
+					</Button>
+				{/if}
+			{/snippet}
+			{#snippet diffButton()}
+				{#if customUi?.topBar?.diff != false}
+					{@const isDraftOnly = savedScript?.no_deployed === true}
+					{@const diffDisabled = !savedScript || !diffDrawer || isDraftOnly}
+					{@const diffTitle = isDraftOnly
+						? 'Deploy this script once to compare against the deployed version'
+						: 'Diff'}
+					<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
 						     never shows on hover. pointer-events-none on the button lets the hover
 						     reach this titled wrapper instead. -->
-						<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
-							<Button
-								variant="default"
-								unifiedSize={headerBtnSize}
-								on:click={() => openDiffDrawer()}
-								disabled={diffDisabled}
-								btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
-								iconOnly={compactTopbar}
-								title={diffTitle}
-								startIcon={{ icon: DiffIcon }}
-							>
-								Diff
-							</Button>
-						</div>
-					{/if}
-				{/snippet}
-				{#if compactTopbar}
-					<DropdownV2 items={getCompactMenuItems} placement="bottom-end">
-						{#snippet buttonReplacement()}
-							<Button
-								nonCaptureEvent
-								unifiedSize={headerBtnSize}
-								variant="subtle"
-								startIcon={{ icon: EllipsisVertical }}
-								iconOnly
-								title="More"
-							/>
-						{/snippet}
-					</DropdownV2>
+					<div title={diffTitle} class={diffDisabled ? 'flex cursor-not-allowed' : 'flex'}>
+						<Button
+							variant="default"
+							unifiedSize={headerBtnSize}
+							on:click={() => openDiffDrawer()}
+							disabled={diffDisabled}
+							btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
+							iconOnly={compactTopbar}
+							title={diffTitle}
+							startIcon={{ icon: DiffIcon }}
+						>
+							Diff
+						</Button>
+					</div>
+				{/if}
+			{/snippet}
+			{#if compactTopbar}
+				<DropdownV2 items={getCompactMenuItems} placement="bottom-end">
+					{#snippet buttonReplacement()}
+						<Button
+							nonCaptureEvent
+							unifiedSize={headerBtnSize}
+							variant="subtle"
+							startIcon={{ icon: EllipsisVertical }}
+							iconOnly
+							title="More"
+						/>
+					{/snippet}
+				</DropdownV2>
+				{#if !phoneTopbar}
 					{@render diffButton()}
 					{@render settingsButton()}
-				{:else}
-					{@render diffButton()}
-					{#if customUi?.topBar?.tagEdit != false}
-						{#if scriptWorkerTags}
-							{#if scriptWorkerTags?.length ?? 0 > 0}
-								<div class="max-w-[200px]">
-									<WorkerTagSelect
-										nullTag={script.language}
-										placeholder={customUi?.tagSelectPlaceholder}
-										bind:tag={script.tag}
-										size={headerBtnSize}
-										workspaceId={opWorkspace}
-									/>
-								</div>
-							{/if}
-						{/if}
-					{/if}
-					{@render settingsButton()}
 				{/if}
+			{:else}
+				{@render diffButton()}
+				{#if customUi?.topBar?.tagEdit != false}
+					{#if scriptWorkerTags}
+						{#if scriptWorkerTags?.length ?? 0 > 0}
+							<div class="max-w-[200px]">
+								<WorkerTagSelect
+									nullTag={script.language}
+									placeholder={customUi?.tagSelectPlaceholder}
+									bind:tag={script.tag}
+									size={headerBtnSize}
+									workspaceId={opWorkspace}
+								/>
+							</div>
+						{/if}
+					{/if}
+				{/if}
+				{@render settingsButton()}
+			{/if}
 
-				<DeployButton
-					loading={!fullyLoaded}
-					{loadingSave}
-					unifiedSize={headerBtnSize}
-					dropdownItems={computeDropdownItems(initialPath, savedScript)}
-					on:save={({ detail }) => handleEditScript(false, detail)}
-				/>
-			</div>
-		</div>
+			<DeployButton
+				loading={!fullyLoaded}
+				{loadingSave}
+				unifiedSize={headerBtnSize}
+				dropdownItems={computeDropdownItems(initialPath, savedScript)}
+				on:save={({ detail }) => handleEditScript(false, detail)}
+			/>
+		{/snippet}
 
 		{#if showPipelineHint}
 			<div
-				class="flex items-center gap-2 px-4 py-1 border-y bg-surface-secondary text-xs text-secondary"
+				class="flex items-center gap-2 px-4 py-1 border-b bg-surface-secondary text-xs text-secondary"
 			>
 				<Network size={14} class="shrink-0 text-tertiary" />
 				<span class="truncate">
@@ -2411,7 +2604,7 @@
 						-- materialize
 					</code>
 					to materialize its result, or build it in the
-					<a href="{base}/pipeline" class="text-blue-500 hover:underline">pipeline editor</a>.
+					<a href="/pipeline" class="text-blue-500 hover:underline">pipeline editor</a>.
 					<a
 						href="https://www.windmill.dev/docs/pipelines"
 						target="_blank"
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index e3215aa9cf..ef3df73f63 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -81,12 +81,12 @@
 	import type { ScriptEditorWhitelabelCustomUi } from './custom_ui'
 	import Tabs from './common/tabs/Tabs.svelte'
 	import Tab from './common/tabs/Tab.svelte'
+	import DraggableTabs, { type TabItem } from './common/tabs/DraggableTabs.svelte'
 	import { slide } from 'svelte/transition'
 	import CaptureTable from '$lib/components/triggers/CaptureTable.svelte'
 	import CaptureButton from './triggers/CaptureButton.svelte'
 	import { setContext } from 'svelte'
 	import HideButton from './apps/editor/settingsPanel/HideButton.svelte'
-	import { base } from '$lib/base'
 	import DispatchEventsButton from '$lib/components/runs/DispatchEventsButton.svelte'
 	import { SUPPORTED_CHAT_SCRIPT_LANGUAGES } from './copilot/chat/script/core'
 	import { getStringError } from './copilot/chat/utils'
@@ -149,6 +149,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 			| 'wac_python'
 			| 'wac_typescript'
 			| 'ci_test_bun'
@@ -407,6 +408,30 @@
 	let supportsModules = $derived((lang === 'bun' || lang === 'python3') && isWacV2)
 	let mainFileName = $derived('script.' + langToExt(scriptLangToEditorLang(lang)))
 
+	// A module path always ends in a file extension, so this id can't collide with one.
+	const MAIN_FILE_TAB_ID = '__main__'
+	// Tab order is view state only: `modules` is stored as JSONB, which re-sorts its keys on
+	// deploy, so an order written into it would not survive.
+	let moduleTabOrder: string[] = $state([])
+	let fileTabs = $derived.by<TabItem[]>(() => {
+		const paths = Object.keys(modules ?? {})
+		const rank = new Map(paths.map((p, i) => [p, i + moduleTabOrder.length]))
+		moduleTabOrder.forEach((p, i) => rank.has(p) && rank.set(p, i))
+		return [
+			{ id: MAIN_FILE_TAB_ID, label: mainFileName, closable: false, pinned: 'left' },
+			// Not closable through the strip: closing deletes the module's code, so it stays on
+			// the explicit × rather than Delete/Backspace and middle-click.
+			...paths
+				.sort((a, b) => rank.get(a)! - rank.get(b)!)
+				.map((modulePath) => ({
+					id: modulePath,
+					label: modulePath,
+					title: modulePath,
+					closable: false
+				}))
+		]
+	})
+
 	let modulePathInput = $state('')
 	let showAddModulePopover = $state(false)
 	let modulePathInputEl: HTMLInputElement | undefined = $state(undefined)
@@ -561,6 +586,7 @@
 		delete modules[modulePath]
 		delete moduleTestState[modulePath]
 		modules = { ...modules }
+		moduleTabOrder = moduleTabOrder.filter((p) => p !== modulePath)
 	}
 
 	function validateRenameModulePath(newPath: string, oldPath: string): string {
@@ -591,6 +617,11 @@
 		return 'path' in canonical && canonical.path === oldPath
 	}
 
+	function prefillRename(modulePath: string) {
+		renameModuleInput = modulePath
+		renameModuleError = ''
+	}
+
 	function renameModule(oldPath: string) {
 		if (!renameModuleInput.trim()) return
 		const canonical = canonicalModulePath(renameModuleInput)
@@ -611,6 +642,7 @@
 		delete modules[oldPath]
 		modules[newPath] = { ...mod, language: newLang ?? mod.language }
 		modules = { ...modules }
+		moduleTabOrder = moduleTabOrder.map((p) => (p === oldPath ? newPath : p))
 		if (moduleTestState[oldPath]) {
 			moduleTestState[newPath] = moduleTestState[oldPath]
 			delete moduleTestState[oldPath]
@@ -2068,43 +2100,15 @@
 							</div>
 						{/if}
 						{#if customUi?.previewPanel?.hideArgs}
-							<!-- Compact preview layout used by the pipeline editor:
-						     no args column (the script is known to take no
-						     inputs), LogPanel takes the full width, with a
-						     small Test/Cancel button at the top-left of the
-						     preview band. The earlier `-translate-y-1/2`
-						     "float onto the editor" version was clipped in
-						     Firefox (transform + overflow: visible interaction
-						     on the parent splitpane Pane), so the button is
-						     now positioned inside the panel — `top-1` keeps
-						     it visually pinned to the top edge without
-						     relying on cross-browser overflow behaviour. -->
-							<div class="relative h-full pt-9 flex flex-col">
-								{#if testJob?.id && testJob.type === 'CompletedJob' && opWs}
-									<!-- Right-side affordances when we're displaying a *completed*
-									     job (either the user just ran a test, or the on-mount
-									     last-run loader populated the panel). The job-id link
-									     opens the full run page in a new tab; the dispatch
-									     button mounts a popover that shows what downstream
-									     jobs this run triggered (rendered only when the run
-									     actually dispatched anything). -->
-									<div class="absolute top-1 right-2 z-10 flex items-center gap-2">
-										<a
-											class="text-3xs text-blue-600 hover:underline font-mono"
-											href={`${base}/run/${testJob.id}?workspace=${opWs}`}
-											target="_blank"
-											rel="noopener noreferrer"
-											title="Open this run"
-										>
-											{testJob.id.slice(0, 8)}… ↗
-										</a>
-										<DispatchEventsButton
-											workspace={testJob.workspace_id ?? opWs}
-											jobId={testJob.id}
-										/>
-									</div>
-								{/if}
-								<div class="absolute top-1 left-2 z-10">
+							<!-- Compact preview layout used by the pipeline editor: no args
+							     column (most pipeline scripts take no inputs) and a full-width
+							     LogPanel. The controls sit in normal flow rather than floating
+							     onto the editor band, which Firefox clipped (transform +
+							     overflow: visible on the parent splitpane Pane). -->
+							<div class="h-full flex flex-col">
+								<!-- Test sits at the top right, the last run's link under it. -->
+								<div class="shrink-0 flex flex-col items-end gap-1 px-2 pt-2 pb-1">
+								<div>
 									{#if testIsLoading}
 										{@render cancelTestButton('sm', 'shadow-md')}
 									{:else if (customUi?.previewPanel?.downstreamSubscribers ?? 0) > 0 || customUi?.previewPanel?.onBoundedRun}
@@ -2238,6 +2242,31 @@
 										{@render runTestButton('sm', 'shadow-md')}
 									{/if}
 								</div>
+								{#if testJob?.id && testJob.type === 'CompletedJob' && opWs}
+									<!-- Right-side affordances when we're displaying a *completed*
+									     job (either the user just ran a test, or the on-mount
+									     last-run loader populated the panel). The job-id link
+									     opens the full run page in a new tab; the dispatch
+									     button mounts a popover that shows what downstream
+									     jobs this run triggered (rendered only when the run
+									     actually dispatched anything). -->
+									<div class="flex items-center gap-2">
+										<a
+											class="text-3xs text-blue-600 hover:underline font-mono"
+											href={`/run/${testJob.id}?workspace=${opWs}`}
+											target="_blank"
+											rel="noopener noreferrer"
+											title="Open this run"
+										>
+											{testJob.id.slice(0, 8)}… ↗
+										</a>
+										<DispatchEventsButton
+											workspace={testJob.workspace_id ?? opWs}
+											jobId={testJob.id}
+										/>
+									</div>
+								{/if}
+								</div>
 								{#if customUi?.previewPanel?.argsAboveLogs && schema?.properties && Object.keys(schema.properties).length > 0}
 									<div
 										class="shrink-0 overflow-auto max-h-[45%] border-b border-gray-200 dark:border-gray-700 px-4 py-3"
@@ -2563,93 +2592,71 @@
 {#snippet editorContent()}
 	<div class="h-full !overflow-visible bg-surface dark:bg-surface-secondary relative flex flex-col">
 		{#if supportsModules}
-			<div
-				class="flex items-center border-b border-tertiary/30 bg-surface-secondary px-1 gap-0.5 text-xs overflow-x-auto shrink-0"
+			<DraggableTabs
+				tabs={fileTabs}
+				activeId={activeModuleTab ?? MAIN_FILE_TAB_ID}
+				onSelect={(id) => (id === MAIN_FILE_TAB_ID ? switchToMain() : switchToModule(id))}
+				onReorder={(next) => (moduleTabOrder = next.map((t) => t.id))}
+				class="shrink-0 border-b border-light bg-surface-secondary/50"
 			>
-				<button
-					class="px-2 py-1 rounded-t {activeModuleTab === null
-						? 'bg-surface font-semibold border-b-2 border-blue-500'
-						: 'hover:bg-surface-hover'}"
-					onclick={() => switchToMain()}
-				>
-					{mainFileName}
-				</button>
-				{#each Object.keys(modules ?? {}) as modulePath}
-					<div
-						class="group rounded-t flex items-center {activeModuleTab === modulePath
-							? 'bg-surface font-semibold border-b-2 border-blue-500'
-							: 'hover:bg-surface-hover'}"
-					>
-						<button class="pl-2 py-1 flex items-center" onclick={() => switchToModule(modulePath)}>
-							{modulePath}
-						</button>
-						<div class="flex items-center pr-1 w-[32px] justify-end">
+				{#snippet tabAccessory(tab)}
+					{#if tab.id !== MAIN_FILE_TAB_ID}
+						<!-- Stops the trigger's click, mouse or Enter/Space alike, from also selecting the tab. -->
+						<span role="presentation" class="inline-flex" onclick={(e) => e.stopPropagation()}>
 							<Popover
 								placement="bottom-start"
 								openFocus={renameModuleInputEl}
 								contentClasses="p-3 w-72"
+								class="inline-flex"
+								triggerAttrs={{
+									'aria-label': `Rename ${tab.id}`,
+									onpointerdown: () => prefillRename(tab.id),
+									onkeydown: (e: KeyboardEvent) =>
+										(e.key === 'Enter' || e.key === ' ') && prefillRename(tab.id)
+								}}
 							>
 								{#snippet trigger()}
 									<span
-										class="opacity-0 group-hover:opacity-100 hover:text-blue-500 transition-opacity"
-										role="button"
-										tabindex="0"
-										onclick={(e) => {
-											e.stopPropagation()
-											renameModuleInput = modulePath
-											renameModuleError = ''
-										}}
-										onkeydown={(e) => {
-											if (e.key === 'Enter') {
-												e.stopPropagation()
-												renameModuleInput = modulePath
-												renameModuleError = ''
-											}
-										}}
+										class="opacity-0 group-hover:opacity-100 group-focus-within:opacity-100 rounded hover:bg-surface-hover w-4 h-4 inline-flex items-center justify-center"
 									>
-										<Pencil size={12} />
+										<Pencil size={10} />
 									</span>
 								{/snippet}
 								{#snippet content({ close })}
-									{@render renameModuleForm(modulePath, close)}
+									{@render renameModuleForm(tab.id, close)}
 								{/snippet}
 							</Popover>
-							<span
-								class="opacity-0 group-hover:opacity-100 hover:text-red-500 transition-opacity"
-								role="button"
-								tabindex="0"
-								onclick={(e) => {
-									e.stopPropagation()
-									removeModule(modulePath)
-								}}
-								onkeydown={(e) => {
-									if (e.key === 'Enter') {
-										e.stopPropagation()
-										removeModule(modulePath)
-									}
-								}}
-							>
-								<X size={12} />
-							</span>
-						</div>
-					</div>
-				{/each}
-				<Popover
-					placement="bottom-start"
-					bind:isOpen={showAddModulePopover}
-					openFocus={modulePathInputEl}
-					contentClasses="p-3 w-72"
-				>
-					{#snippet trigger()}
-						<span class="px-2 py-1 rounded-t hover:bg-surface-hover inline-flex items-center">
-							<Plus size={12} />
 						</span>
-					{/snippet}
-					{#snippet content({ close })}
-						{@render addModuleForm(close)}
-					{/snippet}
-				</Popover>
-			</div>
+						<Button
+							variant="subtle"
+							unifiedSize="2xs"
+							iconOnly
+							startIcon={{ icon: X }}
+							wrapperClasses="opacity-0 group-hover:opacity-100 focus-within:opacity-100"
+							aria-label={`Delete ${tab.id}`}
+							title={`Delete ${tab.id}`}
+							onClick={() => removeModule(tab.id)}
+						/>
+					{/if}
+				{/snippet}
+				{#snippet afterTabs()}
+					<Popover
+						placement="bottom-start"
+						bind:isOpen={showAddModulePopover}
+						openFocus={modulePathInputEl}
+						contentClasses="p-3 w-72"
+						class="ml-0.5 h-6 w-6 rounded-md inline-flex items-center justify-center text-hint hover:text-secondary hover:bg-surface-hover focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected"
+						triggerAttrs={{ 'aria-label': 'Add module' }}
+					>
+						{#snippet trigger()}
+							<Plus size={12} />
+						{/snippet}
+						{#snippet content({ close })}
+							{@render addModuleForm(close)}
+						{/snippet}
+					</Popover>
+				{/snippet}
+			</DraggableTabs>
 		{/if}
 		<div class="relative flex-1 min-h-0 min-w-0 !overflow-visible">
 			<div class="absolute bg-surface top-2 right-4 z-10 flex flex-row gap-2">
@@ -2733,7 +2740,7 @@
 									{#snippet popoverOverride()}
 										<div class="text-sm">
 											Enable Windmill AI in the <a
-												href="{base}/workspace_settings?tab=ai"
+												href="/workspace_settings?tab=ai"
 												target="_blank"
 												class="inline-flex flex-row items-center gap-1"
 											>
diff --git a/frontend/src/lib/components/ScriptPicker.svelte b/frontend/src/lib/components/ScriptPicker.svelte
index 781cb5155e..97ac81713d 100644
--- a/frontend/src/lib/components/ScriptPicker.svelte
+++ b/frontend/src/lib/components/ScriptPicker.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { ScriptService, FlowService, type Script, AppService } from '$lib/gen'
 
-	import { base } from '$lib/base'
 	import { createEventDispatcher, untrack } from 'svelte'
 
 	import Select from './select/Select.svelte'
@@ -198,7 +197,7 @@
 						target="_blank"
 						variant="default"
 						size="xs"
-						href="{base}/flows/edit/{scriptPath}{wsParam}">Edit</Button
+						href="/flows/edit/{scriptPath}{wsParam}">Edit</Button
 					>
 				{/if}
 				{#if allowView}
@@ -221,7 +220,7 @@
 						target="_blank"
 						variant="default"
 						size="xs"
-						href="{base}/apps/edit/{scriptPath}{wsParam}"
+						href="/apps/edit/{scriptPath}{wsParam}"
 					>
 						Edit
 					</Button>
@@ -232,7 +231,7 @@
 						size="xs"
 						target="_blank"
 						startIcon={{ icon: Code }}
-						href="{base}/apps/get/{scriptPath}{wsParam}"
+						href="/apps/get/{scriptPath}{wsParam}"
 					>
 						View
 					</Button>
@@ -246,7 +245,7 @@
 						target="_blank"
 						variant="default"
 						size="xs"
-						href="{base}/scripts/edit/{scriptPath}{wsParam}"
+						href="/scripts/edit/{scriptPath}{wsParam}"
 					>
 						Edit
 					</Button>
diff --git a/frontend/src/lib/components/ScriptSettingsBadges.svelte b/frontend/src/lib/components/ScriptSettingsBadges.svelte
index 8d73609891..7d09bce459 100644
--- a/frontend/src/lib/components/ScriptSettingsBadges.svelte
+++ b/frontend/src/lib/components/ScriptSettingsBadges.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { twMerge } from 'tailwind-merge'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Popover from '$lib/components/Popover.svelte'
 	import {
@@ -12,15 +13,18 @@
 		// (e.g. to open the settings drawer focused on that section).
 		onclick?: (key: string) => void
 		small?: boolean
+		/** On the row that holds the badges — so a script with none of these settings leaves no
+		 * gap where they would have been. */
+		class?: string
 	}
 
-	let { settings, onclick, small = true }: Props = $props()
+	let { settings, onclick, small = true, class: className = '' }: Props = $props()
 
 	let badges = $derived(getActiveScriptSettingsBadges(settings))
 </script>
 
 {#if badges.length > 0}
-	<div class="flex flex-row flex-wrap gap-1 items-center">
+	<div class={twMerge('flex flex-row flex-wrap gap-1 items-center', className)}>
 		{#each badges as badge (badge.key)}
 			<!-- Icon-only chips to save space in crowded top bars; the label and current
 				value are shown in the hover popover. -->
diff --git a/frontend/src/lib/components/ServiceLogsInner.svelte b/frontend/src/lib/components/ServiceLogsInner.svelte
index 16bdd7d2ad..03cd5bf676 100644
--- a/frontend/src/lib/components/ServiceLogsInner.svelte
+++ b/frontend/src/lib/components/ServiceLogsInner.svelte
@@ -1,7 +1,4 @@
 <script lang="ts">
-	import { createBubbler, preventDefault } from 'svelte/legacy'
-
-	const bubble = createBubbler()
 	import { IndexSearchService, ServiceLogsService, type LogSearchHit } from '$lib/gen'
 
 	import TimeframeSelect, {
@@ -11,33 +8,58 @@
 	import CalendarPicker from './common/calendarPicker/CalendarPicker.svelte'
 	import LogViewer from './LogViewer.svelte'
 	import Toggle from './Toggle.svelte'
+	import TextInput from './text_input/TextInput.svelte'
+	import Popover from './Popover.svelte'
+	// The clickable one, for the folded switches; the import above is the hover tooltip.
+	import MeltPopover from './meltComponents/Popover.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { onDestroy, tick } from 'svelte'
-	import { Loader2 } from 'lucide-svelte'
+	import { fade } from 'svelte/transition'
+	import {
+		AlertTriangle,
+		ArrowDown,
+		ChevronLeft,
+		ChevronRight,
+		ClipboardCopy,
+		Loader2,
+		ScrollText,
+		Search,
+		SearchX,
+		SlidersHorizontal
+	} from 'lucide-svelte'
 	import { copyToClipboard, scroll_into_view_if_needed_polyfill, truncateRev } from '$lib/utils'
 	import LogSnippetViewer from './LogSnippetViewer.svelte'
-	import { Alert, Button, Drawer, DrawerContent } from './common'
-	import ClipboardCopy from 'lucide-svelte/icons/clipboard-copy'
+	import { Alert, Button, Drawer, DrawerContent, EmptyState, Skeleton } from './common'
 	import { AnsiUp } from 'ansi_up'
 	import SplitPanesOrColumnOnMobile from './splitPanes/SplitPanesOrColumnOnMobile.svelte'
 	import Select from './select/Select.svelte'
 	import { goto } from '$lib/navigation'
 	import { page } from '$app/state'
 	import { watch } from 'runed'
+	import Tooltip from './Tooltip.svelte'
+	import PageHeaderContent from './PageHeaderContent.svelte'
+	import { pageHeader } from './pageHeaderRegistry.svelte'
 
 	interface Props {
 		searchTerm: string
-		queryParseErrors?: string[]
 		tagLabel?: string
 	}
 
-	let { searchTerm, queryParseErrors = $bindable(), tagLabel }: Props = $props()
+	let { searchTerm = $bindable(), tagLabel }: Props = $props()
+
+	/** Bar width below which the two switches fold into a popover. Measured: the breadcrumb takes
+	 *  ~360, the search field asks for 384 and the timeframe 223, so under this the field is what
+	 *  would start giving width back — and it is the control the page exists for. */
+	const COMPACT_SWITCHES_BAR = 1200
+	const compactSwitches = $derived(
+		pageHeader.barWidth > 0 && pageHeader.barWidth < COMPACT_SWITCHES_BAR
+	)
+
+	let queryParseErrors: string[] | undefined = $state(undefined)
 
 	let minTs: undefined | string = $state(undefined)
 	let maxTs: undefined | string = $state(undefined)
 
-	let max_lines: undefined | number = $state(undefined)
-
 	// let lastSeen: undefined | string = undefined
 
 	let withError = $state(false)
@@ -57,6 +79,7 @@
 	type ByMode = Record<string, ByWorkerGroup>
 
 	let timeout: number | undefined = $state(undefined)
+	const REFRESH_OVERLAP_MS = 2 * 60 * 1000
 
 	let allLogs: ByMode | undefined = $state(undefined)
 
@@ -115,19 +138,22 @@
 					if (!allLogs[log.mode][wg][hn]) {
 						allLogs[log.mode][wg][hn] = []
 					}
-					allLogs[log.mode][wg][hn].push({
+					const files = allLogs[log.mode][wg][hn]
+					// Refreshes overlap the previous window, so a file can come back twice.
+					if (files.some((f) => f.file_path === log.file_path)) {
+						return
+					}
+					files.push({
 						ts: ts,
 						file_path: log.file_path,
 						ok_lines: log.ok_lines ?? 1,
 						err_lines: log.err_lines ?? 0,
 						json_fmt: log.json_fmt
 					})
-					if (
-						log.ok_lines != undefined &&
-						log.err_lines != undefined &&
-						(max_lines == undefined || log.ok_lines + log.err_lines > max_lines)
-					) {
-						max_lines = log.ok_lines + log.err_lines
+					// A late file can be older than one already listed; readers take the
+					// last entries as the newest.
+					if (files.length > 1 && files[files.length - 2].ts > ts) {
+						files.sort((a, b) => a.ts - b.ts)
 					}
 				})
 
@@ -154,13 +180,19 @@
 				if (autoRefresh && searchTerm === '' && !maxTsManual) {
 					timeout = setTimeout(() => {
 						if (searchTerm !== '') return
-						let maxTsPlus1 = maxTs ? new Date(new Date(maxTs).getTime() + 1000) : undefined
-						getAllLogs(maxTsPlus1?.toISOString(), undefined)
+						// Each host's file for a minute is written when that host compacts it, so
+						// files for a minute already seen elsewhere keep landing for a while after.
+						let refreshFrom = maxTs
+							? new Date(new Date(maxTs).getTime() - REFRESH_OVERLAP_MS)
+							: undefined
+						getAllLogs(refreshFrom?.toISOString(), undefined)
 					}, 5000)
 				}
 			})
 			.catch((e) => {
-				sendUserToast('Failed to load service logs: ' + e.body, true)
+				// Only an API error has a body; a network failure or an exception in the
+				// handler above carries its cause in `message`.
+				sendUserToast('Failed to load service logs: ' + (e?.body ?? e?.message ?? e), true)
 				console.error(e)
 				loading = false
 				autoRefresh = false
@@ -168,32 +200,44 @@
 	}
 
 	type Selected = { mode: string; workerGroup: string; hostname: string }
+	// Servers and indexers have no worker group, so the URL omits it for them.
 	let initialSelected =
-		page.url.searchParams.get('mode') &&
-		page.url.searchParams.get('workerGroup') &&
-		page.url.searchParams.get('hostname')
+		page.url.searchParams.get('mode') && page.url.searchParams.get('hostname')
 			? {
 					mode: page.url.searchParams.get('mode')!,
-					workerGroup: page.url.searchParams.get('workerGroup')!,
+					workerGroup: page.url.searchParams.get('workerGroup') ?? '',
 					hostname: page.url.searchParams.get('hostname')!
 				}
 			: undefined
 	let selected: Selected | undefined = $state(initialSelected)
 
 	let logsContent: Record<string, { content?: string; error?: string }> = $state({})
-	export async function getLogFile(hostname: string, path: string) {
-		if (logsContent[path]) {
-			return
-		}
-		try {
-			const res = await ServiceLogsService.getLogFile({ path: `${hostname}/${path}` })
-			logsContent[path] = { content: res }
-		} catch (e) {
-			logsContent[path] = { error: `${e.message}: ${e.body}` }
-		}
+	// Files are fetched from the render path, which runs again before a fetch returns.
+	const fetchingFiles = new Set<string>()
+
+	/** Resolves to true when this call fetched the file, false when it was already there. */
+	// File names are per-minute timestamps, the same on every host, so a file is only
+	// identified by its host and name together.
+	function fileKey(hostname: string, path: string): string {
+		return `${hostname}/${path}`
 	}
 
-	getAllLogs(undefined, undefined)
+	export async function getLogFile(hostname: string, path: string): Promise<boolean> {
+		const key = fileKey(hostname, path)
+		if (logsContent[key] || fetchingFiles.has(key)) {
+			return false
+		}
+		fetchingFiles.add(key)
+		try {
+			const res = await ServiceLogsService.getLogFile({ path: key })
+			logsContent[key] = { content: res }
+		} catch (e) {
+			logsContent[key] = { error: `${e.message}: ${e.body}` }
+		} finally {
+			fetchingFiles.delete(key)
+		}
+		return true
+	}
 
 	function getLogs(selected: Selected, upTo: string | undefined) {
 		if (!selected) {
@@ -217,8 +261,15 @@
 	}
 
 	async function getFiles(hostname: string, logs: string[]) {
-		await Promise.all(logs.map((x) => getLogFile(hostname, x)))
-		scrollToBottom()
+		const fetched = await Promise.all(logs.map((x) => getLogFile(hostname, x)))
+		if (fetched.some(Boolean)) {
+			await tick()
+			onLogsAppended()
+		} else {
+			// Every file was cached: `jumpToEnd` already landed, and the next file that
+			// arrives extends the view, so it should animate.
+			jumpPending = false
+		}
 	}
 
 	function getLatestUpTo(selected: Selected): any {
@@ -232,13 +283,83 @@
 		return logs[logs.length - 1]?.ts
 	}
 
-	function scrollToBottom() {
-		const el = document.querySelector('#logviewer')
-		if (el) {
-			el.scrollTop = el.scrollHeight
+	// Within this distance of the end, the reader is following the tail.
+	const AT_END_PX = 24
+	let logPane: HTMLDivElement | undefined = $state()
+	let followTail = $state(true)
+	let showScrollToEnd = $state(false)
+	let hasNewLogs = $state(false)
+	// Set by an explicit navigation (host, time range); the next content lands at the end
+	// without animation, since it replaces the view rather than extending it.
+	let jumpPending = true
+	// A smooth scroll emits scroll events for its whole duration, all short of the end;
+	// until it lands, those are ours and must not read as the reader leaving the tail.
+	let autoScrollUntil = 0
+
+	function distanceToEnd(): number {
+		return logPane ? logPane.scrollHeight - logPane.scrollTop - logPane.clientHeight : 0
+	}
+
+	function scrollToEnd(smooth: boolean) {
+		if (!logPane) return
+		autoScrollUntil = smooth ? Date.now() + 1000 : 0
+		logPane.scrollTo({ top: logPane.scrollHeight, behavior: smooth ? 'smooth' : 'auto' })
+		followTail = true
+		hasNewLogs = false
+		showScrollToEnd = false
+	}
+
+	async function jumpToEnd() {
+		jumpPending = true
+		followTail = true
+		hasNewLogs = false
+		await tick()
+		scrollToEnd(false)
+	}
+
+	function onLogsAppended() {
+		if (jumpPending) {
+			jumpPending = false
+			scrollToEnd(false)
+		} else if (followTail) {
+			scrollToEnd(true)
+		} else {
+			// Older files fetched while browsing back in time are not news.
+			if (upToIsLatest) hasNewLogs = true
+			showScrollToEnd = distanceToEnd() > AT_END_PX
 		}
 	}
 
+	let lastScrollTop = 0
+	let lastScrollHeight = 0
+
+	function onLogPaneScroll() {
+		const atEnd = distanceToEnd() <= AT_END_PX
+		const movedUp = (logPane?.scrollTop ?? 0) < lastScrollTop
+		const contentChanged = (logPane?.scrollHeight ?? 0) !== lastScrollHeight
+		lastScrollTop = logPane?.scrollTop ?? 0
+		lastScrollHeight = logPane?.scrollHeight ?? 0
+		// Files added or dropped make the browser shift the scroll position to keep the
+		// visible lines in place. That is not the reader moving, so it must not change
+		// whether they follow the tail.
+		if (contentChanged) {
+			if (!followTail) showScrollToEnd = !atEnd
+			return
+		}
+		// An automatic scroll only moves down, so moving up during one is the reader.
+		if (Date.now() < autoScrollUntil && !movedUp) {
+			if (atEnd) autoScrollUntil = 0
+			return
+		}
+		autoScrollUntil = 0
+		followTail = atEnd
+		showScrollToEnd = !atEnd
+		if (atEnd) hasNewLogs = false
+		// A jump whose files were all cached never reaches `onLogsAppended`; once the
+		// reader leaves the end, a later refresh must not carry it out.
+		else jumpPending = false
+	}
+
 	onDestroy(() => {
 		timeout && clearTimeout(timeout)
 	})
@@ -290,10 +411,7 @@
 					delete obj['message']
 					Object.keys(obj).forEach((key) => {
 						nl +=
-							key +
-							'=' +
-							(typeof obj[key] == 'object' ? JSON.stringify(obj[key]) : obj[key]) +
-							' '
+							key + '=' + (typeof obj[key] == 'object' ? JSON.stringify(obj[key]) : obj[key]) + ' '
 					})
 					res += nl + '\n'
 				}
@@ -333,6 +451,18 @@
 	let sumOtherDocCount: number = $state(0)
 	let searchError: string | undefined = $state(undefined)
 
+	// `searchLogs` runs on every refresh too, so leaving a search is detected as a
+	// transition rather than on each empty-term call.
+	let searching = false
+
+	// A search stops the refresh poll and replaces the files with hits.
+	function leaveSearch() {
+		if (autoRefresh && !maxTsManual && maxTs) {
+			getAllLogs(new Date(new Date(maxTs).getTime() - REFRESH_OVERLAP_MS).toISOString(), undefined)
+		}
+		jumpToEnd()
+	}
+
 	async function searchLogs(
 		searchTerm: string,
 		selected: Selected | undefined,
@@ -345,7 +475,9 @@
 		if (selected?.mode) params.set('mode', selected.mode)
 		if (selected?.workerGroup) params.set('workerGroup', selected.workerGroup)
 		if (selected?.hostname) params.set('hostname', selected.hostname)
-		goto(`?${params.toString()}`)
+		// Only syncs the URL: a navigation resets focus by default, which would pull it off
+		// the host button or search field the reader is using.
+		goto(`?${params.toString()}`, { keepFocus: true, noScroll: true })
 		if (searchTerm.trim() === '') {
 			debounceTimeout && clearTimeout(debounceTimeout)
 			logs = undefined
@@ -354,8 +486,13 @@
 			loadingLogs = false
 			loadingLogCounts = false
 			searchError = undefined
+			if (searching) {
+				searching = false
+				leaveSearch()
+			}
 			return
 		}
+		searching = true
 		timeout && clearTimeout(timeout)
 
 		loadingLogCounts = true
@@ -402,7 +539,6 @@
 				logs = undefined
 				countsPerHost = undefined
 				sumOtherDocCount = 0
-				sendUserToast('Service logs search failed: ' + message, true)
 				console.error(e)
 			} finally {
 				loadingLogs = false
@@ -476,6 +612,58 @@
 		)
 	}
 
+	function formatTime(ts: string | number): string {
+		return new Date(ts).toLocaleTimeString([], {
+			day: '2-digit',
+			month: '2-digit',
+			hour: '2-digit',
+			minute: '2-digit'
+		})
+	}
+
+	// Time of day only when both ends fall on the same day, so the axis fits a narrow pane.
+	function formatAxisTime(ts: string, other: string): string {
+		const sameDay = new Date(ts).toDateString() === new Date(other).toDateString()
+		return sameDay
+			? new Date(ts).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })
+			: formatTime(ts)
+	}
+
+	// The API returns hosts in log order, which reshuffles the list on every refresh.
+	function sortedEntries<T>(o: Record<string, T>): [string, T][] {
+		return Object.entries(o).sort(([a], [b]) => a.localeCompare(b))
+	}
+
+	function modeLabel(mode: string, plural: boolean): string {
+		return mode.charAt(0).toUpperCase() + mode.slice(1) + (plural ? 's' : '')
+	}
+
+	function isSelected(mode: string, wg: string, hn: string): boolean {
+		return selected?.mode === mode && selected?.workerGroup === wg && selected?.hostname === hn
+	}
+
+	function selectHost(mode: string, wg: string, hn: string) {
+		selected = { mode, workerGroup: wg, hostname: hn }
+		upToIsLatest = true
+		upTo = getLatestUpTo(selected)
+		jumpToEnd()
+	}
+
+	function visibleHosts(mode: string, wg: string, hosts: ByHostname): [string, LogFile[]][] {
+		return Object.entries(hosts).filter(([hn]) => {
+			if (isSelected(mode, wg, hn)) return true
+			const count = countsPerHost?.[`${mode},${wg},${hn}`]?.doc_count
+			return !countsPerHost || (count != undefined && count > 0)
+		})
+	}
+
+	function shiftUpTo(minutes: number) {
+		if (!upTo) return
+		upToIsLatest = false
+		upTo = new Date(new Date(upTo).getTime() + minutes * 60 * 1000).toISOString()
+		jumpToEnd()
+	}
+
 	watch(
 		() => timeframe,
 		() => {
@@ -495,365 +683,508 @@
 </script>
 
 <Drawer bind:this={logDrawer} bind:open={logDrawerOpen} size="1400px">
-	<DrawerContent title="See context" on:close={logDrawer.closeDrawer}>
+	<DrawerContent title="Log context" on:close={logDrawer.closeDrawer}>
 		{#snippet actions()}
 			<Button
-				on:click={() => copyToClipboard(content)}
-				color="light"
-				size="xs"
-				startIcon={{
-					icon: ClipboardCopy
-				}}
+				onClick={() => copyToClipboard(content)}
+				variant="default"
+				unifiedSize="md"
+				startIcon={{ icon: ClipboardCopy }}
 			>
 				Copy to clipboard
 			</Button>
 		{/snippet}
-		<div class="w-fit">
-			<pre
-				class="bg-surface-secondary text-secondary text-xs w-full p-2 whitespace-pre border rounded-md"
-				>...<br />{#each content.split('\n') as line, index}<div
-						id={`log-line-${index}`}
-						class={index === hitLineNumber ? 'bg-yellow-200 bg-opacity-20' : ''}>{@html line}</div
-					>{/each}...</pre
-			>
-		</div>
+		<pre
+			class="w-fit min-w-full rounded-md border border-border-light bg-surface-secondary p-2 font-mono text-2xs text-primary whitespace-pre"
+			>{#each content.split('\n') as line, index}<div
+					id={`log-line-${index}`}
+					class={index === hitLineNumber ? 'bg-surface-accent-selected' : ''}>{@html line}</div
+				>{/each}</pre
+		>
 	</DrawerContent>
 </Drawer>
 
-<SplitPanesOrColumnOnMobile>
-	{#snippet left_pane()}
-		<div class="p-1">
-			<div
-				class="flex flex-col lg:flex-row gap-y-1 justify-between w-full relative pb-4 gap-x-0.5"
-				id="service-logs-date-pickers"
-			>
-				<TimeframeSelect
-					items={serviceLogsTimeframes}
-					bind:value={timeframe}
-					{loading}
-					wrapperClasses="w-full"
-					onClick={() => {
-						minTs = undefined
-						maxTs = undefined
-						allLogs = undefined
-						const ts = timeframe.computeMinMax()
-						getAllLogs(ts.minTs ?? undefined, ts.maxTs ?? undefined)
-					}}
-				/>
-			</div>
-			<div class="flex w-full flex-row-reverse pb-4 -mt-2 gap-2"
-				><Toggle
-					size="xs"
-					bind:checked={withError}
-					options={{ right: 'errors > 0' }}
-					on:change={() => {
-						allLogs = undefined
-						getAllLogs(minTs, maxTs)
-					}}
-				/>
-				<Toggle
-					size="xs"
-					bind:checked={autoRefresh}
-					disabled={searchTerm != ''}
-					on:change={(e) => {
-						if (e.detail) {
-							getAllLogs(maxTs, undefined)
-						} else {
-							timeout && clearTimeout(timeout)
-						}
-					}}
-					options={{ right: 'auto-refresh' }}
-				/></div
-			>
-			{#if searchError}
-				<div class="pb-4">
-					<Alert type="warning" title="Service logs search unavailable" size="xs">
-						{searchError}
-					</Alert>
-				</div>
-			{/if}
-			{#if allLogs == undefined}
-				<div class="text-center pb-2"><Loader2 class="animate-spin" /></div>
-			{:else if Object.keys(allLogs).length == 0}
-				<div class="flex flex-col justify-center items-center h-full gap-2">
-					<span>No logs</span>
-					<span class="text-2xs text-tertiary"
-						>Search only covers a recent time window, configurable in instance settings under
-						Indexer.</span
-					>
-				</div>
-			{:else if minTs && maxTs}
-				{@const minTsN = new Date(minTs).getTime()}
-				{@const maxTsN = new Date(maxTs).getTime()}
-				{@const diff = maxTsN - minTsN}
-				{#if searchTerm === ''}
-					<div class="flex w-full text-2xs text-primary pb-6">
-						<div style="width: 60px;"></div>
+{#snippet serviceLogsHint()}
+	<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/service_logs">
+		Logs written by the servers, workers and indexers of this instance, grouped by host.
+	</Tooltip>
+{/snippet}
 
-						<div class="flex justify-between w-full"
-							><div
-								>{new Date(minTs).toLocaleTimeString([], {
-									day: '2-digit',
-									month: '2-digit',
-									hour: '2-digit',
-									minute: '2-digit'
-								})}</div
-							><div
-								>{new Date(maxTs).toLocaleTimeString([], {
-									day: '2-digit',
-									month: '2-digit',
-									hour: '2-digit',
-									minute: '2-digit'
-								})}</div
-							></div
-						>
-					</div>
-				{/if}
-				<div class="mr-0.5 mb-2">
-					<Select
-						bind:value={selected}
-						items={getSelectItems(allLogs, countsPerHost)}
-						onClear={() => {
-							selected = undefined
-						}}
-						placeholder="Select a service"
-					/>
+{#snippet serviceLogsActions()}
+	<!-- The widest control here, because searching is what the page is for. It is also the one that
+	     gives width back when the bar is tight — that is what `actionsFlexible` on the registration
+	     asks the bar to allow — down to a floor that still fits a query worth reading. -->
+	<div class="relative w-96 min-w-40 shrink">
+		<Search
+			size={16}
+			class="absolute left-2 top-1/2 -translate-y-1/2 text-hint pointer-events-none z-10"
+		/>
+		<TextInput
+			bind:value={searchTerm}
+			size="sm"
+			class="pl-8 pr-8"
+			inputProps={{
+				id: 'quickSearchInput',
+				placeholder: 'Search service logs',
+				autocomplete: 'off',
+				autofocus: true
+			}}
+		/>
+		{#if searchTerm !== '' && queryParseErrors && queryParseErrors.length > 0}
+			<div class="absolute right-2 top-1/2 -translate-y-1/2 z-10 flex">
+				<Popover notClickable placement="bottom-end">
+					<AlertTriangle size={16} class="text-yellow-500" />
+					{#snippet text()}
+						<div class="flex flex-col gap-1 text-xs">
+							<span>Some search terms were ignored because they could not be parsed:</span>
+							<ul class="list-disc pl-4">
+								{#each queryParseErrors ?? [] as msg}
+									<li>{msg}</li>
+								{/each}
+							</ul>
+						</div>
+					{/snippet}
+				</Popover>
+			</div>
+		{/if}
+	</div>
+	<!-- No width of its own: the preset labels run to "1000 last service logs", and a fixed box
+	     narrower than that does not clip it — the control's overflow is visible, so it spills into
+	     whatever sits next to it in the bar. -->
+	<TimeframeSelect
+		unifiedSize="sm"
+		items={serviceLogsTimeframes}
+		bind:value={timeframe}
+		{loading}
+		wrapperClasses="shrink-0"
+		onClick={() => {
+			minTs = undefined
+			maxTs = undefined
+			allLogs = undefined
+			const ts = timeframe.computeMinMax()
+			getAllLogs(ts.minTs ?? undefined, ts.maxTs ?? undefined)
+		}}
+	/>
+	<!-- The two labelled switches are the widest thing in this row, and the search field is the one
+	     that pays for them: it is the only control that yields width. So they fold into a popover
+	     well before the bar is tight, which keeps the field at its full width down to a much
+	     narrower window. Folded, not dropped — the page below no longer carries a toolbar they
+	     could fall back to, so hiding them would put them out of reach. -->
+	{#if compactSwitches}
+		<MeltPopover placement="bottom-end">
+			{#snippet trigger()}
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					iconOnly
+					startIcon={{ icon: SlidersHorizontal }}
+					title="Log listing options"
+				/>
+			{/snippet}
+			{#snippet content()}
+				<div class="flex flex-col gap-3 p-3">
+					{@render logSwitches()}
 				</div>
-				{#each Object.entries(allLogsOrQueryResults(allLogs, countsPerHost)) as [mode, o1]}
-					<div class="w-full pb-8">
-						<h2 class="pb-2 text-2xl">{mode}s</h2>
-						{#each Object.entries(o1) as [wg, o2]}
-							<div class="w-full px-1">
-								{#if wg && wg != ''}
-									<h4 class="pt-4">{wg}</h4>
+			{/snippet}
+		</MeltPopover>
+	{:else}
+		<div class="flex items-center gap-4 shrink-0">
+			{@render logSwitches()}
+		</div>
+	{/if}
+{/snippet}
+
+{#snippet logSwitches()}
+	<Toggle
+		size="sm"
+		bind:checked={withError}
+		options={{
+			right: 'With errors only',
+			rightTooltip: 'Only list the log files that contain at least one error line'
+		}}
+		on:change={() => {
+			allLogs = undefined
+			getAllLogs(minTs, maxTs)
+		}}
+	/>
+	<Toggle
+		size="sm"
+		bind:checked={autoRefresh}
+		disabled={searchTerm != ''}
+		on:change={(e) => {
+			if (e.detail) {
+				getAllLogs(maxTs, undefined)
+			} else {
+				timeout && clearTimeout(timeout)
+			}
+		}}
+		options={{
+			right: 'Auto-refresh',
+			rightTooltip: 'Fetch new log files every 5 seconds. Paused while searching.'
+		}}
+	/>
+{/snippet}
+
+<!-- The page's name is the breadcrumb's, so the band carries the hint beside it and the toolbar at
+     its far end; the page below starts straight into the logs.
+     No `separator`: the default draws the edge only while something is passing under the bar, and
+     the two panes below start lower than it with borders of their own, so at rest there is nothing
+     for the band to divide. -->
+<PageHeaderContent afterName={serviceLogsHint} actions={serviceLogsActions} actionsFlexible />
+
+<div class="flex flex-col grow min-h-0 min-w-0 gap-2 py-2">
+	{#if searchError}
+		<Alert type="warning" title="Service logs search unavailable" size="xs">
+			{searchError}
+		</Alert>
+	{/if}
+
+	<div class="flex grow min-h-0 min-w-0 service-logs-splitpanes">
+		<SplitPanesOrColumnOnMobile leftPaneSize={28} leftPaneMinSize={20} rightPaneSize={72}>
+			{#snippet left_pane()}
+				<div
+					class="flex flex-col h-full min-h-0 overflow-y-auto mb-2 md:mb-0 md:mr-2 rounded-md border bg-surface-tertiary"
+				>
+					{#if allLogs == undefined}
+						<div class="flex flex-col gap-2 p-3">
+							{#each new Array(6) as _}
+								<Skeleton layout={[[2]]} />
+							{/each}
+						</div>
+					{:else if Object.keys(allLogs).length == 0}
+						<div class="flex grow items-center justify-center p-3">
+							<EmptyState
+								icon={ScrollText}
+								title="No log files"
+								description="No service wrote a log file in this time range."
+							/>
+						</div>
+					{:else}
+						<div class="px-3 pt-3">
+							<Select
+								bind:value={
+									() => selected,
+									(v) => (v ? selectHost(v.mode, v.workerGroup, v.hostname) : (selected = v))
+								}
+								items={getSelectItems(allLogs, countsPerHost)}
+								onClear={() => {
+									selected = undefined
+								}}
+								size="sm"
+								placeholder="Find a host"
+							/>
+						</div>
+						{@const minTsN = minTs ? new Date(minTs).getTime() : 0}
+						{@const diff = maxTs && minTs ? new Date(maxTs).getTime() - minTsN || 1 : 1}
+						<div class="flex flex-col gap-4 p-3">
+							{#if searchTerm === '' && minTs && maxTs}
+								<!-- Same columns as a host row, so the labels sit over the bars they measure. -->
+								<div
+									class="flex gap-2 px-2 -mb-2 text-2xs text-secondary whitespace-nowrap"
+									title="{formatTime(minTs)} – {formatTime(maxTs)}"
+								>
+									<span class="w-24 shrink-0"></span>
+									<div class="flex grow min-w-0 justify-between gap-2">
+										<span class="truncate">{formatAxisTime(minTs, maxTs)}</span>
+										<span class="truncate">{formatAxisTime(maxTs, minTs)}</span>
+									</div>
+								</div>
+							{/if}
+							{#each sortedEntries(allLogsOrQueryResults(allLogs, countsPerHost)) as [mode, o1]}
+								<section class="flex flex-col gap-2">
+									<h2 class="text-sm font-semibold text-emphasis">{modeLabel(mode, true)}</h2>
+									{#each sortedEntries(o1) as [wg, o2]}
+										{@const hosts = visibleHosts(mode, wg, o2)}
+										{#if hosts.length > 0}
+											<div class="flex flex-col gap-0.5">
+												{#if wg}
+													<span class="text-2xs text-secondary px-2">{wg}</span>
+												{/if}
+												{#each hosts as [hn, files]}
+													{@const hostKey = `${mode},${wg},${hn}`}
+													{@const hostMax = Math.max(
+														1,
+														...files.map((f) => f.ok_lines + f.err_lines)
+													)}
+													<Button
+														variant="subtle"
+														unifiedSize="md"
+														selected={isSelected(mode, wg, hn)}
+														aria-current={isSelected(mode, wg, hn) ? 'true' : undefined}
+														title={hn}
+														wrapperClasses="w-full"
+														btnClasses="w-full justify-start gap-2 px-2"
+														onClick={() => selectHost(mode, wg, hn)}
+													>
+														<span
+															class="w-24 shrink-0 truncate text-left font-mono text-2xs font-normal text-emphasis"
+															>{truncateRev(hn, 14)}</span
+														>
+														{#if loadingLogCounts}
+															<Loader2 size={16} class="ml-auto animate-spin text-secondary" />
+														{:else if countsPerHost}
+															<span class="ml-auto text-2xs text-secondary">
+																{countsPerHost[hostKey]?.doc_count ?? 0} matches
+															</span>
+														{:else}
+															<div
+																class="relative grow h-5 border-b border-border-light"
+																aria-hidden="true"
+															>
+																{#each files as file}
+																	{@const total = file.ok_lines + file.err_lines}
+																	{@const height =
+																		total > 0 ? Math.max(10, (100 * total) / hostMax) : 0}
+																	{@const errShare = total > 0 ? file.err_lines / total : 0}
+																	<div
+																		class="absolute bottom-0 w-1 -translate-x-1/2 flex flex-col"
+																		style="left: {((file.ts - minTsN) / diff) *
+																			100}%; height: {height}%"
+																	>
+																		<div class="bg-red-500" style="height: {errShare * 100}%"></div>
+																		<div class="bg-border-normal grow"></div>
+																	</div>
+																{/each}
+															</div>
+														{/if}
+													</Button>
+												{/each}
+											</div>
+										{/if}
+									{/each}
+								</section>
+							{/each}
+							{#if !loadingLogCounts && sumOtherDocCount != 0}
+								<span class="text-2xs text-secondary">
+									{sumOtherDocCount} more matches are not attributed to any of these hosts.
+								</span>
+							{/if}
+						</div>
+					{/if}
+				</div>
+			{/snippet}
+			{#snippet right_pane()}
+				<div
+					class="flex flex-col h-full min-h-0 md:ml-2 rounded-md border bg-surface-tertiary overflow-hidden"
+				>
+					{#if selected}
+						<div
+							class="flex flex-wrap items-center justify-between gap-2 px-3 py-2 border-b border-border-light"
+						>
+							<div class="flex flex-col gap-0.5 min-w-0">
+								<div class="flex items-baseline gap-2 min-w-0">
+									<h2 class="text-sm font-semibold text-emphasis">
+										{modeLabel(selected.mode, false)}
+									</h2>
+									<span class="truncate font-mono text-2xs text-emphasis">{selected.hostname}</span>
+								</div>
+								{#if selected.workerGroup}
+									<span class="text-2xs text-secondary">
+										Worker group {selected.workerGroup}
+									</span>
 								{/if}
-								<div class="divide-y flex flex-col">
-									{#each Object.entries(o2).filter(([hn, files]) => {
-										if (selected && selected.mode === mode && selected.workerGroup === wg && selected.hostname === hn) {
-											return true
-										}
-										const hostKey = `${mode},${wg},${hn}`
-										if (countsPerHost && (countsPerHost[hostKey] == undefined || countsPerHost[hostKey].doc_count === 0)) {
-											return false
-										}
-										return true
-									}) as [hn, files]}
-										{@const hostKey = `${mode},${wg},${hn}`}
-										<!-- svelte-ignore a11y_click_events_have_key_events -->
-										<!-- svelte-ignore a11y_no_static_element_interactions -->
-										<div
-											class="w-full flex items-baseline justify-between rounded px-1 hover:bg-surface-hover cursor-pointer {selected &&
-											selected.mode == mode &&
-											selected.workerGroup == wg &&
-											selected.hostname == hn
-												? 'bg-surface-secondary'
-												: ''}"
-											onclick={() => {
-												selected = { mode, workerGroup: wg, hostname: hn }
-												upToIsLatest = true
-												upTo = getLatestUpTo(selected)
-												scrollToBottom()
+							</div>
+							{#if searchTerm == ''}
+								<div class="flex items-center gap-1">
+									<span class="text-xs text-secondary pr-1">Last 5 log files up to</span>
+									<Button
+										variant="subtle"
+										unifiedSize="sm"
+										iconOnly
+										startIcon={{ icon: ChevronLeft }}
+										title="5 minutes earlier"
+										disabled={!upTo}
+										onClick={() => shiftUpTo(-5)}
+									/>
+									<div class="relative flex w-40">
+										<TextInput
+											size="sm"
+											value={upTo ? formatTime(upTo) : ''}
+											class="pr-9 tabular-nums"
+											inputProps={{ readonly: true, 'aria-label': 'Logs up to' }}
+										/>
+										<CalendarPicker
+											bind:date={upTo}
+											label="Logs up to"
+											placement="bottom-end"
+											on:change={() => {
+												upToIsLatest = false
+												jumpToEnd()
 											}}
+										/>
+									</div>
+									<Button
+										variant="subtle"
+										unifiedSize="sm"
+										iconOnly
+										startIcon={{ icon: ChevronRight }}
+										title="5 minutes later"
+										disabled={!upTo}
+										onClick={() => shiftUpTo(5)}
+									/>
+									<Button
+										variant="default"
+										unifiedSize="sm"
+										selected={upToIsLatest}
+										onClick={() => {
+											upTo = new Date().toISOString()
+											upToIsLatest = true
+											jumpToEnd()
+										}}
+									>
+										Latest
+									</Button>
+								</div>
+							{:else if logs != undefined && !loadingLogs}
+								<span class="text-2xs text-secondary">
+									{(logs.hits ?? []).length} matches on this host
+								</span>
+							{/if}
+						</div>
+						{#if searchTerm == ''}
+							<span class="px-3 py-1 text-2xs text-secondary border-b border-border-light">
+								Logs appear about a minute after they are written, once their file is compacted.
+							</span>
+						{/if}
+						<div class="relative grow min-h-0 flex flex-col">
+							<div
+								class="grow min-h-0 overflow-auto"
+								id="logviewer"
+								bind:this={logPane}
+								onscroll={onLogPaneScroll}
+							>
+								{#if loadingLogs}
+									<div class="flex justify-center items-center h-48 text-secondary">
+										<Loader2 size={24} class="animate-spin" />
+									</div>
+								{:else if logs != undefined}
+									<div class="flex flex-col min-w-full w-fit py-1">
+										<!-- Keyed: LogSnippetViewer renders its html once at creation, so an
+										 index-reused instance would keep the previous search's line. -->
+										{#each logs.hits ?? [] as hit, i (`${i}:${hit.file_path}:${hit.line_no}`)}
+											<LogSnippetViewer
+												content={renderHit(hit)}
+												highlighted={[]}
+												onClick={() => seeLogContext(hit.line_no, hit.file_path, hit.host, true)}
+											/>
+										{/each}
+										{#if (logs.hits ?? []).length === 0}
+											<div class="flex items-center justify-center p-3 py-16">
+												<EmptyState
+													icon={SearchX}
+													title="No matches on this host"
+													description="Try another host, a wider time range or a broader search."
+												/>
+											</div>
+										{/if}
+										{#if (logs.hits ?? []).length === 1000}
+											<span class="px-3 py-3 text-2xs text-secondary">
+												Only the 1000 most recent matches are shown. Narrow the search or the time
+												range to see older ones.
+											</span>
+										{/if}
+									</div>
+								{:else}
+									<!-- Keyed: the window slides by one file at a time, and an index-reused
+									     block would swap its content in place, so the browser could not keep
+									     the line being read where it is. -->
+									{#each getLogs(selected, upTo) as file (file.file_path)}
+										{@const entry = logsContent[fileKey(selected.hostname, file.file_path)]}
+										<div
+											class="relative"
+											style="min-height: {entry
+												? 10
+												: Math.min(file.ok_lines + file.err_lines, 30) * 16}px;"
 										>
 											<div
-												class="text-sm pt-2 pl-0.5 whitespace-nowrap"
-												title={hn}
-												style="width: 90px;"
-												>{truncateRev(hn, countsPerHost || loadingLogs ? 40 : 8)}</div
+												class="sticky top-0 z-10 px-3 py-1 bg-surface-secondary border-b border-border-light text-2xs text-secondary"
 											>
-											{#if loadingLogCounts}
-												<Loader2 size={15} class="animate-spin" />
-											{:else if countsPerHost}
-												<div class="text-primary text-xs">
-													{countsPerHost[hostKey]?.doc_count ?? 0} matches
+												{formatTime(file.ts)}
+											</div>
+											{#if entry == undefined}
+												<div class="p-3"><Skeleton layout={[[4]]} /></div>
+											{:else if entry.error}
+												<div class="p-3">
+													{#if entry.error?.startsWith('Not Found')}
+														<Alert type="info" size="xs" title="Log file not reachable">
+															Servers and workers need a shared log volume, or the EE object storage
+															for logs set in the instance settings, for their log files to be
+															readable from here.
+														</Alert>
+													{:else}
+														<Alert type="error" size="xs" title="Could not load this log file">
+															{entry.error}
+														</Alert>
+													{/if}
 												</div>
+											{:else if entry.content}
+												<LogViewer
+													noAutoScroll
+													noMaxH
+													isLoading={false}
+													tag={undefined}
+													{tagLabel}
+													content={processLogWithJsonFmt(entry.content, file.json_fmt)}
+												/>
 											{:else}
-												<div class="relative grow h-8 mr-2">
-													{#each files as file}
-														{@const okHeight = 100.0 * ((file.ok_lines * 1.0) / (max_lines ?? 1))}
-														{@const errHeight = 100.0 * ((file.err_lines * 1.0) / (max_lines ?? 1))}
-														<div
-															class=" w-2 bg-red-400 absolute"
-															style="left: {((file.ts - minTsN) / diff) *
-																100}%; height: {errHeight}%; bottom: {okHeight}%;"
-														></div>
-														<div
-															class="w-2 bg-surface-secondary-inverse absolute bottom-0"
-															style="left: {((file.ts - minTsN) / diff) *
-																100}%; height: {okHeight}%"
-														></div>
-													{/each}
-												</div>
+												<p class="px-3 py-2 text-xs text-secondary">This log file is empty.</p>
 											{/if}
 										</div>
 									{/each}
-								</div>
-							</div>
-						{/each}
-					</div>
-				{/each}
-				{#if !loadingLogCounts && sumOtherDocCount != 0}
-					<div class="text-primary italic text-sm">
-						Note: {sumOtherDocCount} additional matches weren't grouped into any of the above hosts.
-					</div>
-				{/if}
-			{/if}
-		</div>
-	{/snippet}
-	{#snippet right_pane()}
-		<div class="relative h-full flex flex-col gap-1 pb-2">
-			{#if selected}
-				{#if !loadingLogs && logs == undefined}
-					<div class="w-full bg-surface-primary-inverse text-primary text-xs text-center">
-						1 min delay: logs are compacted before being available
-					</div>
-				{/if}
-				<div class="grow overflow-auto" id="logviewer">
-					{#if loadingLogs}
-						<div class="flex w-full justify-center items-center h-48">
-							<div class="text-primary text-center">
-								<Loader2 size={34} class="animate-spin" />
-							</div>
-						</div>
-					{:else if logs != undefined}
-						<div class="flex flex-col min-w-full w-fit">
-							<!-- Keyed: LogSnippetViewer renders its html once at creation, so an
-										 index-reused instance would keep the previous search's line. -->
-							{#each logs.hits ?? [] as hit, i (`${i}:${hit.file_path}:${hit.line_no}`)}
-								<LogSnippetViewer
-									content={renderHit(hit)}
-									highlighted={[]}
-									onClick={() => seeLogContext(hit.line_no, hit.file_path, hit.host, true)}
-								/>
-							{/each}
-							{#if (logs.hits ?? []).length === 0}
-								<div class="text-center py-20 text-bold text-xl text-primary"> No logs </div>
-							{/if}
-							{#if (logs.hits ?? []).length === 1000}
-								<div class="pl-6 py-6 text-sm text-secondary">
-									Older matches were truncated from this search, try refining your filters to get
-									more precise results.
-								</div>
-							{/if}
-							<div class="py-20"></div>
-						</div>
-					{:else}
-						{#each getLogs(selected, upTo) as file}
-							<div
-								style="min-height: {logsContent[file.file_path]
-									? 10
-									: Math.min(file.ok_lines + file.err_lines, 30) * 16}px;"
-							>
-								<div class="bg-surface-primary-inverse text-sm font-semibold px-1"
-									>{new Date(file.ts).toLocaleTimeString([], {
-										day: '2-digit',
-										month: '2-digit',
-										hour: '2-digit',
-										minute: '2-digit'
-									})}</div
-								>
-								{#if logsContent[file.file_path] == undefined}
-									<div
-										class="animate-skeleton dark:bg-frost-900/50 [animation-delay:1000ms] h-full w-full"
-									></div>
-								{:else if logsContent[file.file_path]}
-									{#if logsContent[file.file_path].error}
-										{#if logsContent[file.file_path].error?.startsWith('Not Found')}
-											<div class="text-xs pb-4 pt-2 text-secondary"
-												>Log file is missing. Log files require a shared log volume to be mounted
-												across servers and workers or to use the EE S3/object storage integration
-												for logs. To avoid mounting a shared volume, set the EE object store logs in
-												the instance settings</div
-											>
-										{:else}
-											<div class="text-xs text-red-400 pb-4"
-												>{logsContent[file.file_path].error}</div
-											>
-										{/if}
-									{:else if logsContent[file.file_path].content}
-										<!-- svelte-ignore a11y_click_events_have_key_events -->
-										<!-- svelte-ignore a11y_no_static_element_interactions -->
-										<div onclick={preventDefault(bubble('click'))} class="pr-2"
-											><LogViewer
-												noAutoScroll
-												noMaxH
-												isLoading={false}
-												tag={undefined}
-												{tagLabel}
-												content={processLogWithJsonFmt(
-													logsContent[file.file_path].content,
-													file.json_fmt
-												)}
-											/></div
-										>
-									{:else}
-										<div>No logs</div>
-									{/if}
 								{/if}
 							</div>
-						{/each}
+							{#if showScrollToEnd && logs == undefined}
+								<div
+									transition:fade={{ duration: 120 }}
+									class="absolute bottom-3 left-1/2 -translate-x-1/2 z-20 rounded-md bg-surface shadow-md"
+								>
+									<Button
+										variant={hasNewLogs ? 'accent' : 'default'}
+										unifiedSize="sm"
+										iconOnly={!hasNewLogs}
+										title="Scroll to latest logs"
+										aria-label={hasNewLogs ? 'New logs, scroll to latest' : 'Scroll to latest logs'}
+										startIcon={{ icon: ArrowDown }}
+										onClick={() => scrollToEnd(true)}
+									>
+										{#if hasNewLogs}New logs{/if}
+									</Button>
+									{#if hasNewLogs}
+										<span class="pointer-events-none absolute -top-1 -right-1 flex h-2.5 w-2.5">
+											<span
+												class="absolute inline-flex h-full w-full animate-ping rounded-full bg-surface-accent-primary opacity-75"
+											></span>
+											<span
+												class="relative inline-flex h-2.5 w-2.5 rounded-full border border-surface bg-surface-accent-primary"
+											></span>
+										</span>
+									{/if}
+								</div>
+							{/if}
+							<!-- The button is visual only; this tells screen readers new files arrived. -->
+							<span class="sr-only" aria-live="polite">
+								{hasNewLogs ? 'New logs available below' : ''}
+							</span>
+						</div>
+					{:else}
+						<div class="flex grow items-center justify-center p-3">
+							<EmptyState
+								icon={ScrollText}
+								title="Select a host"
+								description="Pick a server, worker or indexer on the left to read its logs."
+							/>
+						</div>
 					{/if}
 				</div>
-				{#if searchTerm == ''}
-					<div class="flex w-full items-center gap-4">
-						<div class="text-primary px-1 text-2xs">Last 5 log files up to:</div>
-						<div class="flex grow text-xs justify-center px-2 items-center gap-2">
-							{#if upTo}
-								<button
-									onclick={() => {
-										if (upTo) {
-											upToIsLatest = false
-											upTo = new Date(new Date(upTo).getTime() - 5 * 60 * 1000).toISOString()
-										}
-									}}>{'<'} 5m</button
-								>
-							{:else}
-								<div></div>
-							{/if}
+			{/snippet}
+		</SplitPanesOrColumnOnMobile>
+	</div>
+</div>
 
-							<div class="flex gap-1 relative items-center"
-								><div class="flex gap-1 relative">
-									<input
-										type="text"
-										value={upTo
-											? new Date(upTo).toLocaleTimeString([], {
-													day: '2-digit',
-													month: '2-digit',
-													hour: '2-digit',
-													minute: '2-digit'
-												})
-											: ''}
-										disabled
-									/><CalendarPicker bind:date={upTo} label="Logs up to" /></div
-								></div
-							>
-							{#if upTo}
-								<button
-									onclick={() => {
-										if (upTo) {
-											upToIsLatest = false
-											upTo = new Date(new Date(upTo).getTime() + 5 * 60 * 1000).toISOString()
-										}
-									}}>5m {'>'}</button
-								>
-							{:else}
-								<div></div>
-							{/if}
-						</div>
-						<div>
-							<button
-								class="text-xs"
-								onclick={() => {
-									upTo = new Date().toISOString()
-									upToIsLatest = true
-								}}>now</button
-							>
-						</div>
-					</div>
-				{/if}
-			{:else}
-				<div class="flex justify-center items-center pt-8">Select a host to see its logs</div>
-			{/if}</div
-		>
-	{/snippet}
-</SplitPanesOrColumnOnMobile>
+<style>
+	/* The two panes are separate cards; the splitter is the gap between them. */
+	:global(.service-logs-splitpanes .splitpanes__splitter) {
+		background-color: transparent !important;
+		border: none !important;
+	}
+</style>
diff --git a/frontend/src/lib/components/SummaryPathDisplay.svelte b/frontend/src/lib/components/SummaryPathDisplay.svelte
index 22925e98e7..8fa0073b48 100644
--- a/frontend/src/lib/components/SummaryPathDisplay.svelte
+++ b/frontend/src/lib/components/SummaryPathDisplay.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import type { Snippet } from 'svelte'
 	import { emptyString, isOwner } from '$lib/utils'
 	import { Alert, Button } from '$lib/components/common'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
@@ -27,7 +28,26 @@
 		inheritedLabels?: string[] | undefined
 		editable?: boolean
 		onSaved?: (newPath: string) => void
-		kind?: 'flow' | 'script'
+		/** What is being renamed. An agent is a resource, so the path field is scoped to one and
+		 *  the write goes through the agent branch of the rename manager. */
+		kind?: 'flow' | 'script' | 'agent'
+		/** Saves instead of the API, for an item that exists only locally (a draft).
+		 * Returns an error message to keep the popover open. */
+		saveOverride?: (next: {
+			path: string
+			summary: string
+			labels: string[] | undefined
+		}) => string | undefined
+		/** Header variant: no path line (the host shows it) and a lighter summary. */
+		compact?: boolean
+		/** Rendered inside the trigger in place of the summary, for a host that hangs a second copy
+		 *  of this editor off something else it draws — the band's path segment. */
+		label?: Snippet
+		/** The trigger's own classes, for a host whose row has a look of its own. */
+		triggerClass?: string
+		/** Which field takes the cursor on open: the click says which half of the name the user came
+		 *  to change. `Path` is only reachable for an owner, so 'path' falls back to the summary. */
+		focusField?: 'summary' | 'path'
 	}
 
 	let {
@@ -37,41 +57,71 @@
 		inheritedLabels = undefined,
 		editable = false,
 		onSaved,
-		kind = 'flow'
+		kind = 'flow',
+		saveOverride = undefined,
+		compact = false,
+		label,
+		triggerClass = 'block min-w-0 max-w-full px-1 py-0.5 rounded text-left cursor-pointer hover:bg-surface-hover transition-colors',
+		focusField = 'summary'
 	}: Props = $props()
 
+	// An agent lives at a resource path, so that is what the picker validates against; the
+	// placeholder still says "agent", which is what the reader is naming.
+	const pathKind = $derived(kind === 'agent' ? 'resource' : kind)
+
 	let editSummary = $state('')
 	let editPath = $state('')
 	let dirtyPath = $state(false)
 	let popoverOpen = $state(false)
-	let ownPath = $state<string | undefined>(undefined)
-	// Derived: ownership answers about the operating workspace, whose user resolves asynchronously.
+	// Resolved before the popover opens, not on opening it: the path field only exists for an owner,
+	// and `openFocus` looks for it in the same flush the popover renders in.
 	const own = $derived(
-		ownPath === undefined ? false : isOwner(ownPath, actingUser, $operatingWorkspace)
+		saveOverride !== undefined || isOwner(path ?? '', actingUser, $operatingWorkspace)
 	)
 	let onBehalfOfEmail = $state<string | undefined>(undefined)
 	let summaryInput: ReturnType<typeof TextInput> | undefined = $state()
 	let labelsDirty = $state(false)
 	let hasChanges = $derived(editSummary !== (summary ?? '') || (own && dirtyPath) || labelsDirty)
 
-	$effect(() => {
-		if (popoverOpen && onSaved) {
-			editSummary = summary ?? ''
-			editPath = path ?? ''
-			labelsDirty = false
-			ownPath = path ?? ''
-			onBehalfOfEmail = undefined
-			if (kind === 'flow' && $operatingWorkspace && path) {
-				checkFlowOnBehalfOf($operatingWorkspace, path).then((email) => {
-					onBehalfOfEmail = email
-				})
-			}
-		}
-	})
+	/** Seeds the fields from the item and asks who a flow runs on behalf of. Called on the open
+	 *  transition rather than from an effect watching `popoverOpen`: that effect also read
+	 *  `summary`, `path` and the workspace, so a save or a rename landing while the popover was
+	 *  open reseeded the fields from the props — over whatever the user had typed. */
+	function onOpen() {
+		if (!onSaved) return
+		editSummary = summary ?? ''
+		editPath = path ?? ''
+		labelsDirty = false
+		onBehalfOfEmail = undefined
+		if (kind !== 'flow' || !$operatingWorkspace || !path) return
+		const askedFor = path
+		checkFlowOnBehalfOf($operatingWorkspace, path).then((email) => {
+			// The answer describes the path the popover opened on. Closed since, or moved to
+			// another path, it answers nothing on screen.
+			if (popoverOpen && path === askedFor) onBehalfOfEmail = email
+		})
+	}
+
+	/** The path's name field inside this popover. `Path` hardcodes `id="path"`, and melt resolves a
+	 *  string `openFocus` with a document-wide `querySelector`, so a popover portalled to the body
+	 *  would hand the keystrokes to whichever other `Path` the page happens to have mounted. */
+	const pathField = () =>
+		document.querySelector<HTMLInputElement>('[data-path-edit-path] #path') ?? null
 
 	async function save(close: () => void) {
 		const initialPath = path ?? ''
 		const newPath = own ? editPath : initialPath
+		if (saveOverride) {
+			const error = saveOverride({ path: newPath, summary: editSummary, labels })
+			if (error) {
+				sendUserToast(error, true)
+				return
+			}
+			labelsDirty = false
+			close()
+			onSaved?.(newPath)
+			return
+		}
 
 		try {
 			await updateItemPathAndSummary({
@@ -82,7 +132,7 @@
 				newSummary: editSummary,
 				labels
 			})
-			sendUserToast(`${kind === 'flow' ? 'Flow' : 'Script'} updated`)
+			sendUserToast(`${kind.charAt(0).toUpperCase()}${kind.slice(1)} updated`)
 			labelsDirty = false
 			close()
 			onSaved?.(newPath)
@@ -92,45 +142,48 @@
 	}
 </script>
 
-{#if editable || onSaved}
+{#snippet editor()}
+	<!-- Without naming the path's own field melt lands on the row's first button, so a popover
+	     opened from the path would not be typing into the path. -->
 	<Popover
-		class="min-w-0 max-w-full"
+		class={triggerClass}
 		placement="bottom-start"
 		contentClasses="p-4"
+		triggerAttrs={{ title: 'Edit summary and path', 'aria-label': 'Edit summary and path' }}
 		usePointerDownOutside
 		excludeSelectors=".drawer"
 		disableFocusTrap
-		openFocus={() => {
-			summaryInput?.focus()
-			return null
-		}}
-		bind:isOpen={popoverOpen}
+		openFocus={focusField === 'path' && own
+			? pathField
+			: () => {
+					summaryInput?.focus()
+					return null
+				}}
+		bind:isOpen={
+			() => popoverOpen,
+			(v) => {
+				const opening = v && !popoverOpen
+				popoverOpen = v
+				if (opening) onOpen()
+			}
+		}
 	>
 		{#snippet trigger()}
-			<div
-				class={'min-w-0 truncate flex flex-col items-start px-2 py-1 rounded-md transition-colors cursor-pointer hover:bg-surface-hover'}
-			>
-				<span class="text-2xs leading-tight text-tertiary font-mono font-normal truncate max-w-full"
-					>{path}</span
+			<!-- Both of the popover's arms show the summary and the path, and ownership decides
+					     whether the path can be changed, not whether it is there. -->
+			{#if label}
+				{@render label()}
+			{:else}
+				<span
+					class="{compact
+						? 'text-xs font-medium'
+						: 'text-sm font-semibold'} block truncate {emptyString(summary)
+						? 'text-tertiary italic font-normal'
+						: 'text-emphasis'}"
 				>
-				<div class="flex items-center gap-3 max-w-full">
-					<span
-						class="text-sm font-semibold truncate {emptyString(summary)
-							? 'text-tertiary italic font-normal'
-							: 'text-emphasis'}"
-					>
-						{emptyString(summary) ? 'Add a summary...' : summary}
-					</span>
-					{#if labels?.length}
-						<div class="flex items-center gap-0.5">
-							{#each labels as label}
-								<Badge color="blue" verySmall class="px-1" title="Label: {label}">{label}</Badge>
-							{/each}
-						</div>
-					{/if}
-					<InheritedLabels labels={inheritedLabels} />
-				</div>
-			</div>
+					{emptyString(summary) ? 'Add a summary...' : summary}
+				</span>
+			{/if}
 		{/snippet}
 		{#snippet content({ close })}
 			<div class="flex flex-col gap-6 w-[480px]">
@@ -168,16 +221,18 @@
 					{/if}
 					<Label label="Path">
 						{#if own}
-							<Path
-								autofocus={false}
-								bind:path={editPath}
-								bind:dirty={dirtyPath}
-								initialPath={path ?? ''}
-								namePlaceholder={kind}
-								{kind}
-								size="sm"
-								drawerOffset={4000}
-							/>
+							<div data-path-edit-path>
+								<Path
+									autofocus={false}
+									bind:path={editPath}
+									bind:dirty={dirtyPath}
+									initialPath={path ?? ''}
+									namePlaceholder={kind}
+									kind={pathKind}
+									size="sm"
+									drawerOffset={4000}
+								/>
+							</div>
 						{:else}
 							<span class="text-xs font-mono text-secondary">{path}</span>
 							<p class="text-2xs text-tertiary mt-1">Only the owner can change the path</p>
@@ -216,27 +271,69 @@
 					</label>
 					<div class="block text-primary">
 						<div class="pb-1 text-xs font-semibold text-emphasis">Path</div>
-						<Path
-							autofocus={false}
-							bind:path
-							bind:dirty={dirtyPath}
-							initialPath={path ?? ''}
-							namePlaceholder={kind}
-							{kind}
-							size="sm"
-							drawerOffset={4000}
-						/>
+						<div data-path-edit-path>
+							<Path
+								autofocus={false}
+								bind:path
+								bind:dirty={dirtyPath}
+								initialPath={path ?? ''}
+								namePlaceholder={kind}
+								kind={pathKind}
+								size="sm"
+								drawerOffset={4000}
+							/>
+						</div>
 					</div>
 				{/if}
 			</div>
 		{/snippet}
 	</Popover>
+{/snippet}
+
+{#if label && (editable || onSaved)}
+	<!-- The host draws the row this hangs in — the band's path segment — so only the trigger comes
+	     from here: no path line above it, and no second copy of the labels. -->
+	{@render editor()}
+{:else if editable || onSaved}
+	<!-- The name itself opens the popover, the same way the editors do it. Only the name: the whole
+	     block was the trigger once, which meant a path or a label you only wanted to read answered
+	     a click. -->
+	<div
+		class="min-w-0 truncate flex {compact
+			? 'items-center px-1 py-0.5'
+			: 'flex-col items-start px-2 py-1'}"
+	>
+		{#if !compact}
+			<span class="text-2xs leading-tight text-tertiary font-mono font-normal truncate max-w-full"
+				>{path}</span
+			>
+		{/if}
+		<div class="flex items-center gap-3 max-w-full min-w-0">
+			{@render editor()}
+			<!-- Outside the trigger: a label is read, not clicked through to a rename. -->
+			{#if labels?.length}
+				<div class="flex items-center gap-0.5">
+					{#each labels as labelText}
+						<Badge color="blue" verySmall class="px-1" title="Label: {labelText}">{labelText}</Badge
+						>
+					{/each}
+				</div>
+			{/if}
+			<InheritedLabels labels={inheritedLabels} />
+		</div>
+	</div>
+{:else if label}
+	<!-- Nothing to open, but the host still drew this into a slot of its own: give back what it
+	     handed over rather than this component's own block, which belongs in a row it owns. -->
+	{@render label()}
 {:else}
-	<div class="min-w-0 truncate flex flex-col px-2">
-		{#if !emptyString(summary)}
+	<div class="min-w-0 truncate flex items-center {compact ? '' : 'flex-col px-2'}">
+		{#if !emptyString(summary) && !compact}
 			<span class="text-[10px] leading-tight text-tertiary font-mono truncate">{path}</span>
 		{/if}
-		<span class="text-sm font-semibold text-emphasis truncate">
+		<span
+			class="{compact ? 'text-xs font-medium' : 'text-sm font-semibold'} text-emphasis truncate"
+		>
 			{emptyString(summary) ? (path ?? '') : summary}
 		</span>
 	</div>
diff --git a/frontend/src/lib/components/SuperadminSettingsInner.svelte b/frontend/src/lib/components/SuperadminSettingsInner.svelte
index 0fd7991597..eb5559a2aa 100644
--- a/frontend/src/lib/components/SuperadminSettingsInner.svelte
+++ b/frontend/src/lib/components/SuperadminSettingsInner.svelte
@@ -8,7 +8,6 @@
 	import InviteGlobalUser from '$lib/components/InviteGlobalUser.svelte'
 	import { Button } from '$lib/components/common'
 	import { sendUserToast } from '$lib/toast'
-	import { base } from '$lib/base'
 	import SearchItems from './SearchItems.svelte'
 	import { page } from '$app/state'
 	import { replaceState } from '$app/navigation'
@@ -18,7 +17,7 @@
 	import { truncate } from '$lib/utils'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
 	import {
 		ArrowRightLeft,
 		Ban,
@@ -47,6 +46,8 @@
 		tabToAuthSubTab,
 		categoryToTabMap,
 		buildSearchableSettingItems,
+		listedNavigationGroups,
+		usesExternalOidcSigner,
 		type SearchableSettingItem
 	} from './instanceSettings'
 	import TextInput from './text_input/TextInput.svelte'
@@ -228,7 +229,14 @@
 		return instanceSettings?.buildFullDiff() ?? { original: '', modified: '' }
 	}
 	// --- Settings search ---
-	const searchableItems = buildSearchableSettingItems()
+	let externalOidcSigner = $state(false)
+	$effect(() => {
+		if ($enterpriseLicense) usesExternalOidcSigner().then((v) => (externalOidcSigner = v))
+	})
+	const navigationGroups = $derived(
+		listedNavigationGroups(instanceSettingsNavigationGroups, externalOidcSigner)
+	)
+	const searchableItems = $derived(buildSearchableSettingItems(navigationGroups))
 
 	let scrollTimeout: ReturnType<typeof setTimeout> | undefined
 	let highlightTimeout: ReturnType<typeof setTimeout> | undefined
@@ -288,7 +296,7 @@
 				<Button
 					variant="default"
 					target="_blank"
-					href="{base}/?workspace=admins"
+					href="/?workspace=admins"
 					endIcon={{ icon: ExternalLink }}
 				>
 					Admins workspace
@@ -301,15 +309,11 @@
 			<!-- Sidebar Navigation -->
 			<div class="w-52 shrink-0 h-full overflow-auto p-4 bg-surface flex flex-col">
 				<SettingsSearchInput {searchableItems} onSelect={handleSearchSelect} class="mb-3" />
-				<SidebarNavigation
-					groups={instanceSettingsNavigationGroups}
-					selectedId={tab}
-					onNavigate={handleNavigate}
-				/>
+				<SidebarNavigation groups={navigationGroups} selectedId={tab} onNavigate={handleNavigate} />
 				{#if $workspaceStore !== 'admins'}
 					<div class="mt-4 pt-2 border-t border-surface-hover">
 						<a
-							href="{base}/?workspace=admins"
+							href="/?workspace=admins"
 							target="_blank"
 							class="flex items-center gap-2 px-2 py-1.5 text-xs text-secondary hover:text-primary transition-colors"
 						>
@@ -372,7 +376,7 @@
 								</div>
 							{/if}
 
-							<Tabs bind:selected={usersSubTab} class="mb-4">
+							<Tabs bind:selected={usersSubTab} class="mb-4" wrapperClass="shrink-0">
 								<Tab value="users" label="Users" />
 								{#if extJwtTokens.length > 0}
 									<Tab value="ext_jwt" label="External JWTs" />
@@ -623,7 +627,7 @@
 																		in
 																		{#if workspace_id}
 																			<a
-																				href="{base}/workspace_settings?tab=users&workspace={workspace_id}"
+																				href="/workspace_settings?tab=users&workspace={workspace_id}"
 																				class="hover:underline"
 																				title={workspace_id}
 																				onclick={() => closeDrawer?.()}
@@ -635,7 +639,7 @@
 																	</span>
 																{:else if groupRole}
 																	<a
-																		href="{base}/groups"
+																		href="/groups"
 																		class="text-2xs text-tertiary mt-0.5 ml-1 hover:underline"
 																		title={groupRoleTooltip}
 																		onclick={() => closeDrawer?.()}
@@ -655,7 +659,7 @@
 																					displayName: 'Manage in workspace',
 																					icon: Settings,
 																					action: () => closeDrawer?.(),
-																					href: `${base}/workspace_settings?tab=users&workspace=${workspace_id}`
+																					href: `/workspace_settings?tab=users&workspace=${workspace_id}`
 																				}
 																			]}
 																		/>
diff --git a/frontend/src/lib/components/TimelineBar.svelte b/frontend/src/lib/components/TimelineBar.svelte
index 1d8e05008d..66d350a11b 100644
--- a/frontend/src/lib/components/TimelineBar.svelte
+++ b/frontend/src/lib/components/TimelineBar.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { msToSec } from '$lib/utils'
-	import { base } from '$lib/base'
 	import { ExternalLink } from 'lucide-svelte'
 	import Popover from './Popover.svelte'
 
@@ -59,7 +58,7 @@
 			{#if tooltip}
 				<span>{tooltip}</span>
 			{:else}
-				<a href="{base}/run/{id}" class="inline-flex items-center gap-1" target="_blank"
+				<a href="/run/{id}" class="inline-flex items-center gap-1" target="_blank"
 					>{id} <ExternalLink size={14} /></a
 				>
 			{/if}
diff --git a/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte b/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte
index c53b1436c8..44fdd6465f 100644
--- a/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte
+++ b/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import { Alert } from '$lib/components/common'
-	import { base } from '$lib/base'
 	import { goto } from '$lib/navigation'
 	import { sendUserToast } from '$lib/toast'
 	import { updateDevWorkspaceModal } from '$lib/utils/editInForkModal.svelte'
@@ -80,7 +79,7 @@
 	// confirm button leads when the user can't deploy here, so the request still has somewhere to go.
 	const compareHref = $derived(
 		pending
-			? `${base}/forks/compare?workspace_id=${encodeURIComponent(pending.devWorkspaceId)}` +
+			? `/forks/compare?workspace_id=${encodeURIComponent(pending.devWorkspaceId)}` +
 					`&mode=fork&dir=update` +
 					`&${COMPARE_ITEMS_PARAM}=${encodeURIComponent(`${pending.itemType}:${pending.itemPath}`)}`
 			: ''
diff --git a/frontend/src/lib/components/VariableEditor.svelte b/frontend/src/lib/components/VariableEditor.svelte
index be76185959..901bf119cc 100644
--- a/frontend/src/lib/components/VariableEditor.svelte
+++ b/frontend/src/lib/components/VariableEditor.svelte
@@ -13,7 +13,8 @@
 	import { VARIABLES_PATH } from './sessions/previewPaths'
 	import Alert from './common/alert/Alert.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { canWrite } from '$lib/utils'
+	import { canEditItem } from '$lib/editRights'
+	import { userWorkspaces } from '$lib/stores'
 	import { Save } from 'lucide-svelte'
 	import VariableForm from './VariableForm.svelte'
 	import { invalidateWorkspacePaths } from './PathNameAutocomplete.svelte'
@@ -137,8 +138,12 @@
 		if (!selected || !edit) return true
 		const perms = extraPerms[selected]
 		if (!perms || !acting.resolved(selected)) return undefined
-		return canWrite(editPath ?? '', perms, acting.in(selected))
+		return canEditVariableIn(selected, perms)
 	})
+	function canEditVariableIn(ws: string, perms: Record<string, boolean>): boolean {
+		const settings = $userWorkspaces.find((w) => w.id === ws)?.operator_settings
+		return canEditItem('variable', editPath ?? '', perms, acting.in(ws), settings)
+	}
 	const dirtyWorkspaces = $derived(
 		Object.keys(states).filter((ws) => !draftValuesEqual(states[ws].draft, initialStates[ws]))
 	)
@@ -301,7 +306,7 @@
 	const dirtyCanWrite = $derived(
 		dirtyWorkspaces.every((ws) => {
 			const perms = extraPerms[ws]
-			return !perms || canWrite(editPath ?? '', perms, acting.in(ws))
+			return !perms || canEditVariableIn(ws, perms)
 		})
 	)
 
diff --git a/frontend/src/lib/components/WorkerGroup.svelte b/frontend/src/lib/components/WorkerGroup.svelte
index 65d00f9ba6..5e8957c31a 100644
--- a/frontend/src/lib/components/WorkerGroup.svelte
+++ b/frontend/src/lib/components/WorkerGroup.svelte
@@ -55,6 +55,7 @@
 	import TagList from './TagList.svelte'
 	import DedicatedWorkersSelector from './DedicatedWorkersSelector.svelte'
 	import { computeHashedTag } from './dedicated_worker'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import ObjectStoreConfigSettings, {
 		type ObjectStoreConfig
 	} from './ObjectStoreConfigSettings.svelte'
@@ -104,6 +105,7 @@
 		autoscaling?: AutoscalingConfig
 		native_mode?: boolean
 		object_store_cache_config?: ObjectStoreConfig
+		paused?: boolean
 	} = $state({})
 
 	function loadNConfig() {
@@ -111,10 +113,9 @@
 			? config.worker_tags != undefined ||
 				config.dedicated_worker != undefined ||
 				config.dedicated_workers != undefined
-				? config
-				: {
-						worker_tags: []
-					}
+				? // a copy: editing the draft must not touch the saved config it is compared against
+					$state.snapshot(config)
+				: { ...$state.snapshot(config), worker_tags: [] }
 			: {
 					worker_tags: []
 				}
@@ -212,6 +213,7 @@
 					periodic_script_interval_seconds?: number
 					native_mode?: boolean
 					object_store_cache_config?: ObjectStoreConfig
+					paused?: boolean
 			  }
 		activeWorkers: number
 		customTags: string[] | undefined
@@ -268,8 +270,10 @@
 		if (!config && !nconfig) return false
 		if (!config || !nconfig) return true
 
-		const cleaned1 = cleanValueProperties(config)
-		const cleaned2 = cleanValueProperties(nconfig)
+		// Compared without empty values: the draft is filled with empty defaults a saved
+		// config may lack, which are not an edit.
+		const cleaned1 = cleanWorkerGroupConfig(cleanValueProperties(config))
+		const cleaned2 = cleanWorkerGroupConfig(cleanValueProperties(nconfig))
 
 		return (
 			orderedJsonStringify(replaceFalseWithUndefined(cleaned1)) !==
@@ -298,6 +302,47 @@
 	let openDelete = $state(false)
 	let openClean = $state(false)
 	let openRestart = $state(false)
+	let pendingConfig: typeof nconfig | undefined = $state()
+
+	// Mirrors `reload_worker_config` in backend/src/monitor.rs, which decides the restart. It
+	// compares the body that is sent rather than the draft, and only the fields a worker loads.
+	const RESTART_FIELDS = [
+		'dedicated_worker',
+		'dedicated_workers',
+		'init_bash',
+		'periodic_script_bash',
+		'periodic_script_interval_seconds',
+		'native_mode'
+	] as const
+	const OTHER_WORKER_FIELDS = [
+		'worker_tags',
+		'priority_tags',
+		'additional_python_paths',
+		'pip_local_dependencies',
+		'object_store_cache_config'
+	] as const
+	function restartsWorkers(body: typeof nconfig): boolean {
+		if (activeWorkers === 0) return false
+		const saved: typeof nconfig = config ?? {}
+		const comparable = (c: typeof nconfig, k: keyof typeof nconfig) =>
+			orderedJsonStringify(replaceFalseWithUndefined(cleanWorkerGroupConfig({ v: c[k] })))
+		const changed = (k: keyof typeof nconfig) => comparable(saved, k) !== comparable(body, k)
+		const restartFieldChanged = RESTART_FIELDS.some(changed)
+		const onlyPauseChanged =
+			changed('paused') &&
+			!restartFieldChanged &&
+			!OTHER_WORKER_FIELDS.some(changed) &&
+			!hasEnvVarChanges
+		const dedicated =
+			body.dedicated_worker != undefined || (body.dedicated_workers?.length ?? 0) > 0
+		return !onlyPauseChanged && (dedicated || restartFieldChanged)
+	}
+
+	async function saveConfig(body: typeof nconfig) {
+		await ConfigService.updateConfig({ name: 'worker__' + name, requestBody: body })
+		sendUserToast('Configuration set')
+		dispatch('reload')
+	}
 
 	// Compute hashed tags for display (actual tags used by the worker)
 	let hashedDedicatedTags: Map<string, string> = $state(new Map())
@@ -399,6 +444,31 @@
 	</div>
 </ConfirmationModal>
 
+<ConfirmationModal
+	open={pendingConfig != undefined}
+	title="Apply changes and restart workers"
+	confirmationText="Apply and restart"
+	on:canceled={() => {
+		pendingConfig = undefined
+	}}
+	on:confirmed={async () => {
+		const body = pendingConfig
+		pendingConfig = undefined
+		if (body) {
+			await saveConfig(body)
+		}
+	}}
+>
+	<div class="flex flex-col w-full space-y-4">
+		<span
+			>Applying these changes will restart the {pluralize(activeWorkers, 'worker')} of worker group '{name}'.
+			Workers finish their running job, shut down gracefully and are expected to be restarted by
+			their supervisor.</span
+		>
+		<span>Pausing or resuming a worker group alone does not restart its workers.</span>
+	</div>
+</ConfirmationModal>
+
 <ConfirmationModal
 	open={openRestart}
 	title="Restart workers"
@@ -733,6 +803,32 @@
 			</div>
 		{/if}
 
+		{#if nconfig !== undefined}
+			<div class="mt-8"></div>
+			<Label label="Pause">
+				{#snippet header()}
+					<Tooltip>
+						{#snippet text()}
+							A paused worker group stops pulling jobs, including suspended jobs that are resumed.
+							Jobs already running finish, queued jobs stay in the queue until the group is resumed.
+							Workers pick the change up within about 10 seconds, without restarting.
+						{/snippet}
+					</Tooltip>
+				{/snippet}
+				<Toggle
+					size="sm"
+					options={{ right: 'Pause this worker group' }}
+					checked={nconfig?.paused === true}
+					on:change={(ev) => {
+						if (nconfig !== undefined) {
+							nconfig.paused = ev.detail ? true : undefined
+						}
+					}}
+					disabled={!canEditConfig}
+				/>
+			</Label>
+		{/if}
+
 		<div class="mt-8"></div>
 
 		<Label
@@ -1143,7 +1239,7 @@
 				<p class="text-xs text-tertiary">Requires a superadmin token.</p>
 				<pre
 					class="mt-1 p-2 bg-surface-secondary rounded text-xs overflow-x-auto whitespace-pre-wrap break-all"
-					>curl -X POST '{window.location.origin}/api/configs/update/worker__{name}' \
+					>curl -X POST '{apiBaseUrl()}/api/configs/update/worker__{name}' \
   -H 'Content-Type: application/json' \
   -H 'Authorization: Bearer &lt;token&gt;' \
   -d '{JSON.stringify(cleanWorkerGroupConfig(nconfig ?? {}), null, 2)}'</pre
@@ -1216,9 +1312,19 @@
 									}
 								})
 
-								await ConfigService.updateConfig({ name: 'worker__' + name, requestBody: nconfig })
-								sendUserToast('Configuration set')
-								dispatch('reload')
+								// A group without saved tags inherits them from the worker's environment, and
+								// an explicit empty list would override that: only send one the user asked for.
+								const inheritsTags =
+									config?.worker_tags == undefined &&
+									config?.dedicated_worker == undefined &&
+									config?.dedicated_workers == undefined &&
+									nconfig.worker_tags?.length === 0
+								const body = inheritsTags ? { ...nconfig, worker_tags: undefined } : nconfig
+								if (restartsWorkers(body)) {
+									pendingConfig = body
+								} else {
+									await saveConfig(body)
+								}
 							}}
 							disabled={(!hasChanges &&
 								!hasEnvVarChanges &&
@@ -1258,6 +1364,16 @@
 				{#if isNativeMode}
 					<Badge color="blue" small>Native</Badge>
 				{/if}
+				{#if config?.paused === true}
+					<Badge color="yellow" small>
+						Paused
+						<Tooltip>
+							{#snippet text()}
+								Workers of this group pull no new jobs. Queued jobs wait until the group is resumed.
+							{/snippet}
+						</Tooltip>
+					</Badge>
+				{/if}
 			</div>
 
 			{#if vcpus_memory?.vcpus}
diff --git a/frontend/src/lib/components/WorkflowTimeline.svelte b/frontend/src/lib/components/WorkflowTimeline.svelte
index 868f215c20..4526281293 100644
--- a/frontend/src/lib/components/WorkflowTimeline.svelte
+++ b/frontend/src/lib/components/WorkflowTimeline.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { displayDate, msToSec, emptyString } from '$lib/utils'
 	import { onDestroy } from 'svelte'
 	import { getDbClockNow } from '$lib/forLater'
@@ -315,7 +314,7 @@
 								<a
 									target="_blank"
 									class="inline-flex gap-2 items-baseline hover:underline whitespace-nowrap"
-									href="{base}/run/{k}"
+									href="/run/{k}"
 									onclick={(e) => e.stopPropagation()}
 								>
 									{v.name ?? k}
diff --git a/frontend/src/lib/components/WorkspaceDependenciesEditor.svelte b/frontend/src/lib/components/WorkspaceDependenciesEditor.svelte
index 7bc0351c82..2d5d8a62ce 100644
--- a/frontend/src/lib/components/WorkspaceDependenciesEditor.svelte
+++ b/frontend/src/lib/components/WorkspaceDependenciesEditor.svelte
@@ -154,7 +154,7 @@ numpy>=1.24.0
 
 		// 		go: `module mymod
 
-		// go 1.26
+		// go 1.27
 
 		// require (
 		// 	rsc.io/quote v1.5.2
diff --git a/frontend/src/lib/components/WorkspaceDeployLayout.svelte b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
index 66beb18b73..de666451ee 100644
--- a/frontend/src/lib/components/WorkspaceDeployLayout.svelte
+++ b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
@@ -38,6 +38,9 @@
 		deploymentStatus: Record<string, { status: 'loading' | 'deployed' | 'failed'; error?: string }>
 		allSelected?: boolean
 		emptyMessage?: string
+		/** The list is empty because it has not arrived yet. An empty list and an unanswered one
+		 *  look alike from here, and "no changes" is a claim that needs an answer behind it. */
+		loading?: boolean
 		hideSelection?: boolean
 		children?: Snippet
 
@@ -70,6 +73,7 @@
 		deploymentStatus,
 		allSelected = false,
 		emptyMessage = 'No items to deploy',
+		loading = false,
 		hideSelection = false,
 		header,
 		alerts,
@@ -308,6 +312,11 @@
 				{/each}
 			</div>
 		</div>
+	{:else if loading}
+		<div class="flex items-center justify-center h-full gap-2 text-hint text-xs">
+			<Loader2 class="animate-spin w-4 h-4" />
+			Comparing…
+		</div>
 	{:else}
 		<div class="flex items-center justify-center h-full">
 			<div class="text-hint text-xs">{emptyMessage}</div>
diff --git a/frontend/src/lib/components/WorkspaceDraftsBanner.svelte b/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
index 2e0110f710..c77082fbf3 100644
--- a/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
+++ b/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
@@ -1,10 +1,11 @@
 <script lang="ts">
 	import { workspaceStore, userWorkspaces } from '$lib/stores'
 	import { workspaceIsFork } from '$lib/utils/workspaceHierarchy'
-	import { Button } from './common'
-	import { Pencil } from 'lucide-svelte'
+	import { Badge, Button } from './common'
 	import { goto } from '$app/navigation'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 
 	// Surfaces pending drafts (scripts/flows/apps) for the current workspace and
 	// links to the compare page in draft mode. Mutually exclusive with
@@ -26,26 +27,33 @@
 			})
 		}
 	}
+	const phone = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
 </script>
 
 {#if !isFork && draftCount > 0}
-	<!-- Side padding mirrors the page content container below, so the banner
-	     stays aligned with it instead of bleeding to the viewport edges. -->
-	<div class="w-full text-xs max-w-7xl mx-auto px-4 sm:px-8 pt-2">
-		<div class="bg-blue-50 dark:bg-blue-900 rounded-md px-4 py-2">
-			<div class="flex flex-wrap items-center justify-between gap-x-3 gap-y-2">
-				<div class="flex items-center gap-3 min-w-0">
-					<Pencil class="w-4 h-4 text-accent shrink-0" />
-					<span class="text-xs font-medium text-blue-900 dark:text-blue-100">
-						This workspace has {draftCount} draft{draftCount !== 1 ? 's' : ''}
-					</span>
-				</div>
-				<!-- Same button as the sibling ForkWorkspaceBanner CTA (they sit on the
-				     same home page), kept visually identical on purpose. -->
-				<Button variant="default" unifiedSize="sm" onclick={openDraftCompare}>
-					Review & deploy drafts
-				</Button>
-			</div>
-		</div>
-	</div>
+	<!-- In the band rather than a banner over the page: it is a standing fact about the workspace,
+	     not an interruption, and one button says it and acts on it. -->
+	<PageHeaderContent actions={draftsAction} actionsOrder={-100} />
 {/if}
+
+{#snippet draftsAction()}
+	<!-- On a phone the badge becomes the button: the count is the part that has to be seen, and
+	     the bar has room for one thing. -->
+	{#if phone}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			onclick={openDraftCompare}
+			title="Review & deploy drafts"
+		>
+			<Badge color="blue" small>{draftCount}</Badge>
+		</Button>
+	{:else}
+		<Badge color="blue" small>
+			{draftCount} draft{draftCount !== 1 ? 's' : ''}
+		</Badge>
+		<Button variant="subtle" unifiedSize="sm" onclick={openDraftCompare}>
+			Review & deploy drafts
+		</Button>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/WorkspaceItemKindIcon.svelte b/frontend/src/lib/components/WorkspaceItemKindIcon.svelte
new file mode 100644
index 0000000000..9d07f6ef89
--- /dev/null
+++ b/frontend/src/lib/components/WorkspaceItemKindIcon.svelte
@@ -0,0 +1,19 @@
+<!--
+@component
+The glyph the rest of the app gives a workspace item's kind (see RowIcon), at the caller's size.
+-->
+<script lang="ts">
+	import { Code2, LayoutDashboard } from 'lucide-svelte'
+	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
+	import type { WorkspaceItemKind } from '$lib/components/workspacePicker'
+
+	let { kind, size = 14 }: { kind: WorkspaceItemKind; size?: number } = $props()
+</script>
+
+{#if kind === 'flow'}
+	<BarsStaggered {size} class="flex-shrink-0 text-teal-500" />
+{:else if kind === 'app'}
+	<LayoutDashboard {size} class="flex-shrink-0 text-orange-500" />
+{:else}
+	<Code2 {size} class="flex-shrink-0 text-blue-500" />
+{/if}
diff --git a/frontend/src/lib/components/WorkspaceScopeTrigger.svelte b/frontend/src/lib/components/WorkspaceScopeTrigger.svelte
index 77fe52b421..37a27f3812 100644
--- a/frontend/src/lib/components/WorkspaceScopeTrigger.svelte
+++ b/frontend/src/lib/components/WorkspaceScopeTrigger.svelte
@@ -2,8 +2,8 @@
 	import { userWorkspaces, type UserWorkspace } from '$lib/stores'
 	import { findWorkspaceRoot } from '$lib/utils/workspaceHierarchy'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
-	import { Badge, Button } from '$lib/components/common'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import { Button } from '$lib/components/common'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import { Building, ChevronDown, EllipsisVertical, GitFork } from 'lucide-svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import { type Item } from '$lib/utils'
@@ -171,12 +171,12 @@
 			{#if pendingFork}
 				<span class="shrink-0 opacity-70 font-normal">(new)</span>
 			{:else if currentWs?.is_dev_workspace}
-				<Badge
-					color="dark-blue"
-					small
-					class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-					>{devBadgeText(currentWs.dev_workspace_label)}</Badge
-				>
+				<DevWorkspaceBadge
+					label={currentWs.dev_workspace_label}
+					color={color ?? (pendingFork ? undefined : currentWs.color)}
+					fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+					class="text-3xs px-1 py-0"
+				/>
 			{/if}
 		{/if}
 	</Button>
diff --git a/frontend/src/lib/components/aiEvals/EvalScorers.svelte b/frontend/src/lib/components/aiEvals/EvalScorers.svelte
index d00e52d77e..e87745887b 100644
--- a/frontend/src/lib/components/aiEvals/EvalScorers.svelte
+++ b/frontend/src/lib/components/aiEvals/EvalScorers.svelte
@@ -21,7 +21,6 @@
 		Settings,
 		Trash2
 	} from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import AddScorer from './AddScorer.svelte'
 	import { kindLabel, parseThreshold, scorerLabel, type ScorerKind } from './evalUtils'
 
@@ -304,8 +303,8 @@
 					<a
 						class="flex items-center gap-1.5 text-xs min-w-0 hover:underline w-fit"
 						href={settingsScorer.kind === 'agent'
-							? `${base}/resources?path=${settingsScorer.path}&workspace=${workspace}`
-							: `${base}/scripts/get/${settingsScorer.path}?workspace=${workspace}`}
+							? `/resources?path=${settingsScorer.path}&workspace=${workspace}`
+							: `/scripts/get/${settingsScorer.path}?workspace=${workspace}`}
 						target="_blank"
 						rel="noreferrer"
 						title={`Open ${settingsScorer.path}`}
diff --git a/frontend/src/lib/components/aiEvals/EvalsPane.svelte b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
index db765607e5..267d174f0f 100644
--- a/frontend/src/lib/components/aiEvals/EvalsPane.svelte
+++ b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { Button } from '$lib/components/common'
 	import Select from '$lib/components/select/Select.svelte'
 	import DataTable from '$lib/components/table/DataTable.svelte'
@@ -768,7 +767,7 @@
 		{#if experiment?.run_job_id}
 			<a
 				class="text-xs text-accent hover:underline inline-flex items-center gap-1 shrink-0 pb-2"
-				href={`${base}/run/${experiment.run_job_id}?workspace=${ws}`}
+				href={`/run/${experiment.run_job_id}?workspace=${ws}`}
 				target="_blank"
 			>
 				Open the job
@@ -962,7 +961,7 @@
 								{#if openRow.job_id}
 									<a
 										class="text-2xs text-accent hover:underline inline-flex items-center gap-1"
-										href={`${base}/run/${openRow.job_id}?workspace=${ws}`}
+										href={`/run/${openRow.job_id}?workspace=${ws}`}
 										target="_blank"
 									>
 										Open the case job
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/InsertRow.svelte b/frontend/src/lib/components/apps/components/display/dbtable/InsertRow.svelte
index 0483bbd272..767240a60f 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/InsertRow.svelte
+++ b/frontend/src/lib/components/apps/components/display/dbtable/InsertRow.svelte
@@ -30,6 +30,42 @@
 		nullable: 'YES' | 'NO'
 	}
 
+	// Snowflake's information_schema reports canonical names (NUMBER, TEXT,
+	// TIMESTAMP_NTZ, ...), which the pinned parser wasm only knows by a few aliases.
+	function snowflakeParserAlias(typ: string): string {
+		switch (typ) {
+			case 'number':
+			case 'decimal':
+			case 'numeric':
+			case 'float4':
+			case 'float8':
+			case 'double':
+			case 'double precision':
+			case 'real':
+				return 'float'
+			case 'integer':
+			case 'bigint':
+			case 'smallint':
+			case 'tinyint':
+			case 'byteint':
+				return 'int'
+			case 'text':
+			case 'string':
+			case 'char':
+			case 'character':
+				return 'varchar'
+			case 'varbinary':
+				return 'binary'
+			case 'datetime':
+			case 'timestamp_ntz':
+			case 'timestamp_ltz':
+			case 'timestamp_tz':
+				return 'timestamp'
+			default:
+				return typ
+		}
+	}
+
 	function parseSQLArgs(field: string, dbType: DbType): string {
 		let rawType = ''
 		switch (dbType) {
@@ -43,7 +79,7 @@
 				rawType = parse_bigquery(field)
 				break
 			case 'snowflake':
-				rawType = parse_snowflake(field)
+				rawType = parse_snowflake(snowflakeParserAlias(field.toLowerCase()))
 				break
 			case 'ms_sql_server':
 				rawType = parse_mssql(field)
@@ -97,12 +133,27 @@
 					schemaProperty.default = field.defaultValue
 				}
 			}
-			if (field.type === 'timestamp without time zone' || field.type === 'timestamp') {
+			const fieldType = dbType === 'snowflake' ? field.type.toLowerCase() : field.type
+			if (
+				fieldType === 'timestamp without time zone' ||
+				fieldType === 'timestamp' ||
+				fieldType === 'timestamp_ntz'
+			) {
 				schemaProperty.format = 'naive-date-time'
 			}
-			if (field.type === 'timestamp with time zone' || field.type === 'timestamptz') {
+			if (
+				fieldType === 'timestamp with time zone' ||
+				fieldType === 'timestamptz' ||
+				fieldType === 'timestamp_tz' ||
+				fieldType === 'timestamp_ltz'
+			) {
 				schemaProperty.format = 'date-time'
 			}
+			if (dbType === 'snowflake' && fieldType === 'date') {
+				schemaProperty.format = 'date'
+				// DateInput defaults to dd-MM-yyyy, which Snowflake's AUTO input format rejects
+				schemaProperty.dateFormat = 'yyyy-MM-dd'
+			}
 
 			properties[field.name] = schemaProperty
 
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/utils.ts b/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
index 21371aa08b..ae3a82e97c 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
+++ b/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
@@ -41,6 +41,8 @@ export type ColumnDef = {
 	children?: ColumnDef[]
 	// DBExplorer
 	ignored?: boolean
+	/** False when the column cannot be filtered on, e.g. a nested value. */
+	filterable?: boolean
 	hideInsert?: boolean
 	editable?: boolean
 	overrideDefaultValue?: boolean
diff --git a/frontend/src/lib/components/apps/components/helpers/eval.ts b/frontend/src/lib/components/apps/components/helpers/eval.ts
index bacfb65b2d..0b6bdd55db 100644
--- a/frontend/src/lib/components/apps/components/helpers/eval.ts
+++ b/frontend/src/lib/components/apps/components/helpers/eval.ts
@@ -1,7 +1,6 @@
 import type { World } from '../../rx'
 import { sendUserToast } from '$lib/toast'
 import { waitJob } from '$lib/components/waitJob'
-import { base } from '$lib/base'
 import { appNavigateSameWindow } from '../../utils'
 import { OpenAPI } from '$lib/gen/core/OpenAPI'
 
@@ -312,10 +311,10 @@ export async function eval_like(
 					params.append('s3', input.s3 ?? '')
 					if (input.storage) params.append('storage', input.storage)
 					params.append('token', OpenAPI.TOKEN)
-					const s3href = `${base}/api/w/${workspaceId}/apps_u/download_s3_file/${appPath}?${params.toString()}`
+					const s3href = `/api/w/${workspaceId}/apps_u/download_s3_file/${appPath}?${params.toString()}`
 					downloadFile(s3href, filename || input.s3)
 				} else {
-					const s3href = `${base}/api/w/${workspaceId}/job_helpers/download_s3_file?file_key=${encodeURIComponent(
+					const s3href = `/api/w/${workspaceId}/job_helpers/download_s3_file?file_key=${encodeURIComponent(
 						input?.s3 ?? ''
 					)}${input?.storage ? `&storage=${input.storage}` : ''}`
 					downloadFile(s3href, filename || input.s3)
diff --git a/frontend/src/lib/components/apps/editor/AppEditor.svelte b/frontend/src/lib/components/apps/editor/AppEditor.svelte
index 073d6c3e7d..ac0d2b1cb6 100644
--- a/frontend/src/lib/components/apps/editor/AppEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditor.svelte
@@ -86,7 +86,8 @@
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
 		onRestore,
-		onDeploy
+		onDeploy,
+		ownsPageHeader = false
 	}: AppEditorProps = $props()
 
 	migrateApp(untrack(() => app))
@@ -885,6 +886,7 @@
 {#if !$userStore?.operator}
 	{#if $appStore}
 		<AppEditorHeader
+			{ownsPageHeader}
 			{newPath}
 			{newApp}
 			{labels}
@@ -914,7 +916,7 @@
 			onHideBottomPanel={() => hideBottomPanel()}
 		/>
 		{#if $mode === 'preview'}
-			<SplitPanesWrapper class="border-t">
+			<SplitPanesWrapper>
 				<div
 					class={twMerge(
 						'h-full w-full relative',
@@ -959,7 +961,7 @@
 				</div>
 			{/if}
 
-			<SplitPanesWrapper class="border-t">
+			<SplitPanesWrapper>
 				<Splitpanes id="o1" class="max-w-full overflow-hidden">
 					<Pane bind:size={leftPanelSize} minSize={5} maxSize={33}>
 						<div
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 5ea5a804f1..f07d596baa 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -8,7 +8,7 @@
 	import { discardDraftAfterDeploy } from '$lib/userDraftToast'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
-	import { isMac, type Item, userPathPrefix } from '$lib/utils'
+	import { isMac, type Item, userPathPrefix, emptyString } from '$lib/utils'
 	import { random_adj } from '$lib/components/random_positive_adjetive'
 	import {
 		AlignHorizontalSpaceAround,
@@ -32,7 +32,7 @@
 		Zap,
 		Globe
 	} from 'lucide-svelte'
-	import { getContext, onDestroy, untrack } from 'svelte'
+	import { getContext, onDestroy, untrack, type Snippet } from 'svelte'
 	import { orderedJsonStringify, type Value, replaceFalseWithUndefined } from '../../../utils'
 	import type { App, AppEditorContext, AppViewerContext } from '../types'
 	import { toStatic } from '../utils'
@@ -52,6 +52,9 @@
 	import DebugPanel from './contextPanel/DebugPanel.svelte'
 
 	import EditorHeader from '$lib/components/EditorHeader.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
 	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
 	import { editPathFor } from '$lib/components/workspacePicker'
 	import { invalidateWorkspacePaths } from '$lib/components/PathNameAutocomplete.svelte'
@@ -114,6 +117,8 @@
 		// the deploy wrote, for the next draft's fork base, and `head` what is deployed
 		// now, with its author and time.
 		onDeploy?: (e: { version?: number; head?: number; headBy?: string; headAt?: string }) => void
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader?: boolean
 	}
 
 	let {
@@ -142,10 +147,11 @@
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
 		onRestore,
-		onDeploy
+		onDeploy,
+		ownsPageHeader = false
 	}: Props = $props()
 
-	/** Mirror of the path the user is editing in the pen popover. Initialized
+	/** Mirror of the path the user is editing in the rename popover. Initialized
 	 * once from `newPath` (or a synthesized path for new apps) and only
 	 * updated by user input from then on — we deliberately do NOT sync from
 	 * `newPath` afterwards so the user's in-flight rename isn't clobbered by
@@ -223,6 +229,18 @@
 	// the preview to the deployed version.
 	const inSessionPane = !!getContext('aiChatManager')
 
+	// The header's buttons render under the page header, not under this component, so the contexts
+	// they look up have to travel with them. The app's own two carry everything the canvas toggles,
+	// the panel buttons, Debug runs and the preview switch read.
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
+	const headerContexts = new Map<any, any>([
+		['AppViewerContext', getContext('AppViewerContext')],
+		['AppEditorContext', getContext('AppEditorContext')]
+	])
+
 	const loading = $state({
 		publish: false,
 		save: false
@@ -243,7 +261,24 @@
 
 	// Top-bar responsive collapse — container width, not viewport.
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+	// In the page header the buttons share the row with the breadcrumb, so they shed the canvas
+	// toggles and fold Debug runs into the menu sooner: the whole group is ~840px and the trail
+	// with the summary takes ~430px of the same row.
+	// Measured on the band rather than estimated: with the canvas toggles shown the actions alone
+	// are 826-911px and the trail with the summary another ~500, so the row overflows the bar at
+	// every width up to about 1470 — 1350 was not high enough either. Below this the toggles stand
+	// down and the menu carries all three, which is what keeps them reachable rather than merely
+	// out of the way.
+	const compactBelow = $derived(ownsPageHeader ? 1500 : 720)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar holds the trail and Deploy. Which panels are open, the export and the
+	// editor/preview switch join the menu compact already shows.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	function closeSaveDrawer() {
 		saveDrawerOpen = false
@@ -590,7 +625,49 @@
 								selectedJobId = $jobs[$jobs.length - 1]
 							}
 							$jobsDrawerOpen = true
-						},
+						}
+					},
+					// The canvas toggles stand down with the bar, and the breakpoint among them is the
+					// only way onto the mobile layout — so each one keeps an entry here.
+					{
+						displayName: $breakpoint === 'sm' ? 'Computer view' : 'Mobile view',
+						icon: $breakpoint === 'sm' ? Laptop2 : Smartphone,
+						action: () => ($breakpoint = $breakpoint === 'sm' ? 'lg' : 'sm')
+					},
+					// The setting the mobile view is edited for, which otherwise lives beside the
+					// toggle group that stood down: without it here a deployed app could be put on
+					// the mobile layout at this width and never taken off it.
+					...($breakpoint === 'sm'
+						? [
+								{
+									displayName: $app?.mobileViewOnSmallerScreens
+										? 'Mobile view on small screens: on'
+										: 'Mobile view on small screens: off',
+									icon: Smartphone,
+									action: () => {
+										if ($app) $app.mobileViewOnSmallerScreens = !$app.mobileViewOnSmallerScreens
+									}
+								}
+							]
+						: []),
+					{
+						displayName: $app?.fullscreen ? 'Centered canvas' : 'Full-width canvas',
+						icon: $app?.fullscreen ? AlignHorizontalSpaceAround : Expand,
+						action: () => {
+							if ($app) $app.fullscreen = !$app.fullscreen
+						}
+					},
+					{
+						displayName:
+							$app?.darkMode === undefined
+								? 'Theme: automatic'
+								: $app.darkMode
+									? 'Theme: dark'
+									: 'Theme: light',
+						icon: $app?.darkMode === undefined ? SunMoon : $app.darkMode ? Moon : Sun,
+						// Cycles auto → light → dark, the order the toggle group reads in.
+						action: () =>
+							setTheme($app?.darkMode === undefined ? false : $app.darkMode ? undefined : true),
 						separatorBottom: true
 					}
 				]
@@ -913,141 +990,232 @@
 
 <AppReportsDrawer bind:open={appReportingDrawerOpen} appPath={$appPath ?? ''} />
 
-<div
-	bind:clientWidth={topbarWidth}
-	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
->
-	<!-- Identity block shrinks/truncates first (min-w-0) so the cloud indicator
+{#if ownsPageHeader}
+	<!-- The editor's own top bar is the page header on this route: the app's path and summary are
+	     the breadcrumb's, and everything else the bar carried rides along as the header's actions. -->
+	<PageHeaderContent
+		item={{
+			// The path being edited, not the stored one: a brand-new app is parked at a
+			// `draft_<uuid>` placeholder, and the trail would name that instead of the path Deploy
+			// will create. Same fallback chain the rename sites read.
+			// Frozen while the rename popover is open so the trail holds still as the user types.
+			kind: 'app',
+			path: pathSnapshot ?? (newEditedPath || $appPath || newPath || undefined),
+			summaryContent: appSummary,
+			pathTrigger: appPathTrigger
+		}}
+		actions={appHeaderActions}
+		contexts={headerContexts}
+		separator="always"
+	/>
+{:else}
+	<div
+		bind:clientWidth={topbarWidth}
+		class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
+	>
+		<!-- Identity block shrinks/truncates first (min-w-0) so the cloud indicator
 	     and the pinned action groups (shrink-0 below) stay visible on narrow
 	     widths instead of the breadcrumb overflowing and hiding them. Kept at
 	     min-w-0 (not flex-1) so justify-between still positions the panel-hide
 	     buttons between the identity and the actions. -->
-	<div class="flex flex-row gap-2 items-center min-w-0">
-		<div class="min-w-0 overflow-hidden">
-			<EditorHeader
-				bind:summary={$summary}
-				bind:path={newEditedPath}
-				savedPath={$appPath || newPath || undefined}
-				kind="app"
-				onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
-			/>
-		</div>
-		<div class="flex gap-2 shrink-0 {compactTopbar ? 'hidden' : ''}">
-			{#if $app}
-				<ToggleButtonGroup
-					selected={$app.fullscreen ? 'true' : 'false'}
-					on:selected={({ detail }) => {
-						$app.fullscreen = detail === 'true'
-					}}
-				>
-					{#snippet children({ item })}
-						<ToggleButton
-							icon={AlignHorizontalSpaceAround}
-							iconOnly
-							value={'false'}
-							tooltip="The max width is 1168px and the content stay centered instead of taking the full page width"
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							tooltip="The width is of the app if the full width of its container"
-							icon={Expand}
-							iconOnly
-							value={'true'}
-							{item}
-							size="md"
-						/>
-					{/snippet}
-				</ToggleButtonGroup>
-			{/if}
-			{#if $app}
-				<ToggleButtonGroup
-					on:selected={({ detail }) => {
-						const theme = detail === 'dark' ? true : detail === 'sun' ? false : undefined
-						setTheme(theme)
-					}}
-					selected={$app.darkMode === undefined ? 'auto' : $app.darkMode ? 'dark' : 'sun'}
-				>
-					{#snippet children({ item })}
-						<ToggleButton
-							icon={SunMoon}
-							iconOnly
-							value={'auto'}
-							tooltip="The app mode between dark/light is automatic"
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							icon={Sun}
-							iconOnly
-							value={'sun'}
-							tooltip="Force light mode"
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							tooltip="Force dark mode"
-							icon={Moon}
-							iconOnly
-							value={'dark'}
-							{item}
-							size="md"
-						/>
-					{/snippet}
-				</ToggleButtonGroup>
-			{/if}
-			<div class="flex flex-row gap-2">
-				<ToggleButtonGroup bind:selected={$breakpoint}>
-					{#snippet children({ item })}
-						<ToggleButton
-							tooltip="Computer View"
-							icon={Laptop2}
-							iconOnly
-							value={'lg'}
-							{item}
-							size="md"
-						/>
-						<ToggleButton
-							tooltip="Mobile View"
-							icon={Smartphone}
-							iconOnly
-							value={'sm'}
-							{item}
-							size="md"
-						/>
-						{#if $breakpoint === 'sm'}
-							<Toggle
-								size="xs"
-								options={{
-									right: 'Enable mobile view for smaller screens',
-									rightTooltip:
-										'Desktop view is enabled by default. Enable this to customize the layout of the components for the mobile view'
-								}}
-								textClass="text-2xs whitespace-nowrap white !w-full"
-								bind:checked={$app.mobileViewOnSmallerScreens}
-								class="flex flex-row px-2 items-center"
-							/>
-						{/if}
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-		</div>
-		{#if $workspaceStore}
-			<div class="ml-4">
-				<AutosaveIndicator
-					workspace={$workspaceStore}
-					itemKind="app"
-					path={userDraftPath}
-					draftOnly={newApp}
-					{onResetToDeployed}
-					{loadedFromDraft}
-					{othersDraftsCount}
-					{onOpenOthersDrafts}
+		<div class="flex flex-row gap-2 items-center min-w-0">
+			<div class="min-w-0 overflow-hidden">
+				<EditorHeader
+					bind:summary={$summary}
+					bind:path={newEditedPath}
+					savedPath={$appPath || newPath || undefined}
+					kind="app"
+					onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
 				/>
 			</div>
-		{/if}
-	</div>
+			{@render canvasToggles()}
+			{@render autosaveIndicator()}
+		</div>
 
+		{@render panelButtons()}
+		{@render awarenessMark()}
+		{@render appActions()}
+	</div>
+{/if}
+
+<!-- The summary's editor again, hung off the band's path segment so it opens under the path, with
+     the cursor in the path field. `bind:` cannot be spread, so the slots are written out twice;
+     both instances bind the same ones and only one is ever open. -->
+{#snippet appPathTrigger(pathLabel: Snippet, triggerClass: string)}
+	<PathEditPopover
+		label={pathLabel}
+		{triggerClass}
+		focusField="path"
+		bind:summary={$summary}
+		bind:path={newEditedPath}
+		bind:snapshotPath={pathSnapshot}
+		savedPath={$appPath || newPath || undefined}
+		kind="app"
+	/>
+{/snippet}
+
+{#snippet appSummary()}
+	<!-- Not edited in place: clicking the name opens the summary and the path together, so the band
+	     reads as a name rather than a form. `title` for one it truncates. -->
+	<div class="flex items-center gap-1 min-w-0">
+		{#snippet summaryText()}
+			<span
+				class="min-w-0 truncate text-xs {emptyString($summary)
+					? 'text-tertiary italic font-normal'
+					: 'font-medium text-emphasis'}"
+				title={$summary}>{emptyString($summary) ? 'Add a summary...' : $summary}</span
+			>
+		{/snippet}
+		<PathEditPopover
+			label={summaryText}
+			bind:summary={$summary}
+			bind:path={newEditedPath}
+			bind:snapshotPath={pathSnapshot}
+			savedPath={$appPath || newPath || undefined}
+			kind="app"
+		/>
+	</div>
+{/snippet}
+
+{#snippet appHeaderActions()}
+	<!-- The bar's own order kept: what the canvas looks like, how the draft is doing, which panels
+	     are open, then what to do with the app. The set scrolls rather than pushing past the end of
+	     the bar — this editor carries the widest action row of any page, and the row it replaced
+	     scrolled for the same reason. -->
+	<div
+		class="flex flex-row items-center gap-2 min-w-0 overflow-x-auto scrollbar-hidden whitespace-nowrap"
+	>
+		{@render canvasToggles()}
+		{@render autosaveIndicator()}
+		{#if !phoneTopbar}
+			{@render panelButtons()}
+			{@render awarenessMark()}
+		{/if}
+		{@render appActions()}
+	</div>
+{/snippet}
+
+{#snippet canvasToggles()}
+	<div class="flex gap-2 shrink-0 {compactTopbar ? 'hidden' : ''}">
+		{#if $app}
+			<ToggleButtonGroup
+				selected={$app.fullscreen ? 'true' : 'false'}
+				on:selected={({ detail }) => {
+					$app.fullscreen = detail === 'true'
+				}}
+			>
+				{#snippet children({ item })}
+					<ToggleButton
+						icon={AlignHorizontalSpaceAround}
+						iconOnly
+						value={'false'}
+						tooltip="The max width is 1168px and the content stay centered instead of taking the full page width"
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						tooltip="The width is of the app if the full width of its container"
+						icon={Expand}
+						iconOnly
+						value={'true'}
+						{item}
+						size="md"
+					/>
+				{/snippet}
+			</ToggleButtonGroup>
+		{/if}
+		{#if $app}
+			<ToggleButtonGroup
+				on:selected={({ detail }) => {
+					const theme = detail === 'dark' ? true : detail === 'sun' ? false : undefined
+					setTheme(theme)
+				}}
+				selected={$app.darkMode === undefined ? 'auto' : $app.darkMode ? 'dark' : 'sun'}
+			>
+				{#snippet children({ item })}
+					<ToggleButton
+						icon={SunMoon}
+						iconOnly
+						value={'auto'}
+						tooltip="The app mode between dark/light is automatic"
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						icon={Sun}
+						iconOnly
+						value={'sun'}
+						tooltip="Force light mode"
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						tooltip="Force dark mode"
+						icon={Moon}
+						iconOnly
+						value={'dark'}
+						{item}
+						size="md"
+					/>
+				{/snippet}
+			</ToggleButtonGroup>
+		{/if}
+		<div class="flex flex-row gap-2">
+			<ToggleButtonGroup bind:selected={$breakpoint}>
+				{#snippet children({ item })}
+					<ToggleButton
+						tooltip="Computer View"
+						icon={Laptop2}
+						iconOnly
+						value={'lg'}
+						{item}
+						size="md"
+					/>
+					<ToggleButton
+						tooltip="Mobile View"
+						icon={Smartphone}
+						iconOnly
+						value={'sm'}
+						{item}
+						size="md"
+					/>
+					{#if $breakpoint === 'sm'}
+						<Toggle
+							size="xs"
+							options={{
+								right: 'Enable mobile view for smaller screens',
+								rightTooltip:
+									'Desktop view is enabled by default. Enable this to customize the layout of the components for the mobile view'
+							}}
+							textClass="text-2xs whitespace-nowrap white !w-full"
+							bind:checked={$app.mobileViewOnSmallerScreens}
+							class="flex flex-row px-2 items-center"
+						/>
+					{/if}
+				{/snippet}
+			</ToggleButtonGroup>
+		</div>
+	</div>
+{/snippet}
+
+{#snippet autosaveIndicator()}
+	{#if $workspaceStore}
+		<div class="ml-4">
+			<AutosaveIndicator
+				workspace={$workspaceStore}
+				itemKind="app"
+				path={userDraftPath}
+				draftOnly={newApp}
+				{onResetToDeployed}
+				{loadedFromDraft}
+				{othersDraftsCount}
+				{onOpenOthersDrafts}
+			/>
+		</div>
+	{/if}
+{/snippet}
+
+{#snippet panelButtons()}
 	{#if $mode !== 'preview'}
 		<div class="flex gap-1 shrink-0">
 			<HideButton
@@ -1085,11 +1253,17 @@
 			/>
 		</div>
 	{/if}
+{/snippet}
+
+{#snippet awarenessMark()}
 	{#if $enterpriseLicense && $appPath != '' && !inSessionPane}
 		<div class="shrink-0">
 			<Awareness />
 		</div>
 	{/if}
+{/snippet}
+
+{#snippet appActions()}
 	<div class="flex flex-row gap-2 justify-end items-center overflow-visible shrink-0">
 		<Dropdown items={moreItems} />
 
@@ -1131,14 +1305,19 @@
 				</div>
 			</Button>
 		</div>
+		<!-- Draws nothing in the bar: it is the export drawer, opened from the menu's Export
+		     entries through this instance. The preview switch keeps its place on a phone, since
+		     seeing the app is most of what an app editor is good for on one. -->
 		<AppExportButton bind:this={appExport} />
-		<PreviewToggle loading={loading.save} />
+		<PreviewToggle loading={loading.save} iconOnly={phoneTopbar} />
 		<Button
 			variant="accent"
 			loading={loading.save}
 			startIcon={{ icon: Save }}
 			on:click={save}
-			unifiedSize="md"
+			iconOnly={phoneTopbar}
+			title="Deploy"
+			unifiedSize={phoneTopbar ? 'sm' : 'md'}
 			dropdownItems={$appPath != ''
 				? () => [
 						{
@@ -1163,4 +1342,4 @@
 			Deploy
 		</Button>
 	</div>
-</div>
+{/snippet}
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
index d062247fa4..7b25dc234e 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
@@ -3,6 +3,7 @@
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { enterpriseLicense, userStore } from '$lib/stores'
+	import { useOperatorBuilderApps } from '$lib/operatorWriteRights'
 	import { Loader2 } from 'lucide-svelte'
 
 	import Tooltip from '$lib/components/Tooltip.svelte'
@@ -15,7 +16,6 @@
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import { computeSecretUrl } from './appDeploy.svelte'
-	import { base } from '$lib/base'
 	import { isCloudHosted } from '$lib/cloud'
 	import EEOnly from '$lib/components/EEOnly.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -34,6 +34,7 @@
 	const operatingWorkspaceStore = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
 	const actingUser = $derived(operatingUser.current)
+	const operatorBuilderApps = useOperatorBuilderApps()
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
 
@@ -185,7 +186,7 @@
 	let secretUrl: string | undefined = $state(undefined)
 	let secretUrlHref = $derived(secretUrl ? computeSecretUrl(secretUrl) : undefined)
 	let fullCustomUrl = $derived(
-		`${window.location.origin}${base}/a/${
+		`${window.location.origin}/a/${
 			isCloudHosted() || globalWorkspacedRoute ? opWs + '/' : ''
 		}${customPath}`
 	)
@@ -364,7 +365,7 @@
 <div class="my-6">
 	<Toggle
 		options={{ right: "Isolate the app from the viewer's browser session" }}
-		checked={policy.sandbox == true}
+		checked={$operatorBuilderApps || policy.sandbox == true}
 		on:change={(e) => {
 			policy.sandbox = e.detail || undefined
 			// Counted where the toggle is flipped rather than where the policy is
@@ -387,8 +388,13 @@
 				setPublishState(e.detail ? 'Sandbox isolation enabled' : 'Sandbox isolation disabled')
 			}
 		}}
-		disabled={!savedApp}
+		disabled={!savedApp || $operatorBuilderApps}
 	/>
+	{#if $operatorBuilderApps}
+		<div class="text-xs text-secondary mt-1">
+			Required for apps built by operators, and cannot be turned off.
+		</div>
+	{/if}
 	<div class="text-xs text-secondary mt-1">
 		Controls what the app's browser-side code can reach in each viewer's browser — distinct from the
 		on-behalf-of model above (which sets who its runnables run as). Off by default, the app's code
diff --git a/frontend/src/lib/components/apps/editor/AppReportsDrawerInner.svelte b/frontend/src/lib/components/apps/editor/AppReportsDrawerInner.svelte
index d77deb6579..672d8dd6e6 100644
--- a/frontend/src/lib/components/apps/editor/AppReportsDrawerInner.svelte
+++ b/frontend/src/lib/components/apps/editor/AppReportsDrawerInner.svelte
@@ -15,7 +15,6 @@
 		WorkspaceService
 	} from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
-	import { base } from '$lib/base'
 	import { emptyString, formatCron, sendUserToast, tryEvery } from '$lib/utils'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -644,7 +643,7 @@
 								<p class="text-clip grow min-w-0">
 									The workspace needs to be connected to Slack to use this feature. You can <a
 										target="_blank"
-										href="{base}/workspace_settings?tab=slack">configure it here</a
+										href="/workspace_settings?tab=slack">configure it here</a
 									>.
 								</p>
 								<Button
diff --git a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
index e004c17a04..2e45a3f668 100644
--- a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
+++ b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
@@ -9,31 +9,37 @@
 	 * untrusted markup/JS must not run with the member's full session — hence the
 	 * scoped embed token / opaque isolation.
 	 */
-	import { base } from '$lib/base'
 	import { sendUserToast } from '$lib/toast'
 	import PublicApp from '$lib/components/apps/editor/PublicApp.svelte'
 	import PublicAppFrame from '$lib/components/apps/editor/PublicAppFrame.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
+	import type { Item } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import { AppService, OpenAPI } from '$lib/gen'
-	import type { UserExt } from '$lib/stores'
-	import { canWrite } from '$lib/utils'
+	import { userStore, type UserExt } from '$lib/stores'
 	import { getUserExt } from '$lib/user'
-	import { Pen } from 'lucide-svelte'
+	import { ExternalLink, Pen } from 'lucide-svelte'
 	import { page } from '$app/state'
-	import {
-		setOperatingWorkspace,
-		useOperatingUser
-	} from '$lib/components/operatingWorkspace.svelte'
+	import { isMenuHidden } from '$lib/components/sessions/sessionMode.svelte'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { useEditRights } from '$lib/operatorWriteRights'
 
 	let {
 		workspace,
 		path,
 		onEdit,
 		onLoadState,
-		syncHashToUrl = true
+		syncHashToUrl = true,
+		ownsPageHeader = false
 	}: {
 		workspace: string
 		path: string
+		/** True for the route's own page: the app becomes what the page header names. A host that
+		 * renders this inside something else — a session's preview panel, whose band names the
+		 * session — leaves it false, and the app keeps its Edit over its own canvas. */
+		ownsPageHeader?: boolean
 		/** Handle Edit in place instead of following `editHref`. An AI session shows
 		 * this viewer inside a preview tab, where a plain link would navigate the whole
 		 * page out of the session rather than flipping the tab to its editor. */
@@ -48,7 +54,6 @@
 	// The app, its permission check and everything this viewer renders belong to `workspace`,
 	// which on a session preview tab is the session's and not the one the nav points at.
 	setOperatingWorkspace(() => workspace)
-	const operatingUser = useOperatingUser()
 
 	/** This workspace's membership for the viewer, which is what the app's `ctx.username` /
 	 * `ctx.groups` must describe — they sit beside `ctx.workspace` in the same object. */
@@ -62,15 +67,22 @@
 	let appPerms = $state<{ path: string; extraPerms: Record<string, boolean> } | undefined>(
 		undefined
 	)
+	const editRights = useEditRights()
 	const canWriteApp = $derived(
-		!!appPerms && canWrite(appPerms.path, appPerms.extraPerms, operatingUser.current)
+		!!appPerms && editRights.canEditItem('app', appPerms.path, appPerms.extraPerms)
 	)
 	/** Raw vs low-code, read from the app itself rather than from the route:
 	 * both kinds render here and either route serves either kind (links to a raw
 	 * app point at /apps/get all over the app), so only the app can say which
 	 * editor the Edit button must open. */
 	let isRawApp = $state(false)
-	let editHref = $derived(`${base}/${isRawApp ? 'apps_raw' : 'apps'}/edit/${path}?nodraft=true`)
+	/** The app's execution mode, from the same lite read as the permissions and for the same
+	 * reason: a sandboxed low-code app loads inside the opaque iframe, so `app` here stays
+	 * undefined and cannot say whether the app answers at a public url. `policy.execution_mode` is
+	 * where the lite payload carries it; the flat field beside it is the apps *list* row's
+	 * spelling (ListableApp, which is what AppRow reads). */
+	let executionMode = $state<string | undefined>(undefined)
+	let editHref = $derived(`/${isRawApp ? 'apps_raw' : 'apps'}/edit/${path}?nodraft=true`)
 	let refresh: (() => void) | undefined
 
 	// The opaque iframe loads the dedicated cookieless, chrome-less viewer route.
@@ -80,11 +92,16 @@
 	// page's URL (wm_embed_hash relay), and re-deriving the iframe src from them
 	// would reload the app on its every navigation.
 	const initialSearchHash = page.url.search + page.url.hash
-	let viewerUrl = $derived(`${base}/app_embed/${workspace}/${path}${initialSearchHash}`)
+	let viewerUrl = $derived(`/app_embed/${workspace}/${path}${initialSearchHash}`)
 
 	const hideEditBtn = page.url.searchParams.get('hideEditBtn') === 'true'
 	const hideRefreshBar = page.url.searchParams.get('hideRefreshBar') === 'true'
 
+	const showEdit = $derived(canWriteApp && !hideEditBtn)
+	// Decides where Edit goes, not whether it appears: without the workspace navigation there is
+	// no band to put it in. Same rule the layout hides the sidebar by.
+	const menuHidden = $derived(isMenuHidden(page.url))
+
 	// Embedder side: mint a scoped embed token (by path) from the member's session.
 	async function fetchEmbedToken(opts?: { sdkConsent?: boolean }): Promise<{ token?: string }> {
 		const headers: Record<string, string> = {}
@@ -155,48 +172,142 @@
 			const lite: any = await AppService.getAppLiteByPath({ workspace, path })
 			appPerms = { path: lite?.path ?? path, extraPerms: lite?.extra_perms ?? {} }
 			isRawApp = !!lite?.raw_app
+			executionMode = lite?.policy?.execution_mode ?? lite?.execution_mode
 		} catch (_) {
 			appPerms = undefined
 		}
 	}
 
+	/** Whether the app answers at a public url at all. Read from the app this viewer has already
+	 *  loaded, the way the apps table decides the same thing (AppRow) — the secret itself is a
+	 *  request, and asking for one on every app view to decide whether to draw a button is a
+	 *  request per view that most views never use. */
+	const hasPublicUrl = $derived(executionMode === 'anonymous')
+	/** Resolved when the button is used, not when it is drawn. */
+	async function openPublicUrl() {
+		// The tab is opened inside the click itself and filled once the secret arrives. Safari only
+		// lets a gesture open the tab it opens synchronously, so opening it after the await is
+		// blocked there — silently, since a blocked popup reports nothing.
+		const tab = window.open('about:blank', '_blank')
+		try {
+			const secret = await AppService.getPublicSecretOfApp({ workspace, path })
+			if (!secret) {
+				tab?.close()
+				sendUserToast('This app has no public url', true)
+				return
+			}
+			// Built from this viewer's workspace rather than the navigation one, like everything
+			// else here: the two differ inside a session's preview panel.
+			const url = `${window.location.origin}/public/${workspace}/${secret}`
+			if (tab) tab.location.href = url
+			else sendUserToast('Allow pop-ups for this site to open the app’s public url', true)
+		} catch (e: any) {
+			tab?.close()
+			sendUserToast('Could not open the public url: ' + (e?.body ?? e?.message ?? e), true)
+		}
+	}
+
 	$effect(() => {
 		if (workspace && path) loadPerms()
 	})
+
+	// Both of this page's buttons carry a label, and a phone's bar has room for neither beside the
+	// app's path — so below that width they become one menu. Unmeasured (0) counts as wide: the bar
+	// measures itself on mount, and starting compact would pop them out a frame later.
+	const compact = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR)
+	const compactItems: Item[] = $derived([
+		...(hasPublicUrl
+			? [
+					{
+						displayName: 'Public url',
+						icon: ExternalLink,
+						action: () => openPublicUrl()
+					}
+				]
+			: []),
+		{
+			displayName: 'Edit',
+			icon: Pen,
+			href: onEdit ? undefined : editHref,
+			action: onEdit ? () => onEdit() : undefined
+		}
+	])
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	{viewerUrl}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{app}
-			{workspace}
-			user={appUser}
-			{notExists}
-			{noPermission}
-			jwtError={false}
-			inWorkspace
-			{hideRefreshBar}
-			{syncHashToUrl}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<div class="h-full">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		{viewerUrl}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{app}
+				{workspace}
+				user={appUser ?? $userStore}
+				{notExists}
+				{noPermission}
+				jwtError={false}
+				inWorkspace
+				{hideRefreshBar}
+				{syncHashToUrl}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
 
-{#if canWriteApp && !hideEditBtn}
-	<div id="app-edit-btn" class="absolute bottom-4 z-50 right-4">
-		<Button
-			size="sm"
-			startIcon={{ icon: Pen }}
-			variant="subtle"
-			href={onEdit ? undefined : editHref}
-			on:click={() => onEdit?.()}>Edit</Button
-		>
+<!-- The band names the app for whoever opened it, write access or not: the route alone registers
+     no item, and the breadcrumb would fall back to the section name "Apps". -->
+{#if ownsPageHeader}
+	<PageHeaderContent
+		item={{ kind: 'app', path }}
+		actions={showEdit && !menuHidden ? editAction : undefined}
+		separator="always"
+	/>
+{/if}
+
+<!-- Edit is the bar's action when this viewer owns the bar, and floats over the canvas otherwise:
+     an embed has no bar — it would cost the app 44px of the iframe to carry one button — and
+     inside a session's preview panel the bar belongs to the session, so an Edit up there would
+     sit beside the session's name and act on the panel below it. -->
+{#if showEdit && (menuHidden || !ownsPageHeader)}
+	<div class="absolute bottom-4 right-4 z-50">
+		{@render editAction()}
 	</div>
 {/if}
+
+{#snippet editAction()}
+	{#if compact}
+		<!-- Too little bar to seat both: they fold into one menu rather than losing their labels,
+		     which are what say where each one goes. -->
+		<DropdownV2 items={compactItems} placement="bottom-end" size="sm" />
+	{:else}
+		{#if hasPublicUrl}
+			<!-- The app on its own, at the url anyone it is shared with uses. A new tab rather than
+			     this one: the viewer here is the same app, so replacing it would look like nothing
+			     happened. The secret is fetched by the click, so the url exists only once asked for. -->
+			<Button
+				unifiedSize="sm"
+				variant="subtle"
+				startIcon={{ icon: ExternalLink }}
+				onclick={openPublicUrl}
+				title="Open the app's public url in a new tab">Public url</Button
+			>
+		{/if}
+		<!-- `onEdit` wins over the href: a host that embeds this viewer opens its own editor rather
+		     than navigating the frame to one. -->
+		<Button
+			unifiedSize="sm"
+			startIcon={{ icon: Pen }}
+			variant="default"
+			href={onEdit ? undefined : editHref}
+			on:click={() => onEdit?.()}
+			title="Edit this app"
+			id="app-edit-btn">Edit</Button
+		>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/apps/editor/PreviewToggle.svelte b/frontend/src/lib/components/apps/editor/PreviewToggle.svelte
index 7a72ac62b3..4e20301043 100644
--- a/frontend/src/lib/components/apps/editor/PreviewToggle.svelte
+++ b/frontend/src/lib/components/apps/editor/PreviewToggle.svelte
@@ -8,9 +8,11 @@
 
 	interface Props {
 		loading?: boolean
+		/** Drops the two labels, for a bar with no room for them: the pen and the eye carry it. */
+		iconOnly?: boolean
 	}
 
-	let { loading = false }: Props = $props()
+	let { loading = false, iconOnly = false }: Props = $props()
 
 	const { mode, jobs, jobsById } = getContext<AppViewerContext>('AppViewerContext')
 </script>
@@ -24,7 +26,8 @@
 >
 	{#snippet children({ item })}
 		<ToggleButton
-			label="Editor"
+			label={iconOnly ? undefined : 'Editor'}
+			tooltip={iconOnly ? 'Editor mode' : undefined}
 			value="dnd"
 			icon={Pen}
 			disabled={loading}
@@ -33,7 +36,7 @@
 			{item}
 		/>
 		<ToggleButton
-			label="Preview"
+			label={iconOnly ? undefined : 'Preview'}
 			value="preview"
 			icon={Eye}
 			tooltip="Preview mode"
diff --git a/frontend/src/lib/components/apps/editor/PublicApp.svelte b/frontend/src/lib/components/apps/editor/PublicApp.svelte
index 58b6eaf838..64da63e727 100644
--- a/frontend/src/lib/components/apps/editor/PublicApp.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicApp.svelte
@@ -1,28 +1,15 @@
 <script lang="ts">
 	import { applyDarkModeVariant } from '$lib/darkModeVariant'
-	import { enterpriseLicense, userStore, type UserExt } from '$lib/stores'
-	import { base } from '$app/paths'
-	import { page } from '$app/state'
-	import Login from '$lib/components/Login.svelte'
+	import type { UserExt } from '$lib/stores'
 	import { isCloudHosted } from '$lib/cloud'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import WindmillIcon from '$lib/components/icons/WindmillIcon.svelte'
-	import { getContext, setContext } from 'svelte'
-	import {
-		EMBED_NAV_CONTEXT_KEY,
-		IS_APP_PUBLIC_CONTEXT_KEY,
-		type EditorBreakpoint,
-		type EmbedNav
-	} from '../types'
-	import { UserService, type AppWithLastVersion, type GlobalWhoamiResponse } from '$lib/gen'
-	import { urlParamsToObject } from '$lib/utils'
-	import { goto } from '$app/navigation'
-	import { loadAppPreview } from './loadAppPreview'
+	import { setContext } from 'svelte'
+	import { IS_APP_PUBLIC_CONTEXT_KEY } from '../types'
+	import type { AppWithLastVersion } from '$lib/gen/types.gen'
 	import RawAppPreview from '$lib/components/raw_apps/RawAppPreview.svelte'
 	import type { Runnable } from '$lib/components/raw_apps/rawAppPolicy'
-	import { twMerge } from 'tailwind-merge'
-	import { writable } from 'svelte/store'
+	import { loadAppCss } from './publicAppApi'
 
 	let {
 		notExists,
@@ -33,6 +20,7 @@
 		app,
 		workspace,
 		user = undefined,
+		license = undefined,
 		inWorkspace = false,
 		hideRefreshBar = false,
 		syncHashToUrl = true
@@ -46,11 +34,13 @@
 		onLoginSuccess: () => void
 		app: (AppWithLastVersion & { value: any; workspace_id?: string }) | undefined
 		workspace: string | undefined
-		/** The viewer's membership in `workspace`, for the app's `ctx`. Without it `ctx` falls
-		 * back to `userStore`, which describes the workspace the page is navigated to — the
-		 * same one on every standalone viewer route, but not inside an AI session's preview
-		 * tab, where the app belongs to the session's workspace. */
+		/** The viewer's membership in `workspace`, for the app's `ctx`. Callers pass it
+		 * explicitly — `$userStore` describes the workspace the page is navigated to, which
+		 * is not the app's inside an AI session's preview tab. */
 		user?: UserExt | undefined
+		/** The instance license, which fades the "Powered by" badge and lets a low-code app's
+		 * custom CSS apply. */
+		license?: string | undefined
 		/**
 		 * In-workspace rendering (`/apps/get`, `/app_embed`): keep exact parity
 		 * with the pre-sandbox member viewer — no "Powered by Windmill" badge, no
@@ -65,23 +55,11 @@
 	// Use workspace from props or from app.workspace_id (for custom path responses)
 	let effectiveWorkspace = $derived(workspace ?? app?.workspace_id)
 
-	// `ctx.username` / `ctx.groups` are per-workspace, and they sit next to `ctx.workspace`
-	// in the same object, so they have to come from the same workspace it names.
-	let ctxUser = $derived(user ?? $userStore)
-
 	// On the public surfaces (untrusted distribution) runnable-authored html/svg needs
 	// the viewer's approval before it renders, unless the app sandbox isolates it. The
 	// in-workspace viewer renders it verbatim. See getAppMarkupTrust.
 	setContext(IS_APP_PUBLIC_CONTEXT_KEY, !inWorkspace)
 
-	// WIN-2006: inside the opaque viewer iframe, navigations to other routes
-	// (navbar "app" items) must happen on the TOP page — the iframe is cookieless,
-	// so navigating it would just show a login screen. PublicAppFrame provides the
-	// relay; outside the opaque viewer this is undefined and goto works directly.
-	const embedNav = getContext<EmbedNav | undefined>(EMBED_NAV_CONTEXT_KEY)
-
-	const breakpoint = writable<EditorBreakpoint>('lg')
-
 	const darkMode =
 		window.localStorage.getItem('dark-mode') ??
 		(window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light')
@@ -93,135 +71,75 @@
 	}
 	// This route bypasses the (root) layout, so restore the variant class too.
 	applyDarkModeVariant()
-
-	let globalUser = $state<GlobalWhoamiResponse | undefined>(undefined)
-	async function loadGlobalUser() {
-		try {
-			globalUser = await UserService.globalWhoami()
-		} catch (error) {
-			console.error(error)
-		}
-		// const user = await fetch('/api/global/user')
-		// console.log(user)
-	}
-
-	// Only the no-access page reads it, to tell a signed-in non-member which
-	// workspace the app belongs to.
-	$effect(() => {
-		if (noPermission && !guestAppPath && !$userStore && !globalUser) {
-			loadGlobalUser()
-		}
-	})
 </script>
 
+<!-- Only the raw-app branch is imported statically: everything else waits for app.css and
+     its own chunk, see publicAppApi.ts. -->
 {#if !inWorkspace}
-	<div
-		class="z-50 text-xs fixed bottom-1 right-2 {$enterpriseLicense && !isCloudHosted()
-			? 'transition-opacity delay-1000 duration-1000 opacity-20 hover:delay-0 hover:opacity-100'
-			: ''}"
-	>
-		<a href="https://windmill.dev" class="whitespace-nowrap text-primary inline-flex items-center"
-			>Powered by &nbsp;<WindmillIcon />&nbsp;Windmill</a
+	{#await loadAppCss() then}
+		<div
+			class="z-50 text-xs fixed bottom-1 right-2 {license && !isCloudHosted()
+				? 'transition-opacity delay-1000 duration-1000 opacity-20 hover:delay-0 hover:opacity-100'
+				: ''}"
 		>
-	</div>
+			<a href="https://windmill.dev" class="whitespace-nowrap text-primary inline-flex items-center"
+				>Powered by &nbsp;<WindmillIcon />&nbsp;Windmill</a
+			>
+		</div>
+	{/await}
 {/if}
 
-{#if notExists}
-	<div class="px-4 mt-20"
-		><Alert type="error" title="Not found"
-			>There was an error loading the app, is the url correct? <a href={base}>Go to Windmill</a>
-		</Alert></div
-	>
-{:else if noPermission}
-	{#if guestAppPath && !$userStore}
-		<div class="px-4 mt-20 w-full text-center font-bold text-xl"> Sign in to open this app </div>
-		<div class="text-center mt-8 text-sm text-primary">
-			You do not need a Windmill account. Signing in lets you open this app and nothing else.
-		</div>
-	{:else}
-		<div class="px-4 mt-20 w-full text-center font-bold text-xl">
-			This app requires read access
-		</div>
-		<div class="text-center mt-8 text-sm text-primary">
-			{#if $userStore}You are logged in but have no read access to this app{:else if globalUser && effectiveWorkspace}
-				You are logged in but are not a member of the workspace <span class="text-xl font-bold"
-					>{effectiveWorkspace}</span
-				> this app is part of
-			{:else}You must be logged in and have read access to this app{/if}</div
-		>
-	{/if}
-	<div class="px-2 mx-auto mt-20 max-w-xl w-full">
-		{#if !jwtError}
-			<Login
-				{onLoginSuccess}
-				popup
-				guestApp={guestAppPath}
-				rd={page.url.pathname + page.url.search + page.url.hash}
-			/>
-		{/if}
-	</div>
+{#if notExists || noPermission}
+	{#await Promise.all([loadAppCss(), import('./PublicAppAccess.svelte')]) then [, { default: PublicAppAccess }]}
+		<PublicAppAccess
+			{notExists}
+			{jwtError}
+			{guestAppPath}
+			{user}
+			workspace={effectiveWorkspace}
+			{onLoginSuccess}
+		/>
+	{/await}
 {:else if app}
 	{#key app}
 		{#if app.raw_app && effectiveWorkspace}
-			<RawAppPreview
-				workspace={effectiveWorkspace}
-				user={ctxUser}
-				secret={app.bundle_secret}
-				path={app.path}
-				runnables={(app.value?.runnables ?? {}) as Record<string, Runnable>}
-				{syncHashToUrl}
-			/>
+			<!-- The bundle's iframe is full-height, so every host has to give this box a height to
+			     resolve against: in the workspace the layout hands one down, and the share, embed
+			     and custom-path routes floor themselves at the viewport. An iframe with no height
+			     above it falls back to 150px. Styled inline: app.css may not be loaded here. -->
+			<div style="height: 100%; width: 100%">
+				<RawAppPreview
+					workspace={effectiveWorkspace}
+					{user}
+					secret={app.bundle_secret}
+					path={app.path}
+					runnables={(app.value?.runnables ?? {}) as Record<string, Runnable>}
+					{syncHashToUrl}
+				/>
+			</div>
 		{:else if app.raw_app && !effectiveWorkspace}
-			<div class="px-4 mt-20">
-				<Alert type="error" title="Configuration error">
-					Unable to load raw app: workspace information is missing.
-				</Alert>
-			</div>
+			{#await Promise.all([loadAppCss(), import('$lib/components/common/alert/Alert.svelte')]) then [, { default: Alert }]}
+				<div class="px-4 mt-20">
+					<Alert type="error" title="Configuration error">
+						Unable to load raw app: workspace information is missing.
+					</Alert>
+				</div>
+			{/await}
 		{:else}
-			<div
-				class={twMerge(
-					// `flex-col` matches the pre-sandbox in-workspace viewer exactly;
-					// the public viewer always used a plain `flex` wrapper.
-					inWorkspace
-						? 'min-h-screen h-full w-full flex flex-col'
-						: 'min-h-screen h-full w-full flex',
-					app?.value?.['css']?.['app']?.['viewer']?.class,
-					'wm-app-viewer'
-				)}
-				style={app?.value?.['css']?.['app']?.['viewer']?.style}
-			>
-				{#await loadAppPreview()}
-					<Skeleton layout={[[4], 0.5, [50]]} />
-				{:then Module}
-					<Module.default
-						noBackend={false}
-						{hideRefreshBar}
-						context={{
-							email: ctxUser?.email,
-							name: ctxUser?.name,
-							groups: ctxUser?.groups,
-							username: ctxUser?.username,
-							query: urlParamsToObject(page.url.searchParams, { stripReserved: true }),
-							hash: page.url.hash.substring(1)
-						}}
-						workspace={effectiveWorkspace}
-						summary={app.summary}
-						app={app.value}
-						appPath={app.path}
-						{breakpoint}
-						policy={app.policy}
-						isEditor={false}
-						replaceStateFn={(path) => goto(path)}
-						gotoFn={(path, opt) => (embedNav ? embedNav.navigateTop(path) : goto(path, opt))}
-					/>
-				{:catch}
-					<div class="px-4 mt-20 w-full">
-						<Alert type="error" title="Could not load the app">Reload the page to try again.</Alert>
-					</div>
-				{/await}
-			</div>
+			{#await Promise.all([loadAppCss(), import('./PublicLowCodeApp.svelte')]) then [, { default: PublicLowCodeApp }]}
+				<PublicLowCodeApp
+					{app}
+					workspace={effectiveWorkspace}
+					{user}
+					{license}
+					{inWorkspace}
+					{hideRefreshBar}
+				/>
+			{/await}
 		{/if}
 	{/key}
 {:else}
-	<Skeleton layout={[[4], 0.5, [50]]} />
+	{#await loadAppCss() then}
+		<Skeleton layout={[[4], 0.5, [50]]} />
+	{/await}
 {/if}
diff --git a/frontend/src/lib/components/apps/editor/PublicAppAccess.svelte b/frontend/src/lib/components/apps/editor/PublicAppAccess.svelte
new file mode 100644
index 0000000000..5e1d80b893
--- /dev/null
+++ b/frontend/src/lib/components/apps/editor/PublicAppAccess.svelte
@@ -0,0 +1,80 @@
+<script lang="ts">
+	import { page } from '$app/state'
+	import Login from '$lib/components/Login.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { UserService, type GlobalWhoamiResponse } from '$lib/gen'
+	import type { UserExt } from '$lib/stores'
+	import { dropPrefetched } from './publicAppApi'
+
+	let {
+		notExists,
+		jwtError,
+		guestAppPath,
+		user,
+		workspace,
+		onLoginSuccess
+	}: {
+		notExists: boolean
+		jwtError: boolean
+		guestAppPath: string | undefined
+		user: UserExt | undefined
+		workspace: string | undefined
+		onLoginSuccess: () => void
+	} = $props()
+
+	let globalUser = $state<GlobalWhoamiResponse | undefined>(undefined)
+	async function loadGlobalUser() {
+		try {
+			globalUser = await UserService.globalWhoami()
+		} catch (error) {
+			console.error(error)
+		}
+	}
+
+	// Only the no-access page reads it, to tell a signed-in non-member which
+	// workspace the app belongs to.
+	$effect(() => {
+		if (!notExists && !guestAppPath && !user && !globalUser) {
+			loadGlobalUser()
+		}
+	})
+</script>
+
+{#if notExists}
+	<div class="px-4 mt-20"
+		><Alert type="error" title="Not found"
+			>There was an error loading the app, is the url correct? <a href="/">Go to Windmill</a>
+		</Alert></div
+	>
+{:else}
+	{#if guestAppPath && !user}
+		<div class="px-4 mt-20 w-full text-center font-bold text-xl"> Sign in to open this app </div>
+		<div class="text-center mt-8 text-sm text-primary">
+			You do not need a Windmill account. Signing in lets you open this app and nothing else.
+		</div>
+	{:else}
+		<div class="px-4 mt-20 w-full text-center font-bold text-xl">
+			This app requires read access
+		</div>
+		<div class="text-center mt-8 text-sm text-primary">
+			{#if user}You are logged in but have no read access to this app{:else if globalUser && workspace}
+				You are logged in but are not a member of the workspace <span class="text-xl font-bold"
+					>{workspace}</span
+				> this app is part of
+			{:else}You must be logged in and have read access to this app{/if}</div
+		>
+	{/if}
+	<div class="px-2 mx-auto mt-20 max-w-xl w-full">
+		{#if !jwtError}
+			<Login
+				onLoginSuccess={() => {
+					dropPrefetched()
+					onLoginSuccess()
+				}}
+				popup
+				guestApp={guestAppPath}
+				rd={page.url.pathname + page.url.search + page.url.hash}
+			/>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte b/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
index e994767488..eacb3652e1 100644
--- a/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
@@ -23,19 +23,42 @@
 	 * bearer token (no cookie); the raw wrapper document always carries `CSP: sandbox`.
 	 */
 	import { BROWSER } from 'esm-env'
-	import { OpenAPI, UserService } from '$lib/gen'
+	import { OpenAPI } from '$lib/gen/core/OpenAPI'
 	import { page } from '$app/state'
 	import { onDestroy, onMount, setContext, type Snippet } from 'svelte'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
-	import { base } from '$app/paths'
 	import { goto } from '$app/navigation'
-	import Login from '$lib/components/Login.svelte'
-	import { WINDMILL_RESERVED_QUERY_PARAMS } from '$lib/utils'
+	import { WINDMILL_RESERVED_QUERY_PARAMS } from '$lib/utils/queryParams'
 	import { EMBED_NAV_CONTEXT_KEY, type EmbedNav } from '../types'
 	import { loadAppPreview } from './loadAppPreview'
-	import RawAppSdkConsent from '$lib/components/raw_apps/RawAppSdkConsent.svelte'
-	import { hasStoredSdkConsent, storeSdkConsent } from '$lib/components/raw_apps/sdkScopes'
+	import { dropPrefetched, loadAppCss } from './publicAppApi'
+	import {
+		hasStoredSdkConsent,
+		sdkConsentCovers,
+		storeSdkConsent
+	} from '$lib/components/raw_apps/sdkScopes'
+
+	// Everything but a rendered app (sign-in, errors, the SDK consent prompt) loads on
+	// demand: a raw app that renders right away needs none of it. See publicAppApi.ts.
+	let frameUi:
+		| Promise<{
+				Alert: typeof import('$lib/components/common/alert/Alert.svelte').default
+				Login: typeof import('$lib/components/Login.svelte').default
+				RawAppSdkConsent: typeof import('$lib/components/raw_apps/RawAppSdkConsent.svelte').default
+		  }>
+		| undefined
+	function loadFrameUi() {
+		return (frameUi ??= Promise.all([
+			loadAppCss(),
+			import('$lib/components/common/alert/Alert.svelte'),
+			import('$lib/components/Login.svelte'),
+			import('$lib/components/raw_apps/RawAppSdkConsent.svelte')
+		]).then(([, alert, login, consent]) => ({
+			Alert: alert.default,
+			Login: login.default,
+			RawAppSdkConsent: consent.default
+		})))
+	}
 
 	type EmbedToken = {
 		token?: string | null
@@ -231,7 +254,8 @@
 		if (offerSignIn && accountSession === 'unknown') {
 			// Workspace-less, so it answers for an account and never for a guest
 			// (pinned to its workspace) or for nobody.
-			UserService.getCurrentEmail()
+			import('$lib/gen')
+				.then(({ UserService }) => UserService.getCurrentEmail())
 				.then(() => (accountSession = 'held'))
 				.catch(() => (accountSession = 'none'))
 		}
@@ -245,8 +269,12 @@
 	let staleGuestLogoutFailed = $state(false)
 	$effect(() => {
 		if (deniedStatus === 403 && guestEntry === 'guest' && !staleGuestCleared) {
-			UserService.logout()
-				.then(() => (staleGuestCleared = true))
+			import('$lib/gen')
+				.then(({ UserService }) => UserService.logout())
+				.then(() => {
+					dropPrefetched()
+					staleGuestCleared = true
+				})
 				.catch(() => (staleGuestLogoutFailed = true))
 		}
 	})
@@ -388,7 +416,7 @@
 			appPath = resp.app_path ?? appPath
 			workspaceId = resp.workspace_id ?? workspaceId
 			const granted = resp.sdk_scopes ?? []
-			if (!granted.every((s) => approved.includes(s))) {
+			if (!sdkConsentCovers(approved, granted)) {
 				// The app was redeployed with more scopes between the prompt and the
 				// mint. Never inject a token carrying scopes the viewer wasn't shown:
 				// drop it and ask again with the new set.
@@ -423,7 +451,10 @@
 			// Render the app directly on this origin: same-origin when unsandboxed
 			// (the default), or a single opaque bundle iframe when it's a sandboxed
 			// raw app. A low-code app's runtime downloads alongside the app payload.
-			if (!isRaw) loadAppPreview().catch(() => {})
+			if (!isRaw) {
+				loadAppCss().catch(() => {})
+				loadAppPreview().catch(() => {})
+			}
 			onViewerReady?.(undefined, requestTokenRefresh)
 		} else {
 			// Sandboxed low-code: hand the scoped token to the opaque viewer iframe.
@@ -533,6 +564,7 @@
 	onMount(() => {
 		if (isViewer) {
 			// Only a sandboxed low-code app is ever framed as a viewer.
+			loadAppCss().catch(() => {})
 			loadAppPreview().catch(() => {})
 			window.addEventListener('message', handleViewerMessage)
 			installHashRelay()
@@ -565,105 +597,120 @@
 	{#if viewerReady}
 		{@render viewer()}
 	{:else if viewerOrphaned}
-		<div class="px-4 mt-20 max-w-xl mx-auto">
-			<Alert type="info" title="Open this app from Windmill">
-				This is a Windmill app viewer and must be loaded by Windmill. If you embedded it in your own
-				page, use the app's public URL without the <code>wm_embed</code> parameter.
-			</Alert>
-		</div>
+		{#await loadFrameUi() then { Alert }}
+			<div class="px-4 mt-20 max-w-xl mx-auto">
+				<Alert type="info" title="Open this app from Windmill">
+					This is a Windmill app viewer and must be loaded by Windmill. If you embedded it in your
+					own page, use the app's public URL without the <code>wm_embed</code> parameter.
+				</Alert>
+			</div>
+		{/await}
 	{:else}
-		<Skeleton layout={[[4], 0.5, [50]]} />
+		{#await loadAppCss() then}
+			<Skeleton layout={[[4], 0.5, [50]]} />
+		{/await}
 	{/if}
 {:else if status === 'loading'}
-	<Skeleton layout={[[4], 0.5, [50]]} />
-{:else if status === 'notExists' && !offerSignIn}
-	<div class="px-4 mt-20">
-		<Alert type="error" title="Not found">
-			There was an error loading the app, is the url correct?
-			<a href={base}>Go to Windmill</a>
-		</Alert>
-	</div>
-{:else if status === 'sdkPrompt'}
-	<!-- Raw-app frontend SDK: ask before the app's code runs, so the viewer sees
-	     what it will be able to do with their identity. -->
-	<RawAppSdkConsent
-		scopes={sdkScopes ?? []}
-		onContinue={onSdkConsentContinue}
-		onDecline={onSdkConsentDecline}
-	/>
-{:else if offerSignIn && (guestEntry === 'pending' || accountSession === 'unknown' || (deniedStatus === 403 && guestEntry === 'guest' && !staleGuestCleared && !staleGuestLogoutFailed))}
-	<Skeleton layout={[[4], 0.5, [50]]} />
-{:else if offerSignIn && (guestEntry === 'error' || staleGuestLogoutFailed)}
-	<div class="px-4 mt-20">
-		<Alert type="error" title="Could not check access">
-			The app could not be reached to find out who may open it. Reload to try again.
-		</Alert>
-	</div>
-{:else if offerSignIn}
-	<!-- Login happens here, on the embedder (main) window, so the session cookie
-	     is set on the main origin only and never reaches the opaque iframe. -->
-	{#if signInDidNotHelp}
-		<!-- Offering the same sign-in again would loop: they are signed in, and this
-		     app still will not open for them. Say why and stop. -->
-		<div class="px-4 mt-20 w-full text-center font-bold text-xl">
-			You are signed in, but this app is not open to you
-		</div>
-		<div class="text-center mt-8 text-sm text-primary">
-			It is open to the people it was shared with{guestAppPath
-				? ', and to guests who have no Windmill account'
-				: ''}. Ask the person who shared it to give your account access.
-		</div>
+	{#await loadAppCss() then}
+		<Skeleton layout={[[4], 0.5, [50]]} />
+	{/await}
+{:else if status === 'ready'}
+	{#if unsandboxed}
+		<!-- Same-origin (full session): the app was not opted into sandbox isolation
+		     (the default). Rendered directly here; RawAppPreview reads
+		     IS_APP_UNSANDBOXED to drop the bundle's opaque sandbox. -->
+		{@render viewer()}
+	{:else if isRaw}
+		<!-- Variant A: sandboxed raw app rendered directly on the real origin. The
+		     untrusted author bundle stays isolated in its own opaque iframe (inside
+		     RawAppPreview); no opaque viewer and no embed token are needed. -->
+		{@render viewer()}
 	{:else}
-		{#if guestAppPath}
-			<div class="px-4 mt-20 w-full text-center font-bold text-xl">Sign in to open this app</div>
-			<div class="text-center mt-8 text-sm text-primary">
-				You do not need a Windmill account. Signing in lets you open this app and nothing else.
-			</div>
-		{:else}
-			<div class="px-4 mt-20 w-full text-center font-bold text-xl">
-				This app requires read access
-			</div>
-		{/if}
-		{#if signInError}
-			<div class="px-2 mx-auto mt-8 max-w-xl w-full">
-				<Alert type="error" title="Could not sign you in">{signInError}</Alert>
-			</div>
-		{/if}
-		<div class="px-2 mx-auto mt-20 max-w-xl w-full">
-			<Login
-				onLoginSuccess={() => {
-					signInError = undefined
-					accountSession = 'unknown'
-					initEmbedder()
-				}}
-				onLoginError={(message) => (signInError = message)}
-				popup
-				guestApp={guestAppPath}
-				rd={page.url.pathname + page.url.search + page.url.hash}
-			/>
-		</div>
+		<!-- referrerpolicy: the embedder page URL can carry a viewer credential (the
+		     JWT path segment of share links); without this, the same-origin iframe
+		     navigation would expose it to app-authored code via document.referrer.
+		     Styled inline: it can render before app.css has loaded. -->
+		<iframe
+			bind:this={iframeEl}
+			src={buildViewerUrl()}
+			title="App"
+			style="display: block; width: 100%; height: 100%; border: 0"
+			sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation"
+			allow="clipboard-read; clipboard-write; fullscreen"
+			referrerpolicy="no-referrer"
+		></iframe>
 	{/if}
-{:else if unsandboxed}
-	<!-- Same-origin (full session): the app was not opted into sandbox isolation
-	     (the default). Rendered directly here; RawAppPreview reads
-	     IS_APP_UNSANDBOXED to drop the bundle's opaque sandbox. -->
-	{@render viewer()}
-{:else if isRaw}
-	<!-- Variant A: sandboxed raw app rendered directly on the real origin. The
-	     untrusted author bundle stays isolated in its own opaque iframe (inside
-	     RawAppPreview); no opaque viewer and no embed token are needed. -->
-	{@render viewer()}
 {:else}
-	<!-- referrerpolicy: the embedder page URL can carry a viewer credential (the
-	     JWT path segment of share links); without this, the same-origin iframe
-	     navigation would expose it to app-authored code via document.referrer. -->
-	<iframe
-		bind:this={iframeEl}
-		src={buildViewerUrl()}
-		title="App"
-		class="w-full h-screen border-0 block"
-		sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation"
-		allow="clipboard-read; clipboard-write; fullscreen"
-		referrerpolicy="no-referrer"
-	></iframe>
+	{#await loadFrameUi() then { Alert, Login, RawAppSdkConsent }}
+		{#if status === 'notExists' && !offerSignIn}
+			<div class="px-4 mt-20">
+				<Alert type="error" title="Not found">
+					There was an error loading the app, is the url correct?
+					<a href="/">Go to Windmill</a>
+				</Alert>
+			</div>
+		{:else if status === 'sdkPrompt'}
+			<!-- Raw-app frontend SDK: ask before the app's code runs, so the viewer sees
+	     what it will be able to do with their identity. -->
+			<RawAppSdkConsent
+				scopes={sdkScopes ?? []}
+				onContinue={onSdkConsentContinue}
+				onDecline={onSdkConsentDecline}
+			/>
+		{:else if offerSignIn && (guestEntry === 'pending' || accountSession === 'unknown' || (deniedStatus === 403 && guestEntry === 'guest' && !staleGuestCleared && !staleGuestLogoutFailed))}
+			<Skeleton layout={[[4], 0.5, [50]]} />
+		{:else if offerSignIn && (guestEntry === 'error' || staleGuestLogoutFailed)}
+			<div class="px-4 mt-20">
+				<Alert type="error" title="Could not check access">
+					The app could not be reached to find out who may open it. Reload to try again.
+				</Alert>
+			</div>
+		{:else if offerSignIn}
+			<!-- Login happens here, on the embedder (main) window, so the session cookie
+	     is set on the main origin only and never reaches the opaque iframe. -->
+			{#if signInDidNotHelp}
+				<!-- Offering the same sign-in again would loop: they are signed in, and this
+		     app still will not open for them. Say why and stop. -->
+				<div class="px-4 mt-20 w-full text-center font-bold text-xl">
+					You are signed in, but this app is not open to you
+				</div>
+				<div class="text-center mt-8 text-sm text-primary">
+					It is open to the people it was shared with{guestAppPath
+						? ', and to guests who have no Windmill account'
+						: ''}. Ask the person who shared it to give your account access.
+				</div>
+			{:else}
+				{#if guestAppPath}
+					<div class="px-4 mt-20 w-full text-center font-bold text-xl">Sign in to open this app</div
+					>
+					<div class="text-center mt-8 text-sm text-primary">
+						You do not need a Windmill account. Signing in lets you open this app and nothing else.
+					</div>
+				{:else}
+					<div class="px-4 mt-20 w-full text-center font-bold text-xl">
+						This app requires read access
+					</div>
+				{/if}
+				{#if signInError}
+					<div class="px-2 mx-auto mt-8 max-w-xl w-full">
+						<Alert type="error" title="Could not sign you in">{signInError}</Alert>
+					</div>
+				{/if}
+				<div class="px-2 mx-auto mt-20 max-w-xl w-full">
+					<Login
+						onLoginSuccess={() => {
+							dropPrefetched()
+							signInError = undefined
+							accountSession = 'unknown'
+							initEmbedder()
+						}}
+						onLoginError={(message) => (signInError = message)}
+						popup
+						guestApp={guestAppPath}
+						rd={page.url.pathname + page.url.search + page.url.hash}
+					/>
+				</div>
+			{/if}
+		{/if}
+	{/await}
 {/if}
diff --git a/frontend/src/lib/components/apps/editor/PublicLowCodeApp.svelte b/frontend/src/lib/components/apps/editor/PublicLowCodeApp.svelte
new file mode 100644
index 0000000000..f74be67166
--- /dev/null
+++ b/frontend/src/lib/components/apps/editor/PublicLowCodeApp.svelte
@@ -0,0 +1,91 @@
+<script lang="ts">
+	import { goto } from '$app/navigation'
+	import { page } from '$app/state'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
+	import type { AppWithLastVersion } from '$lib/gen'
+	import { enterpriseLicense, userStore, type UserExt } from '$lib/stores'
+	import { urlParamsToObject } from '$lib/utils'
+	import { getContext } from 'svelte'
+	import { writable } from 'svelte/store'
+	import { twMerge } from 'tailwind-merge'
+	import { EMBED_NAV_CONTEXT_KEY, type EditorBreakpoint, type EmbedNav } from '../types'
+	import { loadAppPreview } from './loadAppPreview'
+
+	let {
+		app,
+		workspace,
+		user,
+		license,
+		inWorkspace,
+		hideRefreshBar
+	}: {
+		app: AppWithLastVersion & { value: any }
+		workspace: string | undefined
+		user: UserExt | undefined
+		license: string | undefined
+		inWorkspace: boolean
+		hideRefreshBar: boolean
+	} = $props()
+
+	// The public routes hold the viewer and license as props, while low-code components
+	// read them from the stores (the license gates the app's custom CSS, for one).
+	$effect(() => {
+		if (inWorkspace) return
+		userStore.set(user)
+		if (license) enterpriseLicense.set(license)
+	})
+
+	// WIN-2006: inside the opaque viewer iframe, navigations to other routes
+	// (navbar "app" items) must happen on the TOP page — the iframe is cookieless,
+	// so navigating it would just show a login screen. PublicAppFrame provides the
+	// relay; outside the opaque viewer this is undefined and goto works directly.
+	const embedNav = getContext<EmbedNav | undefined>(EMBED_NAV_CONTEXT_KEY)
+
+	const breakpoint = writable<EditorBreakpoint>('lg')
+</script>
+
+<div
+	class={twMerge(
+		// `flex-col` matches the pre-sandbox in-workspace viewer exactly;
+		// the public viewer always used a plain `flex` wrapper. `min-h-full`, not
+		// `h-full`: the box has to reach the bottom of what the host gives it so the
+		// app's own background covers the window, and still grow with a grid taller
+		// than that. A viewport floor instead would overhang the page box by the
+		// height of the page header band.
+		inWorkspace ? 'min-h-full w-full flex flex-col' : 'min-h-full w-full flex',
+		app?.value?.['css']?.['app']?.['viewer']?.class,
+		'wm-app-viewer'
+	)}
+	style={app?.value?.['css']?.['app']?.['viewer']?.style}
+>
+	{#await loadAppPreview()}
+		<Skeleton layout={[[4], 0.5, [50]]} />
+	{:then Module}
+		<Module.default
+			noBackend={false}
+			{hideRefreshBar}
+			context={{
+				email: user?.email,
+				name: user?.name,
+				groups: user?.groups,
+				username: user?.username,
+				query: urlParamsToObject(page.url.searchParams, { stripReserved: true }),
+				hash: page.url.hash.substring(1)
+			}}
+			{workspace}
+			summary={app.summary}
+			app={app.value}
+			appPath={app.path}
+			{breakpoint}
+			policy={app.policy}
+			isEditor={false}
+			replaceStateFn={(path) => goto(path)}
+			gotoFn={(path, opt) => (embedNav ? embedNav.navigateTop(path) : goto(path, opt))}
+		/>
+	{:catch}
+		<div class="px-4 mt-20 w-full">
+			<Alert type="error" title="Could not load the app">Reload the page to try again.</Alert>
+		</div>
+	{/await}
+</div>
diff --git a/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts b/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts
index f799cb864a..5c22e3f475 100644
--- a/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts
+++ b/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts
@@ -1,7 +1,6 @@
-import { base } from '$lib/base'
 import { workspaceStore } from '$lib/stores'
 import { get } from 'svelte/store'
 
 export function computeSecretUrl(secretUrl: string) {
-	return `${window.location.origin}${base}/public/${get(workspaceStore)}/${secretUrl}`
+	return `${window.location.origin}/public/${get(workspaceStore)}/${secretUrl}`
 }
diff --git a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte
index a4bed4affb..1d3d46fc35 100644
--- a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte
+++ b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte
@@ -15,6 +15,7 @@
 	import WorkspaceScriptList from '../settingsPanel/mainInput/WorkspaceScriptList.svelte'
 	import RunnableSelector from '../settingsPanel/mainInput/RunnableSelector.svelte'
 	import { defaultScripts } from '$lib/stores'
+	import { useOperatorBuilderApps } from '$lib/operatorWriteRights'
 	import DefaultScripts from '$lib/components/DefaultScripts.svelte'
 	import type { Preview } from '$lib/gen'
 	import type { InlineScript } from '../../sharedTypes'
@@ -38,6 +39,7 @@
 	let picker: Drawer | undefined = $state(undefined)
 
 	const dispatch = createEventDispatcher()
+	const operatorBuilderApps = useOperatorBuilderApps()
 
 	async function inferInlineScriptSchema(
 		language: Preview['language'],
@@ -104,7 +106,9 @@
 				<Tabs bind:selected={tab}>
 					<Tab value="workspacescripts" label="Workspace Scripts" icon={Building} />
 
-					<Tab value="hubscripts" label="Hub Scripts" icon={Globe2} />
+					{#if !$operatorBuilderApps}
+						<Tab value="hubscripts" label="Hub Scripts" icon={Globe2} />
+					{/if}
 				</Tabs>
 				<div class="my-2"></div>
 				<div class="flex flex-col gap-y-16">
@@ -123,21 +127,25 @@
 
 <div class="flex flex-col px-4 gap-2 text-sm" id="app-editor-empty-runnable">
 	<div class="mt-2 flex justify-between gap-4" id="app-editor-runnable-header">
-		<div class="font-bold items-baseline truncate">Choose a language</div>
+		<div class="font-bold items-baseline truncate">
+			{$operatorBuilderApps ? 'Choose a script or flow' : 'Choose a language'}
+		</div>
 		<div class="flex gap-2">
 			{#if showScriptPicker}
 				<RunnableSelector {unusedInlineScripts} {rawApps} on:pick hideCreateScript />
 			{/if}
-			<Button
-				on:click={() => picker?.openDrawer()}
-				size="xs"
-				variant="border"
-				color="light"
-				startIcon={{ icon: GitFork }}
-				btnClasses="truncate"
-			>
-				Fork other script
-			</Button>
+			{#if !$operatorBuilderApps}
+				<Button
+					on:click={() => picker?.openDrawer()}
+					size="xs"
+					variant="border"
+					color="light"
+					startIcon={{ icon: GitFork }}
+					btnClasses="truncate"
+				>
+					Fork other script
+				</Button>
+			{/if}
 
 			<Button
 				on:click={() => dispatch('delete')}
@@ -151,7 +159,9 @@
 		</div>
 	</div>
 
-	<div class="flex flex-row w-full gap-8">
+	<!-- Operators with builder rights compose runnables that already exist: the language pickers
+	     below all author code, which the backend refuses from them. -->
+	<div class="flex flex-row w-full gap-8" class:hidden={$operatorBuilderApps}>
 		<div id="app-editor-backend-runnables">
 			<div class="mb-1 text-sm font-semibold flex gap-4">Backend <DefaultScripts /> </div>
 
diff --git a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
index 293d83b4ae..45dbe82c14 100644
--- a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
+++ b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
@@ -3,7 +3,6 @@
 
 	const bubble = createBubbler()
 	import { Button, Drawer, DrawerContent } from '$lib/components/common'
-	import { base } from '$lib/base'
 	import FlowGraphViewer from '$lib/components/FlowGraphViewer.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import FlowModuleScript from '$lib/components/flows/content/FlowModuleScript.svelte'
@@ -19,6 +18,7 @@
 		CtxAppInput
 	} from '../../inputType'
 	import type { AppViewerContext } from '../../types'
+	import { useOperatorBuilderApps } from '$lib/operatorWriteRights'
 	import { createEventDispatcher } from 'svelte'
 	import { deepEqual } from 'fast-equals'
 	import { computeFields } from './utils'
@@ -37,6 +37,7 @@
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
+	const operatorBuilderApps = useOperatorBuilderApps()
 
 	interface Props {
 		runnable: RunnableByPath
@@ -325,7 +326,7 @@
 					startIcon={{ icon: GitFork }}
 					endIcon={{ icon: ExternalLink }}
 					target="_blank"
-					href="{base}/flows/add?hub={hubFlowId}"
+					href="/flows/add?hub={hubFlowId}"
 				>
 					Fork
 				</Button>
@@ -346,7 +347,7 @@
 					startIcon={{ icon: Eye }}
 					endIcon={{ icon: ExternalLink }}
 					target="_blank"
-					href="{base}/flows/get/{runnable.path}?workspace={$operatingWorkspace}"
+					href="/flows/get/{runnable.path}?workspace={$operatingWorkspace}"
 				>
 					Details
 				</Button>
@@ -362,16 +363,18 @@
 			>
 				Edit
 			</Button>
-			<Button
-				size="xs"
-				variant="default"
-				startIcon={{ icon: GitFork }}
-				on:click={() => {
-					fork(runnable.path)
-				}}
-			>
-				Fork
-			</Button>
+			{#if !$operatorBuilderApps}
+				<Button
+					size="xs"
+					variant="default"
+					startIcon={{ icon: GitFork }}
+					on:click={() => {
+						fork(runnable.path)
+					}}
+				>
+					Fork
+				</Button>
+			{/if}
 		{/if}
 		<Popover
 			floatingConfig={{
diff --git a/frontend/src/lib/components/apps/editor/publicAppApi.ts b/frontend/src/lib/components/apps/editor/publicAppApi.ts
new file mode 100644
index 0000000000..674cb0b622
--- /dev/null
+++ b/frontend/src/lib/components/apps/editor/publicAppApi.ts
@@ -0,0 +1,82 @@
+// The public app routes (`/public/...`, `/a/...`) render a raw app as little more than its
+// bundle's iframe, so they must not statically import the generated client, `$lib/stores`
+// or `$lib/utils`: each drags in most of the app shell. `vite.config.js`
+// (`assertLeanPublicAppRoutes`) fails the build if they do. Anything heavier is imported
+// lazily by the branch that needs it.
+import { OpenAPI } from '$lib/gen/core/OpenAPI'
+import type { AppWithLastVersion, User } from '$lib/gen/types.gen'
+import type { UserExt } from '$lib/stores'
+import { mapUserToUserExt } from '$lib/userExt'
+
+export type PublicAppValue = AppWithLastVersion & { value: any; workspace_id?: string }
+
+declare global {
+	interface Window {
+		/** Responses `app.html` requested before any module loaded, keyed by URL. */
+		__wmPublicAppPrefetch?: Record<string, Promise<Response>>
+	}
+}
+
+/** Carries `status` like the generated client's `ApiError`, which callers branch on. */
+export class PublicApiError extends Error {
+	constructor(public status: number) {
+		super(`Request failed with status ${status}`)
+	}
+}
+
+/** Prefetched responses answer for the credential the page loaded with; call this when it
+ * changes (a sign-in or logout on the page) so later reads go to the network. */
+export function dropPrefetched(): void {
+	delete window.__wmPublicAppPrefetch
+}
+
+function takePrefetched(url: string): Promise<Response> | undefined {
+	const prefetched = window.__wmPublicAppPrefetch
+	const res = prefetched?.[url]
+	if (res) delete prefetched![url]
+	return res
+}
+
+/** GET an API path with the page credential: the bearer token in `OpenAPI.TOKEN` when the
+ * share link carries one, the session cookie otherwise. A prefetched response is only
+ * taken in the cookie case, which is the only credential `app.html` sends. */
+export async function publicGet<T>(path: string): Promise<T> {
+	const url = `${OpenAPI.BASE}${path}`
+	const token = typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN ? OpenAPI.TOKEN : undefined
+	const res = await ((!token && takePrefetched(url)) ||
+		fetch(url, {
+			// As the generated client does: the opaque viewer frame is cross-origin to the
+			// API, whose `Access-Control-Allow-Origin: *` refuses a credentialed request.
+			credentials: OpenAPI.WITH_CREDENTIALS ? OpenAPI.CREDENTIALS : undefined,
+			headers: token ? { Authorization: `Bearer ${token}` } : {}
+		}))
+	if (!res.ok) throw new PublicApiError(res.status)
+	return (res.headers.get('content-type')?.includes('json') ? res.json() : res.text()) as T
+}
+
+export async function getUserExtOrUndefined(workspace: string): Promise<UserExt | undefined> {
+	try {
+		return mapUserToUserExt(
+			await publicGet<User>(`/w/${encodeURI(workspace)}/users/whoami`),
+			workspace
+		)
+	} catch {
+		return undefined
+	}
+}
+
+/** Only fades the "Powered by" badge, so a failure is not worth surfacing. */
+export async function getLicenseOrUndefined(): Promise<string | undefined> {
+	try {
+		return (await publicGet<string>('/ee_license')) || undefined
+	} catch {
+		return undefined
+	}
+}
+
+let appCss: Promise<unknown> | undefined
+/** The app-wide stylesheet, which these routes need only off the raw-app path: sign-in,
+ * errors, skeletons and low-code apps. A raw app's bundle brings its own styles. */
+export function loadAppCss(): Promise<unknown> {
+	return (appCss ??= import('$lib/assets/app.css'))
+}
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
index 08b8ac6219..44f2adb9ac 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
@@ -12,8 +12,10 @@
 	import { emptySchema } from '$lib/utils'
 	import { loadSchema } from '$lib/infer'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { useOperatorBuilderApps } from '$lib/operatorWriteRights'
 
 	const operatingWorkspace = useOperatingWorkspace()
+	const operatorBuilderApps = useOperatorBuilderApps()
 	import { buildPathRunnableSelection } from './runnableSelectorUtils'
 
 	type TabType = 'hubscripts' | 'hubflows' | 'workspacescripts' | 'workspaceflows' | 'inlinescripts'
@@ -163,10 +165,12 @@
 						<Tab value="workspacescripts" label="Workspace Scripts" icon={Building} />
 					{/if}
 					<Tab value="workspaceflows" label="Workspace Flows" icon={Building} />
-					{#if !onlyFlow}
-						<Tab value="hubscripts" label="Hub Scripts" icon={Globe2} />
+					{#if !$operatorBuilderApps}
+						{#if !onlyFlow}
+							<Tab value="hubscripts" label="Hub Scripts" icon={Globe2} />
+						{/if}
+						<Tab value="hubflows" label="Hub Flows" icon={Globe2} />
 					{/if}
-					<Tab value="hubflows" label="Hub Flows" icon={Globe2} />
 				</Tabs>
 				<div class="my-2"></div>
 				<div class="flex flex-col gap-y-16">
diff --git a/frontend/src/lib/components/apps/types.ts b/frontend/src/lib/components/apps/types.ts
index 75de2d7faf..a72d54507e 100644
--- a/frontend/src/lib/components/apps/types.ts
+++ b/frontend/src/lib/components/apps/types.ts
@@ -188,6 +188,8 @@ export interface AppEditorProps {
 	// with its author and time. `version` and `head` differ when another deploy landed
 	// beside this one, which is when the out-of-date prompt has something to say.
 	onDeploy?: (e: { version?: number; head?: number; headBy?: string; headAt?: string }) => void
+	/** True for the route's own editor: its top bar becomes the page header. */
+	ownsPageHeader?: boolean
 }
 
 export type App = {
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddDataSourceMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/AddDataSourceMenu.svelte
new file mode 100644
index 0000000000..49a222148b
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/AddDataSourceMenu.svelte
@@ -0,0 +1,150 @@
+<!--
+@component
+The menu that adds a pipeline script started by a data source (a schedule, a
+webhook, a queue…): the add node's, and the canvas's right-click one.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import PipelineInsertMenu, {
+		type PipelineInsertOptions,
+		type PipelineInsertPick
+	} from './PipelineInsertMenu.svelte'
+	import {
+		Clock,
+		Webhook,
+		Mail,
+		Zap,
+		Radio,
+		MessageSquare,
+		Database,
+		Send,
+		CloudCog,
+		Upload
+	} from 'lucide-svelte'
+	import type { ScriptLang } from '$lib/gen'
+	import type { NativeTriggerKind } from './types'
+	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
+	import type { PipelineOutputKind } from './pipelineTemplates'
+
+	interface Props {
+		onAddPipelineScript: (
+			language: ScriptLang,
+			path: string,
+			source: { kind: NativeTriggerKind; path: string | undefined },
+			outputKind: PipelineOutputKind,
+			aiPrompt?: string,
+			options?: PipelineInsertOptions
+		) => void
+		pathPrefix: string
+		defaultPathSuffix: string
+		trigger: Snippet<[{ open: boolean }]>
+		/** Opens the menu each time it changes. */
+		openSignal?: number
+	}
+	let {
+		onAddPipelineScript,
+		pathPrefix,
+		defaultPathSuffix,
+		trigger,
+		openSignal
+	}: Props = $props()
+
+	function handlePick(pick: PipelineInsertPick) {
+		if (!pick.language || !pick.path) return
+		// Native trigger annotation is marker-only — the binding lives on the
+		// trigger row's own `script_path`, which is created separately.
+		onAddPipelineScript(
+			pick.language as ScriptLang,
+			pick.path,
+			{ kind: pick.kindId as NativeTriggerKind, path: undefined },
+			(pick.outputKind ?? 'none') as PipelineOutputKind,
+			pick.aiPrompt,
+			{ schedule: pick.schedule, outputAsset: pick.outputAsset }
+		)
+	}
+</script>
+
+<PipelineInsertMenu
+	kinds={[
+		{
+			id: 'data_upload',
+			label: 'On data upload',
+			description: 'UI-first: run by uploading a file via the S3 picker',
+			icon: Upload
+		},
+		{
+			id: 'schedule',
+			label: 'On schedule',
+			description: 'Triggered by a schedule you create',
+			icon: Clock
+		},
+		{
+			id: 'webhook',
+			label: 'On webhook',
+			description: 'Triggered by an HTTP webhook',
+			icon: Webhook
+		},
+		{
+			id: 'email',
+			configuredAfterCreate: true,
+			label: 'On email',
+			description: 'Triggered by incoming email',
+			icon: Mail
+		},
+		{
+			id: 'kafka',
+			configuredAfterCreate: true,
+			label: 'On Kafka',
+			description: 'Triggered by a Kafka message',
+			icon: Zap
+		},
+		{
+			id: 'mqtt',
+			configuredAfterCreate: true,
+			label: 'On MQTT',
+			description: 'Triggered by an MQTT message',
+			icon: Radio
+		},
+		{
+			id: 'amqp',
+			configuredAfterCreate: true,
+			label: 'On AMQP',
+			description: 'Triggered by an AMQP (RabbitMQ) message',
+			icon: Radio
+		},
+		{
+			id: 'nats',
+			configuredAfterCreate: true,
+			label: 'On NATS',
+			description: 'Triggered by a NATS message',
+			icon: MessageSquare
+		},
+		{
+			id: 'postgres',
+			configuredAfterCreate: true,
+			label: 'On Postgres',
+			description: 'Triggered by a Postgres event',
+			icon: Database
+		},
+		{
+			id: 'sqs',
+			configuredAfterCreate: true,
+			label: 'On SQS',
+			description: 'Triggered by an SQS message',
+			icon: Send
+		},
+		{
+			id: 'gcp',
+			configuredAfterCreate: true,
+			label: 'On GCP Pub/Sub',
+			description: 'Triggered by a Pub/Sub message',
+			icon: CloudCog
+		}
+	]}
+	languages={PIPELINE_LANGUAGES as any}
+	{pathPrefix}
+	{defaultPathSuffix}
+	onPick={handlePick}
+	{openSignal}
+	{trigger}
+/>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddDownstreamMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamMenu.svelte
new file mode 100644
index 0000000000..2a54fe11d4
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamMenu.svelte
@@ -0,0 +1,73 @@
+<!--
+@component
+The menu adding a pipeline script downstream of an asset: opened from the asset's
+"+", or where that "+" was dropped on the blank canvas.
+-->
+<script lang="ts" module>
+	import type { ScriptLang } from '$lib/gen'
+	import type { AssetKind } from '$lib/components/assets/lib'
+	import type { PipelineInsertOptions } from './PipelineInsertMenu.svelte'
+	import type { PipelineOutputKind } from './pipelineTemplates'
+
+	export type AddScriptForAsset = (
+		asset: { kind: AssetKind; path: string },
+		language: ScriptLang,
+		scriptPath: string,
+		outputKind: PipelineOutputKind,
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
+	) => void
+</script>
+
+<script lang="ts">
+	import { Code2 } from 'lucide-svelte'
+	import type { Snippet } from 'svelte'
+	import PipelineInsertMenu, { type PipelineInsertPick } from './PipelineInsertMenu.svelte'
+	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
+
+	let {
+		asset,
+		onAddScript,
+		pathPrefix = '',
+		defaultPathSuffix = '',
+		openSignal,
+		trigger
+	}: {
+		asset: { kind: AssetKind; path: string }
+		onAddScript: AddScriptForAsset
+		pathPrefix?: string
+		defaultPathSuffix?: string
+		openSignal?: number
+		trigger: Snippet<[{ open: boolean }]>
+	} = $props()
+
+	function handlePick(pick: PipelineInsertPick) {
+		if (pick.kindId === 'pipeline_script' && pick.language && pick.path) {
+			onAddScript(
+				asset,
+				pick.language as ScriptLang,
+				pick.path,
+				(pick.outputKind ?? 'none') as PipelineOutputKind,
+				pick.aiPrompt,
+				{ outputAsset: pick.outputAsset }
+			)
+		}
+	}
+</script>
+
+<PipelineInsertMenu
+	kinds={[
+		{
+			id: 'pipeline_script',
+			label: 'Add downstream pipeline script',
+			description: 'Triggered when this asset changes',
+			icon: Code2
+		}
+	]}
+	languages={PIPELINE_LANGUAGES as any}
+	{pathPrefix}
+	{defaultPathSuffix}
+	{openSignal}
+	onPick={handlePick}
+	{trigger}
+/>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddDownstreamPill.svelte b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamPill.svelte
new file mode 100644
index 0000000000..8ebd24455c
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/AddDownstreamPill.svelte
@@ -0,0 +1,23 @@
+<!--
+@component
+The "+" on an asset's bottom edge: a circle at rest, widened into a labelled pill
+while its menu is open or while it is being dragged. The label animates its
+max-width (width can't transition to auto) and never wraps.
+-->
+<script lang="ts">
+	import { Plus } from 'lucide-svelte'
+
+	let { expanded }: { expanded: boolean } = $props()
+</script>
+
+<span
+	class="group/add h-6 min-w-6 rounded-full flex items-center justify-center bg-surface border border-gray-400 dark:border-gray-600 text-secondary hover:text-primary hover:border-gray-500 shadow-sm leading-none overflow-hidden transition-[padding] duration-200 ease-out data-[open=true]:pl-1"
+	data-open={expanded}
+>
+	<Plus size={16} strokeWidth={2.5} class="shrink-0" />
+	<span
+		class="max-w-0 opacity-0 whitespace-nowrap text-3xs font-normal transition-[max-width,opacity,margin] duration-200 ease-out group-data-[open=true]/add:max-w-32 group-data-[open=true]/add:opacity-100 group-data-[open=true]/add:ml-1 group-data-[open=true]/add:mr-2"
+	>
+		Add downstream step
+	</span>
+</span>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
index 880abb685a..57a31e34d8 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AddNode.svelte
@@ -1,145 +1,36 @@
 <script lang="ts">
-	import PipelineInsertMenu, { type PipelineInsertPick } from './PipelineInsertMenu.svelte'
-	import {
-		Plus,
-		Clock,
-		Webhook,
-		Mail,
-		Zap,
-		Radio,
-		MessageSquare,
-		Database,
-		Send,
-		CloudCog,
-		Upload
-	} from 'lucide-svelte'
-	import type { ScriptLang } from '$lib/gen'
-	import type { NativeTriggerKind } from './types'
-	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
-	import type { PipelineOutputKind } from './pipelineTemplates'
-
-	// Each left-column kind is just "pipeline script triggered by <trigger
-	// source>". id === the SCRIPT_TRIGGER_KIND value, so the handler can
-	// dispatch on it uniformly. Asset-triggered scripts are not in this
-	// menu; those live under the per-asset + inside the graph.
-	type KindId = NativeTriggerKind
+	import AddDataSourceMenu from './AddDataSourceMenu.svelte'
+	import { Plus } from 'lucide-svelte'
+	import { NODE } from '$lib/components/graph/util'
 
 	interface Props {
-		data: {
-			onAddPipelineScript: (
-				language: ScriptLang,
-				path: string,
-				source: { kind: NativeTriggerKind; path: string | undefined },
-				outputKind: PipelineOutputKind,
-				aiPrompt?: string
-			) => void
-			pathPrefix: string
-			defaultPathSuffix: string
-		}
+		data: Pick<
+			import('svelte').ComponentProps<typeof AddDataSourceMenu>,
+			'onAddPipelineScript' | 'pathPrefix' | 'defaultPathSuffix'
+		>
 	}
 	let { data }: Props = $props()
-
-	function handlePick(pick: PipelineInsertPick) {
-		if (!pick.language || !pick.path) return
-		const kindId = pick.kindId as KindId
-		const outputKind = (pick.outputKind ?? 'none') as PipelineOutputKind
-		// Native trigger annotation is marker-only — the binding lives on
-		// the trigger row's own `script_path`, which the user creates
-		// separately. Seed with `path: undefined`.
-		data.onAddPipelineScript(
-			pick.language as ScriptLang,
-			pick.path,
-			{ kind: kindId, path: undefined },
-			outputKind,
-			pick.aiPrompt
-		)
-	}
 </script>
 
-<PipelineInsertMenu
-	kinds={[
-		{
-			id: 'data_upload',
-			label: 'On data upload',
-			description: 'UI-first: run by uploading a file via the S3 picker',
-			icon: Upload
-		},
-		{
-			id: 'schedule',
-			label: 'On schedule',
-			description: 'Triggered by a schedule you create',
-			icon: Clock
-		},
-		{
-			id: 'webhook',
-			label: 'On webhook',
-			description: 'Triggered by an HTTP webhook',
-			icon: Webhook
-		},
-		{
-			id: 'email',
-			label: 'On email',
-			description: 'Triggered by incoming email',
-			icon: Mail
-		},
-		{
-			id: 'kafka',
-			label: 'On Kafka',
-			description: 'Triggered by a Kafka message',
-			icon: Zap
-		},
-		{
-			id: 'mqtt',
-			label: 'On MQTT',
-			description: 'Triggered by an MQTT message',
-			icon: Radio
-		},
-		{
-			id: 'amqp',
-			label: 'On AMQP',
-			description: 'Triggered by an AMQP (RabbitMQ) message',
-			icon: Radio
-		},
-		{
-			id: 'nats',
-			label: 'On NATS',
-			description: 'Triggered by a NATS message',
-			icon: MessageSquare
-		},
-		{
-			id: 'postgres',
-			label: 'On Postgres',
-			description: 'Triggered by a Postgres event',
-			icon: Database
-		},
-		{
-			id: 'sqs',
-			label: 'On SQS',
-			description: 'Triggered by an SQS message',
-			icon: Send
-		},
-		{
-			id: 'gcp',
-			label: 'On GCP Pub/Sub',
-			description: 'Triggered by a Pub/Sub message',
-			icon: CloudCog
-		}
-	]}
-	languages={PIPELINE_LANGUAGES as any}
-	pathPrefix={data.pathPrefix}
-	defaultPathSuffix={data.defaultPathSuffix}
-	onPick={handlePick}
->
-	{#snippet trigger()}
-		<!-- Quiet insert affordance, mirroring the flow editor's inline +
-		     buttons (bg-surface + gray border + secondary text) — a filled
-		     accent circle outweighed every real node on the canvas. -->
-		<button
-			type="button"
-			class="w-8 h-8 rounded-full flex items-center justify-center bg-surface border border-gray-400 dark:border-gray-600 text-secondary shadow-sm hover:bg-surface-hover transition-colors cursor-pointer"
-			title="Add to pipeline"
-		>
-			<Plus size={16} />
-		</button>
-	{/snippet}
-</PipelineInsertMenu>
+<!-- The layout gives this node a full node-width slot; centering the pill in
+     it lines it up with the nodes below whatever its label's width. -->
+<div class="flex justify-center" style="width: {NODE.width}px;">
+	<AddDataSourceMenu
+		onAddPipelineScript={data.onAddPipelineScript}
+		pathPrefix={data.pathPrefix}
+		defaultPathSuffix={data.defaultPathSuffix}
+	>
+		{#snippet trigger()}
+			<!-- Quiet insert affordance, mirroring the flow editor's inline +
+			     buttons (bg-surface + gray border + secondary text) — a filled
+			     accent pill would outweigh every real node on the canvas. -->
+			<button
+				type="button"
+				class="h-8 px-3 rounded-full flex items-center gap-1.5 whitespace-nowrap bg-surface border border-gray-400 dark:border-gray-600 text-xs font-normal text-secondary shadow-sm hover:bg-surface-hover transition-colors cursor-pointer"
+			>
+				<Plus size={16} class="shrink-0" />
+				Add data source
+			</button>
+		{/snippet}
+	</AddDataSourceMenu>
+</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
index 27f6ce6be7..87b085593c 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
@@ -1,8 +1,11 @@
 <script lang="ts">
 	import '@xyflow/svelte/dist/base.css'
+	import { randomUUID } from '$lib/utils/uuid'
+	import { onMount } from 'svelte'
 	import {
 		SvelteFlow,
 		Controls,
+		Panel,
 		MiniMap,
 		ConnectionLineType,
 		type Node,
@@ -13,13 +16,47 @@
 	import RunnableNode from './RunnableNode.svelte'
 	import TriggerNode, { type TriggerNodeKind } from './TriggerNode.svelte'
 	import AddNode from './AddNode.svelte'
+	import AddDataSourceMenu from './AddDataSourceMenu.svelte'
+	import PipelineInsertMenu, { type PipelineInsertSchedule } from './PipelineInsertMenu.svelte'
+	import AddDownstreamMenu from './AddDownstreamMenu.svelte'
+	import AddDownstreamPill from './AddDownstreamPill.svelte'
 	import DataTestNode from './DataTestNode.svelte'
 	import AssetGraphEdge from './AssetGraphEdge.svelte'
 	import PanToNode from './PanToNode.svelte'
 	import InitialFitView from './InitialFitView.svelte'
-	import { layoutAssetGraph } from './assetGraphLayout'
+	import {
+		layoutAssetGraph,
+		PIPELINE_NODE_EXTRA_ROW,
+		PIPELINE_NODE_HEADER,
+		PIPELINE_NODE_HEADER_CARD_PAD
+	} from './assetGraphLayout'
+	import {
+		assetsOnlyView,
+		upstreamDeletion,
+		withoutPassiveReads,
+		type AssetUpstream,
+		type AssetUpstreamDelete
+	} from './assetsOnlyView'
+	import { assetsOnlyNodeWidth } from './assetNodeWidth'
+	import { describeEdge } from './edgeDescription'
+	import { onDirectiveTargets } from './onDirectiveTargets'
+	import { listenChangeText, stopListeningChangeText } from './pipelineAnnotationEdits'
+	import { Button } from '$lib/components/common'
+	import type { NodeFix, NodeFixSpec } from './NodeFixButton.svelte'
+	import { isAssetsOnlyFolder, setAssetsOnlyFolder } from './assetsOnlyFolders'
+	import { formatAssetKind, formatShortAssetPath } from '$lib/components/assets/lib'
+	import { TRIGGER_NODE_STYLE } from './TriggerNode.svelte'
+	import { describeSchedule } from '$lib/utils/describeCron'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { fly } from 'svelte/transition'
+	import { Clock, Plus } from 'lucide-svelte'
+	import {
+		getContextMenuContainerClass,
+		CONTEXT_MENU_ITEM_BASE_CLASS,
+		CONTEXT_MENU_ITEM_HOVER_CLASS
+	} from '$lib/components/common/contextmenu/contextMenuStyles'
 	import { computeMutedReadKeys, dbtAssociations } from './resolveGraph'
-	import { buildDownstreamMap } from './graphTraversal'
+	import { buildDownstreamMap, hoverLineage, transitivelyImpliedEdges } from './graphTraversal'
 	import { buildLineageDownstreamMap } from './boundedCascade'
 	import type {
 		AssetGraphResponse,
@@ -31,16 +68,15 @@
 	import type { AssetKind } from '$lib/gen'
 	import { NODE } from '$lib/components/graph/util'
 
-	// Width of the + node's rendered DOM element. Sugiyama allocates a full
-	// NODE.width slot for every node, so the small round button ends up
-	// left-aligned in its slot. We compensate by shifting the + node right
-	// by half the difference so its visual center matches the slot center.
-	const ADD_NODE_WIDTH = 40
-
 	interface Props {
 		graph: AssetGraphResponse
 		selection?: AssetGraphSelection | undefined
-		onselect?: (selection: AssetGraphSelection | undefined) => void
+		/** `open` marks a selection asked to be shown (a script's open button), as
+		 * opposed to a click on a node, which only selects it. */
+		onselect?: (
+			selection: AssetGraphSelection | undefined,
+			opts?: { open?: boolean }
+		) => void
 		// Called when the user clicks the per-asset + button (consumer-script
 		// entry). Kept optional so the canvas stays usable outside the
 		// pipeline editor.
@@ -49,7 +85,8 @@
 			language: import('$lib/gen').ScriptLang,
 			scriptPath: string,
 			outputKind: import('./pipelineTemplates').PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		// Pipeline-wide + node shown at the top of the graph. Picking any
 		// kind from the menu invokes this one callback with the chosen
@@ -65,7 +102,8 @@
 				path: string | undefined
 			},
 			outputKind: import('./pipelineTemplates').PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		// Folder-scoped prefix shown as a read-only chip in the insert menu
 		// path input (e.g. `f/{folder}/`). Shared across top + and per-asset +.
@@ -194,6 +232,32 @@
 		 * canvas is embedded inline inside a scrollable container, so a wheel
 		 * gesture over it scrolls the container instead of being captured. */
 		scrollZoom?: boolean
+		/** Offer the "Show scripts and triggers" switch; off folds scripts and triggers into the
+		 * assets they produce. */
+		assetsOnlyToggle?: boolean
+		/** The pipeline's `<workspace>/<folder>`, when the toggle's state should be
+		 * remembered for it. */
+		assetsOnlyFolder?: string
+		/** Deletes what produces an asset in the assets-only view: its script, and its
+		 * trigger when set. The canvas only offers what no other asset shares. */
+		onDeleteAssetUpstream?: (target: AssetUpstreamDelete) => void
+		/** Canvas node id → what is wrong with it and how to fix it (the Fix pill). */
+		nodeFixes?: ReadonlyMap<string, NodeFixSpec>
+		/** "Archive" for someone who can only archive the script the delete removes. */
+		assetDeleteVerb?: 'Delete' | 'Archive'
+		/** Makes scripts run after each write to an asset: a script's (or, in the
+		 * assets-only view, an asset's producers') top dot dragged onto that asset.
+		 * `reads` says whether each script already reads it. */
+		onAddAssetTrigger?: (a: {
+			scripts: Array<{ script: string; reads: boolean }>
+			asset: { kind: AssetKind; path: string }
+		}) => void
+		/** Makes scripts run after each write to an asset they read, or stop. `reads`
+		 * decides whether stopping also mutes the asset. */
+		onEdgeAction?: (a: {
+			action: 'listen' | 'stop'
+			targets: Array<{ script: string; asset: { kind: AssetKind; path: string }; reads: boolean }>
+		}) => void
 	}
 	let {
 		graph,
@@ -226,9 +290,347 @@
 		highlightActiveRun = false,
 		recomputedAssetIds,
 		assetRunStatus,
-		scrollZoom = true
+		scrollZoom = true,
+		assetsOnlyToggle = false,
+		assetsOnlyFolder,
+		onDeleteAssetUpstream,
+		nodeFixes,
+		assetDeleteVerb = 'Delete',
+		onEdgeAction,
+		onAddAssetTrigger
 	}: Props = $props()
 
+	// Two drags write `// on`: a script's top dot onto an asset, and an asset's "+"
+	// onto a script. Only the nodes the drop can subscribe without a loop stay lit.
+	// The "+" can also be dropped on the blank canvas, opening its add menu there.
+	let onDrag = $state<
+		| {
+				sourceId: string
+				from: { x: number; y: number }
+				to: { x: number; y: number }
+				eligible: Set<string>
+				over: string | undefined
+				/** Dragging an asset's "+", whose blank-canvas drop adds a step. */
+				feed: boolean
+				blank: boolean
+		  }
+		| undefined
+	>(undefined)
+	// Hit-tested on the boxes rather than with elementFromPoint: svelte-flow can
+	// make nodes click-through while the pointer is held down.
+	const within = (el: Element, x: number, y: number) => {
+		const r = el.getBoundingClientRect()
+		return x >= r.left && x <= r.right && y >= r.top && y <= r.bottom
+	}
+	let flowEl: HTMLElement | undefined = $state()
+	const nodeUnder = (x: number, y: number) =>
+		Array.from(flowEl?.querySelectorAll('.svelte-flow__node') ?? [])
+			.find((el) => within(el, x, y))
+			?.getAttribute('data-id') ?? undefined
+	const overBlank = (x: number, y: number) =>
+		!!flowEl &&
+		within(flowEl, x, y) &&
+		!Array.from(
+			flowEl.querySelectorAll('.svelte-flow__panel, .svelte-flow__controls, .svelte-flow__minimap')
+		).some((el) => within(el, x, y))
+	const readsAsset = (assetId: string, scriptId: string) =>
+		model.edges.some((x) => x.kind === 'lineage-read' && x.source === assetId && x.target === scriptId)
+	const assetOf = (assetId: string) => {
+		const a = model.nodes.find((n) => n.id === assetId)?.data
+		return a ? { kind: a.asset_kind as AssetKind, path: a.path as string } : undefined
+	}
+	function subscribe(assetId: string, scripts: string[]) {
+		const asset = assetOf(assetId)
+		if (!asset) return
+		onAddAssetTrigger?.({
+			asset,
+			scripts: scripts.map((id) => ({
+				script: id.replace(/^script:/, ''),
+				reads: readsAsset(assetId, id)
+			}))
+		})
+	}
+	/** `threshold`: pixels the pointer must travel before it counts as a drag, so a
+	 * plain click on the handle still clicks. */
+	function trackDrag(
+		e: PointerEvent,
+		start: { sourceId: string; feed: boolean; eligible: () => Set<string>; threshold: number },
+		drop: (target: string | undefined, at: { x: number; y: number }, blank: boolean) => void
+	) {
+		const from = { x: e.clientX, y: e.clientY }
+		let started = false
+		const begin = () => {
+			started = true
+			onDrag = {
+				sourceId: start.sourceId,
+				from,
+				to: from,
+				eligible: start.eligible(),
+				over: undefined,
+				feed: start.feed,
+				blank: false
+			}
+		}
+		if (start.threshold === 0) begin()
+		const move = (ev: PointerEvent) => {
+			if (!started) {
+				if (Math.hypot(ev.clientX - from.x, ev.clientY - from.y) < start.threshold) return
+				begin()
+			}
+			if (!onDrag) return
+			onDrag.to = { x: ev.clientX, y: ev.clientY }
+			onDrag.over = nodeUnder(ev.clientX, ev.clientY)
+			onDrag.blank = !onDrag.over && overBlank(ev.clientX, ev.clientY)
+		}
+		// A drag that ends without a release (pointer cancelled, window left) drops
+		// nothing, and must not leave its line following the cursor.
+		const teardown = () => {
+			window.removeEventListener('pointermove', move)
+			window.removeEventListener('pointerup', up)
+			window.removeEventListener('pointercancel', cancel)
+			window.removeEventListener('blur', cancel)
+			document.removeEventListener('visibilitychange', cancel)
+		}
+		const cancel = () => {
+			teardown()
+			onDrag = undefined
+		}
+		const up = (ev: PointerEvent) => {
+			teardown()
+			const drag = onDrag
+			onDrag = undefined
+			if (!started || !drag) return
+			// The release is not a click on whatever it lands on.
+			const swallow = (c: MouseEvent) => {
+				c.stopPropagation()
+				c.preventDefault()
+			}
+			window.addEventListener('click', swallow, { capture: true, once: true })
+			setTimeout(() => window.removeEventListener('click', swallow, { capture: true }), 0)
+			const target = nodeUnder(ev.clientX, ev.clientY)
+			const at = { x: ev.clientX, y: ev.clientY }
+			drop(target && drag.eligible.has(target) ? target : undefined, at, !target && drag.blank)
+		}
+		window.addEventListener('pointermove', move)
+		window.addEventListener('pointerup', up)
+		window.addEventListener('pointercancel', cancel)
+		window.addEventListener('blur', cancel)
+		document.addEventListener('visibilitychange', cancel)
+	}
+	function startOnDrag(sourceId: string, scripts: string[], e: PointerEvent) {
+		if (!onAddAssetTrigger || scripts.length === 0) return
+		trackDrag(
+			e,
+			{
+				sourceId,
+				feed: false,
+				threshold: 0,
+				eligible: () => {
+					const sets = scripts.map((id) => onDirectiveTargets(model.nodes, model.edges, id))
+					return new Set([...sets[0]].filter((a) => sets.every((t) => t.has(a))))
+				}
+			},
+			(target) => {
+				if (target) subscribe(target, scripts)
+			}
+		)
+	}
+	// Where a "+" dropped on the blank canvas opened its add menu.
+	let feedMenu = $state<
+		| { at: { x: number; y: number }; asset: { kind: AssetKind; path: string }; data: any }
+		| undefined
+	>(undefined)
+	let feedMenuSignal = $state(0)
+	function startFeedDrag(assetId: string, data: any, e: PointerEvent) {
+		trackDrag(
+			e,
+			{
+				sourceId: assetId,
+				feed: true,
+				threshold: 5,
+				// A drop target is a node whose scripts can all subscribe to the asset.
+				eligible: () => {
+					if (!onAddAssetTrigger) return new Set()
+					const targets = new Map<string, Set<string>>()
+					const can = (id: string) => {
+						if (!targets.has(id)) targets.set(id, onDirectiveTargets(model.nodes, model.edges, id))
+						return targets.get(id)!.has(assetId)
+					}
+					return new Set(
+						view.nodes
+							.filter((n) => {
+								const scripts = dragScripts(n)
+								return n.id !== assetId && scripts.length > 0 && scripts.every(can)
+							})
+							.map((n) => n.id)
+					)
+				}
+			},
+			(target, at, blank) => {
+				const node = target ? view.nodes.find((n) => n.id === target) : undefined
+				if (node) subscribe(assetId, dragScripts(node))
+				else if (blank) {
+					const asset = assetOf(assetId)
+					if (!asset) return
+					feedMenu = { at, asset, data }
+					feedMenuSignal++
+				}
+			}
+		)
+	}
+	// Pipeline scripts a node's top dot drags for: the script itself, or, in the
+	// assets-only view, the scripts building the asset.
+	function dragScripts(n: { id: string; type: string; data: any }): string[] {
+		const ids =
+			n.type === 'runnable' ? [n.id] : n.type === 'asset' ? ((n.data.foldedIds ?? []) as string[]) : []
+		return ids.filter((id) => {
+			const d = model.nodes.find((x) => x.id === id)?.data
+			return d?.runnable_kind === 'script' && d.in_pipeline
+		})
+	}
+
+	let assetsOnly = $state(false)
+	// Before the first paint: the default view is assets-only, and a plain effect
+	// would flash the full graph first.
+	$effect.pre(() => {
+		if (assetsOnlyFolder != undefined) assetsOnly = isAssetsOnlyFolder(assetsOnlyFolder)
+	})
+
+	// Right-click on the empty canvas: a menu at the pointer whose entry opens the
+	// add-data-source menu there too.
+	let paneMenu = $state<{ x: number; y: number } | undefined>(undefined)
+
+	// Hovering an edge names the relationship it draws, after a short pause so
+	// sweeping the pointer across the canvas doesn't flash popovers.
+	let hoveredEdge = $state<{ id: string; x: number; y: number } | undefined>(undefined)
+	let edgeHoverTimer: ReturnType<typeof setTimeout> | undefined
+	function onEdgeEnter({ edge, event }: { edge: Edge; event: PointerEvent }) {
+		clearTimeout(edgeHoverTimer)
+		const at = { id: edge.id, x: event.clientX, y: event.clientY }
+		edgeHoverTimer = setTimeout(() => (hoveredEdge = at), 300)
+	}
+	// Leaving the edge closes the popover after a moment, so the pointer can reach
+	// its buttons; entering the popover keeps it.
+	function onEdgeLeave() {
+		clearTimeout(edgeHoverTimer)
+		edgeHoverTimer = setTimeout(() => (hoveredEdge = undefined), 200)
+	}
+	// What the hovered edge lets you change: a plain read can become a trigger, and
+	// an asset trigger can be dropped. Both rewrite the script's `// on` header.
+	// What the hovered edge lets you change: a script that only reads the upstream
+	// asset can rerun on each write to it, and one it triggers can stop. On an
+	// assets-only edge, those are the scripts folded into it; both rewrite `// on`.
+	type EdgeTarget = { script: string; asset: { kind: AssetKind; path: string }; reads: boolean }
+	let hoveredEdgeActions = $derived.by(() => {
+		const e = hoveredEdge && onEdgeAction && view.edges.find((x) => x.id === hoveredEdge!.id)
+		if (!e) return []
+		const assetData = view.nodes.find((n) => n.id === e.source)?.data
+		if (!assetData?.asset_kind) return []
+		const asset = { kind: assetData.asset_kind as AssetKind, path: assetData.path as string }
+		const scriptIds =
+			e.kind === 'asset-flow'
+				? (e.via ?? [])
+				: e.kind === 'lineage-read' || e.kind === 'trigger-asset'
+					? [e.target]
+					: []
+		const listen: EdgeTarget[] = []
+		const stop: EdgeTarget[] = []
+		for (const id of scriptIds) {
+			const script = model.nodes.find((n) => n.id === id)?.data
+			if (script?.runnable_kind !== 'script' || !script.in_pipeline) continue
+			const has = (kind: string) =>
+				model.edges.some((x) => x.kind === kind && x.source === e.source && x.target === id)
+			const target = { script: script.path as string, asset, reads: has('lineage-read') }
+			if (has('trigger-asset')) stop.push(target)
+			// A script rerunning on its own writes would loop: offered only for inputs.
+			else if (
+				target.reads &&
+				!model.edges.some(
+					(x) => x.kind === 'lineage-write' && x.source === id && x.target === e.source
+				)
+			)
+				listen.push(target)
+		}
+		const where = (ts: EdgeTarget[]) =>
+			ts.length === 1 ? ts[0].script : `${ts.length} scripts: ${ts.map((t) => t.script).join(', ')}`
+		const out: Array<{ label: string; detail: string; run: () => void }> = []
+		if (listen.length) {
+			out.push({
+				label: 'Rerun on each write',
+				detail: `${listenChangeText(asset, true)} in ${where(listen)}; only the annotation header changes. Saved as a draft.`,
+				run: () => onEdgeAction?.({ action: 'listen', targets: listen })
+			})
+		}
+		if (stop.length) {
+			out.push({
+				label: 'Stop rerunning on writes',
+				detail: `${stopListeningChangeText(
+					asset,
+					stop.some((t) => t.reads)
+				)} in ${where(stop)}; only the annotation header changes. Saved as a draft.`,
+				run: () => onEdgeAction?.({ action: 'stop', targets: stop })
+			})
+		}
+		return out
+	})
+	let hoveredEdgeText = $derived.by(() => {
+		const e = hoveredEdge && view.edges.find((x) => x.id === hoveredEdge!.id)
+		if (!e) return undefined
+		const byId = new Map(view.nodes.map((n) => [n.id, n]))
+		const nameOf = (id: string) => {
+			const n = byId.get(id)
+			if (!n) return id.replace(/^[^:]+:/, '')
+			if (n.type === 'asset')
+				return formatShortAssetPath({ kind: n.data.asset_kind, path: n.data.path })
+			if (n.type === 'no-asset') return n.data.noAssetName
+			if (n.type === 'trigger') return n.data.summary || n.data.ref
+			return n.data.summary || n.data.path
+		}
+		return describeEdge(e, nameOf, (id) => byId.get(id)?.data)
+	})
+	let addMenuAt = $state<{ x: number; y: number }>({ x: 0, y: 0 })
+	let addMenuSignal = $state(0)
+
+	// The schedule wizard a Fix action opens for an existing script, at the pill.
+	let scheduleWizard = $state<
+		| {
+				script: string
+				onSchedule: (s: PipelineInsertSchedule) => void
+				at: { x: number; y: number }
+		  }
+		| undefined
+	>(undefined)
+	let scheduleWizardSignal = $state(0)
+
+	function toFix(spec: NodeFixSpec | undefined): NodeFix | undefined {
+		if (!spec) return undefined
+		return {
+			explainer: spec.explainer,
+			actions: spec.actions.map((a) => ({
+				label: a.label,
+				detail: a.detail,
+				run: (anchor) => {
+					if (a.scheduleFor) {
+						scheduleWizard = { ...a.scheduleFor, at: anchor }
+						scheduleWizardSignal++
+					} else a.run?.()
+				}
+			}))
+		}
+	}
+	function handleContextMenu(e: MouseEvent) {
+		const t = e.target as HTMLElement | null
+		// A node's own actions menu opens on right-click; the browser's never does,
+		// on nodes without one either.
+		if (t?.closest('.svelte-flow__node')) {
+			e.preventDefault()
+			return
+		}
+		if (!onAddPipelineScript || boundPick || !t?.closest('.svelte-flow__pane')) return
+		e.preventDefault()
+		paneMenu = { x: e.clientX, y: e.clientY }
+	}
+
 	// `${kind}:${path}` ids for the hovered / pinned runs (both script and flow
 	// variants, since the run row's kind isn't known here).
 	const runIds = (paths: string[] | undefined): Set<string> =>
@@ -256,7 +658,12 @@
 			| 'macro'
 			| 'test-dependency'
 			| 'dbt-ref'
+			// Assets-only view: an asset → an asset computed from it, through the
+			// script that is folded away.
+			| 'asset-flow'
 		unsaved?: boolean
+		// Assets-only `asset-flow`: a write to the source reruns a folded script.
+		reactive?: boolean
 		// Muted read edge: a ducklake/s3 input read every run whose (default)
 		// auto cascade trigger is suppressed by `// mute` / `// mute all`.
 		// Rendered with a bell-off badge — auto-wiring is the norm, so we mark
@@ -276,6 +683,8 @@
 		// whole lib when pulled in via `// use`) — rendered as a ƒ badge.
 		macro_names?: string[]
 		via_use?: boolean
+		// Assets-only edges: the scripts folded between the two assets.
+		via?: string[]
 	}
 
 	// Graph-id of the script the user just launched (zero-latency hint),
@@ -290,7 +699,7 @@
 	function build(g: AssetGraphResponse) {
 		const nodes: Array<{
 			id: string
-			type: 'asset' | 'runnable' | 'trigger' | 'add' | 'data-test'
+			type: 'asset' | 'runnable' | 'trigger' | 'add' | 'data-test' | 'no-asset'
 			data: any
 		}> = []
 		const edges: BuiltEdge[] = []
@@ -427,8 +836,10 @@
 					path: a.path,
 					fork_materialization: a.fork_materialization,
 					derived_from: a.derived_from,
+					error: a.error,
 					dbt: a.dbt,
 					onAddScript: onAddScriptForAsset,
+					neverWritten: a.never_written,
 					pathPrefix,
 					defaultPathSuffix,
 					producers: producersByAsset.get(`${a.kind}:${a.path}`) ?? [],
@@ -454,11 +865,14 @@
 									const owner = model.dbtOwnerByAsset.get(assetId)
 									const [kind, ...rest] = owner?.split(':') ?? []
 									if (kind && rest.length) {
-										onselect?.({
-											kind: 'runnable',
-											runnable_kind: kind as 'script' | 'flow',
-											path: rest.join(':')
-										})
+										onselect?.(
+											{
+												kind: 'runnable',
+												runnable_kind: kind as 'script' | 'flow',
+												path: rest.join(':')
+											},
+											{ open: true }
+										)
 									}
 								}
 							}
@@ -466,14 +880,6 @@
 				}
 			})
 		}
-		// Set of `script_path` values for runnables that are still drafts (no
-		// DB row yet). Trigger nodes use this to swap "Click to create" for
-		// "Click to create (after draft save)" so the user knows the create
-		// button is blocked until the script is deployed.
-		const unsavedRunnablePaths = new Set<string>()
-		for (const r of g.runnables) {
-			if (r.unsaved) unsavedRunnablePaths.add(r.path)
-		}
 		// Producer → its `// data_test` checks, keyed by runnable id, so the
 		// write-edge to the materialized asset can carry the test badge: the
 		// edge *is* the transformation, and the tests assert on what it produces.
@@ -526,6 +932,9 @@
 				data: {
 					runnable_kind: r.usage_kind,
 					path: r.path,
+					summary: r.summary,
+					language: r.language,
+					error: r.error,
 					in_pipeline: r.in_pipeline ?? false,
 					partition_kind: r.partition_kind,
 					freshness: r.freshness,
@@ -724,6 +1133,10 @@
 				kind: TriggerNodeKind
 				ref: string
 				missing: boolean
+				draft: boolean
+				schedule?: string
+				timezone?: string
+				summary?: string
 				// First target script (drives the per-script create/edit flows).
 				runnable_path?: string
 				// Every target script: a single (kind, ref) — e.g. one schedule —
@@ -739,7 +1152,11 @@
 			ref: string,
 			unsaved: boolean,
 			missing: boolean,
-			runnable_path?: string
+			draft: boolean,
+			runnable_path?: string,
+			schedule?: string,
+			timezone?: string,
+			summary?: string
 		) {
 			const prev = triggerSourceNodes.get(id)
 			if (!prev) {
@@ -748,6 +1165,10 @@
 					kind,
 					ref,
 					missing,
+					draft,
+					schedule,
+					timezone,
+					summary,
 					runnable_path,
 					runnable_paths: runnable_path ? [runnable_path] : []
 				})
@@ -796,13 +1217,17 @@
 				ref,
 				!!t.unsaved,
 				isMissing,
+				t.draft === true,
 				// Always thread the target script so the trigger node can
 				// reach back to it — drives both the missing-trigger "create"
 				// flow and the attached-trigger "edit" flow's script-path
 				// lock. Previously only set for missing, which silently
 				// disabled `canEdit` (and the resulting click affordance)
 				// on every attached native trigger.
-				t.runnable_path
+				t.runnable_path,
+				t.schedule,
+				t.timezone,
+				t.summary
 			)
 			edges.push({
 				id: `trig-${t.trigger_kind}:${sourceId}->${runnableId}`,
@@ -830,10 +1255,12 @@
 					ref: info.ref,
 					unsaved: info.allUnsaved,
 					missing: info.missing,
+					draft: info.draft,
+					schedule: info.schedule,
+					timezone: info.timezone,
+					summary: info.summary,
 					runnable_path: info.runnable_path,
-					runnable_unsaved: info.runnable_path
-						? unsavedRunnablePaths.has(info.runnable_path)
-						: false,
+					runnable_paths: info.runnable_paths,
 					// data_upload nodes go green once a file is staged for their
 					// target script (see readyDataUploadPaths / page dataUploadArgs).
 					ready: info.runnable_path
@@ -881,11 +1308,383 @@
 
 	let model = $derived(build(graph))
 
+	// The trigger chip last clicked in the assets-only view, by trigger node id: it
+	// opens a drawer rather than a selection, so it is highlighted until the next pick.
+	let activeTriggerId = $state<string | undefined>(undefined)
+	$effect(() => {
+		void selection
+		activeTriggerId = undefined
+	})
+
+	/** The chip naming what runs an asset's producer, and the editor it opens: the
+	 * same routes the trigger's own node takes. */
+	function triggerChip(
+		t: (AssetUpstream & { multiple: false })['trigger'],
+		scriptPath: string
+	): {
+		label: string
+		/** Nothing to show: the edges into the node already say it runs on writes. */
+		hidden?: boolean
+		kind?: string
+		nodeId?: string
+		missing?: boolean
+		draft?: boolean
+		onOpen?: () => void
+	} {
+		if (!t) return { label: 'Manual' }
+		if (t.kind === 'asset') return { label: '', hidden: true }
+		const kind = t.kind as NativeTriggerKind
+		const style = TRIGGER_NODE_STYLE[kind]
+		const label =
+			t.kind === 'schedule' && t.data?.schedule
+				? (describeSchedule(t.data.schedule, t.data.timezone) ?? `Schedule (${t.data.schedule})`)
+				: (style?.label ?? t.kind)
+		const rowless = kind === 'webhook' || kind === 'data_upload'
+		const missing = !!t.data?.missing && !rowless
+		const open =
+			kind === 'webhook'
+				? onOpenWebhook && (() => onOpenWebhook(scriptPath))
+				: kind === 'data_upload'
+					? onOpenDataUpload && (() => onOpenDataUpload(scriptPath))
+					: missing
+						? onCreateMissingTrigger && (() => onCreateMissingTrigger(kind, scriptPath))
+						: t.data?.ref && onEditTrigger
+							? () => onEditTrigger(kind, t.data.ref, scriptPath)
+							: undefined
+		return {
+			label,
+			kind,
+			nodeId: t.nodeId,
+			missing,
+			draft: t.data?.draft,
+			onOpen: open
+				? () => {
+						activeTriggerId = t.nodeId
+						open()
+					}
+				: undefined
+		}
+	}
+
+	// Scripts and triggers fold into the assets they produce: each asset carries
+	// its producer's run state, language and trigger instead of drawing them.
+	function assetsOnlyModel(m: typeof model): typeof model {
+		const v = assetsOnlyView(m.nodes, m.edges)
+		const runnables = new Map(m.nodes.filter((n) => n.type === 'runnable').map((n) => [n.id, n]))
+		// What an asset card shows in this view: its producer's chips, its width,
+		// and what deleting it removes. `data` is an asset's, or the "No asset" node's.
+		const fold = (data: any, u: AssetUpstream | undefined) => {
+			const r = u && !u.multiple ? runnables.get(u.runnableId)?.data : undefined
+			// A dbt model is built by its project, whose writes the canvas does not
+			// draw; its dbt chip already names it.
+			const upstream = !u
+				? data.dbt && data.dbt.resource_type !== 'source'
+					? undefined
+					: { none: true as const }
+				: u.multiple || !r
+					? {
+							multiple: true as const,
+							scripts: (u.multiple ? u.runnableIds : [])
+								.map((id) => runnables.get(id)?.data)
+								.filter((d) => d != undefined)
+								.map((d) => ({
+									runnableId: `${d.runnable_kind}:${d.path}`,
+									path: d.path as string,
+									summary: d.summary as string | undefined,
+									language: d.language,
+									unsaved: d.unsaved as boolean | undefined,
+									onOpen: () =>
+										onselect?.(
+											{ kind: 'runnable', runnable_kind: d.runnable_kind, path: d.path },
+											{ open: true }
+										)
+								})),
+							// Every script's own triggers; asset triggers show as edges instead.
+							triggers: (u.multiple ? u.runnableIds : [])
+								.flatMap((id) => {
+									const d = runnables.get(id)?.data
+									if (!d) return []
+									return m.edges
+										.filter((e) => e.kind === 'trigger-native' && e.target === id)
+										.map((e) => m.nodes.find((n) => n.id === e.source))
+										.filter((t) => t != undefined)
+										.map((t) => ({
+											...triggerChip(
+												{ nodeId: t.id, kind: t.data.kind, data: t.data },
+												d.path as string
+											),
+											script: d.path as string
+										}))
+								})
+								.filter((t) => !t.hidden)
+						}
+					: {
+							runnableId: u.runnableId,
+							path: r.path,
+							summary: r.summary,
+							language: r.language,
+							unsaved: r.unsaved,
+							runState: r.runState,
+							trigger: triggerChip(u.trigger, r.path),
+							onOpen: () =>
+								onselect?.(
+									{ kind: 'runnable', runnable_kind: r.runnable_kind, path: r.path },
+									{ open: true }
+								)
+						}
+			const toDelete =
+				onDeleteAssetUpstream && u && !u.multiple && r
+					? upstreamDeletion(u, r, v.upstream)
+					: undefined
+			// The scripts and triggers folded into this node, whose errors it reports.
+			const scriptIds = u ? (u.multiple ? u.runnableIds : [u.runnableId]) : []
+			const foldedIds = [
+				...scriptIds,
+				...m.edges
+					.filter((e) => e.kind === 'trigger-native' && scriptIds.includes(e.target))
+					.map((e) => e.source)
+			]
+			const foldedErrors = foldedIds.filter((id) => nodeFixes?.has(id)).length
+			const asset = { kind: data.asset_kind, path: data.path }
+			// Chips this estimate does not model keep the regular width.
+			const width =
+				upstream && !data.dbt && !data.fork_materialization && !data.derived_from && !data.runStatus
+					? assetsOnlyNodeWidth({
+							kind: data.noAsset ? 'No asset' : formatAssetKind(asset),
+							title: data.noAsset ? data.noAssetName : formatShortAssetPath(asset),
+							chip: foldedErrors
+								? `${foldedErrors} errors · Fix`
+								: 'none' in upstream
+									? 'External source'
+									: 'multiple' in upstream
+										? (upstream.triggers?.length ?? 0) > 1
+											? 'Multiple triggers'
+											: (upstream.triggers?.length ?? 0) === 1
+												? (upstream.triggers?.[0]?.label ?? '')
+												: ''
+										: upstream.trigger.hidden
+											? ''
+											: `${upstream.trigger.label}${upstream.trigger.draft ? ' · draft' : ''}`,
+							chipIcon: foldedErrors > 0,
+							// Room for the chip's trailing icon: a pencil, or the chevron of a
+							// several-trigger menu (about as wide).
+							chipEdit:
+								!foldedErrors &&
+								('multiple' in upstream
+									? (upstream.triggers?.length ?? 0) > 1 ||
+										(!!upstream.triggers?.[0]?.onOpen && !upstream.triggers?.[0]?.missing)
+									: 'trigger' in upstream &&
+										!!upstream.trigger?.onOpen &&
+										!upstream.trigger.missing),
+							header:
+								'runnableId' in upstream
+									? {
+											label: upstream.summary || upstream.path,
+											icons: 1,
+											draft: !!upstream.unsaved
+										}
+									: 'scripts' in upstream && upstream.scripts?.length
+										? upstream.scripts.length === 1
+											? {
+													label: upstream.scripts[0].summary || upstream.scripts[0].path,
+													icons: 1,
+													draft: !!upstream.scripts[0].unsaved
+												}
+											: { label: `${upstream.scripts.length} scripts`, icons: 2, chevron: true }
+										: undefined
+						})
+					: undefined
+			return {
+				...data,
+				upstream,
+				width,
+				foldedIds,
+				...(toDelete
+					? {
+							upstreamDelete: toDelete,
+							deleteVerb: assetDeleteVerb,
+							onDeleteUpstream: (t: AssetUpstreamDelete) => onDeleteAssetUpstream?.(t)
+						}
+					: onDeleteAssetUpstream && u
+						? {
+								// No combined delete, but each script it folds can still go on its
+								// own: in this view its node's menu is the only way to reach it.
+								scriptDeletes: (u.multiple ? u.runnableIds : [u.runnableId])
+									.map((id) => runnables.get(id)?.data)
+									.filter((d) => d?.runnable_kind === 'script')
+									.map((d) => ({ path: d.path as string, unsaved: !!d.unsaved })),
+								// Its scripts' own triggers: a row that starts only them, which
+								// webhooks and data uploads (no row) and missing ones are not.
+								triggerDeletes: scriptIds.flatMap((id) => {
+									const runnable = runnables.get(id)?.data
+									// A flow is not deleted from here, and neither are its triggers.
+									if (runnable?.runnable_kind !== 'script') return []
+									const scriptPath = runnable.path
+									return m.edges
+										.filter((e) => e.kind === 'trigger-native' && e.target === id)
+										.map((e) => m.nodes.find((n) => n.id === e.source)?.data)
+										.filter(
+											(t) =>
+												t &&
+												t.kind !== 'webhook' &&
+												t.kind !== 'data_upload' &&
+												t.ref &&
+												!t.missing &&
+												((t.runnable_paths ?? []) as string[]).every((p) => p === scriptPath)
+										)
+										.map((t) => ({
+											kind: t.kind as NativeTriggerKind,
+											path: t.ref as string,
+											draft: !!t.draft
+										}))
+								}),
+								deleteVerb: assetDeleteVerb,
+								onDeleteUpstream: (t: AssetUpstreamDelete) => onDeleteAssetUpstream?.(t),
+								// The No-asset card stands for its scripts; an asset is built by them.
+								deleteBlocked: data.noAsset
+									? !u.multiple
+										? 'it stands for a flow'
+										: u.runnableIds.length > 1
+											? 'it stands for several scripts'
+											: 'its script has several triggers'
+									: !u.multiple
+										? r?.runnable_kind === 'flow'
+											? 'a flow builds it'
+											: 'its script builds other assets too'
+										: u.runnableIds.length > 1
+											? 'several scripts build it'
+											: 'its script has several triggers'
+							}
+						: {})
+			}
+		}
+		const nodes = m.nodes
+			.filter((n) => n.id === ADD_NODE_ID || v.nodeIds.has(n.id))
+			.map((n) => (n.type === 'asset' ? { ...n, data: fold(n.data, v.upstream.get(n.id)) } : n))
+		for (const id of v.noAssetNodeIds) {
+			const u = v.upstream.get(id)
+			const scriptId = u && !u.multiple ? u.runnableId : u?.runnableIds[0]
+			const data = fold(
+				{ noAsset: true, noAssetName: scriptId?.split('/').pop() ?? 'script' },
+				u
+			)
+			// Run only by writes to what it reads, the edges into it already say how
+			// it starts: the script's banner alone. Another trigger, or an error to
+			// fix, needs the card's chip row.
+			const bannerOnly =
+				!!u &&
+				!u.multiple &&
+				u.trigger?.kind === 'asset' &&
+				!(data.foldedIds as string[]).some((f) => nodeFixes?.has(f))
+			nodes.push({ id, type: 'no-asset', data: bannerOnly ? { ...data, bannerOnly } : data })
+		}
+		const edges: BuiltEdge[] = v.edges.map((e) => ({ ...e, kind: e.kind as BuiltEdge['kind'] }))
+		if (nodes.some((n) => n.id === ADD_NODE_ID)) {
+			const hasIncoming = new Set(edges.map((e) => e.target))
+			for (const n of nodes) {
+				if (n.id !== ADD_NODE_ID && !hasIncoming.has(n.id)) {
+					edges.push({
+						id: `add-anchor:${n.id}`,
+						source: ADD_NODE_ID,
+						target: n.id,
+						kind: 'add-anchor'
+					})
+				}
+			}
+		}
+		return { ...m, nodes, edges }
+	}
+	// Reads that start nothing (lookups, reference tables) are often most of a
+	// graph's edges; hiding them leaves what makes the pipeline run. Remembered
+	// across pipelines.
+	const SHOW_PASSIVE_READS_KEY = 'pipeline-show-passive-reads'
+	let showPassiveReads = $state(true)
+	try {
+		showPassiveReads = localStorage.getItem(SHOW_PASSIVE_READS_KEY) !== 'false'
+	} catch {}
+	let withoutPassive = $derived(withoutPassiveReads(model.nodes, model.edges))
+	// Only where the toggle is shown: the preference is global, and a graph
+	// without the toggle would have no way to show the reads again.
+	let shownModel = $derived(
+		!assetsOnlyToggle || showPassiveReads || withoutPassive.dropped === 0
+			? model
+			: { ...model, nodes: withoutPassive.nodes, edges: withoutPassive.edges }
+	)
+	let view = $derived(assetsOnly ? assetsOnlyModel(shownModel) : shownModel)
+
 	// dbt association, surfaced by emphasis instead of edges. Hovering a model's
 	// dbt badge lights up the project node that materializes it; hovering the
 	// project node lights up every model it owns. Clicking the badge selects the
 	// project node, so the association survives the pointer leaving.
 	let dbtHoverId = $state<string | undefined>(undefined)
+
+	// Hovering a node keeps its lineage — everything upstream and downstream of
+	// it, recursively — at full strength and fades the rest. Off while a bounded
+	// pick or a subscribe drag owns the graph's dimming.
+	let hoveredNodeId = $state<string | undefined>(undefined)
+	// A click re-renders the graph under the cursor (the selection rebuilds the
+	// nodes, the details pane resizes or covers the canvas), which fires bursts of
+	// leave/enter. The fade waits for the pointer to settle on a node, outlives a
+	// brief leave, and stays off on a node just clicked until another is hovered.
+	let hoverTimer: ReturnType<typeof setTimeout> | undefined
+	let clickedNodeId: string | undefined
+	function onNodePointerEnter(id: string) {
+		clearTimeout(hoverTimer)
+		if (id === clickedNodeId) return
+		clickedNodeId = undefined
+		hoverTimer = setTimeout(() => (hoveredNodeId = id), 120)
+	}
+	function onNodePointerLeave() {
+		clearTimeout(hoverTimer)
+		hoverTimer = setTimeout(() => (hoveredNodeId = undefined), 80)
+	}
+	$effect(() => () => clearTimeout(hoverTimer))
+	let lineage = $derived(
+		hoveredNodeId && hoveredNodeId !== ADD_NODE_ID && !boundPick && !onDrag
+			? hoverLineage(
+					view.edges.filter((e) => e.kind !== 'add-anchor'),
+					hoveredNodeId
+				)
+			: undefined
+	)
+	// The fade goes through a stylesheet keyed on node and edge ids, never through
+	// the graph's node or edge objects: new node objects make the flow re-measure
+	// them and rebuild every edge they touch, and a rebuilt element jumps to its
+	// new opacity instead of easing there.
+	const canvasId = randomUUID()
+	let lineageFadeCss = $derived.by(() => {
+		if (!lineage) return ''
+		const scope = `[data-asset-canvas="${canvasId}"]`
+		const nodes = view.nodes
+			.filter((n) => outsideLineage(n.id))
+			.map((n) => `${scope} .svelte-flow__node[data-id="${CSS.escape(n.id)}"]`)
+		const edges = view.edges
+			.filter((e) => e.kind !== 'add-anchor' && !lineage!.hasEdge(e))
+			.map((e) => `${scope} .svelte-flow__edge[data-id="${CSS.escape(e.id)}"]`)
+		return [
+			nodes.length ? `${nodes.join(',')}{opacity:0.5}` : '',
+			edges.length ? `${edges.join(',')}{opacity:0.35}` : ''
+		].join('')
+	})
+	// Assets-only: a trigger edge A → C that A → B → … → C already implies says
+	// nothing new, so it recedes; the chain carries the cascade.
+	let impliedTriggerEdges = $derived(
+		assetsOnly
+			? transitivelyImpliedEdges(view.edges.filter((e) => e.kind === 'asset-flow' && e.reactive))
+			: new Set<string>()
+	)
+	let lineageSheet = $state<HTMLStyleElement | undefined>(undefined)
+	onMount(() => {
+		const sheet = document.createElement('style')
+		document.head.appendChild(sheet)
+		lineageSheet = sheet
+		return () => sheet.remove()
+	})
+	$effect(() => {
+		if (lineageSheet) lineageSheet.textContent = lineageFadeCss
+	})
+	const outsideLineage = (id: string) =>
+		!!lineage && id !== ADD_NODE_ID && !lineage.upstream.has(id) && !lineage.downstream.has(id)
 	let dbtEmphasisIds = $derived.by(() => {
 		if (!dbtHoverId) return new Set<string>()
 		const owned = model.dbtWritesByOwner.get(dbtHoverId)
@@ -922,14 +1721,14 @@
 	// input; the rendered edges are untouched (both arrows still drawn).
 	let writeEdgePairs = $derived(
 		new Set(
-			model.edges.filter((e) => e.kind === 'lineage-write').map((e) => `${e.source}\n${e.target}`)
+			view.edges.filter((e) => e.kind === 'lineage-write').map((e) => `${e.source}\n${e.target}`)
 		)
 	)
 	let layoutInput = $derived({
-		nodes: model.nodes
-			.map((n) => ({ id: n.id, data: n.data }))
+		nodes: view.nodes
+			.map((n) => ({ id: n.id, data: n.data, width: n.data?.width as number | undefined }))
 			.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)),
-		edges: model.edges
+		edges: view.edges
 			.filter(
 				(e) =>
 					!(
@@ -950,7 +1749,18 @@
 						: 1
 			)
 	})
-	let layoutPositions = $derived(layoutAssetGraph(layoutInput, ADD_NODE_ID))
+	let layoutPositions = $derived(
+		layoutAssetGraph(
+			layoutInput,
+			ADD_NODE_ID,
+			assetsOnly
+				? PIPELINE_NODE_EXTRA_ROW + PIPELINE_NODE_HEADER + PIPELINE_NODE_HEADER_CARD_PAD
+				: 0
+		)
+	)
+
+	/** Assets-only asset cards size to their text; every other node is `NODE.width`. */
+	const nodeWidth = (n: { data?: any }): number => n.data?.width ?? NODE.width
 
 	let positionedNodes = $derived.by(() => {
 		// Compute bbox width from layout; shift every x so the graph is
@@ -965,11 +1775,8 @@
 		}
 		const bboxWidth = isFinite(minX) ? maxX - minX : 0
 		const xCenter = paneWidth / 2 - bboxWidth / 2
-		return model.nodes.map<Node>((n) => {
+		return view.nodes.map<Node>((n) => {
 			const p = layoutPositions.get(n.id) ?? { x: 0, y: 0 }
-			// Compensate for the + node being narrower than its layout slot
-			// so it visually centers over the node(s) below.
-			const xShift = n.id === ADD_NODE_ID ? (NODE.width - ADD_NODE_WIDTH) / 2 : 0
 			// Activity-panel emphasis (purely visual rings, kept off `selected`
 			// which swaps the details pane). Hover wins over pin so the cursor
 			// always tracks.
@@ -998,12 +1805,73 @@
 				else if (!boundPick.eligible.has(n.id)) boundClass = 'wm-bound-dim'
 			}
 			const dbtClass = dbtEmphasisIds.has(n.id) ? 'wm-dbt-linked' : undefined
+			const dragClass = !onDrag
+				? undefined
+				: onDrag.eligible.has(n.id)
+					? onDrag.over === n.id
+						? 'wm-drag-over'
+						: undefined
+					: n.id === onDrag.sourceId
+						? undefined
+						: 'wm-drag-dim'
+			// The chips' selected look rides on the positioned nodes, so a selection
+			// never re-runs the layout.
+			const up = n.type === 'asset' || n.type === 'no-asset' ? n.data.upstream : undefined
+			const fix = toFix(nodeFixes?.get(n.id))
+			const withUpstream = up?.scripts
+				? {
+						...n.data,
+						upstream: {
+							...up,
+							selected: up.scripts.some(
+								(sc: { runnableId: string }) => sc.runnableId === selectedId
+							),
+							triggers: (up.triggers ?? []).map((t: { nodeId?: string }) => ({
+								...t,
+								selected: !!t.nodeId && t.nodeId === activeTriggerId
+							}))
+						}
+					}
+				: up?.runnableId !== undefined
+					? {
+							...n.data,
+							upstream: {
+								...up,
+								selected: up.runnableId === selectedId,
+								trigger: {
+									...up.trigger,
+									selected: !!up.trigger.nodeId && up.trigger.nodeId === activeTriggerId
+								}
+							}
+						}
+					: n.data
+			const foldedFixes = ((n.data.foldedIds ?? []) as string[])
+				.map((id) => toFix(nodeFixes?.get(id)))
+				.filter((f) => f != undefined)
+			const scriptsToDrag = onAddAssetTrigger ? dragScripts(n) : []
+			// Assets-only: a folded script with an error reddens the header naming it.
+			const scriptError = ((n.data.foldedIds ?? []) as string[]).some(
+				(id) => id.startsWith('script:') && nodeFixes?.has(id)
+			)
+			const data = {
+				...withUpstream,
+				...(scriptError ? { scriptError } : {}),
+				...(fix ? { fix } : {}),
+				...(foldedFixes.length ? { foldedFixes } : {}),
+				...(scriptsToDrag.length
+					? { onStartOnDrag: (e: PointerEvent) => startOnDrag(n.id, scriptsToDrag, e) }
+					: {}),
+				...(n.type === 'asset' && onAddScriptForAsset
+					? { onStartFeedDrag: (e: PointerEvent) => startFeedDrag(n.id, n.data, e) }
+					: {})
+			}
 			return {
 				id: n.id,
 				type: n.type,
-				position: { x: p.x + xCenter + xShift, y: p.y + 40 },
-				data: n.data,
-				class: boundClass ?? dbtClass ?? runClass ?? assetClass,
+				// The layout places centers; a node's position is its top-left corner.
+				position: { x: p.x - nodeWidth(n) / 2 + xCenter, y: p.y + 40 },
+				data,
+				class: dragClass ?? boundClass ?? dbtClass ?? runClass ?? assetClass,
 				selected: n.id === selectedId,
 				// All nodes non-draggable: the layout is sugiyama-computed,
 				// dragging would fight the reactive re-layout. Selection is
@@ -1013,7 +1881,7 @@
 				// on its inner box so the edit/create button still receives
 				// clicks despite svelte-flow's wrapper-level pointer-events: none.
 				draggable: false,
-				selectable: n.id !== ADD_NODE_ID && n.type !== 'trigger'
+				selectable: n.id !== ADD_NODE_ID && n.type !== 'trigger' && n.type !== 'no-asset'
 			}
 		})
 	})
@@ -1039,7 +1907,7 @@
 	let assetEmphasis = $derived.by<Map<string, 'input' | 'output'>>(() => {
 		const m = new Map<string, 'input' | 'output'>()
 		if (emphasizedRunIdSet.size === 0) return m
-		for (const e of model.edges) {
+		for (const e of view.edges) {
 			if (e.kind === 'lineage-write' && emphasizedRunIdSet.has(e.source)) {
 				m.set(e.target, 'output')
 			} else if (
@@ -1058,15 +1926,20 @@
 	let nodeCenters = $derived(
 		positionedNodes
 			.filter((n) => n.id !== ADD_NODE_ID)
-			.map((n) => ({ id: n.id, cx: n.position.x + NODE.width / 2, cy: n.position.y }))
+			.map((n) => ({
+				id: n.id,
+				cx: n.position.x + nodeWidth(n) / 2,
+				cy: n.position.y,
+				halfW: nodeWidth(n) / 2
+			}))
 	)
-	// Detour lane for an edge whose straight run would pass over an unrelated
-	// node (the failure the same-column gutter can't see). For each node
-	// strictly between the endpoints' rows, sample the straight line at that
-	// row; if the node sits under it, route around the obstacle on the side the
-	// edge is already heading. Returns the outermost lane x clearing every
+	// Detour lane for an edge whose run would pass over an unrelated node. An
+	// edge spanning rows bends inside the first gap below its source and then
+	// runs straight down the *target's* column (see AssetGraphEdge), so every
+	// node strictly between the endpoints' rows is tested against the target's
+	// x, not against a source→target line. A crossed node is routed around on
+	// the side the target lies. Returns the outermost lane x clearing every
 	// crossed node, or undefined when the corridor is clear. O(nodes) per edge.
-	const HALF_W = NODE.width / 2
 	const ROUTE_PAD = NODE.gap.horizontal / 2
 	function detourForEdge(sourceId: string, targetId: string): number | undefined {
 		const s = nodeCenters.find((n) => n.id === sourceId)
@@ -1078,11 +1951,10 @@
 			if (n.id === sourceId || n.id === targetId) continue
 			// strictly between the two rows
 			if ((n.cy - s.cy) / dyTot <= 0.01 || (n.cy - s.cy) / dyTot >= 0.99) continue
-			const edgeX = s.cx + (t.cx - s.cx) * ((n.cy - s.cy) / dyTot)
-			if (Math.abs(edgeX - n.cx) >= HALF_W + 8) continue
+			if (Math.abs(t.cx - n.cx) >= n.halfW + 8) continue
 			// Crossed: a lane just outside this node, toward the target side.
 			const side = t.cx >= n.cx ? 1 : -1
-			const candidate = n.cx + side * (HALF_W + ROUTE_PAD)
+			const candidate = n.cx + side * (n.halfW + ROUTE_PAD)
 			// Keep the outermost lane so one detour clears every obstacle.
 			if (lane == undefined || Math.abs(candidate - s.cx) > Math.abs(lane - s.cx)) lane = candidate
 		}
@@ -1090,7 +1962,7 @@
 	}
 
 	let flowEdges = $derived.by(() =>
-		model.edges
+		view.edges
 			// Anchor edges are layout-only.
 			.filter((e) => e.kind !== 'add-anchor')
 			.map<Edge>((e) => {
@@ -1118,30 +1990,42 @@
 				// the "happening now" signal.
 				switch (e.kind) {
 					case 'lineage-write':
-						style = 'stroke: rgb(59 130 246); stroke-width: 2px;'
+						style = 'stroke: rgb(59 130 246); stroke-width: 1.25px;'
 						animated = flowAnimated
 						markerColor = 'rgb(59 130 246)'
 						break
+					case 'asset-flow':
+						// Assets-only: a write upstream reruns what builds the target
+						// (solid, like a trigger), or the target only reads it (dashed gray).
+						if (e.reactive) {
+							style = `stroke: rgb(59 130 246); stroke-width: 1.5px;${impliedTriggerEdges.has(e.id) ? ' opacity: 0.35;' : ''}`
+							markerColor = 'rgb(59 130 246)'
+						} else {
+							style = 'stroke: rgb(156 163 175); stroke-width: 1px;'
+							strokeDasharray = '4 3'
+							markerColor = 'rgb(156 163 175)'
+						}
+						break
 					case 'lineage-read':
-						style = 'stroke: rgb(156 163 175); stroke-width: 1.25px;'
+						style = 'stroke: rgb(156 163 175); stroke-width: 1px;'
 						animated = flowAnimated
 						break
 					case 'data-test':
 						// Asset → its custom-test script: dashed, muted, no run
 						// animation (the test isn't a producing step).
-						style = 'stroke: rgb(156 163 175); stroke-width: 1.25px;'
+						style = 'stroke: rgb(156 163 175); stroke-width: 1px;'
 						strokeDasharray = '4 3'
 						markerColor = 'rgb(156 163 175)'
 						break
 					case 'trigger-asset':
-						style = 'stroke: rgb(107 114 128); stroke-width: 2px;'
+						style = 'stroke: rgb(107 114 128); stroke-width: 1.25px;'
 						animated = flowAnimated
 						markerColor = 'rgb(107 114 128)'
 						label = 'triggers'
 						labelStyle = 'fill: rgb(107 114 128); font-size: 10px; font-weight: 600;'
 						break
 					case 'trigger-native':
-						style = 'stroke: rgb(107 114 128); stroke-width: 2px;'
+						style = 'stroke: rgb(107 114 128); stroke-width: 1.25px;'
 						strokeDasharray = '6 3'
 						markerColor = 'rgb(107 114 128)'
 						label = 'triggers'
@@ -1151,7 +2035,7 @@
 						// Library → consumer: violet dashed, visually apart from both
 						// lineage (blue/gray solid) and trigger (gray dashed) families —
 						// it's a code dependency, not data flow or execution.
-						style = 'stroke: rgb(139 92 246); stroke-width: 1.25px;'
+						style = 'stroke: rgb(139 92 246); stroke-width: 1px;'
 						strokeDasharray = '5 3'
 						markerColor = 'rgb(139 92 246)'
 						label = e.via_use ? 'uses lib' : 'macros'
@@ -1161,7 +2045,7 @@
 						// Producer → tested script: amber dashed ordering link. Not
 						// data flow (blue/gray) nor execution trigger (gray "triggers")
 						// — it only says "the test needs this asset to exist first".
-						style = 'stroke: rgb(217 119 6); stroke-width: 1.25px;'
+						style = 'stroke: rgb(217 119 6); stroke-width: 1px;'
 						strokeDasharray = '5 3'
 						markerColor = 'rgb(217 119 6)'
 						label = 'test needs'
@@ -1171,7 +2055,7 @@
 						// model → model inside one dbt project. Orange, matching the
 						// dbt badges, and dashed because the edge is dbt's own lineage
 						// rather than a Windmill read/write the cascade acts on.
-						style = 'stroke: rgb(234 88 12); stroke-width: 1.25px;'
+						style = 'stroke: rgb(234 88 12); stroke-width: 1px;'
 						strokeDasharray = '4 3'
 						markerColor = 'rgb(234 88 12)'
 						label = 'ref'
@@ -1208,7 +2092,7 @@
 				// (red dashed dimmed — fresh draft annotation that also has
 				// no matching row, which is the common case).
 				if (e.missing) {
-					style = 'stroke: rgb(239 68 68); stroke-width: 2px;'
+					style = 'stroke: rgb(239 68 68); stroke-width: 1.25px;'
 					strokeDasharray = '3 3'
 					markerColor = 'rgb(239 68 68)'
 					label = 'missing trigger'
@@ -1246,8 +2130,8 @@
 					style,
 					markerEnd: {
 						type: MarkerType.ArrowClosed,
-						width: 14,
-						height: 14,
+						width: 12,
+						height: 12,
 						color: markerColor
 					}
 				}
@@ -1265,6 +2149,7 @@
 
 	const nodeTypes = {
 		asset: AssetNode as any,
+		'no-asset': AssetNode as any,
 		runnable: RunnableNode as any,
 		trigger: TriggerNode as any,
 		add: AddNode as any,
@@ -1276,6 +2161,9 @@
 	}
 
 	function handleNodeClick({ node }: { node: Node }) {
+		clearTimeout(hoverTimer)
+		hoveredNodeId = undefined
+		clickedNodeId = node.id
 		// Bounded-run pick mode intercepts clicks: an eligible (downstream)
 		// node toggles as an end bound; the start, dimmed nodes, and
 		// triggers/+ are inert. Selection (details pane) is suppressed so the
@@ -1319,12 +2207,20 @@
 		) {
 			return
 		}
+		activeTriggerId = undefined
 		onselect(undefined)
 	}
 </script>
 
 <!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
-<div class="w-full h-full relative" bind:clientWidth={paneWidth} onclickcapture={handleBackgroundClick}>
+<div
+	class="w-full h-full relative"
+	data-asset-canvas={canvasId}
+	bind:this={flowEl}
+	bind:clientWidth={paneWidth}
+	onclickcapture={handleBackgroundClick}
+	oncontextmenu={handleContextMenu}
+>
 	<SvelteFlow
 		{nodes}
 		{edges}
@@ -1342,12 +2238,42 @@
 		defaultEdgeOptions={{ type: 'asset' }}
 		proOptions={{ hideAttribution: true }}
 		onnodeclick={handleNodeClick}
+		onnodepointerenter={({ node }) => onNodePointerEnter(node.id)}
+		onnodepointerleave={onNodePointerLeave}
+		onedgepointerenter={onEdgeEnter}
+		onedgepointerleave={onEdgeLeave}
 		--background-color={false}
 	>
 		<div class="absolute inset-0 !bg-surface-secondary h-full"></div>
-		<InitialFitView {nodes} fitKey={viewportFitKey} />
+		<InitialFitView {nodes} fitKey={`${viewportFitKey}:${assetsOnly}`} />
 		<PanToNode targetId={panToNodeId} {nodes} />
 		<Controls position="top-right" orientation="horizontal" showLock={false} class="!mr-10" />
+		{#if assetsOnlyToggle}
+			<Panel position="top-left" class="!m-3 flex flex-col gap-1.5">
+				<Toggle
+					checked={!assetsOnly}
+					size="xs"
+					options={{ right: 'Show scripts and triggers' }}
+					on:change={(e) => {
+						assetsOnly = !e.detail
+						if (assetsOnlyFolder != undefined) setAssetsOnlyFolder(assetsOnlyFolder, assetsOnly)
+					}}
+				/>
+				{#if withoutPassive.dropped > 0}
+					<Toggle
+						checked={showPassiveReads}
+						size="xs"
+						options={{ right: "Show reads that don't trigger runs" }}
+						on:change={(e) => {
+							showPassiveReads = e.detail
+							try {
+								localStorage.setItem(SHOW_PASSIVE_READS_KEY, String(e.detail))
+							} catch {}
+						}}
+					/>
+				{/if}
+			</Panel>
+		{/if}
 		{#if showMinimap}
 			<!-- Node hues mirror the canvas: blue asset cards, amber triggers,
 			     bordered neutral script cards. Visible strokes + rounded corners +
@@ -1379,21 +2305,173 @@
 	</SvelteFlow>
 </div>
 
+<svelte:window
+	onpointerdown={(e) => {
+		if (paneMenu && !(e.target as HTMLElement | null)?.closest('[data-pane-menu]'))
+			paneMenu = undefined
+	}}
+	onkeydown={(e) => {
+		if (e.key === 'Escape') paneMenu = undefined
+	}}
+/>
+
+{#if paneMenu}
+	<div
+		class="fixed {getContextMenuContainerClass()}"
+		style="left: {paneMenu.x}px; top: {paneMenu.y}px;"
+		transition:fly={{ duration: 150, y: -10 }}
+		role="menu"
+		data-pane-menu
+	>
+		<button
+			type="button"
+			role="menuitem"
+			class="{CONTEXT_MENU_ITEM_BASE_CLASS} {CONTEXT_MENU_ITEM_HOVER_CLASS} gap-2 w-full text-left"
+			onclick={() => {
+				if (paneMenu) addMenuAt = paneMenu
+				paneMenu = undefined
+				addMenuSignal++
+			}}
+		>
+			<Plus size={14} />
+			Add data source
+		</button>
+	</div>
+{/if}
+
+{#if onDrag}
+	<svg class="fixed inset-0 w-screen h-screen pointer-events-none z-50" aria-hidden="true">
+		<line
+			x1={onDrag.from.x}
+			y1={onDrag.from.y}
+			x2={onDrag.to.x}
+			y2={onDrag.to.y}
+			class="stroke-blue-500"
+			stroke-width="1.5"
+			stroke-dasharray="4 3"
+		/>
+		{#if !(onDrag.feed && onDrag.blank)}
+			<circle cx={onDrag.to.x} cy={onDrag.to.y} r="3" class="fill-blue-500" />
+		{/if}
+	</svg>
+	{#if onDrag.feed && onDrag.blank}
+		<div
+			class="fixed z-50 pointer-events-none -translate-x-1/2 -translate-y-1/2"
+			style="left: {onDrag.to.x}px; top: {onDrag.to.y}px;"
+		>
+			<AddDownstreamPill expanded />
+		</div>
+	{/if}
+{/if}
+
+{#if feedMenu && onAddScriptForAsset}
+	<div
+		class="fixed z-10 -translate-x-1/2 -translate-y-1/2"
+		style="left: {feedMenu.at.x}px; top: {feedMenu.at.y}px;"
+	>
+		<AddDownstreamMenu
+			asset={feedMenu.asset}
+			onAddScript={onAddScriptForAsset}
+			pathPrefix={feedMenu.data.pathPrefix ?? pathPrefix}
+			defaultPathSuffix={feedMenu.data.defaultPathSuffix ?? defaultPathSuffix}
+			openSignal={feedMenuSignal}
+		>
+			{#snippet trigger({ open })}
+				{#if open}
+					<AddDownstreamPill expanded />
+				{/if}
+			{/snippet}
+		</AddDownstreamMenu>
+	</div>
+{/if}
+
+{#if hoveredEdge && hoveredEdgeText}
+	{@const d = hoveredEdgeText}
+	{@const actions = hoveredEdgeActions}
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div
+		class="fixed z-50 max-w-80 rounded-md border bg-surface px-2.5 py-1.5 text-xs text-primary shadow-md"
+		style="left: {hoveredEdge.x + 12}px; top: {hoveredEdge.y + 12}px;"
+		transition:fly={{ duration: 120, y: -4 }}
+		role="tooltip"
+		onmouseenter={() => clearTimeout(edgeHoverTimer)}
+		onmouseleave={onEdgeLeave}
+	>
+		<span class="font-semibold text-emphasis">{d.subject}</span>
+		{d.phrase}
+		{#if d.object}<span class="font-semibold text-emphasis">{d.object}</span>{/if}
+		{#if d.note}<div class="mt-0.5 text-2xs text-secondary">{d.note}</div>{/if}
+		{#each actions as action (action.label)}
+			<div class="mt-2 flex flex-col gap-0.5">
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					onclick={() => {
+						// Closing the popover drops `actions`: run what this one held.
+						const run = action.run
+						hoveredEdge = undefined
+						run()
+					}}
+				>
+					{action.label}
+				</Button>
+				<span class="text-2xs text-secondary">{action.detail}</span>
+			</div>
+		{/each}
+	</div>
+{/if}
+
+{#if scheduleWizard}
+	<div class="fixed w-0 h-0" style="left: {scheduleWizard.at.x}px; top: {scheduleWizard.at.y}px;">
+		<PipelineInsertMenu
+			kinds={[{ id: 'schedule', label: 'On schedule', description: '', icon: Clock }]}
+			onPick={() => {}}
+			openSignal={scheduleWizardSignal}
+			scheduleFor={scheduleWizard.script}
+			onSchedule={(s) => scheduleWizard?.onSchedule(s)}
+		>
+			{#snippet trigger()}
+				<span class="block w-0 h-0" aria-hidden="true"></span>
+			{/snippet}
+		</PipelineInsertMenu>
+	</div>
+{/if}
+
+{#if onAddPipelineScript}
+	<div class="fixed w-0 h-0" style="left: {addMenuAt.x}px; top: {addMenuAt.y}px;">
+		<AddDataSourceMenu
+			{onAddPipelineScript}
+			{pathPrefix}
+			{defaultPathSuffix}
+			openSignal={addMenuSignal}
+		>
+			{#snippet trigger()}
+				<span class="block w-0 h-0" aria-hidden="true"></span>
+			{/snippet}
+		</AddDataSourceMenu>
+	</div>
+{/if}
+
 <style lang="postcss">
 	:global(.svelte-flow__handle) {
 		opacity: 0;
 	}
+	/* Dragging a script's dot: what it cannot subscribe to recedes. */
+	:global(.svelte-flow__node.wm-drag-dim) {
+		opacity: 0.25;
+		transition: opacity 120ms;
+	}
+	:global(.svelte-flow__node.wm-drag-over .drop-shadow-sm) {
+		@apply ring-2 ring-blue-500 rounded-md;
+	}
 	:global(.svelte-flow__controls-button) {
 		@apply bg-surface border-0;
 	}
 	:global(.svelte-flow__controls-button:hover) {
 		@apply bg-surface-hover;
 	}
-	:global(.svelte-flow__node.selected .drop-shadow-sm) {
-		@apply outline outline-2 outline-blue-500;
-	}
 	/* Activity-panel emphasis — soft, monochromatic, less prominent than the
-	   blue details selection above. Hover is a thin neutral ring (transient);
+	   node's own selected state. Hover is a thin neutral ring (transient);
 	   pinning an expanded run is a soft-blue ring. */
 	/* A dbt project node and the models it materializes, related by badge
 	   rather than by edges — hovering either lights up the whole set. */
@@ -1427,6 +2505,11 @@
 	:global(.svelte-flow__node.wm-bound-end .drop-shadow-sm) {
 		@apply outline outline-[3px] outline-amber-500;
 	}
+	/* Hovering a node fades what is not in its lineage (see lineageFadeCss). */
+	:global(.svelte-flow__node),
+	:global(.svelte-flow__edge) {
+		transition: opacity 120ms;
+	}
 	:global(.svelte-flow__node.wm-bound-dim) {
 		@apply opacity-30;
 	}
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
index 6050c2d1cd..4577a11915 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
@@ -2,7 +2,6 @@
 	import { ScriptService, type Script, type ScriptLang } from '$lib/gen'
 	import { untrack } from 'svelte'
 	import { resource } from 'runed'
-	import { base } from '$lib/base'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import ScriptEditor from '$lib/components/ScriptEditor.svelte'
 	import AssetGenericIcon from '$lib/components/icons/AssetGenericIcon.svelte'
@@ -20,10 +19,17 @@
 		SquareFunction,
 		Trash2,
 		X,
-		Pencil
+		Pencil,
+		ChevronDown,
+		Zap
 	} from 'lucide-svelte'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
-	import { tick } from 'svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import {
+		upstreamScriptItems,
+		upstreamTriggerItems,
+		type UpstreamScript,
+		type UpstreamTriggerAction
+	} from './upstreamScriptItems'
 	import { inferArgs } from '$lib/infer'
 	import { emptySchema, sendUserToast } from '$lib/utils'
 	import type { Schema } from '$lib/common'
@@ -41,6 +47,7 @@
 	import { extractDraftMacros } from './resolveGraph'
 	import { assetColumnNodes, type ColumnLineageGraph } from './columnLineageGraph'
 	import SummaryPathDisplay from '$lib/components/SummaryPathDisplay.svelte'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import S3FilePreview from '$lib/components/S3FilePreview.svelte'
 	import DataTablePreview from './DataTablePreview.svelte'
 	import DucklakeAssetPanel from './DucklakeAssetPanel.svelte'
@@ -117,7 +124,9 @@
 		// (`onDraftPersist`). `onDraftPersist` stays the authoritative commit on
 		// navigate-away; this is the continuous feed that keeps the draft's
 		// server copy current while the user is still typing.
-		onContentChange?: (scriptPath: string | undefined, content: string) => void
+		// `base`: the deployed copy being edited, so the parent can autosave unsaved
+		// edits to it before they are promoted to a draft. Unset for a draft.
+		onContentChange?: (scriptPath: string | undefined, content: string, base?: Script) => void
 		// Fires when the user navigates away from a draft (selects another
 		// node, closes the pane, etc.) — the parent must persist the new
 		// content + write outputs into its drafts Map. Without this,
@@ -133,7 +142,8 @@
 				writes: { kind: AssetWithAltAccessType['kind']; path: string }[]
 				// Body-inferred reads, so the parent's draft keeps its input
 				// lineage while inactive (no live inference runs for it).
-				reads: { kind: AssetWithAltAccessType['kind']; path: string }[]
+				// Undefined when nothing was inferred: keep what the draft has.
+				reads?: { kind: AssetWithAltAccessType['kind']; path: string }[]
 				// Full edited script — set when the source is a persisted
 				// script (needed to seed a brand-new draft entry).
 				script?: Script
@@ -156,6 +166,12 @@
 			path: string
 			unsaved?: boolean
 		}>
+		/** The selected asset's producing scripts, for its "Edit script" action,
+		 * which calls `onEditScript` with the one picked. */
+		producerScripts?: UpstreamScript[]
+		onEditScript?: (path: string) => void
+		/** The selected asset's upstream triggers that can be opened from here. */
+		producerTriggers?: UpstreamTriggerAction[]
 		// Pipeline-wide column-lineage graph (built by the parent page from the
 		// resolved graph). Drives the transitive column-lineage trace shown for a
 		// selected materialized asset.
@@ -215,15 +231,18 @@
 		// the edges. Counter rather than boolean so back-to-back runs
 		// re-fire the effect even if no other prop changed.
 		requestRunSignal?: number
-		// Folder-scoped non-editable prefix shown next to the suffix
-		// editor when the user renames a draft (e.g. `f/<folder>/`). The
-		// new path = pathPrefix + suffix.
-		pathPrefix?: string
 		// Called when the user renames a draft — the parent reseats the
 		// path key in its drafts map and updates activeDraftPath. Returns
 		// true on success; false on collision/validation failure so the
 		// popover can keep itself open and surface the error inline.
 		onDraftPathChange?: (oldPath: string, newPath: string) => boolean | string
+		onDraftMetaChange?: (
+			path: string,
+			meta: { summary: string; labels: string[] | undefined }
+		) => void
+		// The pipeline's folder prefix (`f/<folder>/`). A draft renamed outside it
+		// would be deployed out of the pipeline, so the rename is refused.
+		pathPrefix?: string
 		// Bumped by the parent (e.g. from the runnable-node action menu) to
 		// auto-open the archive/delete confirmation modal for the currently
 		// loaded persisted script. No-ops while the pane is showing a draft
@@ -280,6 +299,19 @@
 		// can persist a data-upload entry's staged input (drives node readiness).
 		// `isValid` is the full-schema validity, not just "file present".
 		onRunFormArgsChange?: (path: string, args: Record<string, any>, isValid: boolean) => void
+		// Show only the open script's inputs and runs (a data-upload click), not
+		// its editor. `onRunInputs` runs it with them, drafts included, and
+		// `onShowScript` leaves this view for the script.
+		inputsOnly?: boolean
+		/** `live` is the pane's buffer when it differs from what is stored: always
+		 * for a draft, and for a deployed script edited before switching to the
+		 * inputs view. A run with it previews that body. */
+		onRunInputs?: (
+			path: string,
+			args: Record<string, any>,
+			live?: { content: string; language: ScriptLang }
+		) => Promise<string | undefined>
+		onShowScript?: () => void
 	}
 	let {
 		selection,
@@ -301,6 +333,9 @@
 		onScriptRenamed,
 		onScriptRemoved,
 		selectionProducers = [],
+		producerScripts = [],
+		onEditScript,
+		producerTriggers = [],
 		selectionColumnGraph,
 		selectionColumnLoading = false,
 		selectionColumnTruncated = false,
@@ -315,8 +350,9 @@
 		activeRunnable,
 		onTestStateChange,
 		requestRunSignal,
-		pathPrefix = '',
 		onDraftPathChange,
+		onDraftMetaChange,
+		pathPrefix = '',
 		requestRemoveSignal,
 		downstreamSubscribers = 0,
 		onStartBoundedRun,
@@ -328,10 +364,15 @@
 		onRunByPath,
 		onRunCascadeByPath,
 		runFormInitialArgs,
-		onRunFormArgsChange
+		onRunFormArgsChange,
+		inputsOnly = false,
+		onRunInputs,
+		onShowScript
 	}: Props = $props()
 
 	let readOnly = $derived(mode !== 'edit')
+	// Someone who cannot switch the pipeline to edit mode only gets to read it.
+	let editScriptLabel = $derived(readOnly && !onRequestEdit ? 'Open script' : 'Edit script')
 
 	// Root element of the pane — used to scope the S3-input lookup for the
 	// data_upload focus effect.
@@ -408,7 +449,7 @@
 	// PipelineScriptView renders instead of the test panel.
 	let viewReadyForTarget = $derived.by(
 		() =>
-			readOnly &&
+			(readOnly || inputsOnly) &&
 			runTargetPath !== undefined &&
 			script?.path === runTargetPath &&
 			(isDraft || (!scriptRes.loading && scriptRes.current?.path === runTargetPath))
@@ -484,6 +525,12 @@
 	// alongside `liveBodyAssets` and forwarded so the live graph can show
 	// inferred column lineage on the edited script before it deploys.
 	let liveColumnLineage = $state<ColumnLineage[] | undefined>(undefined)
+	// The script whose editor last bound `liveBodyAssets` (undefined there means it
+	// inferred nothing). They stay bound after that editor unmounts, so a script
+	// that never had one (the inputs-only view) must not report or persist them as
+	// its lineage. Set by an effect declared after the save-on-switch one, whose
+	// cleanup still needs the previous owner when the selection moves.
+	let liveAssetsOwner: string | undefined = undefined
 
 	// Bumped when the runs panel reports a watched job has reached a
 	// terminal state. Drives S3FilePreview's refreshKey so the preview
@@ -549,7 +596,9 @@
 	let args = $state<Record<string, any>>({})
 	let argsSeedPath: string | undefined = undefined
 	$effect.pre(() => {
-		const p = script?.path
+		// Re-seeded on leaving the inputs-only view too, so the file picked there
+		// shows in the editor's test form.
+		const p = script?.path === undefined ? undefined : `${script.path}|${inputsOnly}`
 		if (p === argsSeedPath) return
 		argsSeedPath = p
 		args = runFormInitialArgs ? structuredClone($state.snapshot(runFormInitialArgs)) : {}
@@ -559,7 +608,8 @@
 	// required field (not just the S3 file) is satisfied.
 	let runFormIsValid = $state(true)
 	$effect(() => {
-		if (readOnly || !script) return
+		// Inputs-only mounts no ScriptEditor: PipelineScriptView reports its own args.
+		if (readOnly || inputsOnly || !script) return
 		onRunFormArgsChange?.(script.path, $state.snapshot(args), runFormIsValid)
 	})
 
@@ -596,18 +646,25 @@
 			b: Array<{ kind: string; path: string }>
 		) => a.length === b.length && a.every((x, i) => x.kind === b[i]?.kind && x.path === b[i]?.path)
 		return () => {
-			const writes = (liveBodyAssets ?? [])
+			// No editor inferred this script (the inputs-only view): keep its stored
+			// lineage rather than persisting it as empty.
+			const inferred = liveAssetsOwner === captured.path
+			const writes = !inferred
+				? (writesAtRegister ?? [])
+				: (liveBodyAssets ?? [])
 				.filter((a) => {
 					const t = a.access_type ?? a.alt_access_type
 					return t === 'w' || t === 'rw'
 				})
 				.map((a) => ({ kind: a.kind, path: a.path }))
-			const reads = (liveBodyAssets ?? [])
-				.filter((a) => {
-					const t = a.access_type ?? a.alt_access_type
-					return t === 'r' || t === 'rw'
-				})
-				.map((a) => ({ kind: a.kind, path: a.path }))
+			const reads = !inferred
+				? readsAtRegister
+				: (liveBodyAssets ?? [])
+						.filter((a) => {
+							const t = a.access_type ?? a.alt_access_type
+							return t === 'r' || t === 'rw'
+						})
+						.map((a) => ({ kind: a.kind, path: a.path }))
 			// Draft runs: emit only when content or lineage changed in THIS clone.
 			// An unconditional emit ping-pongs forever when the entry is rewritten
 			// externally while the pane stays mounted (rename rekey, AI edit):
@@ -617,6 +674,7 @@
 				(captured.content ?? '') === contentAtRegister &&
 				refsEq(writesAtRegister ?? [], writes) &&
 				readsAtRegister != undefined &&
+				reads != undefined &&
 				refsEq(readsAtRegister, reads)
 			)
 				return
@@ -651,12 +709,42 @@
 		}
 	})
 
+	$effect(() => {
+		if (script && !readOnly && !inputsOnly) liveAssetsOwner = script.path
+	})
+
 	let saving = $state(false)
 	// What this pane last deployed, so the persist-back cleanup can tell "the
 	// buffer equals the new deployed head" from real unsaved edits (plain
 	// variable: only read inside the untracked cleanup).
 	let deployedFromPane: { path: string; content: string } | undefined = undefined
 	let isDraft = $derived(draftScript != undefined)
+	function liveBody(): { content: string; language: ScriptLang } | undefined {
+		if (!script) return undefined
+		const live = { content: script.content ?? '', language: script.language as ScriptLang }
+		if (isDraft) return live
+		const orig = scriptRes.current
+		return orig?.path === script.path && (orig.content ?? '') !== live.content ? live : undefined
+	}
+	// A draft's stored schema is empty until an editor infers it, and the inputs
+	// view mounts none: infer from the body here so its fields (the file picker)
+	// show up.
+	const inputsSchema = resource(
+		[() => (inputsOnly && isDraft ? script?.content : undefined), () => script?.language],
+		async ([content, language]) => {
+			if (content === undefined || !language) return undefined
+			const schema = emptySchema()
+			try {
+				await inferArgs(language, content, schema as Schema)
+			} catch {
+				return undefined
+			}
+			return schema
+		}
+	)
+	let inputsScript = $derived(
+		script && inputsSchema.current ? { ...script, schema: inputsSchema.current } : undefined
+	)
 
 	// Single trash-bin button opens one modal that exposes both Archive
 	// (always available) and Delete permanently (admin-only). Archive is
@@ -763,12 +851,17 @@
 		onAnnotationsChange?.(script?.path, liveAnnotations)
 	})
 	$effect(() => {
-		if (readOnly) return
+		if (readOnly || (inputsOnly && liveAssetsOwner !== script?.path)) return
 		onAssetsChange?.(script?.path, liveBodyAssets ?? [], liveColumnLineage)
 	})
 	$effect(() => {
 		if (readOnly) return
-		onContentChange?.(script?.path, script?.content ?? '')
+		const base = draftScript ? undefined : scriptRes.current
+		onContentChange?.(
+			script?.path,
+			script?.content ?? '',
+			base && base.path === script?.path ? base : undefined
+		)
 	})
 
 	async function save() {
@@ -910,49 +1003,6 @@
 			JSON.stringify(script.schema ?? null) === JSON.stringify(orig.schema ?? null)
 		)
 	})
-
-	// Suffix editor for the draft-path popover. Seeded from the current
-	// path each time the popover opens so the user starts with what they
-	// see, not stale state from an earlier rename.
-	let draftPathSuffix = $state('')
-	let draftPathError = $state<string | undefined>(undefined)
-	let draftPathInput: HTMLInputElement | undefined = $state(undefined)
-
-	function suffixOf(fullPath: string): string {
-		return fullPath.startsWith(pathPrefix) ? fullPath.slice(pathPrefix.length) : fullPath
-	}
-
-	async function openDraftPathEditor() {
-		draftPathSuffix = script ? suffixOf(script.path) : ''
-		draftPathError = undefined
-		await tick()
-		draftPathInput?.focus()
-		draftPathInput?.select()
-	}
-
-	function confirmDraftPath(close: () => void) {
-		if (!script) return
-		const suffix = draftPathSuffix.trim()
-		if (!suffix) {
-			draftPathError = 'Path cannot be empty'
-			return
-		}
-		const newPath = pathPrefix + suffix
-		if (newPath === script.path) {
-			close()
-			return
-		}
-		const result = onDraftPathChange?.(script.path, newPath)
-		if (result === true || result === undefined) {
-			script.path = newPath
-			draftPathError = undefined
-			close()
-		} else if (typeof result === 'string') {
-			draftPathError = result
-		} else {
-			draftPathError = 'Path already in use'
-		}
-	}
 </script>
 
 <div class="flex flex-col h-full bg-surface" bind:this={paneEl}>
@@ -964,80 +1014,34 @@
 				{@const draftScriptPath = script.path}
 				<Code2 size={16} class="shrink-0 text-tertiary" />
 				{#if onDraftPathChange && !readOnly}
-					<!-- Inline rename popover for drafts. The persisted-script
-					     branch uses SummaryPathDisplay which round-trips through
-					     updateItemPathAndSummary; drafts have no server row yet,
-					     so we just rekey the parent's drafts map locally. -->
-					<Popover
-						placement="bottom-start"
-						contentClasses="p-3"
-						usePointerDownOutside
-						on:openChange={(e) => {
-							if (e.detail) openDraftPathEditor()
+					<!-- Same summary/path popover as a deployed script, saved into the
+					     drafts map instead of through the API: a draft has no row yet. -->
+					<SummaryPathDisplay
+						summary={script.summary ?? ''}
+						path={draftScriptPath}
+						labels={script.labels ?? []}
+						kind="script"
+						onSaved={() => {}}
+						saveOverride={({ path, summary, labels }) => {
+							if (pathPrefix && (!path.startsWith(pathPrefix) || path === pathPrefix)) {
+								return `A pipeline script stays in ${pathPrefix}: pick a name inside that folder`
+							}
+							// Before the rename, which carries the draft entry over as it is.
+							onDraftMetaChange?.(draftScriptPath, { summary, labels })
+							if (script) {
+								script.summary = summary
+								script.labels = labels
+							}
+							if (path === draftScriptPath) return undefined
+							const result = onDraftPathChange(draftScriptPath, path)
+							if (result !== true && result !== undefined) {
+								return typeof result === 'string' ? result : 'Path already in use'
+							}
+							if (script) script.path = path
+							return undefined
 						}}
-					>
-						{#snippet trigger()}
-							<button
-								type="button"
-								class="flex flex-col min-w-0 text-left px-2 py-1 rounded-md hover:bg-surface-hover transition-colors group"
-								title="Edit draft path"
-							>
-								<span
-									class="text-3xs uppercase tracking-wide text-tertiary flex items-center gap-1"
-								>
-									Draft pipeline script
-									<Pencil size={9} class="opacity-0 group-hover:opacity-60 transition-opacity" />
-								</span>
-								<span class="text-xs font-mono truncate" title={draftScriptPath}
-									>{draftScriptPath}</span
-								>
-							</button>
-						{/snippet}
-						{#snippet content({ close })}
-							<div class="flex flex-col gap-2 w-[420px]">
-								<span class="text-2xs font-normal text-secondary">Path</span>
-								<div
-									class="flex items-stretch border rounded-md bg-surface overflow-hidden focus-within:ring-2 focus-within:ring-blue-400"
-								>
-									{#if pathPrefix}
-										<span
-											class="flex items-center px-2 bg-surface-secondary text-tertiary text-sm font-mono border-r select-none"
-										>
-											{pathPrefix}
-										</span>
-									{/if}
-									<input
-										bind:this={draftPathInput}
-										bind:value={draftPathSuffix}
-										onkeydown={(e) => {
-											if (e.key === 'Enter') {
-												e.preventDefault()
-												confirmDraftPath(close)
-											} else if (e.key === 'Escape') {
-												e.preventDefault()
-												close()
-											}
-										}}
-										class="flex-1 min-w-0 px-2 py-1.5 text-sm font-mono bg-transparent focus:outline-none"
-										placeholder="my_script"
-									/>
-								</div>
-								{#if draftPathError}
-									<span class="text-2xs text-red-500">{draftPathError}</span>
-								{/if}
-								<div class="flex justify-end">
-									<Button
-										variant="accent"
-										unifiedSize="sm"
-										disabled={!draftPathSuffix.trim()}
-										onClick={() => confirmDraftPath(close)}
-									>
-										Rename
-									</Button>
-								</div>
-							</div>
-						{/snippet}
-					</Popover>
+					/>
+					<Badge color="gray">Draft</Badge>
 				{:else}
 					<div class="flex flex-col min-w-0">
 						<span class="text-3xs uppercase tracking-wide text-tertiary">
@@ -1097,6 +1101,66 @@
 			{/if}
 		</div>
 		<div class="flex items-center gap-1 shrink-0">
+			{#if selection?.kind === 'asset' && onEditScript && producerScripts.length === 1}
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					startIcon={{ icon: Pencil }}
+					onclick={() => onEditScript(producerScripts[0].path)}
+					title={`Open ${producerScripts[0].path}, which builds this asset`}
+				>
+					{editScriptLabel}
+				</Button>
+			{:else if selection?.kind === 'asset' && onEditScript && producerScripts.length > 1}
+				<DropdownV2
+					items={upstreamScriptItems(producerScripts, onEditScript)}
+					placement="bottom-end"
+					enableFlyTransition
+				>
+					{#snippet buttonReplacement()}
+						<Button
+							nonCaptureEvent
+							variant="default"
+							unifiedSize="sm"
+							startIcon={{ icon: Pencil }}
+							endIcon={{ icon: ChevronDown }}
+							title={`${producerScripts.length} scripts build this asset`}
+						>
+							{editScriptLabel}
+						</Button>
+					{/snippet}
+				</DropdownV2>
+			{/if}
+			{#if selection?.kind === 'asset' && producerTriggers.length === 1}
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					startIcon={{ icon: Zap }}
+					onclick={() => producerTriggers[0].onOpen()}
+					title={producerTriggers[0].detail}
+				>
+					{producerTriggers[0].label}
+				</Button>
+			{:else if selection?.kind === 'asset' && producerTriggers.length > 1}
+				<DropdownV2
+					items={upstreamTriggerItems(producerTriggers)}
+					placement="bottom-end"
+					enableFlyTransition
+				>
+					{#snippet buttonReplacement()}
+						<Button
+							nonCaptureEvent
+							variant="default"
+							unifiedSize="sm"
+							startIcon={{ icon: Zap }}
+							endIcon={{ icon: ChevronDown }}
+							title={`${producerTriggers.length} triggers start the scripts that build this asset`}
+						>
+							Triggers
+						</Button>
+					{/snippet}
+				</DropdownV2>
+			{/if}
 			{#if readOnly && onRequestEdit}
 				<Button
 					variant="accent"
@@ -1118,28 +1182,17 @@
 					title="Discard draft"
 				/>
 			{/if}
-			<!-- Action order, left → right: trash, external link, save, close.
-			     Save sits closest to Close so the primary commit action is
-			     anchored at the right edge of the bar; trash lives at the
-			     far left so destructive ops are visually separated from
-			     navigation/commit. Mirrors the draft Discard placement. -->
-			{#if !readOnly && !isDraft && isScriptView && script?.hash}
-				<Button
-					variant="subtle"
-					unifiedSize="sm"
-					startIcon={{ icon: Trash2 }}
-					onclick={() => (removeOpen = true)}
-					iconOnly
-					title="Archive or delete"
-				/>
-			{/if}
+			<!-- Action order, left → right: external link, save, close. Save sits
+			     closest to Close so the primary commit action is anchored at the
+			     right edge of the bar. Removing a script goes through its node's
+			     menu. -->
 			{#if !readOnly && !isDraft && selection?.kind === 'runnable'}
 				<Button
 					variant="subtle"
 					unifiedSize="sm"
 					href={selection.runnable_kind === 'flow'
-						? `${base}/flows/edit/${selection.path}`
-						: `${base}/scripts/edit/${selection.path}`}
+						? `/flows/edit/${selection.path}`
+						: `/scripts/edit/${selection.path}`}
 					target="_blank"
 					startIcon={{ icon: ExternalLink }}
 					iconOnly
@@ -1331,21 +1384,38 @@
 				{#if readOnly}
 					Flows have no inline view here. Open <a
 						class="text-blue-600 hover:underline"
-						href="{base}/flows/get/{selection.path}">the flow page</a
+						href="/flows/get/{selection.path}">the flow page</a
 					> for details and runs.
 				{:else}
 					Flows are not editable inline. Use the open-in-editor button above.
 				{/if}
 			</div>
 		{:else if !isDraft && scriptRes.loading && !script}
-			<div class="absolute inset-0 flex items-center justify-center gap-2 text-tertiary">
-				<Loader2 size={16} class="animate-spin" />
-				<span class="text-xs">Loading script…</span>
-			</div>
+			<!-- Blank while the script loads: the fetch is short, and a spinner only flashes. -->
 		{:else if !isDraft && scriptRes.error}
 			<div class="p-3 text-xs text-red-500">
 				Failed to load: {scriptRes.error.message}
 			</div>
+		{:else if script && inputsOnly}
+			{#key script.path}
+				<PipelineScriptView
+					{isDraft}
+					canRun
+					runsDrafts
+					inputsOnly
+					{onShowScript}
+					onRun={onRunInputs && ((path, args) => onRunInputs(path, args, liveBody()))}
+					script={inputsScript ?? script}
+					{runsRefreshKey}
+					{runsPendingJobId}
+					initialArgs={runFormInitialArgs}
+					onArgsChange={onRunFormArgsChange}
+					onRunCompleted={() => {
+						previewRefreshKey += 1
+						onRunCompleted?.()
+					}}
+				/>
+			{/key}
 		{:else if script && readOnly}
 			<!-- Read-only modes: no Monaco/ScriptEditor (operators are
 			     backend-blocked from previews anyway) — highlighted source,
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte
index f39c2d8d18..a6d38b05d8 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphEdge.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { BaseEdge, getBezierPath, type EdgeProps } from '@xyflow/svelte'
 	import { NODE } from '$lib/components/graph/util'
+	import { PIPELINE_NODE_HEIGHT } from './assetGraphLayout'
 	import { FlaskConical, Columns3, SquareFunction, BellOff } from 'lucide-svelte'
 	import type { ColumnLineage, DataTest } from './parsePipelineAnnotations'
 
@@ -103,33 +104,42 @@
 	// straight under the nodes in between — the child-and-grandchild-of-the-
 	// same-node case, where the tidy-tree layout puts all three on one
 	// column. Detour those through the gutter beside the column.
-	const SKIP_DY = NODE.gap.vertical * 2 + NODE.height
+	const SKIP_DY = NODE.gap.vertical * 2 + PIPELINE_NODE_HEIGHT
 	const NEAR_VERTICAL_DX = NODE.width / 4
 	// Lane offset: half a node plus a margin that stays inside the
 	// inter-column gutter (gap.horizontal / 2).
 	const LANE = NODE.width / 2 + NODE.gap.horizontal / 2
-	const CORNER = 14
 
-	// Rounded-orthogonal detour: drop out of the source, swing into the
-	// gutter lane at `midX`, run it down past the intermediate rows, swing
-	// back into the target.
+	// Detour through the gutter lane at `midX`, drawn with the same curves as
+	// every other edge: curve out of the source into the lane within the gap
+	// below it, run down the lane past the rows in between, curve into the
+	// target within the gap above it.
 	function gutterPath(midX: number): string {
-		const yTop = sourceY + 24
-		const yBot = targetY - 24
-		const outDir = midX > sourceX ? 1 : -1
-		const inDir = targetX > midX ? 1 : -1
-		return [
-			`M ${sourceX} ${sourceY}`,
-			`L ${sourceX} ${yTop - CORNER}`,
-			`Q ${sourceX} ${yTop} ${sourceX + outDir * CORNER} ${yTop}`,
-			`L ${midX - outDir * CORNER} ${yTop}`,
-			`Q ${midX} ${yTop} ${midX} ${yTop + CORNER}`,
-			`L ${midX} ${yBot - CORNER}`,
-			`Q ${midX} ${yBot} ${midX + inDir * CORNER} ${yBot}`,
-			`L ${targetX - inDir * CORNER} ${yBot}`,
-			`Q ${targetX} ${yBot} ${targetX} ${yBot + CORNER}`,
-			`L ${targetX} ${targetY}`
-		].join(' ')
+		const bend = NODE.gap.vertical
+		const yTop = sourceY + bend
+		// Clamp only downward edges: an upward (feedback) edge must still run up the
+		// lane, or its last curve cuts across the node the detour was clearing.
+		const yBot = targetY > sourceY ? Math.max(yTop, targetY - bend) : targetY - bend
+		const [out] = getBezierPath({
+			sourceX,
+			sourceY,
+			sourcePosition,
+			targetX: midX,
+			targetY: yTop,
+			targetPosition,
+			curvature: 0.25
+		})
+		const [into] = getBezierPath({
+			sourceX: midX,
+			sourceY: yBot,
+			sourcePosition,
+			targetX,
+			targetY,
+			targetPosition,
+			curvature: 0.25
+		})
+		// Continue from the lane rather than lifting the pen.
+		return `${out} L${midX},${yBot} ${into.replace(/^M/, 'L')}`
 	}
 
 	// Long edges bend out of the source within the layer gap and descend in
@@ -178,7 +188,7 @@
 	path={edgePath}
 	{markerEnd}
 	{style}
-	interactionWidth={0}
+	interactionWidth={12}
 	label={undefined}
 	labelStyle={undefined}
 />
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
index e719bfe2bd..d0835b2880 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
@@ -2,9 +2,14 @@
 	import { Handle, Position } from '@xyflow/svelte'
 	import { twMerge } from 'tailwind-merge'
 	import AssetGenericIcon from '$lib/components/icons/AssetGenericIcon.svelte'
-	import { formatShortAssetPath, type AssetKind } from '$lib/components/assets/lib'
-	import { NODE } from '$lib/components/graph/util'
-	import PipelineInsertMenu, { type PipelineInsertPick } from './PipelineInsertMenu.svelte'
+	import { formatAssetKind, formatShortAssetPath, type AssetKind } from '$lib/components/assets/lib'
+	import PipelineNodeCard from './PipelineNodeCard.svelte'
+	import NodeActionsMenu from './NodeActionsMenu.svelte'
+	import NodeFixButton, { type NodeFix } from './NodeFixButton.svelte'
+	import NodeOnDot from './NodeOnDot.svelte'
+	import { PIPELINE_NODE_HEADER } from './assetGraphLayout'
+	import AddDownstreamMenu from './AddDownstreamMenu.svelte'
+	import AddDownstreamPill from './AddDownstreamPill.svelte'
 	import {
 		ArrowUpRight,
 		Code2,
@@ -12,19 +17,28 @@
 		History,
 		Play,
 		Loader2,
-		Plus,
 		ShieldCheck,
 		ShieldAlert,
 		CheckCircle2,
+		ChevronDown,
+		Pencil,
+		CircleSlash,
+		Trash2,
+		Upload,
 		XCircle
 	} from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
 	import type { ScriptLang } from '$lib/gen'
 	import { enterpriseLicense } from '$lib/stores'
-	import { sendUserToast } from '$lib/utils'
-	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
+	import { sendUserToast, type Item } from '$lib/utils'
 	import type { PipelineOutputKind } from './pipelineTemplates'
 	import type { DbtAssetProvenance } from './types'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
+	import RunStateChip from './RunStateChip.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { upstreamScriptItems } from './upstreamScriptItems'
+	import type { RunnableRunState } from './activeRunnables.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
@@ -33,6 +47,49 @@
 	// `content` / `language` so the page-level run handler can dispatch to
 	// `runScriptPreview` instead of `runScriptByPath` (which 404s for
 	// non-deployed scripts).
+	/** What starts a producing script, as its chip shows it. */
+	export type TriggerChipData = {
+		label: string
+		/** The native trigger kind; a data upload renders as a call to action. */
+		kind?: string
+		/** No chip: the node's incoming edges already show what starts it. */
+		hidden?: boolean
+		missing?: boolean
+		draft?: boolean
+		/** Opens the trigger's editor; unset for what has none (manual, asset change). */
+		onOpen?: () => void
+		selected?: boolean
+	}
+
+	export type AssetUpstreamChips =
+		| { none: true }
+		| {
+				multiple: true
+				/** The producing scripts; one when only its triggers are ambiguous. */
+				scripts: Array<{
+					runnableId: string
+					path: string
+					summary?: string
+					language?: ScriptLang
+					unsaved?: boolean
+					onOpen: () => void
+				}>
+				/** The scripts' own triggers, each named with its script. */
+				triggers: Array<TriggerChipData & { script: string }>
+				selected?: boolean
+		  }
+		| {
+				runnableId: string
+				path: string
+				summary?: string
+				language?: ScriptLang
+				unsaved?: boolean
+				runState?: RunnableRunState
+				trigger: TriggerChipData
+				onOpen: () => void
+				selected?: boolean
+		  }
+
 	export type AssetProducer = {
 		kind: 'script' | 'flow'
 		path: string
@@ -51,6 +108,8 @@
 			// "current view of <dim>" marker so it reads as a derived node, not an
 			// unrelated table.
 			derived_from?: string
+			// Why the node is misconfigured, when it is: renders it red.
+			error?: string
 			// dbt provenance when this warehouse table is a dbt node: which model
 			// it is, how dbt materializes it, its tags and its generic tests.
 			dbt?: DbtAssetProvenance
@@ -65,10 +124,14 @@
 				language: ScriptLang,
 				scriptPath: string,
 				outputKind: PipelineOutputKind,
-				aiPrompt?: string
+				aiPrompt?: string,
+				options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 			) => void
 			pathPrefix?: string
 			defaultPathSuffix?: string
+			/** Starts dragging the "+" onto a script (subscribing it to this asset)
+			 * or onto the blank canvas (opening the add menu there). */
+			onStartFeedDrag?: (e: PointerEvent) => void
 			// Producer scripts/flows that write to this asset, supplied by
 			// the canvas from the graph's write/rw edges. Drives the on-hover
 			// "Run" button. Includes unsaved/draft producers so the button
@@ -99,6 +162,41 @@
 			// instead of only settling once the job ends.
 			runStatus?: 'running' | 'materialized' | 'failed'
 			runRowCount?: number | null
+			/** Set in the assets-only view, where the producing script and its
+			 * trigger are folded into the asset: `none` for an asset nothing in the
+			 * pipeline writes, `multiple` when the producer or its trigger is
+			 * ambiguous. */
+			upstream?: AssetUpstreamChips
+			/** What is wrong with the node, and how to fix it: replaces the "+". */
+			fix?: NodeFix
+			/** Assets-only: errors of the scripts and triggers folded into this node. */
+			foldedFixes?: NodeFix[]
+			/** Assets-only: starts dragging the top dot onto an asset, subscribing the
+			 * scripts that build this one to it. */
+			onStartOnDrag?: (e: PointerEvent) => void
+			/** The assets-only node for the scripts that build no asset. */
+			noAsset?: boolean
+			/** The No-asset node's script, by its file name. */
+			noAssetName?: string
+			/** Assets-only: the node is only its script's banner. */
+			bannerOnly?: boolean
+			/** Assets-only: a script folded into the node has an error. */
+			scriptError?: boolean
+			/** No script in the workspace writes it; a flow's write fires no asset trigger. */
+			neverWritten?: boolean
+			/** Card width in the assets-only view, sized to its text. */
+			width?: number
+			/** Assets-only view: the producing script and trigger no other asset
+			 * shares, which the menu offers to delete one by one or together. */
+			upstreamDelete?: import('./assetsOnlyView').AssetUpstreamDelete
+			/** When no combined delete is possible: the folded scripts, each deletable
+			 * on its own. */
+			scriptDeletes?: Array<{ path: string; unsaved: boolean }>
+			triggerDeletes?: Array<NonNullable<import('./assetsOnlyView').AssetUpstreamDelete['trigger']>>
+			onDeleteUpstream?: (target: import('./assetsOnlyView').AssetUpstreamDelete) => void
+			deleteVerb?: 'Delete' | 'Archive'
+			/** Why nothing can be deleted, when the producer is shared. */
+			deleteBlocked?: string
 		}
 		// SvelteFlow injects this on the node component when the user clicks
 		// the node. Combined with our own `hovered` state to drive the
@@ -140,19 +238,94 @@
 		}
 	}
 
-	function handlePick(pick: PipelineInsertPick) {
-		if (pick.kindId === 'pipeline_script' && pick.language && pick.path) {
-			data.onAddScript?.(
-				{ kind: data.asset_kind, path: data.path },
-				pick.language as ScriptLang,
-				pick.path,
-				(pick.outputKind ?? 'none') as PipelineOutputKind,
-				pick.aiPrompt
-			)
-		}
-	}
 
-	let showAdd = $derived(data.onAddScript != undefined)
+
+	// A red asset needs fixing where its error comes from, not a downstream step;
+	// and a step downstream of what nothing writes would never run on its writes.
+	let showAdd = $derived(data.onAddScript != undefined && !data.error && !data.neverWritten)
+	let menuItems: Item[] = $derived(
+		data.onDeleteUpstream && data.upstreamDelete
+			? deleteItems(data.upstreamDelete, data.onDeleteUpstream)
+			: data.onDeleteUpstream && (data.scriptDeletes?.length || data.triggerDeletes?.length)
+				? [
+						...(data.scriptDeletes ?? []).map((script) => ({ script })),
+						...(data.triggerDeletes ?? []).map((trigger) => ({ trigger }))
+					].flatMap((t) => deleteItems(t, data.onDeleteUpstream!))
+				: data.deleteBlocked
+				? [
+						{
+							displayName: `Can't delete: ${data.deleteBlocked}`,
+							icon: Trash2,
+							disabled: true
+						}
+					]
+				: []
+	)
+	const lastSegment = (p: string) => p.split('/').pop() ?? p
+	// A script is archived rather than deleted when the user may not delete it;
+	// a trigger is always deleted.
+	function deleteItems(
+		t: import('./assetsOnlyView').AssetUpstreamDelete,
+		run: (target: import('./assetsOnlyView').AssetUpstreamDelete) => void
+	): Item[] {
+		const items: Item[] = []
+		if (t.script) {
+			const script = t.script
+			items.push({
+				displayName: `${data.deleteVerb ?? 'Delete'} script ${lastSegment(script.path)}`,
+				icon: Trash2,
+				type: 'delete' as const,
+				action: () => run({ script })
+			})
+		}
+		if (t.trigger) {
+			const trigger = t.trigger
+			items.push({
+				displayName: `Delete ${trigger.kind} trigger ${lastSegment(trigger.path)}`,
+				icon: Trash2,
+				type: 'delete' as const,
+				action: () => run({ trigger })
+			})
+		}
+		if (t.script && t.trigger) {
+			items.push({
+				displayName: `${data.deleteVerb === 'Archive' ? 'Remove' : 'Delete'} all 2 items`,
+				icon: Trash2,
+				type: 'delete' as const,
+				action: () => run(t)
+			})
+		}
+		return items
+	}
+	let upstream = $derived(data.upstream)
+	let HEADER_SELECTED = $derived(
+		data.scriptError
+			? 'bg-red-200 dark:bg-red-600 hover:bg-red-200 dark:hover:bg-red-600'
+			: 'bg-surface-accent-selected hover:bg-surface-accent-selected text-accent'
+	)
+	const CHIP_SELECTED =
+		'bg-surface-accent-selected border-border-selected hover:bg-surface-accent-selected text-accent'
+	let producer = $derived(upstream && 'path' in upstream ? upstream : undefined)
+	let coProducers = $derived(upstream && 'scripts' in upstream ? upstream.scripts : [])
+	let hasHeader = $derived(!!producer || coProducers.length > 0)
+	// The corner controls sit on the card's corner, below the header tab:
+	// -top-2 plus PIPELINE_NODE_HEADER (22px).
+	const CARD_CORNER_TOP = 'top-[14px]'
+	let coSelected = $derived(!!(upstream && 'scripts' in upstream && upstream.selected))
+	let coProducerItems = $derived(
+		upstreamScriptItems(coProducers, (path) => coProducers.find((s) => s.path === path)?.onOpen())
+	)
+	let scriptMenuOpen = $state(false)
+	let coTriggers = $derived(upstream && 'triggers' in upstream ? upstream.triggers : [])
+	let coTriggerItems: Item[] = $derived(
+		coTriggers.map((t) => ({
+			displayName: `${t.label}${t.draft ? ' · draft' : ''}`,
+			description: coProducers.length > 1 ? t.script : undefined,
+			disabled: !t.onOpen,
+			action: () => t.onOpen?.()
+		}))
+	)
+	let triggerMenuOpen = $state(false)
 
 	// dbt badge. `materialized` is dbt's own word rather than the Windmill
 	// strategy because `view` and `ephemeral` have no strategy, and showing the
@@ -220,6 +393,185 @@
 	)
 </script>
 
+{#snippet scriptHeader()}
+	<!-- The script building this asset, folded into it: a strip across the top
+	     naming it, which opens it. Several scripts open a menu to pick one. -->
+	{@const one = producer ?? (coProducers.length === 1 ? coProducers[0] : undefined)}
+	{@const headerClass = twMerge(
+		'flex items-center gap-1.5 w-full min-w-0 px-2 text-3xs font-normal leading-none text-secondary hover:bg-surface-hover hover:text-primary',
+		data.scriptError &&
+			'bg-red-100 dark:bg-red-700 text-red-700 dark:text-red-200 hover:bg-red-200 dark:hover:bg-red-600 hover:text-red-800'
+	)}
+	{#if one}
+		{@const isSelected = producer ? !!producer.selected : coSelected}
+		<button
+			type="button"
+			class={twMerge(headerClass, isSelected && HEADER_SELECTED)}
+			title={`Open ${one.summary ? `${one.summary} (${one.path})` : one.path}${one.unsaved ? ' · draft' : ''}`}
+			onpointerdown={(e) => e.stopPropagation()}
+			onkeydown={(e) => e.stopPropagation()}
+			onclick={(e) => {
+				e.stopPropagation()
+				one.onOpen()
+			}}
+		>
+			{#if one.language}
+				<LanguageIcon lang={one.language} width={11} height={11} />
+			{:else}
+				<Code2 size={11} class="shrink-0" />
+			{/if}
+			<span class="truncate">{one.summary || one.path}</span>
+			{#if one.unsaved}<span class="shrink-0 text-tertiary">draft</span>{/if}
+			{#if producer?.runState}
+				<RunStateChip runState={producer.runState} class="ml-auto h-4 px-1 rounded" />
+			{/if}
+			<Pencil size={10} class={twMerge('shrink-0 opacity-70', !producer?.runState && 'ml-auto')} />
+		</button>
+	{:else if coProducers.length > 1}
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			class="w-full min-w-0 flex"
+			onpointerdown={(e) => e.stopPropagation()}
+			onkeydown={(e) => e.stopPropagation()}
+		>
+			<DropdownV2
+				items={coProducerItems}
+				placement="bottom-start"
+				bind:open={scriptMenuOpen}
+				fixedHeight={false}
+				usePointerDownOutside
+				enableFlyTransition
+				class="w-full"
+			>
+				{#snippet buttonReplacement()}
+					<span
+						class={twMerge(headerClass, 'h-full', (coSelected || scriptMenuOpen) && HEADER_SELECTED)}
+						title={`Built by ${coProducers.length} scripts: pick one to open`}
+					>
+						{#each coProducers.slice(0, 2) as sc (sc.path)}
+							{#if sc.language}
+								<LanguageIcon lang={sc.language} width={11} height={11} />
+							{:else}
+								<Code2 size={11} class="shrink-0" />
+							{/if}
+						{/each}
+						<span class="truncate">{coProducers.length} scripts</span>
+						<ChevronDown size={11} class="shrink-0 ml-auto" />
+					</span>
+				{/snippet}
+			</DropdownV2>
+		</div>
+	{/if}
+{/snippet}
+
+{#snippet upstreamRow()}
+	{#if data.foldedFixes?.length}
+		<!-- A folded script or trigger is misconfigured: its Fix, one at a time. -->
+		<NodeFixButton
+			chip
+			fix={data.foldedFixes[0]}
+			label={`${data.foldedFixes.length} error${data.foldedFixes.length === 1 ? '' : 's'} · Fix`}
+		/>
+	{:else if upstream && coTriggers.length > 1 && !coTriggers.some((t) => t.onOpen)}
+		<!-- Several triggers, none editable here (View mode): a plain label. -->
+		<span
+			class="truncate rounded-md border px-1.5 py-1 text-3xs leading-none font-normal border-gray-300 dark:border-gray-600 text-secondary"
+			>Multiple triggers</span
+		>
+	{:else if upstream && coTriggers.length > 1}
+		<!-- Several triggers start what builds this asset: one chip, a menu to pick
+		     the one to edit. -->
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			class="min-w-0 flex"
+			onpointerdown={(e) => e.stopPropagation()}
+			onkeydown={(e) => e.stopPropagation()}
+		>
+			<DropdownV2
+				items={coTriggerItems}
+				placement="bottom-start"
+				bind:open={triggerMenuOpen}
+				fixedHeight={false}
+				usePointerDownOutside
+				enableFlyTransition
+			>
+				{#snippet buttonReplacement()}
+					<span
+						class={twMerge(
+							'flex items-center gap-1 min-w-0 rounded-md border px-1.5 py-1 text-3xs leading-none font-normal border-gray-300 dark:border-gray-600 text-secondary bg-surface hover:bg-surface-hover cursor-pointer',
+							(triggerMenuOpen || coTriggers.some((t) => t.selected)) && CHIP_SELECTED
+						)}
+						title="Started by several triggers: pick one to edit"
+					>
+						<span class="truncate">Multiple triggers</span>
+						<ChevronDown size={9} class="shrink-0 opacity-70" />
+					</span>
+				{/snippet}
+			</DropdownV2>
+		</div>
+	{:else if upstream}
+		{@const trigger = producer?.trigger ?? coTriggers[0]}
+		{@const triggerScript = producer?.path ?? coTriggers[0]?.script}
+		{@const chipClass = twMerge(
+			'truncate rounded-md border px-1.5 py-1 text-3xs leading-none font-normal',
+			trigger?.missing
+				? 'border-red-300 dark:border-red-600 text-red-700 dark:text-red-300'
+				: 'border-gray-300 dark:border-gray-600 text-secondary',
+			trigger?.draft && 'border-dashed',
+			trigger?.onOpen && 'bg-surface hover:bg-surface-hover cursor-pointer',
+			trigger?.selected && CHIP_SELECTED
+		)}
+		{#if trigger?.kind === 'data_upload' && trigger.onOpen}
+			<!-- The one trigger that needs the user: nothing runs until a file is
+			     provided, so it reads as the node's main action rather than a chip. -->
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<span
+				class="flex min-w-0"
+				onpointerdown={(e) => e.stopPropagation()}
+				onkeydown={(e) => e.stopPropagation()}
+			>
+				<Button
+					variant="accent"
+					unifiedSize="sm"
+					startIcon={{ icon: Upload }}
+					title={`Upload the data ${triggerScript} runs on`}
+					onClick={(e) => {
+						e?.stopPropagation()
+						trigger.onOpen?.()
+					}}
+				>
+					Upload data
+				</Button>
+			</span>
+		{:else if trigger?.onOpen}
+			<button
+				type="button"
+				class={twMerge(chipClass, 'flex items-center gap-1 min-w-0')}
+				title={trigger.missing
+					? `No ${trigger.label} trigger targets ${triggerScript} yet: click to create one`
+					: `Edit the ${trigger.label} trigger`}
+				onpointerdown={(e) => e.stopPropagation()}
+				onkeydown={(e) => e.stopPropagation()}
+				onclick={(e) => {
+					e.stopPropagation()
+					trigger.onOpen?.()
+				}}
+			>
+				<span class="truncate">{trigger.label}{trigger.draft ? ' · draft' : ''}</span>
+				{#if !trigger.missing}<Pencil size={9} class="shrink-0 opacity-70" />{/if}
+			</button>
+		{:else}
+			<span class={chipClass}>
+				{#if 'none' in upstream}
+					External source
+				{:else if trigger}
+					{trigger.label}{trigger.draft ? ' · draft' : ''}
+				{/if}
+			</span>
+		{/if}
+	{/if}
+{/snippet}
+
 <!-- onmouseenter/leave on the wrapper (not the inner card) so the run
      button — which floats outside the card — keeps the hover state alive
      when the cursor moves between the card and the button. -->
@@ -236,123 +588,169 @@
 			<div class="wm-recompute-flash pointer-events-none absolute inset-0 z-10 rounded-md"></div>
 		{/key}
 	{/if}
-	<!-- Mirrors the flow editor's asset pill: quiet surface + gray border at
-	     rest, accent reserved for the selected state. -->
-	<div
-		class={twMerge(
-			'flex items-center rounded-md drop-shadow-sm overflow-hidden border',
-			'bg-surface-secondary border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500 transition-colors',
-			selected && 'bg-surface-accent-selected border-border-selected'
+	<NodeActionsMenu
+		items={menuItems}
+		hover={hovered}
+		kebabClass={twMerge(
+			showGuardBadge && '-right-8',
+			hasHeader && !data.bannerOnly && CARD_CORNER_TOP
 		)}
-		style="width: {NODE.width}px; min-height: {NODE.height}px;"
-		title={data.path}
 	>
-		<!-- Data identity carries the accent (luminance blue), pairing with
-		     the blue write edges that produce these assets — scripts stay
-		     neutral, so script vs data reads at a glance. -->
-		<AssetGenericIcon
-			assetKind={data.asset_kind}
-			class={`shrink-0 ml-2 mr-2 ${selected ? 'text-accent' : 'text-blue-600 dark:text-blue-400'}`}
-			size="14px"
-		/>
-		{#if data.runStatus}
-			<!-- The run in view, per relation: a spinner while its producer is
-			     building it, then its outcome. Left of the name so the eye finds
-			     the moving nodes first on a wide graph. -->
-			<span
-				class="shrink-0 mr-1 {data.runStatus === 'failed'
-					? 'text-red-600 dark:text-red-400'
-					: data.runStatus === 'materialized'
-						? 'text-green-600 dark:text-green-400'
-						: 'text-blue-600 dark:text-blue-400'}"
-				title={data.runStatus}
+		{#if data.bannerOnly}
+			<!-- A script that builds nothing and runs only on writes to what it reads:
+			     the incoming edges say how it starts, so its banner is the whole node. -->
+			<div
+				class={twMerge(
+					'flex items-stretch min-w-0 rounded-md overflow-hidden bg-surface border border-gray-200 dark:border-gray-700 drop-shadow-sm',
+					(producer ? producer.selected : coSelected) &&
+						'border-border-selected dark:border-border-selected'
+				)}
+				style="width: {data.width ?? 160}px; height: {PIPELINE_NODE_HEADER}px;"
 			>
-				{#if data.runStatus === 'running'}
-					<Loader2 size={11} class="animate-spin" />
-				{:else if data.runStatus === 'failed'}
-					<XCircle size={11} />
+				{@render scriptHeader()}
+			</div>
+		{:else}
+		<PipelineNodeCard
+			kindLabel={data.noAsset ? 'No asset' : formatAssetKind(asset)}
+			title={data.noAsset ? (data.noAssetName ?? '') : formatShortAssetPath(asset)}
+			tooltip={data.noAsset
+				? 'This script builds no asset'
+				: data.error
+					? `${data.path}: ${data.error}`
+					: data.path}
+			{selected}
+			tone={data.error ? 'error' : undefined}
+			subtitle={data.foldedFixes?.length ||
+			(upstream &&
+				!producer?.trigger?.hidden &&
+				!('triggers' in upstream && upstream.triggers.length === 0))
+				? upstreamRow
+				: undefined}
+			header={hasHeader ? scriptHeader : undefined}
+			headerTone={data.scriptError ? 'error' : undefined}
+			headerSelected={producer ? !!producer.selected : coSelected}
+			width={data.width}
+			surface={upstream ? 'primary' : 'secondary'}
+		>
+			{#snippet icon()}
+				<!-- Data identity carries the accent (luminance blue), pairing with
+				     the blue write edges that produce these assets — scripts stay
+				     neutral, so script vs data reads at a glance. -->
+				{#if data.noAsset}
+					<CircleSlash size={14} class="text-tertiary" />
 				{:else}
-					<CheckCircle2 size={11} />
+					<AssetGenericIcon
+						assetKind={data.asset_kind}
+						class={data.error
+							? 'text-red-600 dark:text-red-200'
+							: selected
+								? 'text-accent'
+								: 'text-blue-600 dark:text-blue-400'}
+						size="14px"
+					/>
 				{/if}
-			</span>
-			<!-- Rows the run wrote. Recorded per relation already, and the cheapest
-			     answer to "did this model actually produce anything" — a model that
-			     built green but emitted 0 rows is the failure that looks like a
-			     success. Only once settled: mid-build the number is not yet real. -->
-			{#if data.runStatus === 'materialized' && data.runRowCount != undefined}
-				<span
-					class="shrink-0 mr-1 text-3xs tabular-nums text-tertiary"
-					title="{data.runRowCount} rows written by this run"
-				>
-					{Intl.NumberFormat().format(data.runRowCount)}
-				</span>
-			{/if}
-		{/if}
-		<span class="flex-1 min-w-0 pr-1 py-0.5 text-2xs font-mono text-emphasis truncate">
-			{formatShortAssetPath(asset)}
-		</span>
-		<!-- Fork data-environment chip: in a fork every asset shares its parent's
-		     name, so the env it resolves to must read at a glance. Labeled + tinted
-		     (amber "parent" = deferred read of the parent's current table via a
-		     view; emerald "fork" = the fork's own materialized copy) rather than a
-		     bare icon, which was too easy to miss. The title carries the detail. -->
-		{#if data.fork_materialization === 'deferred'}
-			<span
-				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300 border border-amber-300 dark:border-amber-700"
-				title="Deferred to parent workspace: reads the parent's current data. Materialize it in this fork to iterate on it."
-			>
-				<ArrowUpRight size={10} />
-				parent
-			</span>
-		{:else if data.fork_materialization === 'fork'}
-			<span
-				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300 border border-emerald-300 dark:border-emerald-700"
-				title="Materialized in this fork: reads and writes use the fork's isolated copy."
-			>
-				<GitFork size={10} />
-				fork
-			</span>
-		{/if}
-		<!-- dbt chip: names the materialization dbt declares, plus a test count
-		     when the model carries generic tests. Orange keeps it visually
-		     separate from the fork/SCD2 chips, which describe Windmill state.
-		     Where the project node is on the graph it also stands in for the edge
-		     to it: hovering lights that node up, clicking selects it. Where it is
-		     not — the run page, and a pipeline holding a dbt project — there is
-		     nothing to point at, so the chip renders inert. -->
-		{#if data.dbt}
-			<button
-				type="button"
-				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold tracking-wide bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300 border border-orange-300 dark:border-orange-700 {data.onDbtSelect
-					? 'hover:brightness-95 cursor-pointer'
-					: 'cursor-default'}"
-				title={dbtTitle}
-				onmouseenter={() => data.onDbtHover?.(true)}
-				onmouseleave={() => data.onDbtHover?.(false)}
-				onclick={(e) => {
-					e.stopPropagation()
-					data.onDbtSelect?.()
-				}}
-			>
-				<DbtIcon width={9} height={9} />
-				{dbtLabel}
-				{#if data.dbt.data_tests?.length}
-					<span class="opacity-70">&middot; {data.dbt.data_tests.length}T</span>
+			{/snippet}
+			{#snippet leading()}
+				{#if data.runStatus}
+					<!-- The run in view, per relation: a spinner while its producer is
+				     building it, then its outcome. Left of the name so the eye finds
+				     the moving nodes first on a wide graph. -->
+					<span
+						class="shrink-0 mr-1 {data.runStatus === 'failed'
+							? 'text-red-600 dark:text-red-400'
+							: data.runStatus === 'materialized'
+								? 'text-green-600 dark:text-green-400'
+								: 'text-blue-600 dark:text-blue-400'}"
+						title={data.runStatus}
+					>
+						{#if data.runStatus === 'running'}
+							<Loader2 size={11} class="animate-spin" />
+						{:else if data.runStatus === 'failed'}
+							<XCircle size={11} />
+						{:else}
+							<CheckCircle2 size={11} />
+						{/if}
+					</span>
+					<!-- Rows the run wrote. Recorded per relation already, and the cheapest
+				     answer to "did this model actually produce anything" — a model that
+				     built green but emitted 0 rows is the failure that looks like a
+				     success. Only once settled: mid-build the number is not yet real. -->
+					{#if data.runStatus === 'materialized' && data.runRowCount != undefined}
+						<span
+							class="shrink-0 mr-1 text-3xs tabular-nums text-tertiary"
+							title="{data.runRowCount} rows written by this run"
+						>
+							{Intl.NumberFormat().format(data.runRowCount)}
+						</span>
+					{/if}
 				{/if}
-			</button>
+			{/snippet}
+			{#snippet trailing()}
+				<!-- Fork data-environment chip: in a fork every asset shares its parent's
+			     name, so the env it resolves to must read at a glance. Labeled + tinted
+			     (amber "parent" = deferred read of the parent's current table via a
+			     view; emerald "fork" = the fork's own materialized copy) rather than a
+			     bare icon, which was too easy to miss. The title carries the detail. -->
+				{#if data.fork_materialization === 'deferred'}
+					<span
+						class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300 border border-amber-300 dark:border-amber-700"
+						title="Deferred to parent workspace: reads the parent's current data. Materialize it in this fork to iterate on it."
+					>
+						<ArrowUpRight size={10} />
+						parent
+					</span>
+				{:else if data.fork_materialization === 'fork'}
+					<span
+						class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold uppercase tracking-wide bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300 border border-emerald-300 dark:border-emerald-700"
+						title="Materialized in this fork: reads and writes use the fork's isolated copy."
+					>
+						<GitFork size={10} />
+						fork
+					</span>
+				{/if}
+				<!-- dbt chip: names the materialization dbt declares, plus a test count
+			     when the model carries generic tests. Orange keeps it visually
+			     separate from the fork/SCD2 chips, which describe Windmill state.
+			     Where the project node is on the graph it also stands in for the edge
+			     to it: hovering lights that node up, clicking selects it. Where it is
+			     not — the run page, and a pipeline holding a dbt project — there is
+			     nothing to point at, so the chip renders inert. -->
+				{#if data.dbt}
+					<button
+						type="button"
+						class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold tracking-wide bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300 border border-orange-300 dark:border-orange-700 {data.onDbtSelect
+							? 'hover:brightness-95 cursor-pointer'
+							: 'cursor-default'}"
+						title={dbtTitle}
+						onmouseenter={() => data.onDbtHover?.(true)}
+						onmouseleave={() => data.onDbtHover?.(false)}
+						onclick={(e) => {
+							e.stopPropagation()
+							data.onDbtSelect?.()
+						}}
+					>
+						<DbtIcon width={9} height={9} />
+						{dbtLabel}
+						{#if data.dbt.data_tests?.length}
+							<span class="opacity-70">&middot; {data.dbt.data_tests.length}T</span>
+						{/if}
+					</button>
+				{/if}
+				<!-- SCD2 companion marker: this node is the `<dim>_current` "latest row
+			     per key" view its producer maintains alongside the base dimension.
+			     Icon-only (the pill already truncates); the title names the base. -->
+				{#if data.derived_from}
+					<span
+						class="shrink-0 mr-1.5 text-violet-600 dark:text-violet-400"
+						title={`SCD2 current view of ${data.derived_from}: latest row per key, maintained by the same producer as the base dimension.`}
+					>
+						<History size={12} />
+					</span>
+				{/if}
+			{/snippet}
+		</PipelineNodeCard>
 		{/if}
-		<!-- SCD2 companion marker: this node is the `<dim>_current` "latest row
-		     per key" view its producer maintains alongside the base dimension.
-		     Icon-only (the pill already truncates); the title names the base. -->
-		{#if data.derived_from}
-			<span
-				class="shrink-0 mr-1.5 text-violet-600 dark:text-violet-400"
-				title={`SCD2 current view of ${data.derived_from}: latest row per key, maintained by the same producer as the base dimension.`}
-			>
-				<History size={12} />
-			</span>
-		{/if}
-	</div>
+	</NodeActionsMenu>
 	{#if showGuardBadge}
 		<!-- Data-test outcome badge. Floats off the TOP-RIGHT corner (opposite the
 		     left-edge run button and the bottom + inserter) so it never collides
@@ -361,6 +759,7 @@
 		<div
 			class={twMerge(
 				'absolute -top-2 -right-2 z-10 rounded-full w-5 h-5 grid place-items-center border shadow-sm',
+				hasHeader && CARD_CORNER_TOP,
 				guardClass
 			)}
 			title={guardTitle}
@@ -376,7 +775,13 @@
 		     cards. Drafts are runnable too via runScriptPreview, so no
 		     greyed-out state — the page-supplied callback handles the
 		     dispatch. -->
-		<div class="absolute -left-3 top-1/2 -translate-y-1/2 z-10">
+		<!-- Centred on the card, below the header tab when there is one. -->
+		<div
+			class={twMerge(
+				'absolute -left-3 top-1/2 -translate-y-1/2 z-10',
+				hasHeader && !data.bannerOnly && 'top-[calc(50%+11px)]'
+			)}
+		>
 			<button
 				type="button"
 				onclick={runProducers}
@@ -398,53 +803,47 @@
 			</button>
 		</div>
 	{/if}
-	{#if showAdd}
-		<!-- Always-visible + below the asset for downstream pipeline-script
-		     creation. Half-overlapping the bottom edge so it visually attaches
-		     to the node like the flow editor's between-step inserter. -->
+	{#if data.onStartOnDrag}
+		<NodeOnDot onStart={data.onStartOnDrag} visible={hovered} />
+	{/if}
+	{#if data.fix}
+		<!-- A red node's way out replaces its "+": adding downstream of a broken
+		     node is not what it needs. -->
 		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
-			<PipelineInsertMenu
-				kinds={[
-					{
-						id: 'pipeline_script',
-						label: 'Add downstream pipeline script',
-						description: 'Triggered when this asset changes',
-						icon: Code2
-					}
-				]}
-				languages={PIPELINE_LANGUAGES as any}
-				pathPrefix={data.pathPrefix ?? ''}
-				defaultPathSuffix={data.defaultPathSuffix ?? ''}
-				onPick={handlePick}
+			<NodeFixButton fix={data.fix} />
+		</div>
+	{:else if showAdd}
+		<!-- Always-visible + on the asset's bottom edge for downstream pipeline-
+		     script creation, half-overlapping it like the flow editor's
+		     between-step inserter. -->
+		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
+			<AddDownstreamMenu
+				asset={{ kind: data.asset_kind, path: data.path }}
+				onAddScript={data.onAddScript!}
+				pathPrefix={data.pathPrefix}
+				defaultPathSuffix={data.defaultPathSuffix}
 			>
-				{#snippet trigger()}
-					<!--
-						Sizing notes for the round + button:
-						  - w-6/h-6 (24px) chosen so that with border-2 (2px each
-						    side) the inner area is exactly 20px — divisible by
-						    the 16px icon to leave a 2px gap on every side. At
-						    20px / 12px before, the gap was 4px-each but the
-						    odd rounding interacted badly with svelte-flow's
-						    fractional zoom transforms and the icon drifted
-						    half a pixel off-center on certain zoom levels.
-						  - `grid place-items-center` instead of flex centering:
-						    flex's baseline alignment introduces a sub-pixel
-						    nudge on small elements that grid avoids.
-						  - `leading-none` strips the default line-height
-						    contribution that the SVG inherits via the parent's
-						    text rendering, otherwise the icon is shifted
-						    downward by ~0.5px at fractional zooms.
-					-->
+				{#snippet trigger({ open })}
+					<!-- A click opens the menu; a drag goes to the canvas, which
+					     tells a real drag from a click by how far the pointer moves. -->
 					<button
 						type="button"
+						class="nopan nodrag block"
 						onclick={(e) => e.stopPropagation()}
-						class="bg-surface border border-gray-400 dark:border-gray-600 text-secondary hover:bg-surface-hover rounded-full w-6 h-6 grid place-items-center shadow-sm leading-none"
-						title="Add downstream pipeline script"
+						onpointerdown={(e) => {
+							if (e.button !== 0) return
+							e.preventDefault()
+							data.onStartFeedDrag?.(e)
+						}}
+						aria-label="Add downstream step"
+						title={data.onStartFeedDrag
+							? 'Click to add a downstream step, or drag onto a script to run it after each write'
+							: undefined}
 					>
-						<Plus size={16} strokeWidth={2.5} />
+						<AddDownstreamPill expanded={open} />
 					</button>
 				{/snippet}
-			</PipelineInsertMenu>
+			</AddDownstreamMenu>
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
index 7cee1deb76..7d55da04a1 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
@@ -15,7 +15,6 @@
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import JobArgs from '$lib/components/JobArgs.svelte'
-	import { base } from '$lib/base'
 	import { Badge } from '$lib/components/common'
 	import { Popover } from '$lib/components/meltComponents'
 	import { twMerge } from 'tailwind-merge'
@@ -288,7 +287,7 @@
 			</span>
 			<a
 				class="text-3xs text-blue-600 hover:underline shrink-0"
-				href={`${base}/run/${selectedJob.id}?workspace=${$operatingWorkspace}`}
+				href={`/run/${selectedJob.id}?workspace=${$operatingWorkspace}`}
 				target="_blank">Open ↗</a
 			>
 			{#if $operatingWorkspace}
diff --git a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
index 5f5dc98b60..5391c7caff 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
@@ -16,7 +16,6 @@
 	import { parseDbInputFromAssetSyntax } from '$lib/utils'
 	import { AlertTriangle, Database, Loader2, Settings } from 'lucide-svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
-	import { base } from '$lib/base'
 	import { twMerge } from 'tailwind-merge'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
@@ -180,7 +179,7 @@
 				</span>
 			</div>
 			<Button
-				href="{base}/workspace_settings?tab=windmill_data_tables"
+				href="/workspace_settings?tab=windmill_data_tables"
 				variant="accent"
 				unifiedSize="sm"
 				startIcon={{ icon: Settings }}
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte
index 5f7ad050e4..65bd86258d 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeAssetPanel.svelte
@@ -11,7 +11,8 @@
 	// can't be read), so a selectable version always exists in the table.
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { Table2, History, Columns3 } from 'lucide-svelte'
+	import { Table2, History, Columns3, Database } from 'lucide-svelte'
+	import DBManagerContent from '$lib/components/DBManagerContent.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { resource } from 'runed'
 	import { fetchDucklakeSnapshots } from '$lib/components/dbOps'
@@ -31,7 +32,7 @@
 	}
 	let { path, workspace, schemaCanEvolve = true }: Props = $props()
 
-	let tab = $state<'partitions' | 'history' | 'schema'>('partitions')
+	let tab = $state<'data' | 'partitions' | 'history' | 'schema'>('data')
 	// The user's explicit snapshot pick (undefined until they click a row).
 	let selectedVersion = $state<number | undefined>(undefined)
 
@@ -72,24 +73,28 @@
 </script>
 
 <div class="flex flex-col h-full">
-	{#if !qualifiedTable}
-		<!-- Catalog-level ducklake node (no table segment, e.g. `ducklake://main`):
-		     snapshot history / time-travel are per-table, so only the partition
-		     grid applies here. -->
-		<PartitionStatusGrid {path} {workspace} />
-	{:else}
-		<div class="flex items-center gap-2 px-3 py-2 border-b shrink-0">
-			<ToggleButtonGroup selected={tab} on:selected={(e) => (tab = e.detail)}>
-				{#snippet children({ item })}
-					<ToggleButton size="sm" value="partitions" label="Partitions" icon={Table2} {item} />
+	<div class="flex items-center gap-2 px-3 py-2 border-b shrink-0">
+		<ToggleButtonGroup selected={tab} on:selected={(e) => (tab = e.detail)}>
+			{#snippet children({ item })}
+				<ToggleButton size="sm" value="data" label="Data" icon={Database} {item} />
+				<ToggleButton size="sm" value="partitions" label="Partitions" icon={Table2} {item} />
+				<!-- Snapshot history and time-travel are per table: a catalog-level node
+				     (`ducklake://main`, no table segment) has only its data and partitions. -->
+				{#if qualifiedTable}
 					<ToggleButton size="sm" value="schema" label="Schema" icon={Columns3} {item} />
 					<ToggleButton size="sm" value="history" label="History" icon={History} {item} />
-				{/snippet}
-			</ToggleButtonGroup>
-		</div>
+				{/if}
+			{/snippet}
+		</ToggleButtonGroup>
+	</div>
 
-		<div class="flex-1 min-h-0">
-			{#if tab === 'partitions'}
+	<div class="flex-1 min-h-0">
+		{#if tab === 'data' && parsed}
+			<!-- Keyed on the asset: the manager opens its table once, on mount. -->
+			{#key path}
+				<DBManagerContent input={parsed} {workspace} />
+			{/key}
+		{:else if tab === 'partitions' || !qualifiedTable}
 				<PartitionStatusGrid {path} {workspace} />
 			{:else if tab === 'schema'}
 				<SchemaHistoryPanel {path} {workspace} canEvolve={schemaCanEvolve} />
@@ -117,7 +122,6 @@
 						</Pane>
 					</Splitpanes>
 				</div>
-			{/if}
-		</div>
-	{/if}
+		{/if}
+	</div>
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte b/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte
index eea1fb306d..2f8c0cdfe7 100644
--- a/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/InitialFitView.svelte
@@ -25,6 +25,8 @@
 		if (!nodesInitialized.current) return
 		if (!nodes.some((n) => n.type !== 'add')) return
 		fittedFor = fitKey
-		void fitView({ padding: 0.1, maxZoom: 1 })
+		// A re-fit over nodes that keep their ids finds them already measured, one
+		// render before their new positions reach the flow.
+		requestAnimationFrame(() => void fitView({ padding: 0.1, maxZoom: 1 }))
 	})
 </script>
diff --git a/frontend/src/lib/components/assets/AssetGraph/NodeActionsMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/NodeActionsMenu.svelte
new file mode 100644
index 0000000000..dcb32aa00e
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/NodeActionsMenu.svelte
@@ -0,0 +1,68 @@
+<!--
+@component
+A pipeline node's actions, reachable two ways: the kebab revealed on hover at the
+node's top-right corner, and a right-click menu over the node carrying the same
+items. Place it inside the node's `relative` wrapper, around the node's card.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { twMerge } from 'tailwind-merge'
+	import { EllipsisVertical } from 'lucide-svelte'
+	import { stopPropagation, preventDefault } from 'svelte/legacy'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import ContextMenu from '$lib/components/common/contextmenu/ContextMenu.svelte'
+	import { contextMenuItemsFromMenu } from '$lib/components/common/contextmenu/fromMenuItems'
+	import type { Item } from '$lib/utils'
+
+	interface Props {
+		items: Item[]
+		/** The pointer is over the node: shows the kebab. */
+		hover: boolean
+		/** Moves the kebab, for a node with its own badge on that corner. */
+		kebabClass?: string
+		children: Snippet
+	}
+
+	let { items, hover, kebabClass, children }: Props = $props()
+
+	let menuOpen = $state(false)
+	let contextItems = $derived(contextMenuItemsFromMenu(items))
+</script>
+
+{#if items.length > 0}
+	<ContextMenu items={contextItems}>
+		{@render children()}
+	</ContextMenu>
+	<!-- Rendered only on hover or while open, so the canvas stays clean at rest.
+	     `pointerdown` is stopped so svelte-flow doesn't select the node when the
+	     user reaches for the menu. -->
+	<div
+		class={twMerge('absolute -top-2 -right-2 h-7 p-1 min-w-7', kebabClass)}
+		style="will-change: transform;"
+	>
+		<DropdownV2
+			{items}
+			placement="bottom-end"
+			bind:open={menuOpen}
+			fixedHeight={false}
+			usePointerDownOutside
+			enableFlyTransition
+		>
+			{#snippet buttonReplacement()}
+				<button
+					class={twMerge(
+						'center-center p-1 text-secondary shadow-sm bg-surface duration-0 hover:bg-surface-tertiary',
+						hover || menuOpen ? 'block' : '!hidden',
+						'shadow-md rounded-md'
+					)}
+					onpointerdown={stopPropagation(preventDefault(() => {}))}
+					title="Actions"
+				>
+					<EllipsisVertical size={12} />
+				</button>
+			{/snippet}
+		</DropdownV2>
+	</div>
+{:else}
+	{@render children()}
+{/if}
diff --git a/frontend/src/lib/components/assets/AssetGraph/NodeFixButton.svelte b/frontend/src/lib/components/assets/AssetGraph/NodeFixButton.svelte
new file mode 100644
index 0000000000..6e3ba8b8ee
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/NodeFixButton.svelte
@@ -0,0 +1,124 @@
+<!--
+@component
+The "Fix" pill on the bottom edge of a misconfigured (red) pipeline node: what is
+wrong, and the actions that fix it. Styled like the node's "+" pill; the node's
+red fill already says something is wrong.
+-->
+<script lang="ts" module>
+	export type NodeFixAction = {
+		label: string
+		/** The side effect, spelled out: what changes, where. */
+		detail?: string
+		/** `anchor`: where the Fix pill sits, for an action opening a menu there. */
+		run: (anchor: { x: number; y: number }) => void
+	}
+	/** Prose, with the entities it names as links that select them. */
+	export type FixExplainer = Array<string | { text: string; onClick: () => void }>
+	export type NodeFix = { explainer: FixExplainer; actions: NodeFixAction[] }
+
+	/** A fix as its supplier declares it: an action, or opening the schedule
+	 * wizard (which the canvas owns). */
+	export type NodeFixSpec = {
+		explainer: FixExplainer
+		actions: Array<{
+			label: string
+			detail?: string
+			run?: () => void
+			/** Opens the schedule wizard for this script; its confirm calls `onSchedule`. */
+			scheduleFor?: {
+				script: string
+				onSchedule: (s: import('./PipelineInsertMenu.svelte').PipelineInsertSchedule) => void
+			}
+		}>
+	}
+</script>
+
+<script lang="ts">
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import { Button } from '$lib/components/common'
+	import { Wrench } from 'lucide-svelte'
+
+	let {
+		fix,
+		label = 'Fix',
+		chip = false
+	}: {
+		fix: NodeFix
+		label?: string
+		/** A small chip in a node's text, rather than the pill on its edge. */
+		chip?: boolean
+	} = $props()
+
+	let open = $state(false)
+	let anchorEl: HTMLElement | undefined = $state()
+</script>
+
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div
+	bind:this={anchorEl}
+	onpointerdown={(e) => e.stopPropagation()}
+	onkeydown={(e) => e.stopPropagation()}
+	onclick={(e) => e.stopPropagation()}
+>
+	<Popover
+		bind:isOpen={open}
+		placement="bottom"
+		enableFlyTransition
+		usePointerDownOutside
+		contentClasses="p-3 w-96"
+	>
+		{#snippet trigger()}
+			{#if chip}
+				<span
+					class="flex items-center gap-1 rounded-md border px-1.5 py-1 text-3xs leading-none font-normal whitespace-nowrap bg-surface border-red-300 dark:border-red-600 text-red-700 dark:text-red-300 hover:bg-surface-hover"
+				>
+					<Wrench size={10} class="shrink-0" />
+					{label}
+				</span>
+			{:else}
+				<span
+					class="h-6 px-2 rounded-full flex items-center gap-1 bg-surface border border-gray-400 dark:border-gray-600 text-secondary hover:text-primary hover:border-gray-500 shadow-sm text-2xs font-normal leading-none whitespace-nowrap"
+				>
+					<Wrench size={12} class="shrink-0" />
+					{label}
+				</span>
+			{/if}
+		{/snippet}
+		{#snippet content()}
+			<div class="flex flex-col gap-3">
+				<p class="text-xs text-primary">
+					{#each fix.explainer as part}
+						{#if typeof part === 'string'}{part}{:else}<button
+								type="button"
+								class="text-accent hover:underline"
+								onclick={() => {
+									open = false
+									part.onClick()
+								}}>{part.text}</button
+							>{/if}
+					{/each}
+				</p>
+				<div class="flex flex-col gap-2">
+					{#each fix.actions as action, i (action.label)}
+						<div class="flex flex-col gap-0.5">
+							<Button
+								variant={i === 0 ? 'accent' : 'default'}
+								unifiedSize="sm"
+								onclick={() => {
+									const r = anchorEl?.getBoundingClientRect()
+									open = false
+									action.run({ x: r ? r.left + r.width / 2 : 0, y: r ? r.bottom : 0 })
+								}}
+							>
+								{action.label}
+							</Button>
+							{#if action.detail}
+								<span class="text-2xs text-secondary">{action.detail}</span>
+							{/if}
+						</div>
+					{/each}
+				</div>
+			</div>
+		{/snippet}
+	</Popover>
+</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/NodeOnDot.svelte b/frontend/src/lib/components/assets/AssetGraph/NodeOnDot.svelte
new file mode 100644
index 0000000000..25d84b9197
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/NodeOnDot.svelte
@@ -0,0 +1,23 @@
+<!--
+@component
+The dot on a pipeline node's top edge: dragged onto an asset, it makes the node's
+script run after each write to that asset.
+-->
+<script lang="ts">
+	let { onStart, visible }: { onStart: (e: PointerEvent) => void; visible: boolean } = $props()
+</script>
+
+<button
+	type="button"
+	class="absolute -top-1.5 left-1/2 -translate-x-1/2 z-10 w-3 h-3 rounded-full bg-surface border-2 border-blue-500 cursor-crosshair transition-opacity {visible
+		? 'opacity-100'
+		: 'opacity-0'}"
+	title="Drag onto an asset to run after each write to it"
+	aria-label="Drag onto an asset to run after each write to it"
+	onpointerdown={(e) => {
+		e.stopPropagation()
+		e.preventDefault()
+		onStart(e)
+	}}
+	onclick={(e) => e.stopPropagation()}
+></button>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte b/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte
index 83df60b340..22acd606cb 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PanToNode.svelte
@@ -2,6 +2,7 @@
 	import { useSvelteFlow, type Node } from '@xyflow/svelte'
 	import { untrack } from 'svelte'
 	import { NODE } from '$lib/components/graph/util'
+	import { PIPELINE_NODE_HEIGHT } from './assetGraphLayout'
 
 	// Smoothly pans the viewport so a freshly-created node lands in the middle,
 	// keeping the current zoom. Lives inside <SvelteFlow> so useSvelteFlow() has
@@ -27,8 +28,8 @@
 		untrack(() => {
 			const node = ns.find((n) => n.id === id)
 			if (!node) return // not laid out yet — re-runs when `nodes` updates
-			const cx = node.position.x + NODE.width / 2
-			const cy = node.position.y + NODE.height / 2
+			const cx = node.position.x + (node.measured?.width ?? NODE.width) / 2
+			const cy = node.position.y + PIPELINE_NODE_HEIGHT / 2
 			const key = `${id}:${cx}:${cy}`
 			if (key === lastKey) return
 			lastKey = key
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte
index 7e6c34adc2..27a3253d0e 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineActivityPanel.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { workspaceStore } from '$lib/stores'
 	import type { Job } from '$lib/gen'
 	import Select from '$lib/components/select/Select.svelte'
@@ -416,7 +415,7 @@
 					onmouseenter={() => onHoverRun?.([e.path])}
 					onmouseleave={() => onHoverRun?.(undefined)}
 					class={twMerge(
-						'w-full flex items-center gap-2 px-2 py-1 rounded-sm hover:bg-surface-hover text-xs text-left',
+						'w-full flex items-center gap-2 px-2 py-1.5 rounded-sm font-normal hover:bg-surface-hover text-xs text-left',
 						isMember && 'pl-7',
 						expanded && 'bg-surface-selected'
 					)}
@@ -445,7 +444,7 @@
 					{:else}
 						<Code2 size={12} class="shrink-0 text-tertiary" />
 					{/if}
-					<span class="flex-1 min-w-0 truncate font-mono text-2xs" title={e.path}>
+					<span class="flex-1 min-w-0 truncate text-xs" title={e.path}>
 						{e.path}
 					</span>
 					{#if showSource}
@@ -477,7 +476,7 @@
 									<span class="font-mono truncate flex-1 min-w-0">{expandedJob.id}</span>
 									<a
 										class="text-blue-600 hover:underline shrink-0"
-										href={`${base}/run/${expandedJob.id}?workspace=${$workspaceStore}`}
+										href={`/run/${expandedJob.id}?workspace=${$workspaceStore}`}
 										target="_blank">Open ↗</a
 									>
 								</div>
@@ -533,7 +532,7 @@
 						onclick={() => toggleGroup(g.key)}
 						onmouseenter={() => onHoverRun?.(g.members.map((m) => m.path))}
 						onmouseleave={() => onHoverRun?.(undefined)}
-						class="w-full flex items-center gap-2 px-2 py-1 rounded-sm hover:bg-surface-hover text-xs text-left"
+						class="w-full flex items-center gap-2 px-2 py-1.5 rounded-sm font-normal hover:bg-surface-hover text-xs text-left"
 						title={collapsed ? 'Expand cascade runs' : 'Collapse cascade runs'}
 					>
 						<span class="shrink-0 text-tertiary">
@@ -549,7 +548,7 @@
 							{/if}
 						</span>
 						<Workflow size={12} class="shrink-0 text-indigo-500" />
-						<span class="flex-1 min-w-0 truncate font-mono text-2xs" title={groupTitle(g)}>
+						<span class="flex-1 min-w-0 truncate text-xs" title={groupTitle(g)}>
 							{groupTitle(g)}
 						</span>
 						<span
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte
deleted file mode 100644
index 495e9a34bd..0000000000
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte
+++ /dev/null
@@ -1,40 +0,0 @@
-<script lang="ts">
-	import { base } from '$lib/base'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
-	import Button from '$lib/components/common/button/Button.svelte'
-	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
-	import { BookOpen } from 'lucide-svelte'
-
-	const DBT_DOCS = 'https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt'
-</script>
-
-<Alert type="info" title="Prefer using dbt? Windmill also runs dbt" size="xs">
-	<div class="flex flex-col gap-2">
-		<p>
-			A pipeline is Windmill's own abstraction; an existing dbt project stays a dbt project, and
-			runs here unchanged as its own kind of script, with dbt still owning its models, refs and
-			tests. All it needs is a warehouse configured under
-			<a class="underline" href="{base}/workspace_settings?tab=dbt">Settings → dbt</a>. Its models
-			show up in the asset graph as <span class="font-mono">dbt://</span> nodes, visible next to whatever
-			pipelines you do build, so you can adopt pipelines later, or never.
-		</p>
-		<div class="flex flex-row flex-wrap items-center gap-2">
-			<!-- The dbt mark goes in as a child rather than `startIcon`: that slot
-			     sizes its icon with lucide's `size`, which DbtIcon has no prop for. -->
-			<Button variant="default" unifiedSize="sm" href="{base}/scripts/add?lang=dbt">
-				<DbtIcon width={14} height={14} />
-				New dbt script
-			</Button>
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				href={DBT_DOCS}
-				target="_blank"
-				rel="noreferrer"
-				startIcon={{ icon: BookOpen }}
-			>
-				dbt documentation
-			</Button>
-		</div>
-	</div>
-</Alert>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDeployErrors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployErrors.svelte
new file mode 100644
index 0000000000..6206ebdf33
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployErrors.svelte
@@ -0,0 +1,49 @@
+<script lang="ts">
+	import { AlertTriangle } from 'lucide-svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+
+	// Which drafts failed to deploy and why, anchored next to the deploy button so
+	// the reasons are one click away without leaving the editor. Deployed drafts
+	// leave the map; what is listed is still unresolved.
+	let {
+		errors,
+		open = $bindable()
+	}: {
+		errors: ReadonlyMap<string, string>
+		open?: boolean
+	} = $props()
+</script>
+
+<Popover
+	placement="bottom-end"
+	contentClasses="p-3 max-w-[480px]"
+	usePointerDownOutside
+	enableFlyTransition
+	bind:isOpen={open}
+>
+	{#snippet trigger()}
+		<button
+			type="button"
+			class="flex items-center gap-1.5 px-2 py-1 rounded-md text-red-600 dark:text-red-400 bg-red-50 dark:bg-red-900/30 hover:bg-red-100 dark:hover:bg-red-900/50 transition-colors text-xs font-medium"
+			title="View save errors"
+		>
+			<AlertTriangle size={14} />
+			<span>{errors.size} failed</span>
+		</button>
+	{/snippet}
+	{#snippet content()}
+		<div class="flex flex-col gap-2">
+			<span class="text-xs font-semibold text-emphasis">Save errors</span>
+			<div class="flex flex-col gap-2 max-h-72 overflow-y-auto">
+				{#each [...errors.entries()] as [path, message] (path)}
+					<div class="flex flex-col gap-0.5 border-l-2 border-red-400 pl-2">
+						<span class="text-2xs font-mono text-emphasis">{path}</span>
+						<span class="text-2xs text-red-600 dark:text-red-400 break-words">
+							{message}
+						</span>
+					</div>
+				{/each}
+			</div>
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte
new file mode 100644
index 0000000000..d96b758625
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte
@@ -0,0 +1,47 @@
+<script lang="ts">
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import type { PipelineTriggerDraft } from './types'
+
+	// Triggers start running once deployed, so deploying a pipeline's trigger
+	// drafts asks first, listing what will start.
+	let {
+		open,
+		triggerDrafts,
+		onConfirmed,
+		onCanceled
+	}: {
+		open: boolean
+		triggerDrafts: ReadonlyMap<string, PipelineTriggerDraft>
+		onConfirmed: () => void
+		onCanceled: () => void
+	} = $props()
+</script>
+
+<ConfirmationModal
+	{open}
+	title="Deploy triggers?"
+	confirmationText="Deploy"
+	type="info"
+	{onConfirmed}
+	{onCanceled}
+>
+	<div class="flex flex-col gap-2 text-xs text-secondary">
+		<p>
+			{triggerDrafts.size === 1
+				? 'Saving the pipeline also creates this trigger. It starts running its script once deployed.'
+				: `Saving the pipeline also creates these ${triggerDrafts.size} triggers. They start running their scripts once deployed.`}
+		</p>
+		<ul class="flex flex-col gap-1">
+			{#each [...triggerDrafts] as [key, d] (key)}
+				<li class="flex flex-col">
+					<span class="font-mono text-2xs text-emphasis truncate">{d.config.path}</span>
+					<span class="text-2xs text-hint truncate">
+						{d.kind}{#if d.kind === 'schedule'}
+							· <span class="font-mono">{d.config.schedule}</span> ({d.config.timezone}){/if}
+						→ {d.config.script_path}
+					</span>
+				</li>
+			{/each}
+		</ul>
+	</div>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte
index d35b4f21d6..52772ce515 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineFolderList.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { userStore, workspaceStore } from '$lib/stores'
-	import { base } from '$lib/base'
 	import { goto } from '$app/navigation'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import FolderPicker from '$lib/components/FolderPicker.svelte'
@@ -18,11 +17,18 @@
 		mode?: 'view' | 'edit'
 		// Called right before navigating — lets a wrapping modal close itself.
 		onOpen?: () => void
+		// Only the folder picker, for hosts that don't list pipelines.
+		hideExisting?: boolean
 	}
-	let { currentFolder = undefined, mode = 'view', onOpen = undefined }: Props = $props()
+	let {
+		currentFolder = undefined,
+		mode = 'view',
+		onOpen = undefined,
+		hideExisting = false
+	}: Props = $props()
 
 	let pipelines = resource(
-		() => $workspaceStore,
+		() => (hideExisting ? undefined : $workspaceStore),
 		async (ws) => {
 			if (!ws) return [] as ListPipelineFoldersResponse
 			return await AssetService.listPipelineFolders({ workspace: ws })
@@ -38,7 +44,7 @@
 	async function openExistingPipeline(folder: string) {
 		onOpen?.()
 		const modeQuery = mode !== 'view' ? `?mode=${mode}` : ''
-		await goto(`${base}/pipeline/${encodeURIComponent(folder)}${modeQuery}`)
+		await goto(`/pipeline/${encodeURIComponent(folder)}${modeQuery}`)
 	}
 
 	async function openPicked() {
@@ -49,50 +55,52 @@
 </script>
 
 <div class="flex flex-col gap-6 w-full min-w-0">
-	<section class="flex flex-col gap-2">
-		<h3 class="text-xs font-semibold text-secondary uppercase tracking-wide">
-			Existing pipelines
-		</h3>
-		{#if pipelines.loading && !pipelines.current}
-			<div class="text-tertiary text-sm flex items-center gap-2">
-				<Loader2 size={14} class="animate-spin" />
-				Loading…
-			</div>
-		{:else if pipelines.error}
-			<div class="text-red-500 text-sm">Failed: {pipelines.error.message}</div>
-		{:else if visiblePipelines.length === 0}
-			<div class="text-tertiary text-sm">
-				{currentFolder
-					? 'No other pipelines in this workspace.'
-					: 'No pipelines yet. A pipeline is any folder whose scripts carry pipeline annotations.'}
-			</div>
-		{:else}
-			<div class="flex flex-col border rounded-md overflow-hidden max-h-64 overflow-y-auto">
-				{#each visiblePipelines as p (p.folder)}
-					<button
-						type="button"
-						class="flex items-center justify-between px-3 py-2 border-b last:border-b-0 bg-surface hover:bg-surface-hover transition-colors text-left"
-						onclick={() => openExistingPipeline(p.folder)}
-					>
-						<span class="font-mono text-sm">f/{p.folder}</span>
-						<span class="text-2xs text-tertiary">
-							{p.script_count}
-							{p.script_count === 1 ? 'script' : 'scripts'}
-						</span>
-					</button>
-				{/each}
-			</div>
-		{/if}
-	</section>
+	{#if !hideExisting}
+		<section class="flex flex-col gap-2">
+			<h3 class="text-sm font-semibold text-emphasis">Existing pipelines</h3>
+			{#if pipelines.loading && !pipelines.current}
+				<div class="text-tertiary text-sm flex items-center gap-2">
+					<Loader2 size={14} class="animate-spin" />
+					Loading…
+				</div>
+			{:else if pipelines.error}
+				<div class="text-red-500 text-sm">Failed: {pipelines.error.message}</div>
+			{:else if visiblePipelines.length === 0}
+				<div class="text-tertiary text-sm">
+					{currentFolder
+						? 'No other pipelines in this workspace.'
+						: 'No pipelines yet. A pipeline is any folder whose scripts carry pipeline annotations.'}
+				</div>
+			{:else}
+				<div class="flex flex-col border rounded-md overflow-hidden max-h-64 overflow-y-auto">
+					{#each visiblePipelines as p (p.folder)}
+						<button
+							type="button"
+							class="flex items-center justify-between px-3 py-2 border-b last:border-b-0 bg-surface hover:bg-surface-hover transition-colors text-left"
+							onclick={() => openExistingPipeline(p.folder)}
+						>
+							<span class="font-mono text-sm">f/{p.folder}</span>
+							<span class="text-2xs text-tertiary">
+								{p.script_count}
+								{p.script_count === 1 ? 'script' : 'scripts'}
+							</span>
+						</button>
+					{/each}
+				</div>
+			{/if}
+		</section>
+	{/if}
 
 	{#if !$userStore?.operator}
 		<!-- Operators only view existing pipelines — opening an arbitrary
 		     folder is a build-a-new-pipeline affordance. -->
-		<section class="flex flex-col gap-2">
-			<h3 class="text-xs font-semibold text-secondary uppercase tracking-wide">
-				Pick or create a folder
-			</h3>
-			<div class="flex items-center gap-2">
+		<section class="flex flex-col gap-1">
+			<h3 class="text-sm font-semibold text-emphasis">Pick or create a folder</h3>
+			<p class="text-xs text-secondary">
+				Each folder holds one pipeline, made of its pipeline scripts. Pick a folder to open its
+				pipeline, or create one to start a new pipeline.
+			</p>
+			<div class="flex items-center gap-2 mt-1">
 				<div class="flex-1 min-w-0">
 					<FolderPicker bind:folderName={pickedFolder} />
 				</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
index b71a51ea0a..364c4c6221 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
@@ -1,6 +1,15 @@
 <script lang="ts">
 	import { untrack, type Snippet } from 'svelte'
-	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
+	import { MousePointerClick } from 'lucide-svelte'
+	import Disposable from '$lib/components/common/drawer/Disposable.svelte'
+	import Portal from '$lib/components/Portal.svelte'
+	import { getOverlayHost } from '$lib/components/common/overlayHost.svelte'
+	import { useFlowPanelMode } from '$lib/components/flows/flowPanelMode.svelte'
+	import {
+		PIPELINE_DRAFT_KIND,
+		pipelineBundlePath,
+		pipelineLocalMirrorKey
+	} from '$lib/pipelinePaths'
 	import { Loader2 } from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { DraftService } from '$lib/gen'
@@ -11,6 +20,11 @@
 	import type { ColumnLineageGraph } from './columnLineageGraph'
 	import HideButton from '$lib/components/apps/editor/settingsPanel/HideButton.svelte'
 	import AssetGraphCanvas from './AssetGraphCanvas.svelte'
+	import { TRIGGER_NODE_STYLE } from './TriggerNode.svelte'
+	import { describeSchedule } from '$lib/utils/describeCron'
+	import type { UpstreamTriggerAction } from './upstreamScriptItems'
+	import type { AssetUpstreamDelete } from './assetsOnlyView'
+	import type { NodeFixSpec } from './NodeFixButton.svelte'
 	import AssetGraphDetailsPane from './AssetGraphDetailsPane.svelte'
 	import PipelineEventLog from './PipelineEventLog.svelte'
 	import type {
@@ -18,8 +32,10 @@
 		AssetGraphSelection,
 		NativeTriggerKind,
 		PipelineMode,
+		PipelineTriggerDraft,
 		DbtAssetProvenance
 	} from './types'
+	import { isDraftableTriggerKind, triggerDraftKey } from './pipelineTriggerDrafts'
 	import type { AssetKind, Script, ScriptLang } from '$lib/gen'
 	import type { RunnableRunState, PipelineEvent } from './activeRunnables.svelte'
 	import type { PipelineOutputKind } from './pipelineTemplates'
@@ -41,6 +57,7 @@
 		defaultPathSuffix = 'new_pipeline_script',
 		panelHidden = false,
 		onTogglePanelHidden,
+		modalPanel = false,
 		prefetchingAssets = false,
 		hoveredPaths = [],
 		selectedRunPaths = [],
@@ -65,6 +82,11 @@
 		onAddScriptForAsset,
 		onAddPipelineScript,
 		onRunnableMenuRemove,
+		onDeleteAssetUpstream,
+		nodeFixes,
+		assetDeleteVerb,
+		onEdgeAction,
+		onAddAssetTrigger,
 		onRunProducer,
 		idlePane,
 		onRequestEdit,
@@ -73,6 +95,9 @@
 		onRunCascadeByPath,
 		runFormInitialArgs,
 		onRunFormArgsChange,
+		inputsOnly = false,
+		onRunInputs,
+		onShowScript,
 		readyDataUploadPaths,
 		resolveLocalScript,
 		localScriptsVersion,
@@ -126,6 +151,9 @@
 		pathPrefix: string
 		defaultPathSuffix?: string
 		panelHidden?: boolean
+		/** Let the details pane open as a modal over a full-width graph when the editor
+		 * is too narrow to dock it — the flow editor's step panel rule. */
+		modalPanel?: boolean
 		onTogglePanelHidden?: () => void
 		prefetchingAssets?: boolean
 		hoveredPaths?: string[]
@@ -153,16 +181,29 @@
 			language: ScriptLang,
 			scriptPath: string,
 			outputKind: PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		onAddPipelineScript?: (
 			language: ScriptLang,
 			path: string,
 			source: { kind: NativeTriggerKind; path: string | undefined },
 			outputKind: PipelineOutputKind,
-			aiPrompt?: string
+			aiPrompt?: string,
+			options?: import('./PipelineInsertMenu.svelte').PipelineInsertOptions
 		) => void
 		onRunnableMenuRemove?: (...args: any[]) => void
+		onDeleteAssetUpstream?: (target: AssetUpstreamDelete) => void
+		nodeFixes?: ReadonlyMap<string, NodeFixSpec>
+		assetDeleteVerb?: 'Delete' | 'Archive'
+		onEdgeAction?: (a: {
+			action: 'listen' | 'stop'
+			targets: Array<{ script: string; asset: { kind: AssetKind; path: string }; reads: boolean }>
+		}) => void
+		onAddAssetTrigger?: (a: {
+			scripts: Array<{ script: string; reads: boolean }>
+			asset: { kind: AssetKind; path: string }
+		}) => void
 		onRunProducer?: (producer: RunProducer) => Promise<string | undefined>
 		idlePane?: Snippet
 		onRequestEdit?: () => void
@@ -175,8 +216,16 @@
 		// callback to persist them as they change — see the page's dataUploadArgs.
 		runFormInitialArgs?: Record<string, any>
 		onRunFormArgsChange?: (path: string, args: Record<string, any>, isValid: boolean) => void
+		/** See AssetGraphDetailsPane's `inputsOnly`. */
+		inputsOnly?: boolean
+		onRunInputs?: (
+			path: string,
+			args: Record<string, any>,
+			live?: { content: string; language: ScriptLang }
+		) => Promise<string | undefined>
+		onShowScript?: () => void
 		// Data-upload entry scripts whose staged upload is ready (green node).
-		readyDataUploadPaths?: Set<string>
+		readyDataUploadPaths?: ReadonlySet<string>
 		/** Local-dev (`/pipeline_dev`): resolve a node to its working-tree content
 		 * so the details pane skips the (nonexistent) deployed-script fetch. May
 		 * be async (to infer the args schema for the run form). */
@@ -247,18 +296,81 @@
 			? (editor.selection != undefined || editor.activeDraftPath != undefined) && !panelHidden
 			: !panelHidden
 	)
+	// Docked beside the graph, or in a modal over it (modal mode). In modal mode the
+	// details only show once asked for: a double-click on a node, a click on the
+	// node already selected, or a script's open button — never on a selection the
+	// editor makes itself (an AI-built node), which would pop a modal unasked.
+	const panelController = useFlowPanelMode({ enabled: () => modalPanel })
+	$effect(() => panelController.measure(containerWidth))
+	const panelMode = $derived(panelController.mode)
+	let panelModalOpen = $state(false)
+	const dockedPaneOpen = $derived(detailsPaneOpen && panelMode === 'docked')
+	$effect(() => {
+		if (untrack(() => panelModalOpen) && (panelMode === 'docked' || !detailsPaneOpen)) {
+			panelModalOpen = false
+		}
+	})
+	let panelDisposable: Disposable | undefined = $state(undefined)
+	// Disposable joins the overlay stack through its methods, not by watching `open`.
+	$effect(() => {
+		panelModalOpen
+		untrack(() => {
+			panelModalOpen ? panelDisposable?.openDrawer() : panelDisposable?.closeDrawer()
+		})
+	})
+	const overlayHost = getOverlayHost()
+	const modalHost = $derived(overlayHost?.el())
+
+	function selectableNodeAt(e: MouseEvent): HTMLElement | null {
+		return (e.target as HTMLElement | null)?.closest('.svelte-flow__node.selectable') ?? null
+	}
+	// Read in the capture phase: once the click bubbles, the canvas has applied
+	// its selection and a first click looks like a click on the selected node.
+	let clickStartedOnSelected = false
+	function noteSelectionBeforeClick(e: MouseEvent) {
+		clickStartedOnSelected = !!selectableNodeAt(e)?.classList.contains('selected')
+	}
+	function openPanelModalIfReselected(e: MouseEvent) {
+		if (clickStartedOnSelected && selectableNodeAt(e)) panelModalOpen = true
+	}
+	function openPanelModalFromGraph(e: MouseEvent) {
+		if (selectableNodeAt(e)) panelModalOpen = true
+	}
+	// A button in the pane that ends it closes the modal in the same update: left to
+	// the effect above, the modal would first render the pane without its selection.
+	function closePanelModal() {
+		if (panelMode === 'modal') panelModalOpen = false
+	}
+	function handleCanvasSelect(s: AssetGraphSelection | undefined, opts?: { open?: boolean }) {
+		onSelect(s)
+		if (opts?.open && s && panelMode === 'modal') panelModalOpen = true
+	}
+	// A data-upload node's click asks for its run form; in modal mode nothing shows
+	// it unless the modal opens too.
+	$effect(() => {
+		if (focusUploadSignal > 0 && untrack(() => panelMode) === 'modal') {
+			untrack(() => (panelModalOpen = true))
+		}
+	})
+	const showNodeHint = $derived(panelMode === 'modal' && !panelModalOpen)
+	const nodeHintText = $derived(
+		effectiveSelection
+			? 'Click the selected node to open it'
+			: 'Double click a node to open it'
+	)
+
 	let idleView = $derived(
 		mode !== 'edit' && editor.selection == undefined && editor.activeDraftPath == undefined
 	)
 
 	// Wrap the writes (and the rightPaneSize read in the else branch) in untrack so
-	// the effect tracks only `detailsPaneOpen` / `storedRightPaneSize` — without it,
+	// the effect tracks only `dockedPaneOpen` / `storedRightPaneSize` — without it,
 	// the Pane `bind:size` feedback loops the effect and pegs the main thread.
 	$effect(() => {
 		// Stacked (vertical) splits give the details pane more room — the run
 		// form + result need height more than the graph needs it.
 		const fallback = stacked ? 55 : 40
-		if (detailsPaneOpen) {
+		if (dockedPaneOpen) {
 			const restore = storedRightPaneSize
 			untrack(() => {
 				rightPaneSize = restore > 0 ? restore : fallback
@@ -272,6 +384,67 @@
 		}
 	})
 
+	// The selected asset's producing scripts, named and iconed from the graph, for
+	// the pane's "Edit script".
+	let producerScripts = $derived(
+		selectionProducers
+			.filter((p) => p.kind === 'script')
+			.map((p) => {
+				const r = displayGraph.runnables.find((x) => x.usage_kind === 'script' && x.path === p.path)
+				return { path: p.path, summary: r?.summary, language: r?.language }
+			})
+	)
+	// The selected asset's upstream triggers that can be opened from here, each
+	// with the same action its trigger node has: edit (edit mode), create a
+	// missing one (edit mode), or the webhook / data-upload drawers.
+	let producerTriggers = $derived.by((): UpstreamTriggerAction[] => {
+		const scripts = new Set(producerScripts.map((p) => p.path))
+		const seen = new Set<string>()
+		const out: UpstreamTriggerAction[] = []
+		for (const t of displayGraph.triggers ?? []) {
+			if (t.trigger_kind === 'asset' || !scripts.has(t.runnable_path)) continue
+			const kind = t.trigger_kind
+			const rowless = kind === 'webhook' || kind === 'data_upload'
+			const key = `${kind}:${rowless || t.missing ? t.runnable_path : t.path}`
+			if (seen.has(key)) continue
+			seen.add(key)
+			const label = TRIGGER_NODE_STYLE[kind]?.label ?? kind
+			const script = t.runnable_path
+			let action: UpstreamTriggerAction | undefined
+			if (kind === 'webhook') {
+				if (onOpenWebhook)
+					action = { label: 'Open webhook', detail: script, onOpen: () => onOpenWebhook(script) }
+			} else if (kind === 'data_upload') {
+				if (onOpenDataUpload)
+					action = { label: 'Upload data', detail: script, onOpen: () => onOpenDataUpload(script) }
+			} else if (t.missing && !rowless) {
+				if (onCreateMissingTrigger)
+					action = {
+						label: `Create ${label} trigger`,
+						detail: script,
+						onOpen: () => onCreateMissingTrigger(kind, script)
+					}
+			} else if (t.path && onEditTrigger) {
+				const path = t.path
+				action = {
+					label: kind === 'schedule' ? 'Edit schedule' : `Edit ${label} trigger`,
+					detail:
+						kind === 'schedule' && t.schedule
+							? (t.summary ?? describeSchedule(t.schedule, t.timezone) ?? path)
+							: path,
+					onOpen: () => onEditTrigger(kind, path, script)
+				}
+			}
+			if (action) out.push(action)
+		}
+		return out
+	})
+
+	function editProducerScript(path: string) {
+		if (mode !== 'edit') onRequestEdit?.()
+		onSelect({ kind: 'runnable', runnable_kind: 'script', path })
+	}
+
 	// ===================== Draft autosave (persistDrafts only) =====================
 	// All of this folder's in-flight drafts live in ONE per-user DB draft (typ
 	// `data_pipeline`) keyed at the folder, syncing across devices + surfacing in
@@ -279,12 +452,21 @@
 	// for the one-time migration below; the DB is the source of truth on load.
 	// FlowBuilder's autosave analogue — gated by `persistDrafts`.
 	let pipelineDraftPath = $derived(pipelineBundlePath(folder))
-	let storageKey = $derived(`pipeline-${folder}`)
-	type PipelineDraftBundle = { drafts: Array<[string, PipelineDraft]>; activeDraftPath?: string }
+	let storageKey = $derived(pipelineLocalMirrorKey(folder))
+	type PipelineDraftBundle = {
+		drafts: Array<[string, PipelineDraft]>
+		activeDraftPath?: string
+		triggerDrafts?: PipelineTriggerDraft[]
+	}
 	// Hydration is tracked on the editor instance (`editor.hydratedFromDb`), not a
 	// component flag: the in-session preview reuses one instance across editor
 	// hide/show, and it must hydrate ONCE per instance, not on every remount.
 	let lastPersistedBundle: string | undefined = undefined
+	// What decides whether the bundle needs saving: its drafts, not which one is
+	// open. Opening a draft is not an edit, so it rides along with the next real
+	// change instead of saving (and spinning the sync indicator) on a click.
+	const persistKey = (b: PipelineDraftBundle | undefined) =>
+		b ? JSON.stringify({ drafts: b.drafts, triggerDrafts: b.triggerDrafts }) : undefined
 
 	function restoreBundle(bundle: PipelineDraftBundle) {
 		if (Array.isArray(bundle.drafts)) {
@@ -300,6 +482,18 @@
 			if (loaded.size > 0) editor.drafts = loaded
 		}
 		if (typeof bundle.activeDraftPath === 'string') editor.activeDraftPath = bundle.activeDraftPath
+		if (Array.isArray(bundle.triggerDrafts)) {
+			editor.triggerDrafts = new Map(
+				bundle.triggerDrafts
+					.filter(
+						(d) =>
+							isDraftableTriggerKind(d?.kind) &&
+							typeof d.config?.path === 'string' &&
+							typeof d.config?.script_path === 'string'
+					)
+					.map((d) => [triggerDraftKey(d.kind, d.config.path), d])
+			)
+		}
 	}
 
 	function readLocalBundle(): PipelineDraftBundle | undefined {
@@ -311,7 +505,8 @@
 			if (s && (Array.isArray(s.drafts) || typeof s.activeDraftPath === 'string')) {
 				return {
 					drafts: Array.isArray(s.drafts) ? s.drafts : [],
-					activeDraftPath: typeof s.activeDraftPath === 'string' ? s.activeDraftPath : undefined
+					activeDraftPath: typeof s.activeDraftPath === 'string' ? s.activeDraftPath : undefined,
+					triggerDrafts: Array.isArray(s.triggerDrafts) ? s.triggerDrafts : undefined
 				}
 			}
 		} catch (e) {
@@ -339,8 +534,8 @@
 					fromServer = true
 				}
 			}
-			// A folder retarget during the await (the route-page header switcher, or a
-			// session retarget) changed the target and reset hydratedFromDb. Don't
+			// A folder switch during the await (the route page's header switcher)
+			// changed the target and reset hydratedFromDb. Don't
 			// apply this now-stale folder's bundle or mark the new folder hydrated —
 			// otherwise the stale result blocks the new folder's hydrate and its
 			// drafts bleed across folders.
@@ -359,7 +554,7 @@
 				{ workspace: ws ?? '', itemKind: PIPELINE_DRAFT_KIND, path },
 				migratedFromLocal ? undefined : serverSavedAt
 			)
-			if (!migratedFromLocal) lastPersistedBundle = bundle ? JSON.stringify(bundle) : undefined
+			if (!migratedFromLocal) lastPersistedBundle = persistKey(bundle)
 		} catch (e) {
 			console.warn('failed to load pipeline drafts', e)
 		} finally {
@@ -412,30 +607,52 @@
 				return [p, d] as [string, PipelineDraft]
 			return [p, { ...d, script, outputAssets, inputAssets }] as [string, PipelineDraft]
 		})
+		// A deployed script being edited is only promoted to a draft when its pane
+		// closes; until then its buffer is saved as the draft it will become.
+		const { scriptPath: livePath, content: liveBody, base } = editor.liveContent
+		if (
+			livePath != undefined &&
+			base &&
+			!editor.drafts.has(livePath) &&
+			liveBody !== (base.content ?? '')
+		) {
+			const live = editor.liveBodyAssets.scriptPath === livePath
+			const writes = live ? extractWrites(editor.liveBodyAssets.assets) : []
+			serialized.push([
+				livePath,
+				{
+					localId: editor.promotedDraftLocalId(livePath),
+					script: { ...base, content: liveBody },
+					outputAssets: writes.length > 0 ? writes : undefined,
+					inputAssets: live ? extractReads(editor.liveBodyAssets.assets) : undefined
+				}
+			])
+		}
 		const activePath = editor.activeDraftPath
+		const triggerDrafts = [...editor.triggerDrafts.values()]
 		const key = storageKey
 		const ws = workspace
 		const path = pipelineDraftPath
 		const hydrated = editor.hydratedFromDb
 		untrack(() => {
 			if (!hydrated) return
-			const isEmpty = serialized.length === 0 && !activePath
+			const isEmpty = serialized.length === 0 && !activePath && triggerDrafts.length === 0
 			const bundle: PipelineDraftBundle | undefined = isEmpty
 				? undefined
-				: { drafts: serialized, activeDraftPath: activePath }
+				: {
+						drafts: serialized,
+						activeDraftPath: activePath,
+						...(triggerDrafts.length > 0 ? { triggerDrafts } : {})
+					}
 			try {
 				if (typeof localStorage !== 'undefined') {
 					if (isEmpty) localStorage.removeItem(key)
-					else
-						localStorage.setItem(
-							key,
-							encodeState({ drafts: serialized, activeDraftPath: activePath })
-						)
+					else localStorage.setItem(key, encodeState(bundle))
 				}
 			} catch (e) {
 				console.warn('failed to mirror pipeline state', e)
 			}
-			const serializedBundle = bundle ? JSON.stringify(bundle) : undefined
+			const serializedBundle = persistKey(bundle)
 			if (serializedBundle === lastPersistedBundle) return
 			lastPersistedBundle = serializedBundle
 			if (!ws) return
@@ -450,10 +667,90 @@
 	})
 </script>
 
-<div class="h-full w-full" bind:clientWidth={containerWidth}>
+{#snippet detailsBody(ws: string)}
+	{#if idleView && idlePane}
+		{@render idlePane()}
+	{:else}
+		<AssetGraphDetailsPane
+			{mode}
+			{onRequestEdit}
+			{canRunByPath}
+			{onRunByPath}
+			{onRunCascadeByPath}
+			{runFormInitialArgs}
+			{onRunFormArgsChange}
+			{inputsOnly}
+			{onRunInputs}
+			{onShowScript}
+			{resolveLocalScript}
+			{localScriptsVersion}
+			selection={activeDraft ? undefined : editor.selection}
+			selectionProducers={activeDraft ? [] : selectionProducers}
+			{producerScripts}
+			onEditScript={editProducerScript}
+			{producerTriggers}
+			{selectionColumnGraph}
+			{selectionColumnLoading}
+			{selectionColumnTruncated}
+			{selectionColumnFailed}
+			{selectionDbt}
+			{schemaCanEvolve}
+			{selectionForkMaterialization}
+			{schemaContractContext}
+			{runsRefreshKey}
+			{runsPendingJobId}
+			{activeRunnable}
+			{downstreamSubscribers}
+			onStartBoundedRun={canBoundedRunOpenScript &&
+			editor.openScriptPath &&
+			onStartBoundedRunForOpen
+				? () => onStartBoundedRunForOpen?.(editor.openScriptPath!)
+				: undefined}
+			{onRunCompleted}
+			{onTestStateChange}
+			{requestRemoveSignal}
+			{requestRunSignal}
+			{requestRunCascadeSignal}
+			{focusUploadSignal}
+			draftScript={activeDraft?.script}
+			draftOutputAssets={activeDraft?.outputAssets}
+			draftInputAssets={activeDraft?.inputAssets}
+			{onDraftPathChange}
+			onDraftMetaChange={editor.setDraftMeta}
+			{pathPrefix}
+			workspace={ws}
+			onAnnotationsChange={editor.handleAnnotationsChange}
+			onAssetsChange={editor.handleAssetsChange}
+			onContentChange={editor.handleContentChange}
+			onDraftPersist={editor.handleDraftPersist}
+			onclose={() => {
+				closePanelModal()
+				onClose()
+			}}
+			onHide={onTogglePanelHidden &&
+				(() => {
+					closePanelModal()
+					onTogglePanelHidden()
+				})}
+			{onDiscard}
+			{onDraftSaved}
+			{onPersistedSaved}
+			{onScriptRenamed}
+			{onScriptRemoved}
+		/>
+	{/if}
+{/snippet}
+
+<div class="relative h-full w-full" bind:clientWidth={containerWidth}>
 	<Splitpanes class="!h-full" horizontal={stacked}>
 		<Pane bind:size={leftPaneSize}>
-			<div class="relative h-full">
+			<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+			<div
+				class="relative h-full"
+				ondblclick={panelMode === 'modal' ? openPanelModalFromGraph : undefined}
+				onpointerdowncapture={panelMode === 'modal' ? noteSelectionBeforeClick : undefined}
+				onclick={panelMode === 'modal' ? openPanelModalIfReselected : undefined}
+			>
 				<AssetGraphCanvas
 					graph={displayGraph}
 					selection={effectiveSelection}
@@ -470,10 +767,15 @@
 					{onOpenWebhook}
 					{onOpenDataUpload}
 					{readyDataUploadPaths}
-					onselect={onSelect}
+					onselect={handleCanvasSelect}
 					{onAddScriptForAsset}
 					{onAddPipelineScript}
 					{onRunnableMenuRemove}
+					{onDeleteAssetUpstream}
+					{nodeFixes}
+					{assetDeleteVerb}
+					{onEdgeAction}
+					{onAddAssetTrigger}
 					{onRunProducer}
 					{validStartPaths}
 					{onStartBoundedRun}
@@ -482,6 +784,8 @@
 					{panToNodeId}
 					showMinimap={!stacked}
 					viewportFitKey={viewportFitKey ?? folder}
+					assetsOnlyToggle
+					assetsOnlyFolder={workspace ? `${workspace}/${folder}` : undefined}
 				/>
 				{#if boundBar}{@render boundBar()}{/if}
 				{#if mode === 'edit'}
@@ -509,66 +813,47 @@
 				{/if}
 			</div></Pane
 		>
-		{#if detailsPaneOpen && workspace}
+		{#if dockedPaneOpen && workspace}
 			<Pane bind:size={rightPaneSize} minSize={25}>
-				{#if idleView && idlePane}
-					{@render idlePane()}
-				{:else}
-					<AssetGraphDetailsPane
-						{mode}
-						{onRequestEdit}
-						{canRunByPath}
-						{onRunByPath}
-						{onRunCascadeByPath}
-						{runFormInitialArgs}
-						{onRunFormArgsChange}
-						{resolveLocalScript}
-						{localScriptsVersion}
-						selection={activeDraft ? undefined : editor.selection}
-						selectionProducers={activeDraft ? [] : selectionProducers}
-						{selectionColumnGraph}
-						{selectionColumnLoading}
-						{selectionColumnTruncated}
-						{selectionColumnFailed}
-						{selectionDbt}
-						{schemaCanEvolve}
-						{selectionForkMaterialization}
-						{schemaContractContext}
-						{runsRefreshKey}
-						{runsPendingJobId}
-						{activeRunnable}
-						{downstreamSubscribers}
-						onStartBoundedRun={canBoundedRunOpenScript &&
-						editor.openScriptPath &&
-						onStartBoundedRunForOpen
-							? () => onStartBoundedRunForOpen?.(editor.openScriptPath!)
-							: undefined}
-						{onRunCompleted}
-						{onTestStateChange}
-						{requestRemoveSignal}
-						{requestRunSignal}
-						{requestRunCascadeSignal}
-						{focusUploadSignal}
-						draftScript={activeDraft?.script}
-						draftOutputAssets={activeDraft?.outputAssets}
-						draftInputAssets={activeDraft?.inputAssets}
-						{pathPrefix}
-						{onDraftPathChange}
-						{workspace}
-						onAnnotationsChange={editor.handleAnnotationsChange}
-						onAssetsChange={editor.handleAssetsChange}
-						onContentChange={editor.handleContentChange}
-						onDraftPersist={editor.handleDraftPersist}
-						onclose={onClose}
-						onHide={onTogglePanelHidden}
-						{onDiscard}
-						{onDraftSaved}
-						{onPersistedSaved}
-						{onScriptRenamed}
-						{onScriptRemoved}
-					/>
-				{/if}
+				{@render detailsBody(workspace)}
 			</Pane>
 		{/if}
 	</Splitpanes>
+	{#if showNodeHint}
+		<!-- Above the event log's bar, which owns the canvas's bottom edge. -->
+		<div
+			class="pointer-events-none absolute bottom-10 left-3 z-30 flex items-center gap-1.5 text-xs text-hint"
+		>
+			<MousePointerClick size={13} />
+			{nodeHintText}
+		</div>
+	{/if}
 </div>
+
+<!-- Portalled to the host's overlay anchor (a session preview tab) so the modal covers
+     that tab rather than the whole page; Disposable owns its place in the overlay stack
+     and its Escape. -->
+<Disposable bind:open={panelModalOpen} bind:this={panelDisposable}>
+	{#snippet children({ zIndex })}
+		{#if panelMode === 'modal' && panelModalOpen && workspace}
+			<Portal target={modalHost ?? 'body'} class="contents">
+				<!-- svelte-ignore a11y_click_events_have_key_events -->
+				<!-- svelte-ignore a11y_no_static_element_interactions -->
+				<div
+					class="{modalHost ? 'absolute' : 'fixed'} inset-0 flex justify-center px-2 py-6"
+					style="z-index: {zIndex}"
+					role="dialog"
+				>
+					<div class="absolute inset-0 bg-black/20" onclick={() => (panelModalOpen = false)}></div>
+					<div
+						class="relative flex w-full max-w-4xl flex-col overflow-hidden rounded-md border bg-surface shadow-xl"
+					>
+						<div class="min-h-0 flex-1 overflow-auto">
+							{@render detailsBody(workspace)}
+						</div>
+					</div>
+				</div>
+			</Portal>
+		{/if}
+	{/snippet}
+</Disposable>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
index e341707250..56f0877ce0 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
@@ -1,6 +1,7 @@
 <script lang="ts" module>
 	import type { ComponentType } from 'svelte'
 	import type { SupportedLanguage } from '$lib/common'
+	import type { AssetKind, NewSchedule } from '$lib/gen'
 
 	export type PipelineInsertKind = {
 		// Machine-readable id; drives which right-column panel renders.
@@ -8,6 +9,9 @@
 		label: string
 		description?: string
 		icon?: ComponentType
+		// Its trigger is configured in its own editor right after the script is
+		// created, so the wizard's last button reads "Configure".
+		configuredAfterCreate?: boolean
 	}
 
 	export type PipelineInsertPick = {
@@ -22,7 +26,18 @@
 		// from this prompt via AI (using language + outputKind + the
 		// upstream input as context) instead of using the seeded template.
 		aiPrompt?: string
+		// Set by the schedule step when the picked kind is `schedule`.
+		schedule?: PipelineInsertSchedule
+		// Set by the asset step for the table output kinds, replacing the
+		// generated name.
+		outputAsset?: { kind: AssetKind; path: string }
 	}
+
+	export type PipelineInsertOptions = Pick<PipelineInsertPick, 'schedule' | 'outputAsset'>
+
+	// Everything but the target, which is the script being created. An empty
+	// `path` means the default `<script>_schedule`.
+	export type PipelineInsertSchedule = Omit<NewSchedule, 'script_path'>
 </script>
 
 <script lang="ts">
@@ -36,10 +51,28 @@
 		PIPELINE_OUTPUT_KINDS,
 		type PipelineOutputKind
 	} from './pipelineTemplates'
+	import CronInput from '$lib/components/CronInput.svelte'
 	import type { ScriptLang } from '$lib/gen'
 	import Label from '$lib/components/Label.svelte'
-	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { CornerDownLeft, Sparkles } from 'lucide-svelte'
+	import TextInput, {
+		inputBaseClass,
+		inputBorderClass,
+		inputSizeClasses
+	} from '$lib/components/text_input/TextInput.svelte'
+	import DucklakePicker from '$lib/components/DucklakePicker.svelte'
+	import DatatablePicker from '$lib/components/DatatablePicker.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import Section from '$lib/components/Section.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import DateTimeInput from '$lib/components/DateTimeInput.svelte'
+	import ScheduleAdvancedOptions, {
+		emptyScheduleAdvanced,
+		loadDefaultScheduleAdvanced,
+		scheduleAdvancedCfg
+	} from '$lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte'
+	import { workspaceStore } from '$lib/stores'
+	import { ArrowLeft, ChevronDown, CornerDownLeft, Loader2, Sparkles } from 'lucide-svelte'
+	import { tick, untrack } from 'svelte'
 	import { arrowTabNav } from '$lib/attachments/arrowTabNav'
 	import { selectAndAdvanceTo } from '$lib/attachments/selectAndAdvanceTo'
 
@@ -49,8 +82,15 @@
 		pathPrefix?: string
 		defaultPathSuffix?: string
 		onPick: (pick: PipelineInsertPick) => void
-		trigger: import('svelte').Snippet
+		/** Receives whether the menu is open, e.g. to keep a hover state while it is. */
+		trigger: import('svelte').Snippet<[{ open: boolean }]>
 		placement?: 'bottom' | 'top' | 'left' | 'right'
+		/** Opens the menu each time it changes, for an entry point other than the trigger. */
+		openSignal?: number
+		/** With `openSignal`: only the schedule step, for this existing script; its
+		 * confirm hands the schedule to `onSchedule` instead of creating a script. */
+		scheduleFor?: string
+		onSchedule?: (schedule: PipelineInsertSchedule) => void
 	}
 
 	let {
@@ -60,7 +100,10 @@
 		trigger: triggerSnippet,
 		placement = 'bottom',
 		defaultPathSuffix,
-		onPick
+		onPick,
+		openSignal,
+		scheduleFor,
+		onSchedule
 	}: Props = $props()
 
 	// When there's only one trigger kind, hide the Trigger column entirely
@@ -75,6 +118,107 @@
 		aiPrompt: undefined as undefined | string
 	})
 	let selected = $state(buildEmptySelected())
+	let menuOpen = $state(false)
+	$effect(() => {
+		if (!openSignal) return
+		untrack(() => {
+			if (scheduleFor) {
+				resetWizard()
+				selected.triggerId = 'schedule'
+				step = 1
+				config.schedulePath = `${scheduleFor}_schedule`
+				loadAdvancedDefaults()
+				void focusCurrentStep()
+			}
+			menuOpen = true
+		})
+	})
+	let selectedKind = $derived(kinds.find((k) => k.id === selected.triggerId))
+
+	// Steps after the first, each configuring something the picks call for.
+	type ConfigStep = 'schedule' | 'asset'
+	const NAMED_OUTPUT_KINDS: PipelineOutputKind[] = ['materialize', 'datatable', 'ducklake']
+	let configSteps = $derived.by<ConfigStep[]>(() => {
+		const steps: ConfigStep[] = []
+		if (selected.triggerId === 'schedule') steps.push('schedule')
+		if (selected.outputId && NAMED_OUTPUT_KINDS.includes(selected.outputId)) steps.push('asset')
+		return steps
+	})
+	// 0 is the trigger/language/output/path step; `n` is `configSteps[n - 1]`.
+	let step = $state(0)
+	let currentConfigStep = $derived(step > 0 ? configSteps[step - 1] : undefined)
+	let isLastStep = $derived(step >= configSteps.length)
+
+	const buildEmptyConfig = () => ({
+		schedule: '0 0 12 * *',
+		timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+		cronVersion: 'v2',
+		validCron: true,
+		// Follows the script path until the Path field is edited.
+		schedulePath: '',
+		schedulePathDirty: false,
+		schedulePathError: '',
+		summary: '',
+		description: '',
+		pauseUntil: false,
+		pausedUntil: undefined as string | undefined,
+		advanced: emptyScheduleAdvanced(),
+		// The workspace's default handlers, loaded when the schedule step opens.
+		advancedDefaults: 'unloaded' as 'unloaded' | 'loading' | 'loaded',
+		// `store` is the data table or DuckLake catalog name. The table name
+		// follows the script name until the user types in it.
+		asset: undefined as
+			| undefined
+			| { kind: 'ducklake' | 'datatable'; store: string | undefined; table: string },
+		tableEdited: false
+	})
+	let config = $state(buildEmptyConfig())
+
+	// A new schedule starts from the workspace's default handlers, as in the schedule
+	// drawer. The step cannot be confirmed until they are in.
+	function loadAdvancedDefaults() {
+		const ws = $workspaceStore
+		if (!ws || config.advancedDefaults !== 'unloaded') return
+		const target = config
+		target.advancedDefaults = 'loading'
+		loadDefaultScheduleAdvanced(ws)
+			.then((d) => (target.advanced = d))
+			.catch(() => {})
+			.finally(() => (target.advancedDefaults = 'loaded'))
+	}
+
+	function resetWizard() {
+		selected = buildEmptySelected()
+		config = buildEmptyConfig()
+		step = 0
+	}
+
+	const TABLE_NAME_RE = /^[^/\s]+$/
+	// The path grammar of `Path.svelte`: word segments, no empty or trailing ones.
+	const SCRIPT_NAME_RE = /^[\w-]+(\/[\w-]+)*$/
+	let scriptNameValid = $derived(SCRIPT_NAME_RE.test(selected.scriptPath.trim()))
+	let assetValid = $derived(!!config.asset?.store && TABLE_NAME_RE.test(config.asset.table.trim()))
+	let stepValid = $derived(
+		currentConfigStep === 'schedule'
+			? config.validCron &&
+					!!config.schedule.trim() &&
+					!config.schedulePathError &&
+					config.advancedDefaults === 'loaded'
+			: currentConfigStep === 'asset'
+				? assetValid
+				: scriptNameValid && !!selected.triggerId && !!selected.language && !!selected.outputId
+	)
+
+	function enterAssetStep() {
+		const kind = selected.outputId === 'datatable' ? 'datatable' : 'ducklake'
+		if (config.asset?.kind !== kind) {
+			config.asset = { kind, store: 'main', table: '' }
+			config.tableEdited = false
+		}
+		if (!config.tableEdited && config.asset) {
+			config.asset.table = selected.scriptPath.trim().split('/').pop() ?? ''
+		}
+	}
 
 	// Refs to the column containers so Enter inside one column can hand
 	// focus off to the first tabbable in the next column.
@@ -104,16 +248,73 @@
 		return out
 	}
 
+	// A step change re-renders the popover body, dropping focus to <body>, where
+	// keystrokes (Enter, Cmd+Enter) no longer reach the step's key handlers.
+	let contentEl: HTMLElement | undefined = $state()
+	async function focusCurrentStep() {
+		await tick()
+		const target =
+			step === 0
+				? pathEl?.querySelector('input')
+				: contentEl?.querySelector<HTMLElement>('[data-autofocus] input')
+		target?.focus()
+	}
+
+	function goBack() {
+		step -= 1
+		void focusCurrentStep()
+	}
+
+	function scheduleConfig(): PipelineInsertSchedule {
+		return {
+			path: config.schedulePath,
+			schedule: config.schedule.trim(),
+			timezone: config.timezone,
+			cron_version: config.cronVersion,
+			summary: config.summary.trim() || undefined,
+			description: config.description,
+			paused_until: config.pauseUntil ? config.pausedUntil : undefined,
+			is_flow: false,
+			args: {},
+			...scheduleAdvancedCfg($state.snapshot(config.advanced))
+		}
+	}
+
 	function confirm(close: () => void) {
+		if (scheduleFor) {
+			if (!stepValid) return
+			onSchedule?.(scheduleConfig())
+			close()
+			return
+		}
 		const suffix = selected.scriptPath.trim()
 		if (!suffix || !selected.triggerId || !selected.language || !selected.outputId) return
+		if (!stepValid) return
+		if (!isLastStep) {
+			step += 1
+			if (configSteps[step - 1] === 'asset') enterAssetStep()
+			if (configSteps[step - 1] === 'schedule') {
+				loadAdvancedDefaults()
+				if (!config.schedulePathDirty) config.schedulePath = `${pathPrefix}${suffix}_schedule`
+			}
+			void focusCurrentStep()
+			return
+		}
 		const trimmedPrompt = selected.aiPrompt?.trim()
 		onPick({
 			kindId: selected.triggerId,
 			language: selected.language,
 			path: pathPrefix + suffix,
 			outputKind: selected.outputId,
-			aiPrompt: trimmedPrompt && trimmedPrompt.length > 0 ? trimmedPrompt : undefined
+			aiPrompt: trimmedPrompt && trimmedPrompt.length > 0 ? trimmedPrompt : undefined,
+			schedule: configSteps.includes('schedule') ? scheduleConfig() : undefined,
+			outputAsset:
+				configSteps.includes('asset') && config.asset
+					? {
+							kind: config.asset.kind as AssetKind,
+							path: `${config.asset.store}/${config.asset.table.trim()}`
+						}
+					: undefined
 		})
 		close()
 	}
@@ -123,9 +324,18 @@
 	enableFlyTransition
 	contentClasses={twMerge(
 		'p-0 bg-surface overflow-hidden relative transition-height',
-		showBottomPanel ? 'h-[26rem]' : 'h-[22rem]'
+		// The first step's columns (w-56 + w-48 + w-80), held across steps.
+		singleKind ? 'w-[32rem]' : 'w-[46rem]',
+		currentConfigStep === 'schedule'
+			? 'h-[27rem]'
+			: currentConfigStep === 'asset'
+				? 'h-[14rem]'
+				: showBottomPanel
+					? 'h-[26rem]'
+					: 'h-[22rem]'
 	)}
 	class="inline-block"
+	bind:isOpen={menuOpen}
 	usePointerDownOutside
 	floatingConfig={{
 		placement,
@@ -136,24 +346,30 @@
 		fitViewport: true,
 		overlap: false
 	}}
-	onClose={() => (selected = buildEmptySelected())}
+	onClose={resetWizard}
 >
 	{#snippet trigger()}
-		{@render triggerSnippet?.()}
+		{@render triggerSnippet?.({ open: menuOpen })}
 	{/snippet}
 	{#snippet content({ close })}
-		<div class="flex flex-col h-full">
-			<div class={'flex flex-row transition-height divide-x overflow-y-scroll'}>
-				{@render topSection()}
-			</div>
-			<div
-				class={twMerge(
-					'flex flex-col gap-5 grow transition-height px-4 border-t',
-					showBottomPanel ? 'h-[14rem] py-4' : 'h-0'
-				)}
-			>
-				{@render bottomSection(close)}
-			</div>
+		<div class="h-full" bind:this={contentEl}>
+			{#if currentConfigStep}
+				{@render configStepSection(currentConfigStep, close)}
+			{:else}
+				<div class="flex flex-col h-full">
+					<div class={'flex flex-row transition-height divide-x overflow-y-scroll'}>
+						{@render topSection()}
+					</div>
+					<div
+						class={twMerge(
+							'flex flex-col gap-5 grow transition-height px-4 border-t',
+							showBottomPanel ? 'h-[14rem] py-4' : 'h-0'
+						)}
+					>
+						{@render bottomSection(close)}
+					</div>
+				</div>
+			{/if}
 		</div>
 	{/snippet}
 </Popover>
@@ -170,7 +386,10 @@
 				<Button
 					variant="subtle"
 					btnClasses={'text-left'}
-					onClick={() => (selected.triggerId = k.id)}
+					onClick={() => {
+						selected.triggerId = k.id
+						if (k.id === 'schedule') loadAdvancedDefaults()
+					}}
 					selected={isSelected}
 				>
 					{#if k.icon}
@@ -264,14 +483,30 @@
 {#snippet bottomSection(close: () => void)}
 	<Label label="Path">
 		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div bind:this={pathEl} class="flex" onkeydown={selectAndAdvanceTo(() => aiPromptEl ?? saveEl)}>
+		<div
+			bind:this={pathEl}
+			class="flex"
+			onkeydown={(e) =>
+				(e.metaKey || e.ctrlKey) && e.key === 'Enter'
+					? (e.preventDefault(), e.stopPropagation(), confirm(close))
+					: selectAndAdvanceTo(() => aiPromptEl ?? saveEl)(e)}
+		>
 			<div
 				class="border rounded-md rounded-r-none border-r-0 text-xs w-fit shrink-0 whitespace-nowrap flex items-center px-2 text-secondary bg-surface-input"
 			>
 				{pathPrefix}
 			</div>
-			<TextInput bind:value={selected.scriptPath} class="rounded-l-none" />
+			<TextInput
+				bind:value={selected.scriptPath}
+				class="rounded-l-none"
+				error={!scriptNameValid && !!selected.scriptPath.trim()}
+			/>
 		</div>
+		{#if !scriptNameValid && selected.scriptPath.trim()}
+			<span class="text-2xs text-red-600 dark:text-red-400">
+				Letters, digits, <code>_</code> and <code>-</code>, in <code>/</code>-separated segments
+			</span>
+		{/if}
 	</Label>
 	{#if !$copilotInfo.workspaceDisabled}
 		<Label label="AI Prompt (optional)">
@@ -292,15 +527,217 @@
 			</div>
 		</Label>
 	{/if}
-	{@const hasAiPrompt = !!selected.aiPrompt?.trim()}
 	<div class="ml-auto" bind:this={saveEl}>
-		<Button
-			variant="accent"
-			btnClasses="w-fit"
-			disabled={!selected.scriptPath.trim()}
-			onClick={() => confirm(close)}
-			startIcon={hasAiPrompt ? { icon: Sparkles } : undefined}
-			shortCut={{ Icon: CornerDownLeft }}>{hasAiPrompt ? 'Generate' : 'Create'}</Button
-		>
+		{@render confirmButton(close)}
+	</div>
+{/snippet}
+
+{#snippet confirmButton(close: () => void)}
+	{@const hasAiPrompt = !!selected.aiPrompt?.trim()}
+	<Button
+		variant="accent"
+		btnClasses="w-fit"
+		disabled={!stepValid}
+		onClick={() => confirm(close)}
+		startIcon={isLastStep && hasAiPrompt ? { icon: Sparkles } : undefined}
+		shortCut={{ Icon: CornerDownLeft }}
+		>{scheduleFor
+			? 'Create schedule'
+			: !isLastStep
+				? step === 0
+					? 'Configure'
+					: 'Next'
+				: hasAiPrompt
+					? 'Generate'
+					: selectedKind?.configuredAfterCreate
+						? 'Configure'
+						: 'Create'}</Button
+	>
+{/snippet}
+
+{#snippet configStepSection(configStep: ConfigStep, close: () => void)}
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div
+		class="flex flex-col h-full"
+		onkeydown={(e) => {
+			if (e.key !== 'Enter') return
+			const target = e.target as HTMLElement | null
+			// Cmd/Ctrl+Enter confirms from anywhere; bare Enter only from the step's own
+			// inputs, not from the Advanced fields (a textarea, pickers with their own Enter).
+			const bareEnterSubmits = target?.tagName === 'INPUT' && !target.closest('[data-advanced]')
+			if (e.metaKey || e.ctrlKey || bareEnterSubmits) {
+				e.preventDefault()
+				e.stopPropagation()
+				confirm(close)
+			}
+		}}
+	>
+		<div class="flex items-center gap-2 px-2 py-2 border-b">
+			{#if !scheduleFor}
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					iconOnly
+					startIcon={{ icon: ArrowLeft }}
+					onClick={goBack}
+					title="Back"
+				/>
+			{/if}
+			<span class="text-xs font-semibold text-emphasis {scheduleFor ? 'pl-2' : ''}">
+				{scheduleFor
+					? `Schedule for ${scheduleFor}`
+					: configStep === 'schedule'
+						? 'Schedule'
+						: 'Output asset'}
+			</span>
+			{#if !scheduleFor}
+				<span class="text-2xs text-hint ml-auto pr-2"
+					>Step {step + 1} of {configSteps.length + 1}</span
+				>
+			{/if}
+		</div>
+		<div class="flex flex-col gap-2 grow overflow-auto p-4">
+			{#if configStep === 'schedule'}
+				<span class="text-2xs text-secondary">
+					Saved as a draft schedule and deployed along with the pipeline.
+				</span>
+				<div data-autofocus class="contents">
+					<CronInput
+						bind:schedule={config.schedule}
+						bind:timezone={config.timezone}
+						bind:validCRON={config.validCron}
+						bind:cronVersion={config.cronVersion}
+					/>
+				</div>
+				<div data-advanced class="mt-4">
+					<Section label="Advanced" collapsable initiallyCollapsed>
+						<div class="flex flex-col gap-6">
+							<Label label="Summary">
+								<TextInput
+									bind:value={config.summary}
+									inputProps={{ placeholder: 'Short summary to be displayed when listed' }}
+								/>
+							</Label>
+							<Label label="Path">
+								<Path
+									bind:path={config.schedulePath}
+									bind:dirty={config.schedulePathDirty}
+									bind:error={config.schedulePathError}
+									initialPath=""
+									checkInitialPathExistence
+									namePlaceholder="schedule"
+									kind="schedule"
+								/>
+							</Label>
+							<Label label="Description">
+								<TextInput
+									underlyingInputEl="textarea"
+									bind:value={config.description}
+									inputProps={{ placeholder: 'What this schedule does and how to use it' }}
+								/>
+							</Label>
+							<div class="flex flex-col gap-1">
+								<Toggle
+									options={{
+										right: 'Pause schedule until...',
+										rightTooltip:
+											'Pausing the schedule will program the next job to run as if the schedule starts at the time the pause is lifted, instead of now.'
+									}}
+									bind:checked={config.pauseUntil}
+								/>
+								{#if config.pauseUntil}
+									<DateTimeInput bind:value={config.pausedUntil} />
+								{/if}
+							</div>
+							<!-- Rendered once the workspace defaults are in, so they never
+							     overwrite a handler picked while they load. -->
+							{#if config.advancedDefaults === 'loaded'}
+								<ScheduleAdvancedOptions
+									wsId={$workspaceStore}
+									itemKind="script"
+									canWrite
+									bind:errorHandlerSelected={config.advanced.errorHandlerSelected}
+									bind:errorHandlerPath={config.advanced.errorHandlerPath}
+									bind:errorHandleritemKind={config.advanced.errorHandleritemKind}
+									bind:errorHandlerExtraArgs={config.advanced.errorHandlerExtraArgs}
+									bind:wsErrorHandlerMuted={config.advanced.wsErrorHandlerMuted}
+									bind:failedTimes={config.advanced.failedTimes}
+									bind:failedExact={config.advanced.failedExact}
+									bind:recoveryHandlerSelected={config.advanced.recoveryHandlerSelected}
+									bind:recoveryHandlerPath={config.advanced.recoveryHandlerPath}
+									bind:recoveryHandlerItemKind={config.advanced.recoveryHandlerItemKind}
+									bind:recoveryHandlerExtraArgs={config.advanced.recoveryHandlerExtraArgs}
+									bind:recoveredTimes={config.advanced.recoveredTimes}
+									bind:successHandlerSelected={config.advanced.successHandlerSelected}
+									bind:successHandlerPath={config.advanced.successHandlerPath}
+									bind:successHandlerItemKind={config.advanced.successHandlerItemKind}
+									bind:successHandlerExtraArgs={config.advanced.successHandlerExtraArgs}
+									bind:retry={config.advanced.retry}
+									bind:dynamicSkipPath={config.advanced.dynamicSkipPath}
+									bind:tag={config.advanced.tag}
+								/>
+							{:else}
+								<div class="flex items-center gap-1.5 text-xs text-secondary">
+									<Loader2 size={12} class="animate-spin" />
+									Loading the workspace's default handlers…
+								</div>
+							{/if}
+						</div>
+					</Section>
+				</div>
+			{:else if configStep === 'asset' && config.asset}
+				<Label label="Name">
+					<div
+						class={twMerge(
+							inputBaseClass,
+							inputBorderClass({ error: !assetValid }),
+							inputSizeClasses.md,
+							'flex flex-row items-center gap-0 py-0 pl-2 pr-0'
+						)}
+					>
+						<span class="text-xs text-secondary shrink-0">{config.asset.kind}://</span>
+						{#if config.asset.kind === 'datatable'}
+							<DatatablePicker
+								bind:value={config.asset.store}
+								class="shrink-0"
+								selectInputClass="!border-none"
+								placeholder="data table"
+								useContentEditable
+								RightIcon={ChevronDown}
+							/>
+						{:else}
+							<DucklakePicker
+								bind:value={config.asset.store}
+								class="shrink-0"
+								selectInputClass="!border-none"
+								placeholder="catalog"
+								useContentEditable
+								RightIcon={ChevronDown}
+							/>
+						{/if}
+						<span class="text-sm text-secondary">/</span>
+						<div data-autofocus class="grow flex">
+							<TextInput
+								bind:value={config.asset.table}
+								class="!border-none grow"
+								inputProps={{
+									placeholder: 'table',
+									oninput: () => (config.tableEdited = true)
+								}}
+							/>
+						</div>
+					</div>
+				</Label>
+				<span class="text-2xs text-hint">
+					{config.asset.kind === 'datatable' ? 'Data table' : 'DuckLake catalog'}, then the table
+					name
+				</span>
+			{/if}
+		</div>
+		<div class="flex px-4 py-3 border-t">
+			<div class="ml-auto">
+				{@render confirmButton(close)}
+			</div>
+		</div>
 	</div>
 {/snippet}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineNodeCard.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineNodeCard.svelte
new file mode 100644
index 0000000000..e78058f905
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineNodeCard.svelte
@@ -0,0 +1,174 @@
+<!--
+@component
+The body every pipeline graph node shares: icon, a kind line ("Script · draft", "Data table"),
+a title, and trailing chips. Node components add only what is theirs — the icon, the chips,
+and the controls hung around the card.
+-->
+<script lang="ts">
+	import { NODE } from '$lib/components/graph/util'
+	import {
+		PIPELINE_NODE_EXTRA_ROW,
+		PIPELINE_NODE_HEADER,
+		PIPELINE_NODE_HEADER_CARD_PAD,
+		PIPELINE_NODE_HEIGHT
+	} from './assetGraphLayout'
+	import { twMerge } from 'tailwind-merge'
+	import type { Snippet } from 'svelte'
+
+	interface Props {
+		icon: Snippet
+		kindLabel: string
+		title: string
+		/** Hover text; the path, when the title is a summary. */
+		tooltip?: string
+		/** Scripts sit on the main surface, assets and triggers a step down; in the
+		 * assets-only view, which has no scripts, assets take the main surface. */
+		surface?: 'primary' | 'secondary'
+		selected?: boolean
+		/** Not deployed yet: dashed edge. */
+		draft?: boolean
+		/** Feedback states, which recolor the whole card. `error` is a misconfigured
+		 * node, styled like a failed flow step. */
+		tone?: 'danger' | 'error' | 'success' | 'running'
+		/** Makes the whole card a button. */
+		onclick?: (e: MouseEvent) => void
+		/** Between the icon and the text: a live status the eye should find first. */
+		leading?: Snippet
+		trailing?: Snippet
+		/** Defaults to `NODE.width`. */
+		width?: number
+		/** A line under the title, in the text column. */
+		subtitle?: Snippet
+		/** A tab on the card's top edge. Only on a card without `onclick`, since it
+		 * may hold buttons of its own. */
+		header?: Snippet
+		/** The header's script is selected: its edge takes the selected colour. */
+		headerSelected?: boolean
+		/** The header's script has an error: its edge goes red. */
+		headerTone?: 'error'
+	}
+
+	let {
+		icon,
+		kindLabel,
+		title,
+		tooltip,
+		surface = 'secondary',
+		selected = false,
+		draft = false,
+		tone,
+		onclick,
+		leading,
+		trailing,
+		subtitle,
+		header,
+		headerSelected = false,
+		headerTone,
+		width = NODE.width
+	}: Props = $props()
+
+	const cardClass = $derived(
+		twMerge(
+			'flex items-center w-full text-left font-normal rounded-md drop-shadow-sm overflow-hidden border transition-colors',
+			surface === 'primary' ? 'bg-surface' : 'bg-surface-secondary',
+			'border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500',
+			// Like a flow step: a card with a background needs no edge, only its shadow,
+			// until one of the states below draws one.
+			surface === 'primary' &&
+				!draft &&
+				!selected &&
+				!tone &&
+				'border-transparent dark:border-transparent hover:border-transparent dark:hover:border-transparent',
+			draft && 'border-dashed border-gray-400 dark:border-gray-500',
+			// Like a selected flow step: the fill and the edge colour change, the edge's
+			// width and dashes stay.
+			// Each dark: variant too: the base edge sets its own dark colour, which a plain
+			// border class does not override.
+			selected &&
+				'bg-surface-accent-selected border-border-selected dark:border-border-selected hover:border-border-selected dark:hover:border-border-selected',
+			tone === 'danger' &&
+				'bg-red-50 dark:bg-red-900/30 border-dashed border-red-400 dark:border-red-500 hover:bg-red-100 dark:hover:bg-red-900/40',
+			tone === 'error' &&
+				(selected
+					? 'bg-red-200 dark:bg-red-600 border-red-500 dark:border-red-500 hover:border-red-500 dark:hover:border-red-500'
+					: 'bg-red-100 dark:bg-red-700 border-transparent dark:border-transparent hover:border-transparent dark:hover:border-transparent'),
+			tone === 'success' &&
+				'bg-green-50 dark:bg-green-900/30 border-green-500 dark:border-green-600',
+			tone === 'running' &&
+				'bg-amber-50 dark:bg-amber-900/30 border-amber-400 dark:border-amber-600 animate-pulse'
+		)
+	)
+	const minHeight = $derived(PIPELINE_NODE_HEIGHT + (subtitle ? PIPELINE_NODE_EXTRA_ROW : 0))
+	const toneText = $derived(
+		tone === 'danger'
+			? 'text-red-700 dark:text-red-400'
+			: tone === 'error'
+				? 'text-red-700 dark:text-red-200'
+			: tone === 'success'
+				? 'text-green-700 dark:text-green-400'
+				: undefined
+	)
+</script>
+
+{#snippet body()}
+	<span class="shrink-0 ml-3 mr-2.5 flex items-center">{@render icon()}</span>
+	{@render leading?.()}
+	<span class="flex flex-col min-w-0 flex-1 pr-1 py-1 leading-tight">
+		<span class={twMerge('text-2xs truncate text-secondary', toneText)}>{kindLabel}</span>
+		<span class={twMerge('text-xs truncate text-emphasis', selected && 'text-accent', toneText)}
+			>{title}</span
+		>
+		{#if subtitle}
+			<span class="flex items-center min-w-0 mt-1">{@render subtitle()}</span>
+		{/if}
+	</span>
+	{#if trailing}
+		<span class="flex items-center shrink-0 pr-2">{@render trailing()}</span>
+	{/if}
+{/snippet}
+
+{#if onclick}
+	<button
+		type="button"
+		{onclick}
+		class={cardClass}
+		style="width: {width}px; min-height: {minHeight}px;"
+		title={tooltip}
+	>
+		{@render body()}
+	</button>
+{:else if header}
+	<!-- The header is a tab on the card's top edge, inset from its sides. -->
+	<div class="flex flex-col" style="width: {width}px;">
+		<div
+			class={twMerge(
+				'mx-2 flex items-stretch min-w-0 rounded-t-md overflow-hidden bg-surface border border-b-0 border-gray-200 dark:border-gray-700',
+				// Like an errored card: red, and a stronger red when selected.
+				headerTone === 'error'
+					? headerSelected
+						? 'border-red-500 dark:border-red-500'
+						: 'border-red-300 dark:border-red-600'
+					: headerSelected && 'border-border-selected dark:border-border-selected'
+			)}
+			style="height: {PIPELINE_NODE_HEADER}px;"
+		>
+			{@render header()}
+		</div>
+		<div
+			class={twMerge(cardClass, !selected && !tone && 'bg-surface-tertiary')}
+			style="min-height: {minHeight + PIPELINE_NODE_HEADER_CARD_PAD}px; padding-block: {PIPELINE_NODE_HEADER_CARD_PAD /
+				2}px;"
+			title={tooltip}
+		>
+			{@render body()}
+		</div>
+	</div>
+{:else}
+	<div
+		class={cardClass}
+		style="width: {width}px; min-height: {minHeight}px;"
+		title={tooltip}
+	>
+		{@render body()}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
index 2450595b6d..8a060e0b2c 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import type { AssetKind, Script } from '$lib/gen'
-	import { CalendarClock, Loader2, Play, Upload, Zap } from 'lucide-svelte'
+	import { CalendarClock, Code2, Loader2, Play, Upload, Zap } from 'lucide-svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
 	import PipelineRunForm from './PipelineRunForm.svelte'
@@ -44,6 +44,12 @@
 		// "green / ready" state and seeds the whole-pipeline run. `isValid` is the
 		// full-schema validity (all required fields, not just the S3 file).
 		onArgsChange?: (path: string, args: Record<string, any>, isValid: boolean) => void
+		// Just the run form and the runs, without the source: what a data-upload
+		// click asks for. `onShowScript` switches to the script itself.
+		inputsOnly?: boolean
+		onShowScript?: () => void
+		// `onRun` previews a draft's own content, so a draft can run too.
+		runsDrafts?: boolean
 	}
 
 	let {
@@ -57,8 +63,12 @@
 		runsPendingJobId,
 		onRunCompleted,
 		initialArgs,
-		onArgsChange
+		onArgsChange,
+		inputsOnly = false,
+		onShowScript,
+		runsDrafts = false
 	}: Props = $props()
+	let runBlockedByDraft = $derived(isDraft && !runsDrafts)
 
 	// Seed once from the persisted args (see initialArgs). Cloned so the run
 	// form mutates its own copy, not the page's stored snapshot.
@@ -139,7 +149,7 @@
 </script>
 
 <div class="flex flex-col h-full">
-	{#if isDraft}
+	{#if runBlockedByDraft}
 		<div
 			class="shrink-0 flex items-center gap-2 px-3 py-1.5 text-2xs bg-amber-50 dark:bg-amber-900/30 border-b border-amber-200 dark:border-amber-900/60 text-amber-700 dark:text-amber-400"
 		>
@@ -168,13 +178,24 @@
 							{/if}
 						</span>
 						<div class="flex items-center gap-1.5">
+							{#if inputsOnly && onShowScript}
+								<Button
+									variant="subtle"
+									unifiedSize="sm"
+									startIcon={{ icon: Code2 }}
+									onclick={onShowScript}
+									title="Show the script instead of its inputs"
+								>
+									Open script
+								</Button>
+							{/if}
 							{#if hasCascade}
 								<Button
 									variant="accent-secondary"
 									unifiedSize="sm"
 									startIcon={{ icon: running ? Loader2 : Zap }}
 									onclick={() => run(true)}
-									disabled={isDraft || running || !runValid}
+									disabled={runBlockedByDraft || running || !runValid}
 									title={`Run this script with these inputs, then run its ${downstreamCount} downstream pipeline script${downstreamCount === 1 ? '' : 's'} in order`}
 								>
 									Run + downstream
@@ -185,8 +206,8 @@
 								unifiedSize="sm"
 								startIcon={{ icon: running ? Loader2 : Play }}
 								onclick={() => run(false)}
-								disabled={isDraft || running || !runValid || !onRun}
-								title={isDraft
+								disabled={runBlockedByDraft || running || !runValid || !onRun}
+								title={runBlockedByDraft
 									? 'Deploy this draft to run it for real'
 									: hasCascade
 										? 'Run just this step — downstream scripts are not triggered'
@@ -210,9 +231,11 @@
 						{/key}
 					{/if}
 				</div>
-				<div class="flex-1 min-h-0 overflow-auto text-xs p-3">
-					<HighlightCode code={script.content ?? ''} language={script.language} />
-				</div>
+				{#if !inputsOnly}
+					<div class="flex-1 min-h-0 overflow-auto text-xs p-3">
+						<HighlightCode code={script.content ?? ''} language={script.language} />
+					</div>
+				{/if}
 			</div>
 		</Pane>
 		<Pane size={45} minSize={20}>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte
index 751ecbbdc8..c79e638265 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
 	import { resource } from 'runed'
 	import { WorkspaceService } from '$lib/gen'
-	import { base } from '$lib/base'
 	import { CircleCheck, CircleAlert, Database, HardDrive, ArrowRight } from 'lucide-svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { Button } from '$lib/components/common'
 
 	interface Props {
 		workspace: string
@@ -57,7 +58,7 @@
 			title: 'Workspace object storage',
 			description:
 				'Materialized partitions and DuckLake data files are written to S3 / object storage.',
-			href: `${base}/workspace_settings?tab=windmill_lfs`,
+			href: '/workspace_settings?tab=windmill_lfs',
 			cta: 'Configure object storage'
 		},
 		{
@@ -66,55 +67,50 @@
 			title: 'A DuckLake catalog',
 			description:
 				'DuckLake is the table format pipelines materialize into — add at least one catalog.',
-			href: `${base}/workspace_settings?tab=ducklake`,
+			href: '/workspace_settings?tab=ducklake',
 			cta: 'Configure DuckLake'
 		}
 	])
 </script>
 
 {#if show}
-	<div
-		class="flex flex-col gap-3 rounded-lg border border-amber-300 dark:border-amber-900/60 bg-amber-50 dark:bg-amber-950/30 p-4"
-	>
-		<div class="flex items-start gap-2">
-			<CircleAlert size={18} class="text-amber-600 dark:text-amber-400 mt-0.5 shrink-0" />
-			<div class="flex flex-col gap-0.5">
-				<h3 class="text-sm font-semibold text-emphasis">Finish setting up pipelines</h3>
-				<p class="text-xs text-tertiary">
-					Pipelines materialize data into DuckLake tables backed by object storage. Configure the
-					following before your first pipeline can run.
-				</p>
-			</div>
+	<Alert type="warning" title="Finish setting up pipelines" hideIcon>
+		<div class="flex flex-col gap-3">
+			<p>
+				Pipelines materialize data into DuckLake tables backed by object storage. Configure the
+				following before your first pipeline can run.
+			</p>
+			<ul class="flex flex-col gap-2">
+				{#each steps as step (step.title)}
+					{@const Icon = step.icon}
+					<li class="flex items-center gap-3 rounded-md border bg-surface-tertiary px-3 py-2">
+						{#if step.done === true}
+							<CircleCheck size={16} class="text-green-600 dark:text-green-400 shrink-0" />
+						{:else if step.done === false}
+							<CircleAlert size={16} class="text-yellow-600 dark:text-yellow-400 shrink-0" />
+						{:else}
+							<Icon size={16} class="text-secondary shrink-0" />
+						{/if}
+						<div class="flex flex-col min-w-0 flex-1">
+							<span class="text-xs font-semibold text-emphasis">{step.title}</span>
+							<span class="text-2xs text-secondary">{step.description}</span>
+						</div>
+						{#if step.done !== true}
+							<Button
+								variant="default"
+								unifiedSize="sm"
+								href={step.href}
+								endIcon={{ icon: ArrowRight }}
+								wrapperClasses="shrink-0"
+							>
+								{step.cta}
+							</Button>
+						{:else}
+							<span class="shrink-0 text-2xs text-green-700 dark:text-green-400">Configured</span>
+						{/if}
+					</li>
+				{/each}
+			</ul>
 		</div>
-
-		<ul class="flex flex-col gap-2">
-			{#each steps as step (step.title)}
-				{@const Icon = step.icon}
-				<li class="flex items-center gap-3 rounded-md border bg-surface px-3 py-2">
-					{#if step.done === true}
-						<CircleCheck size={16} class="text-green-600 dark:text-green-400 shrink-0" />
-					{:else if step.done === false}
-						<CircleAlert size={16} class="text-amber-600 dark:text-amber-400 shrink-0" />
-					{:else}
-						<Icon size={16} class="text-tertiary shrink-0" />
-					{/if}
-					<div class="flex flex-col min-w-0 flex-1">
-						<span class="text-xs font-semibold text-primary">{step.title}</span>
-						<span class="text-2xs text-tertiary">{step.description}</span>
-					</div>
-					{#if step.done !== true}
-						<a
-							href={step.href}
-							class="shrink-0 inline-flex items-center gap-1 text-xs text-blue-500 hover:underline whitespace-nowrap"
-						>
-							{step.cta}
-							<ArrowRight size={12} />
-						</a>
-					{:else}
-						<span class="shrink-0 text-2xs text-green-700 dark:text-green-400">Configured</span>
-					{/if}
-				</li>
-			{/each}
-		</ul>
-	</div>
+	</Alert>
 {/if}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
index 4f97039a1c..d8d19845fa 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
@@ -1,18 +1,10 @@
 <script lang="ts">
 	import { sendUserToast } from '$lib/utils'
+	import { workspaceStore } from '$lib/stores'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import type { NativeTriggerKind } from './types'
-	import {
-		EmailTriggerService,
-		GcpTriggerService,
-		KafkaTriggerService,
-		MqttTriggerService,
-		AmqpTriggerService,
-		NatsTriggerService,
-		PostgresTriggerService,
-		ScheduleService,
-		SqsTriggerService
-	} from '$lib/gen'
+	import type { NativeTriggerKind, PipelineTriggerDraftKind } from './types'
+	import type { Schedule } from '$lib/gen'
+	import { deleteTriggerRow } from './pipelineTriggerDraftDeploy'
 	import KafkaTriggerEditor from '$lib/components/triggers/kafka/KafkaTriggerEditor.svelte'
 	import MqttTriggerEditor from '$lib/components/triggers/mqtt/MqttTriggerEditor.svelte'
 	import AmqpTriggerEditor from '$lib/components/triggers/amqp/AmqpTriggerEditor.svelte'
@@ -22,6 +14,10 @@
 	import GcpTriggerEditor from '$lib/components/triggers/gcp/GcpTriggerEditor.svelte'
 	import EmailTriggerEditor from '$lib/components/triggers/email/EmailTriggerEditor.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
+	import {
+		loadDefaultScheduleAdvanced,
+		scheduleAdvancedCfg
+	} from '$lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte'
 	import WebhookEditor from '$lib/components/triggers/webhook/WebhookEditor.svelte'
 	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
@@ -110,6 +106,56 @@
 		}
 	}
 
+	/** The kind's full editor over a pipeline-local draft; Save hands the config back,
+	 * and the drawer stays open when `onSave` refuses it.
+	 * `saved` is the draft being edited (absent for a new one), applied over `defaults`. */
+	export function openTriggerDraft(
+		kind: PipelineTriggerDraftKind,
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSave: (cfg: Record<string, any>) => boolean
+	) {
+		switch (kind) {
+			case 'schedule': {
+				// A new draft starts from the workspace's default handlers, like a new
+				// schedule does; the drawer only applies them when it opens without one.
+				const open = (advanced: Record<string, any>) =>
+					scheduleEditor?.openDraft(
+						{
+							is_flow: false,
+							args: {},
+							...advanced,
+							...defaults,
+							...saved,
+							script_path: scriptPath
+						} as Schedule,
+						onSave
+					)
+				if (saved || !$workspaceStore) return open({})
+				return loadDefaultScheduleAdvanced($workspaceStore)
+					.then((a) => open(scheduleAdvancedCfg(a)))
+					.catch(() => open({}))
+			}
+			case 'kafka':
+				return kafkaEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'mqtt':
+				return mqttEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'amqp':
+				return amqpEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'nats':
+				return natsEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'postgres':
+				return postgresEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'sqs':
+				return sqsEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'gcp':
+				return gcpEditor?.openDraft(scriptPath, defaults, saved, onSave)
+			case 'email':
+				return emailEditor?.openDraft(scriptPath, defaults, saved, onSave)
+		}
+	}
+
 	// Open the webhook drawer (endpoint URLs + token flow). Caller owns the
 	// draft guard.
 	export function openWebhook(scriptPath: string) {
@@ -133,37 +179,7 @@
 		const { kind, path: triggerPath } = triggerDeleteTarget
 		triggerDeleteLoading = true
 		try {
-			switch (kind) {
-				case 'schedule':
-					await ScheduleService.deleteSchedule({ workspace, path: triggerPath })
-					break
-				case 'kafka':
-					await KafkaTriggerService.deleteKafkaTrigger({ workspace, path: triggerPath })
-					break
-				case 'mqtt':
-					await MqttTriggerService.deleteMqttTrigger({ workspace, path: triggerPath })
-					break
-				case 'amqp':
-					await AmqpTriggerService.deleteAmqpTrigger({ workspace, path: triggerPath })
-					break
-				case 'nats':
-					await NatsTriggerService.deleteNatsTrigger({ workspace, path: triggerPath })
-					break
-				case 'postgres':
-					await PostgresTriggerService.deletePostgresTrigger({ workspace, path: triggerPath })
-					break
-				case 'sqs':
-					await SqsTriggerService.deleteSqsTrigger({ workspace, path: triggerPath })
-					break
-				case 'gcp':
-					await GcpTriggerService.deleteGcpTrigger({ workspace, path: triggerPath })
-					break
-				case 'email':
-					await EmailTriggerService.deleteEmailTrigger({ workspace, path: triggerPath })
-					break
-				default:
-					return
-			}
+			if (!(await deleteTriggerRow(kind, triggerPath, workspace))) return
 			sendUserToast(`Deleted ${kind} trigger "${triggerPath}"`)
 			triggerDeleteTarget = undefined
 			onUpdate()
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunStateChip.svelte b/frontend/src/lib/components/assets/AssetGraph/RunStateChip.svelte
new file mode 100644
index 0000000000..21edf1df52
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/RunStateChip.svelte
@@ -0,0 +1,37 @@
+<script lang="ts">
+	import { twMerge } from 'tailwind-merge'
+	import { CheckCircle2, Loader2, XCircle } from 'lucide-svelte'
+	import type { RunnableRunState } from './activeRunnables.svelte'
+
+	let { runState: rs, class: className }: { runState: RunnableRunState; class?: string } = $props()
+</script>
+
+<div
+	class={twMerge(
+		'shrink-0 flex items-center gap-0.5 px-1 py-0.5 rounded-sm border',
+		rs.status === 'running'
+			? 'bg-blue-100 dark:bg-blue-900/40 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+			: rs.status === 'success'
+				? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300 border-emerald-300 dark:border-emerald-700'
+				: 'bg-red-100 dark:bg-red-900/40 text-red-700 dark:text-red-300 border-red-300 dark:border-red-700',
+		className
+	)}
+	title={`${
+		rs.status === 'running'
+			? 'Running now'
+			: rs.status === 'success'
+				? 'Last run succeeded'
+				: 'Last run failed'
+	}${rs.runs > 0 ? ` — ran ${rs.runs}× this session` : ''}`}
+>
+	{#if rs.status === 'running'}
+		<Loader2 size={10} class="animate-spin" />
+	{:else if rs.status === 'success'}
+		<CheckCircle2 size={10} />
+	{:else}
+		<XCircle size={10} />
+	{/if}
+	{#if rs.runs > 0}
+		<span class="text-3xs leading-none tabular-nums">×{rs.runs}</span>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
index c4cb5ca998..5d28067982 100644
--- a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
@@ -1,10 +1,8 @@
 <script lang="ts">
 	import { Handle, Position } from '@xyflow/svelte'
 	import {
-		CheckCircle2,
 		ChevronDown,
 		Code2,
-		EllipsisVertical,
 		GitBranch,
 		Layers,
 		Loader2,
@@ -15,17 +13,20 @@
 		Target,
 		Timer,
 		Trash2,
-		XCircle,
 		Zap
 	} from 'lucide-svelte'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import { preventDefault, stopPropagation } from 'svelte/legacy'
 	import type { GraphUsageKind } from './types'
 	import type { RunnableRunState } from './activeRunnables.svelte'
 	import { parseDurationSecs } from './parsePipelineAnnotations'
-	import { NODE } from '$lib/components/graph/util'
-	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
+	import PipelineNodeCard from './PipelineNodeCard.svelte'
+	import NodeActionsMenu from './NodeActionsMenu.svelte'
+	import NodeFixButton, { type NodeFix } from './NodeFixButton.svelte'
+	import NodeOnDot from './NodeOnDot.svelte'
+	import RunStateChip from './RunStateChip.svelte'
+	import type { ScriptLang } from '$lib/gen'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import type { Item } from '$lib/utils'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
@@ -35,8 +36,16 @@
 
 	interface Props {
 		data: {
+			/** What is wrong with the node, and how to fix it: shows the Fix pill. */
+			fix?: NodeFix
+			/** Starts dragging the top dot onto an asset to subscribe the script to it. */
+			onStartOnDrag?: (e: PointerEvent) => void
 			runnable_kind: GraphUsageKind
 			path: string
+			summary?: string
+			language?: ScriptLang
+			// Why the script is misconfigured, when it is: renders it red.
+			error?: string
 			in_pipeline?: boolean
 			partition_kind?: 'daily' | 'hourly' | 'weekly' | 'monthly' | 'dynamic'
 			freshness?: string
@@ -101,10 +110,11 @@
 	}
 	let { data, selected = false }: Props = $props()
 
-	// The icon alone conveys "script" vs "flow"; the uppercase kind label was
-	// visually noisy and redundant. Tooltip on hover surfaces the path in
-	// full when truncated.
 	let Icon = $derived(data.runnable_kind === 'flow' ? GitBranch : Code2)
+	let kindLabel = $derived(
+		data.runnable_kind === 'flow' ? 'Flow' : data.dbt ? 'dbt project' : 'Script'
+	)
+	// The title shows the summary when there is one, so the tooltip keeps the path.
 	let nodeTooltip = $derived(
 		data.unsaved
 			? `${data.path} (unsaved draft)`
@@ -114,7 +124,6 @@
 	)
 
 	let hover = $state(false)
-	let menuOpen = $state(false)
 	let running = $state(false)
 
 	// Amber "computing now" surface, gated so only the replay player lights it up.
@@ -214,131 +223,106 @@
 	<!--
 		Mirrors the flow editor's step styling (getNodeColorClasses): muted
 		surface-tertiary fill with a quiet gray border, accent only for the
-		selected state, dashes for unsaved drafts. The 2px dashed stroke is
-		necessary for the dash gaps to be readable; 1px disappears into the
-		fill.
+		selected state, dashes for unsaved drafts — 1px, like the trigger
+		nodes' dashed outline, so every draft node reads the same.
 	-->
-	<div
-		class={twMerge(
-			'flex items-center rounded-md drop-shadow-sm overflow-hidden border transition-colors',
-			'bg-surface border-gray-400 dark:border-gray-600 hover:border-gray-500 dark:hover:border-gray-500',
-			selected && 'bg-surface-accent-selected border-border-selected',
-			data.unsaved && 'border-2 border-dashed border-gray-400 dark:border-gray-500',
-			computingNow &&
-				'bg-amber-50 dark:bg-amber-900/30 border-amber-400 dark:border-amber-600 animate-pulse'
-		)}
-		style="width: {NODE.width}px; min-height: {NODE.height}px;"
-		title={nodeTooltip}
-	>
-		<Icon size={14} class={`shrink-0 ml-2 mr-2 ${selected ? 'text-accent' : 'text-secondary'}`} />
-		<span class="flex-1 min-w-0 pr-1 py-0.5 text-2xs font-mono text-emphasis truncate">
-			{data.path}
-		</span>
-		<!-- Annotation chips share one neutral treatment — the icon carries
-		     the meaning (colors are reserved for feedback, per the brand
-		     guidelines). Only the freshness chip (when it has a verdict)
-		     and the run-state chip below use semantic colors. -->
-		{#if data.partition_kind}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// partitioned ${data.partition_kind}`}
-			>
-				<Layers size={10} />
-				<span class="text-3xs leading-none">{data.partition_kind}</span>
-			</div>
-		{/if}
-		<!-- Freshness is the one annotation chip that carries feedback (a
-		     fresh/stale verdict against real run history), so like the
-		     run-state chip it uses semantic colors: emerald = within window,
-		     amber = stale. Neutral when there's no verdict (drafts, bad
-		     window value). -->
-		{#if data.freshness}
-			<div
-				class={twMerge(
-					'shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm',
-					freshnessState === 'fresh'
-						? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300'
-						: freshnessState === 'stale'
-							? 'bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300'
-							: 'bg-surface-secondary text-secondary'
-				)}
-				title={freshnessTooltip}
-			>
-				<Timer size={10} />
-				<span class="text-3xs leading-none">{data.freshness}</span>
-			</div>
-		{/if}
-		{#if data.tag}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// tag ${data.tag}`}
-			>
-				<Tag size={10} />
-				<span class="text-3xs leading-none">{data.tag}</span>
-			</div>
-		{/if}
-		{#if data.retry}
-			{@const r = data.retry}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// retry ${r.count}${r.delay ? ` ${r.delay}` : ''}`}
-			>
-				<RotateCw size={10} />
-				<span class="text-3xs leading-none">×{r.count}</span>
-			</div>
-		{/if}
-		{#if data.macros && data.macros.length > 0}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
-				title={`// macros — defines ${data.macros.length} macro${data.macros.length > 1 ? 's' : ''}:\n${data.macros
-					.map((m) => `• ${m.name}(${m.params})${m.is_table ? ' → table' : ''}`)
-					.join('\n')}`}
-			>
-				<SquareFunction size={10} />
-				<span class="text-3xs leading-none">×{data.macros.length}</span>
-			</div>
-		{/if}
-		{#if data.dbt}
-			<div
-				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300"
-				title={`dbt project — materializes ${data.dbt.model_count} model${data.dbt.model_count === 1 ? '' : 's'}`}
-			>
-				<DbtIcon width={10} height={10} />
-				<span class="text-3xs leading-none">×{data.dbt.model_count}</span>
-			</div>
-		{/if}
-		{#if data.runState}
-			{@const rs = data.runState}
-			<div
-				class={twMerge(
-					'shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm',
-					rs.status === 'running'
-						? 'bg-blue-100 dark:bg-blue-900/40 text-blue-700 dark:text-blue-300'
-						: rs.status === 'success'
-							? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300'
-							: 'bg-red-100 dark:bg-red-900/40 text-red-700 dark:text-red-300'
-				)}
-				title={`${
-					rs.status === 'running'
-						? 'Running now'
-						: rs.status === 'success'
-							? 'Last run succeeded'
-							: 'Last run failed'
-				}${rs.runs > 0 ? ` — ran ${rs.runs}× this session` : ''}`}
-			>
-				{#if rs.status === 'running'}
-					<Loader2 size={10} class="animate-spin" />
-				{:else if rs.status === 'success'}
-					<CheckCircle2 size={10} />
+	<NodeActionsMenu items={menuItems} {hover}>
+		<PipelineNodeCard
+			surface="primary"
+			kindLabel="{kindLabel}{data.unsaved ? ' · draft' : ''}"
+			title={data.summary || data.path}
+			tooltip={data.error ? `${data.path}: ${data.error}` : nodeTooltip}
+			{selected}
+			draft={data.unsaved}
+			tone={computingNow ? 'running' : data.error ? 'error' : undefined}
+		>
+			{#snippet icon()}
+				{#if data.language && data.runnable_kind === 'script'}
+					<LanguageIcon lang={data.language} width={14} height={14} />
 				{:else}
-					<XCircle size={10} />
+					<Icon size={14} class={selected ? 'text-accent' : 'text-secondary'} />
 				{/if}
-				{#if rs.runs > 0}
-					<span class="text-3xs leading-none tabular-nums">×{rs.runs}</span>
+			{/snippet}
+			{#snippet trailing()}
+				<!-- Annotation chips share one neutral treatment — the icon carries
+			     the meaning (colors are reserved for feedback, per the brand
+			     guidelines). Only the freshness chip (when it has a verdict)
+			     and the run-state chip below use semantic colors. -->
+				{#if data.partition_kind}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// partitioned ${data.partition_kind}`}
+					>
+						<Layers size={10} />
+						<span class="text-3xs leading-none">{data.partition_kind}</span>
+					</div>
 				{/if}
-			</div>
-		{/if}
-	</div>
+				<!-- Freshness is the one annotation chip that carries feedback (a
+			     fresh/stale verdict against real run history), so like the
+			     run-state chip it uses semantic colors: emerald = within window,
+			     amber = stale. Neutral when there's no verdict (drafts, bad
+			     window value). -->
+				{#if data.freshness}
+					<div
+						class={twMerge(
+							'shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm',
+							freshnessState === 'fresh'
+								? 'bg-emerald-100 dark:bg-emerald-900/40 text-emerald-700 dark:text-emerald-300'
+								: freshnessState === 'stale'
+									? 'bg-amber-100 dark:bg-amber-900/40 text-amber-700 dark:text-amber-300'
+									: 'bg-surface-secondary text-secondary'
+						)}
+						title={freshnessTooltip}
+					>
+						<Timer size={10} />
+						<span class="text-3xs leading-none">{data.freshness}</span>
+					</div>
+				{/if}
+				{#if data.tag}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// tag ${data.tag}`}
+					>
+						<Tag size={10} />
+						<span class="text-3xs leading-none">{data.tag}</span>
+					</div>
+				{/if}
+				{#if data.retry}
+					{@const r = data.retry}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// retry ${r.count}${r.delay ? ` ${r.delay}` : ''}`}
+					>
+						<RotateCw size={10} />
+						<span class="text-3xs leading-none">×{r.count}</span>
+					</div>
+				{/if}
+				{#if data.macros && data.macros.length > 0}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-surface-secondary text-secondary"
+						title={`// macros — defines ${data.macros.length} macro${data.macros.length > 1 ? 's' : ''}:\n${data.macros
+							.map((m) => `• ${m.name}(${m.params})${m.is_table ? ' → table' : ''}`)
+							.join('\n')}`}
+					>
+						<SquareFunction size={10} />
+						<span class="text-3xs leading-none">×{data.macros.length}</span>
+					</div>
+				{/if}
+				{#if data.dbt}
+					<div
+						class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300"
+						title={`dbt project — materializes ${data.dbt.model_count} model${data.dbt.model_count === 1 ? '' : 's'}`}
+					>
+						<DbtIcon width={10} height={10} />
+						<span class="text-3xs leading-none">×{data.dbt.model_count}</span>
+					</div>
+				{/if}
+				{#if data.runState}
+					<RunStateChip runState={data.runState} class="mr-1" />
+				{/if}
+			{/snippet}
+		</PipelineNodeCard>
+	</NodeActionsMenu>
 	{#if showRun}
 		<!-- Run button revealed on hover/select. Matches the placement, size,
 		     and behaviour of AssetNode's run button so both nodes feel
@@ -463,38 +447,12 @@
 			{/if}
 		</div>
 	{/if}
-
-	{#if menuItems.length > 0}
-		<!--
-			Hover-revealed action menu, top-right of the node. Mirrors the
-			FlowModuleSchemaItem pattern: position the trigger button just
-			outside the node frame, only render it on hover (or while the
-			menu is open) so the canvas isn't visually cluttered when idle.
-			The pointerdown stop+preventDefault keeps xyflow from selecting
-			the node when the user is reaching for the menu.
-		-->
-		<div class="absolute -top-2 -right-2 h-7 p-1 min-w-7" style="will-change: transform;">
-			<DropdownV2
-				items={menuItems}
-				placement="bottom-end"
-				bind:open={menuOpen}
-				fixedHeight={false}
-				usePointerDownOutside
-			>
-				{#snippet buttonReplacement()}
-					<button
-						class={twMerge(
-							'center-center p-1 text-secondary shadow-sm bg-surface duration-0 hover:bg-surface-tertiary',
-							hover || menuOpen ? 'block' : '!hidden',
-							'shadow-md rounded-md'
-						)}
-						onpointerdown={stopPropagation(preventDefault(() => {}))}
-						title="Actions"
-					>
-						<EllipsisVertical size={12} />
-					</button>
-				{/snippet}
-			</DropdownV2>
+	{#if data.onStartOnDrag}
+		<NodeOnDot onStart={data.onStartOnDrag} visible={hover} />
+	{/if}
+	{#if data.fix}
+		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
+			<NodeFixButton fix={data.fix} />
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte b/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
index 0e279112cd..f678b3d272 100644
--- a/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/TriggerNode.svelte
@@ -24,46 +24,36 @@
 	type Presentation = {
 		icon: ComponentType
 		label: string
-		// Tailwind class fragments for bg + border + text accent.
-		bg: string
-		border: string
-		borderUnsaved: string
 		iconText: string
 	}
 
-	// One muted treatment for every source kind — colors are meaningful, not
+	// One muted icon color for every source kind — colors are meaningful, not
 	// decorative (brand guidelines), so the kind is carried by the icon and
-	// label while bg/border stay on the surface/gray scale like the flow
-	// editor's nodes. Red stays reserved for the missing-trigger state.
-	const MUTED = {
-		bg: 'bg-surface-secondary',
-		border: 'outline-gray-400 dark:outline-gray-600',
-		borderUnsaved: 'outline-dashed outline-gray-400 dark:outline-gray-500',
-		iconText: 'text-secondary'
-	}
+	// label. Red stays reserved for the missing-trigger state.
+	const MUTED = { iconText: 'text-secondary' }
 
 	export const TRIGGER_NODE_STYLE: Record<TriggerNodeKind, Presentation> = {
-		schedule: { icon: Clock, label: 'schedule', ...MUTED },
-		webhook: { icon: Webhook, label: 'webhook', ...MUTED },
-		email: { icon: Mail, label: 'email', ...MUTED },
-		kafka: { icon: Zap, label: 'kafka', ...MUTED },
-		mqtt: { icon: Radio, label: 'mqtt', ...MUTED },
-		amqp: { icon: Radio, label: 'amqp', ...MUTED },
-		nats: { icon: MessageSquare, label: 'nats', ...MUTED },
-		postgres: { icon: Database, label: 'postgres', ...MUTED },
-		sqs: { icon: Send, label: 'sqs', ...MUTED },
-		gcp: { icon: CloudCog, label: 'gcp', ...MUTED },
-		data_upload: { icon: Upload, label: 'data upload', ...MUTED }
+		schedule: { icon: Clock, label: 'Schedule', ...MUTED },
+		webhook: { icon: Webhook, label: 'Webhook', ...MUTED },
+		email: { icon: Mail, label: 'Email', ...MUTED },
+		kafka: { icon: Zap, label: 'Kafka', ...MUTED },
+		mqtt: { icon: Radio, label: 'MQTT', ...MUTED },
+		amqp: { icon: Radio, label: 'AMQP', ...MUTED },
+		nats: { icon: MessageSquare, label: 'NATS', ...MUTED },
+		postgres: { icon: Database, label: 'Postgres', ...MUTED },
+		sqs: { icon: Send, label: 'SQS', ...MUTED },
+		gcp: { icon: CloudCog, label: 'GCP Pub/Sub', ...MUTED },
+		data_upload: { icon: Upload, label: 'Data upload', ...MUTED }
 	}
 </script>
 
 <script lang="ts">
 	import { Handle, Position } from '@xyflow/svelte'
-	import { NODE } from '$lib/components/graph/util'
-	import { twMerge } from 'tailwind-merge'
-	import { AlertTriangle, CheckCircle2, EllipsisVertical, Target, Trash2 } from 'lucide-svelte'
-	import DropdownV2 from '$lib/components/DropdownV2.svelte'
-	import { stopPropagation, preventDefault } from 'svelte/legacy'
+	import PipelineNodeCard from './PipelineNodeCard.svelte'
+	import NodeActionsMenu from './NodeActionsMenu.svelte'
+	import NodeFixButton, { type NodeFix } from './NodeFixButton.svelte'
+	import { describeSchedule } from '$lib/utils/describeCron'
+	import { AlertTriangle, CheckCircle2, Target, Trash2 } from 'lucide-svelte'
 	import type { Item } from '$lib/utils'
 
 	interface Props {
@@ -74,16 +64,22 @@
 		// owning script is in `runnable_path` (used by the title and the
 		// "+ Create trigger" drawer hook passed by the page).
 		data: {
+			/** What is wrong with the node, and how to fix it: shows the Fix pill. */
+			fix?: NodeFix
 			kind: TriggerNodeKind
 			ref: string
 			unsaved?: boolean
 			missing?: boolean
+			// A pipeline-local schedule draft: `ref` is the path it deploys to.
+			// Edit/delete go through the same callbacks, which the page routes
+			// to the draft instead of a trigger row.
+			draft?: boolean
+			// The cron, for a schedule: the node names its cadence instead of "Schedule".
+			schedule?: string
+			timezone?: string
+			// Shown as the title over the trigger's path, when the trigger has one.
+			summary?: string
 			runnable_path?: string
-			// True iff the target script is still a draft (no DB row yet).
-			// Drives the "(after draft save)" hint on the missing
-			// placeholder, since the page-level handler refuses to open the
-			// create drawer until the script is deployed.
-			runnable_unsaved?: boolean
 			// Page-supplied dispatcher that opens the matching native
 			// trigger drawer with `script_path` pre-filled. When absent
 			// (e.g. schedule, or a kind without an editor) the placeholder is
@@ -128,7 +124,6 @@
 	let { data }: Props = $props()
 
 	let hover = $state(false)
-	let menuOpen = $state(false)
 
 	let style = $derived(TRIGGER_NODE_STYLE[data.kind])
 	// Webhooks are never genuinely "missing" — every deployed runnable has an
@@ -143,7 +138,7 @@
 	let Icon = $derived(displayMissing ? AlertTriangle : style.icon)
 	let missingTitle = $derived(
 		displayMissing
-			? `Missing ${style.label} trigger: ${data.runnable_path ?? ''} declares \`// on ${style.label}\` but no ${style.label} trigger targets it. Click to create one, or remove the annotation.`
+			? `Missing ${style.label} trigger: ${data.runnable_path ?? ''} declares \`// on ${data.kind}\` but no ${style.label} trigger targets it. Click to create one, or remove the annotation.`
 			: undefined
 	)
 	// Webhook gets a drawer (URLs + webhook-specific token creation) rather
@@ -200,7 +195,7 @@
 		...(canDelete
 			? [
 					{
-						displayName: 'Delete…',
+						displayName: data.draft ? 'Discard draft' : 'Delete…',
 						icon: Trash2,
 						type: 'delete' as const,
 						action: () => {
@@ -212,6 +207,75 @@
 			: [])
 	])
 
+	// A schedule names its cadence ("Every day at 4:00", or the cron itself
+	// when it has no plain reading); every other kind names its kind.
+	let kindName = $derived(
+		data.kind === 'schedule' && data.schedule
+			? (describeSchedule(data.schedule, data.timezone) ?? `Schedule (${data.schedule})`)
+			: style.label
+	)
+
+	// One card for every state: which label, title and click the node gets.
+	let card = $derived.by(
+		(): {
+			kindLabel: string
+			title: string
+			tooltip?: string
+			draft: boolean
+			tone?: 'danger' | 'success'
+			onclick?: () => void
+		} => {
+			const unsaved = !!data.unsaved
+			if (canCreate)
+				return {
+					kindLabel: `${style.label} · missing`,
+					title: 'Click to create',
+					tooltip: missingTitle,
+					draft: false,
+					tone: 'danger',
+					onclick: handleMissingClick
+				}
+			if (canEdit)
+				return {
+					kindLabel: `${kindName}${data.draft ? ' · draft' : unsaved ? ' · unsaved' : ''}`,
+					title: data.summary || data.ref,
+					tooltip: data.draft
+						? `Draft ${style.label}: ${data.ref} — created when you save the pipeline. Click to edit.`
+						: `Edit ${style.label} trigger: ${data.ref}`,
+					draft: unsaved,
+					onclick: handleEditClick
+				}
+			if (canOpenWebhook)
+				return {
+					kindLabel: style.label,
+					title: 'URLs & token',
+					tooltip: `Webhook endpoint for ${data.runnable_path ?? ''} — click to view URLs and create a token`,
+					draft: unsaved,
+					onclick: handleWebhookClick
+				}
+			if (canOpenDataUpload)
+				return {
+					kindLabel: `${style.label}${dataUploadReady ? ' · ready' : ''}`,
+					title: dataUploadReady ? 'File staged' : 'Upload & run',
+					tooltip: dataUploadReady
+						? `Data upload for ${data.runnable_path ?? ''} — a file is staged; the pipeline is ready to run. Click to change it.`
+						: `Data upload for ${data.runnable_path ?? ''} — click to open the run form and upload a file`,
+					draft: !dataUploadReady && unsaved,
+					tone: dataUploadReady ? 'success' : undefined,
+					onclick: handleDataUploadClick
+				}
+			return {
+				kindLabel: `${displayMissing ? style.label : kindName}${displayMissing ? ' · missing' : unsaved ? ' · unsaved' : ''}`,
+				title: displayMissing ? 'no trigger row' : data.summary || data.ref,
+				tooltip:
+					missingTitle ??
+					(unsaved ? `Unsaved ${style.label}: ${data.ref}` : `${style.label}: ${data.ref}`),
+				draft: unsaved && !displayMissing,
+				tone: displayMissing ? 'danger' : undefined
+			}
+		}
+	)
+
 	function handleMissingClick() {
 		if (!canCreate || !data.runnable_path || !data.onCreateMissingTrigger) return
 		data.onCreateMissingTrigger(data.kind as NativeTriggerKind, data.runnable_path)
@@ -235,195 +299,33 @@
 
 <!-- svelte-ignore a11y_no_static_element_interactions -->
 <div class="relative" onmouseenter={() => (hover = true)} onmouseleave={() => (hover = false)}>
-	{#if canCreate}
-		<!-- Same affordance as the asset's downstream + button: render the
-		     whole node as a button so the cursor + hover + click is obvious
-		     without depending on svelte-flow's wrapper-level handlers. -->
-		<button
-			type="button"
-			onclick={handleMissingClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				'bg-red-50 dark:bg-red-900/30 outline-dashed outline-red-400 dark:outline-red-500',
-				'hover:bg-red-100 dark:hover:bg-red-900/40 transition-colors'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={missingTitle}
+	<NodeActionsMenu items={menuItems} {hover}>
+		<PipelineNodeCard
+			kindLabel={card.kindLabel}
+			title={card.title}
+			tooltip={card.tooltip}
+			draft={card.draft}
+			tone={card.tone}
+			onclick={card.onclick}
 		>
-			<Icon size={14} class="shrink-0 ml-2 mr-2 text-red-600 dark:text-red-400" />
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span class="text-3xs uppercase tracking-wide truncate text-red-700 dark:text-red-400">
-					{style.label} · missing
-				</span>
-				<span class="text-2xs font-mono truncate text-red-700 dark:text-red-400">
-					{data.runnable_unsaved ? 'Click to create (after draft save)' : 'Click to create'}
-				</span>
-			</div>
-		</button>
-	{:else if canEdit}
-		<!-- Mirrors the missing-trigger pattern: render the whole node as a
-		     button so clicks open the editor drawer reliably (don't rely on
-		     svelte-flow's onnodeclick wiring). -->
-		<button
-			type="button"
-			onclick={handleEditClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				style.bg,
-				data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border,
-				'hover:brightness-95 dark:hover:brightness-110 transition-[filter]'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={`Edit ${style.label} trigger: ${data.ref}`}
-		>
-			<Icon size={14} class={`shrink-0 ml-2 mr-2 ${style.iconText}`} />
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span class="text-3xs uppercase tracking-wide truncate text-tertiary">
-					{style.label}{data.unsaved ? ' · unsaved' : ''}
-				</span>
-				<span class="text-2xs font-mono truncate text-emphasis">
-					{data.ref}
-				</span>
-			</div>
-		</button>
-	{:else if canOpenWebhook}
-		<!-- Webhook endpoint: implicit (no trigger row), so the node opens a
-		     drawer with the URLs + webhook-specific token creation instead of
-		     an editor. Styled like an attached trigger, never the red
-		     "missing" state. -->
-		<button
-			type="button"
-			onclick={handleWebhookClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				style.bg,
-				data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border,
-				'hover:brightness-95 dark:hover:brightness-110 transition-[filter]'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={`Webhook endpoint for ${data.runnable_path ?? ''} — click to view URLs and create a token`}
-		>
-			<Icon size={14} class={`shrink-0 ml-2 mr-2 ${style.iconText}`} />
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span class="text-3xs uppercase tracking-wide truncate text-tertiary">
-					{style.label}
-				</span>
-				<span class="text-2xs font-mono truncate text-emphasis"> URLs & token </span>
-			</div>
-		</button>
-	{:else if canOpenDataUpload}
-		<!-- Data upload: UI-first entry point (no trigger row). Clicking the
-		     node opens the target script's run form, where the auto-generated
-		     S3 picker lets the user upload a file and run the pipeline. Goes
-		     green once a file is staged (ready), so "Run pipeline" can proceed;
-		     until then it stays neutral with an "upload a file" prompt. Never
-		     the red "missing" state. -->
-		<button
-			type="button"
-			onclick={handleDataUploadClick}
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1 w-full text-left',
-				dataUploadReady
-					? 'bg-green-50 dark:bg-green-900/30 outline-green-500 dark:outline-green-600'
-					: style.bg,
-				dataUploadReady ? '' : data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border,
-				'hover:brightness-95 dark:hover:brightness-110 transition-[filter]'
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={dataUploadReady
-				? `Data upload for ${data.runnable_path ?? ''} — a file is staged; the pipeline is ready to run. Click to change it.`
-				: `Data upload for ${data.runnable_path ?? ''} — click to open the run form and upload a file`}
-		>
-			<DataUploadIcon
-				size={14}
-				class={`shrink-0 ml-2 mr-2 ${dataUploadReady ? 'text-green-600 dark:text-green-400' : style.iconText}`}
-			/>
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span
-					class={twMerge(
-						'text-3xs uppercase tracking-wide truncate',
-						dataUploadReady ? 'text-green-700 dark:text-green-400' : 'text-tertiary'
-					)}
-				>
-					{style.label}{dataUploadReady ? ' · ready' : ''}
-				</span>
-				<span
-					class={twMerge(
-						'text-2xs font-mono truncate',
-						dataUploadReady ? 'text-green-700 dark:text-green-400' : 'text-emphasis'
-					)}
-				>
-					{dataUploadReady ? 'File staged' : 'Upload & run'}
-				</span>
-			</div>
-		</button>
-	{:else}
-		<div
-			class={twMerge(
-				'flex items-center rounded-md drop-shadow-sm overflow-hidden outline outline-1',
-				displayMissing
-					? 'bg-red-50 dark:bg-red-900/30 outline-dashed outline-red-400 dark:outline-red-500'
-					: style.bg,
-				displayMissing ? '' : data.unsaved ? `opacity-80 ${style.borderUnsaved}` : style.border
-			)}
-			style="width: {NODE.width}px; min-height: {NODE.height}px;"
-			title={missingTitle ??
-				(data.unsaved ? `Unsaved ${style.label}: ${data.ref}` : `${style.label}: ${data.ref}`)}
-		>
-			<Icon
-				size={14}
-				class={`shrink-0 ml-2 mr-2 ${displayMissing ? 'text-red-600 dark:text-red-400' : style.iconText}`}
-			/>
-			<div class="flex flex-col min-w-0 flex-1 pr-2 py-0.5 leading-tight">
-				<span
-					class={twMerge(
-						'text-3xs uppercase tracking-wide truncate',
-						displayMissing ? 'text-red-700 dark:text-red-400' : 'text-tertiary'
-					)}
-				>
-					{style.label}{displayMissing ? ' · missing' : data.unsaved ? ' · unsaved' : ''}
-				</span>
-				<span
-					class={twMerge(
-						'text-2xs font-mono truncate',
-						displayMissing ? 'text-red-700 dark:text-red-400' : 'text-emphasis'
-					)}
-				>
-					{displayMissing ? 'no trigger row' : data.ref}
-				</span>
-			</div>
-		</div>
-	{/if}
-
-	{#if menuItems.length > 0}
-		<!-- Hover-revealed kebab menu (Delete only for now). Mirrors the
-		     RunnableNode pattern: positioned just outside the top-right of
-		     the node, rendered only on hover or while the menu is open so
-		     the canvas stays clean at rest. `pointerdown` is stopped so
-		     svelte-flow doesn't kick off node selection / drag when the
-		     user reaches for the menu. -->
-		<div class="absolute -top-2 -right-2 h-7 p-1 min-w-7" style="will-change: transform;">
-			<DropdownV2
-				items={menuItems}
-				placement="bottom-end"
-				bind:open={menuOpen}
-				fixedHeight={false}
-				usePointerDownOutside
-			>
-				{#snippet buttonReplacement()}
-					<button
-						class={twMerge(
-							'center-center p-1 text-secondary shadow-sm bg-surface duration-0 hover:bg-surface-tertiary',
-							hover || menuOpen ? 'block' : '!hidden',
-							'shadow-md rounded-md'
-						)}
-						onpointerdown={stopPropagation(preventDefault(() => {}))}
-						title="Actions"
-					>
-						<EllipsisVertical size={12} />
-					</button>
-				{/snippet}
-			</DropdownV2>
+			{#snippet icon()}
+				{#if canOpenDataUpload}
+					<DataUploadIcon
+						size={14}
+						class={dataUploadReady ? 'text-green-600 dark:text-green-400' : style.iconText}
+					/>
+				{:else}
+					<Icon
+						size={14}
+						class={displayMissing || canCreate ? 'text-red-600 dark:text-red-400' : style.iconText}
+					/>
+				{/if}
+			{/snippet}
+		</PipelineNodeCard>
+	</NodeActionsMenu>
+	{#if data.fix}
+		<div class="absolute left-1/2 -bottom-3 -translate-x-1/2 z-10">
+			<NodeFixButton fix={data.fix} />
 		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts
index 24e7d4c2da..073432e1a5 100644
--- a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.test.ts
@@ -147,4 +147,18 @@ describe('layoutAssetGraph (tidy-tree with join breaks)', () => {
 			expect(pos.get(id)!.y).toBeGreaterThan(anchor.y)
 		}
 	})
+
+	it('packs narrow nodes by their own width', () => {
+		const pos = layoutAssetGraph({
+			nodes: [
+				{ ...n('p'), width: 100 },
+				{ ...n('l'), width: 100 },
+				{ ...n('r'), width: 180 }
+			],
+			edges: [e('p', 'l'), e('p', 'r')]
+		})
+		const gap = pos.get('r')!.x - 90 - (pos.get('l')!.x + 50)
+		expect(gap).toBe(NODE.gap.horizontal)
+		expect(pos.get('l')!.x).toBe(50)
+	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts
index c9d7d60355..e1e1e1e7da 100644
--- a/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/assetGraphLayout.ts
@@ -7,7 +7,15 @@ import { NODE } from '$lib/components/graph/util'
 // breathing room.
 const NODE_WIDTH = NODE.width
 const NODE_HEIGHT = NODE.height + 30
-const LAYER_GAP = NODE.gap.vertical
+/** Rendered height of a pipeline node: a kind label over a title. Fits inside
+ * the `NODE_HEIGHT` row the layout reserves. */
+export const PIPELINE_NODE_HEIGHT = 48
+// A step more than the flow editor's gap: the + on a node's bottom edge sits in it.
+const LAYER_GAP = NODE.gap.vertical + 16
+/** Height of the "Add data source" pill the anchor draws, and its gap to the
+ * graph: tighter than LAYER_GAP, since no edge runs through it. */
+const ANCHOR_HEIGHT = 32
+const ANCHOR_GAP = 40
 const SIBLING_GAP = NODE.gap.horizontal
 // Horizontal gutter between two disjoint subgraphs. Wider than the
 // within-subgraph sibling gap so visually-unrelated components (e.g. two
@@ -15,10 +23,16 @@ const SIBLING_GAP = NODE.gap.horizontal
 // into each other's columns — but only ~2×, so they don't drift far apart.
 const COMPONENT_GAP = SIBLING_GAP * 2
 
-const LAYER_H = NODE_HEIGHT + LAYER_GAP
+/** Extra height of an assets-only node: the trigger chip under its title. */
+export const PIPELINE_NODE_EXTRA_ROW = 20
+/** Height of the header strip naming an assets-only node's producing script. */
+export const PIPELINE_NODE_HEADER = 22
+/** Extra vertical padding of a card under a header, top plus bottom. */
+export const PIPELINE_NODE_HEADER_CARD_PAD = 12
 
 interface GraphInput {
-	nodes: Array<{ id: string; data: AssetGraphNodeData }>
+	/** `width` defaults to `NODE.width`. */
+	nodes: Array<{ id: string; data: AssetGraphNodeData; width?: number }>
 	edges: Array<{ source: string; target: string }>
 }
 
@@ -52,15 +66,18 @@ interface Band {
 // intersects theirs.
 //
 // y comes from longest-path layering (same top-down orientation as before:
-// producers above, assets in the middle, consumers below). Returns positions
-// (band centers) normalized so the component's min x,y = 0. Cyclic input is
-// handled by dropping feedback edges (see the Kahn step below).
+// producers above, assets in the middle, consumers below). Returns node
+// centers, normalized so the component's leftmost edge and top are at 0.
+// Cyclic input is handled by dropping feedback edges (see the Kahn step below).
 function layoutComponent(
 	nodes: GraphInput['nodes'],
-	edges: GraphInput['edges']
+	edges: GraphInput['edges'],
+	rowH: number
 ): Map<string, Positioned> {
+	const layerH = rowH + LAYER_GAP
 	const out = new Map<string, Positioned>()
 	const ids = new Set(nodes.map((n) => n.id))
+	const nodeW = new Map(nodes.map((n) => [n.id, n.width ?? NODE_WIDTH]))
 
 	const parents = new Map<string, string[]>()
 	const children = new Map<string, string[]>()
@@ -137,7 +154,7 @@ function layoutComponent(
 		const kids = treeChildren.get(id)!
 		const kidsW =
 			kids.reduce((acc, k) => acc + W.get(k)!, 0) + SIBLING_GAP * Math.max(0, kids.length - 1)
-		W.set(id, Math.max(NODE_WIDTH, kidsW))
+		W.set(id, Math.max(nodeW.get(id)!, kidsW))
 	}
 
 	// Vertical (pixel) extent of a subtree, for band collision checks.
@@ -152,14 +169,14 @@ function layoutComponent(
 			if (l > hi) hi = l
 			for (const k of treeChildren.get(cur)!) stack.push(k)
 		}
-		return { top: lo * LAYER_H, bottom: hi * LAYER_H + NODE_HEIGHT }
+		return { top: lo * layerH, bottom: hi * layerH + rowH }
 	}
 
 	// Recursive placement: node centered over its band, children packed
 	// side-by-side and centered within it.
 	function placeTree(id: string, left: number) {
 		const w = W.get(id)!
-		out.set(id, { x: left + w / 2, y: layer.get(id)! * LAYER_H })
+		out.set(id, { x: left + w / 2, y: layer.get(id)! * layerH })
 		const kids = treeChildren.get(id)!
 		if (kids.length === 0) return
 		const kidsW = kids.reduce((acc, k) => acc + W.get(k)!, 0) + SIBLING_GAP * (kids.length - 1)
@@ -211,11 +228,11 @@ function layoutComponent(
 		placeAndRecord(id, center - w / 2)
 	}
 
-	// Normalize so the component's min x,y = 0.
+	// Normalize so the component's leftmost edge and top are at 0.
 	let minX = Infinity
 	let minY = Infinity
-	for (const p of out.values()) {
-		if (p.x < minX) minX = p.x
+	for (const [id, p] of out) {
+		if (p.x - nodeW.get(id)! / 2 < minX) minX = p.x - nodeW.get(id)! / 2
 		if (p.y < minY) minY = p.y
 	}
 	if (isFinite(minX) && isFinite(minY)) {
@@ -243,7 +260,13 @@ function layoutComponent(
 //
 // Falls back to a stable grid if the component layout throws (defensive —
 // cycles are already absorbed by feedback-edge dropping in layoutComponent).
-export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<string, Positioned> {
+export function layoutAssetGraph(
+	graph: GraphInput,
+	anchorId?: string,
+	extraRowHeight = 0
+): Map<string, Positioned> {
+	const rowH = NODE_HEIGHT + extraRowHeight
+	const layerH = rowH + LAYER_GAP
 	const byId = new Map<string, Positioned>()
 	if (graph.nodes.length === 0) return byId
 
@@ -297,19 +320,20 @@ export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<stri
 		// 3. Lay out each component and pack side-by-side. xOffset advances by
 		// the laid-out width of each component (max node center + a node width,
 		// since positions are node centers) plus the gutter.
+		const widthOf = new Map(nodes.map((n) => [n.id, n.width ?? NODE_WIDTH]))
 		let xOffset = 0
 		for (let c = 0; c < nComp; c++) {
-			const positions = layoutComponent(compNodes[c], compEdges[c])
-			let maxX = 0
-			for (const p of positions.values()) if (p.x > maxX) maxX = p.x
+			const positions = layoutComponent(compNodes[c], compEdges[c], rowH)
+			let maxRight = 0
 			for (const [id, p] of positions) {
+				maxRight = Math.max(maxRight, p.x + widthOf.get(id)! / 2)
 				byId.set(id, { x: p.x + xOffset, y: p.y })
 			}
-			xOffset += maxX + NODE_WIDTH + COMPONENT_GAP
+			xOffset += maxRight + COMPONENT_GAP
 		}
 
 		// 4. Re-place the anchor centered horizontally over the whole packed
-		// graph, one layer above it; then renormalize so the anchor sits at the
+		// graph, just above it; then renormalize so the anchor sits at the
 		// top (y = 0), pushing the components down a layer to make room (mirrors
 		// the previous "anchor is the parent of every root" behaviour).
 		if (anchorId && graph.nodes.some((n) => n.id === anchorId)) {
@@ -324,7 +348,9 @@ export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<stri
 					if (p.x > maxX) maxX = p.x
 					if (p.y < minY) minY = p.y
 				}
-				byId.set(anchorId, { x: (minX + maxX) / 2, y: minY - LAYER_H })
+				// One gap above the graph, sized to the pill rather than a full node row:
+				// a row tall enough for an assets-only card leaves it floating high.
+				byId.set(anchorId, { x: (minX + maxX) / 2, y: minY - ANCHOR_HEIGHT - ANCHOR_GAP })
 				let nMinY = Infinity
 				for (const p of byId.values()) if (p.y < nMinY) nMinY = p.y
 				for (const p of byId.values()) p.y -= nMinY
@@ -336,7 +362,7 @@ export function layoutAssetGraph(graph: GraphInput, anchorId?: string): Map<stri
 		graph.nodes.forEach((n, i) => {
 			byId.set(n.id, {
 				x: (i % cols) * (NODE_WIDTH + SIBLING_GAP),
-				y: Math.floor(i / cols) * LAYER_H
+				y: Math.floor(i / cols) * layerH
 			})
 		})
 		return byId
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetNodeWidth.ts b/frontend/src/lib/components/assets/AssetGraph/assetNodeWidth.ts
new file mode 100644
index 0000000000..176ecf7411
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetNodeWidth.ts
@@ -0,0 +1,66 @@
+import { NODE } from '$lib/components/graph/util'
+
+const MIN_WIDTH = 160
+
+let ctx: CanvasRenderingContext2D | null | undefined
+
+/** Rendered width of `text` at `rem` in the page font, or a rough guess without a DOM. */
+function textWidth(text: string, rem: number): number {
+	if (typeof document === 'undefined') return text.length * rem * 16 * 0.6
+	ctx ??= document.createElement('canvas').getContext('2d')
+	const root = parseFloat(getComputedStyle(document.documentElement).fontSize) || 16
+	if (!ctx) return text.length * rem * root * 0.6
+	const body = getComputedStyle(document.body)
+	ctx.font = `${rem * root}px ${body.fontFamily}`
+	const spacing = parseFloat(body.letterSpacing) || 0
+	return ctx.measureText(text).width + spacing * text.length
+}
+
+/**
+ * Width of an assets-only asset card, from the pieces `PipelineNodeCard` and
+ * `AssetNode` lay out: icon and the widest of kind / title / trigger chip, or the
+ * header naming the producing script, if wider. The numbers mirror their Tailwind spacing; change one
+ * and the other drifts. Clamped to the regular node width, past which the title
+ * truncates as usual.
+ */
+export function assetsOnlyNodeWidth(n: {
+	kind: string
+	title: string
+	chip: string
+	/** The chip leads with an icon (the folded-errors Fix chip). */
+	chipIcon?: boolean
+	/** The chip ends in the edit icon (an editable trigger). */
+	chipEdit?: boolean
+	/** The header tab: its text (a script's summary or path, "N scripts"), icon
+	 * count, and whether it ends in the menu chevron (else the edit icon) or has a "draft" mark;
+	 * undefined without a header. */
+	header?: { label: string; icons: number; chevron?: boolean; draft?: boolean }
+}): number {
+	const icon = 12 + 14 + 10
+	const text = Math.max(
+		textWidth(n.kind, 0.7),
+		textWidth(n.title, 0.75),
+		textWidth(n.chip, 0.65) + 12 + 2 + (n.chipIcon ? 14 : 0) + (n.chipEdit ? 4 + 9 : 0)
+	)
+	const body = Math.ceil(icon + text + 4 + 8 + 2 + 8)
+	// Header tab: mx-2 and a 1px border around px-2, then gap-1.5 between its
+	// items: the icons, the label, a "draft" mark, and the chevron or edit icon.
+	// The run chip is left out: it comes and goes with runs, and a width that
+	// followed it would re-lay the graph on a click; the label truncates instead.
+	const h = n.header
+	const header = h
+		? Math.ceil(
+				16 +
+					2 +
+					16 +
+					h.icons * (11 + 6) +
+					textWidth(h.label, 0.65) +
+					(h.draft ? 6 + textWidth('draft', 0.65) : 0) +
+					// The menu chevron, or the edit icon of a single script.
+					6 +
+					(h.chevron ? 11 : 10) +
+					4
+			)
+		: 0
+	return Math.min(NODE.width, Math.max(MIN_WIDTH, body, header))
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetsOnlyFolders.ts b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyFolders.ts
new file mode 100644
index 0000000000..4079986ee5
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyFolders.ts
@@ -0,0 +1,25 @@
+// Pipelines open in the assets-only view. This remembers the ones last left
+// showing their scripts and triggers, as `<workspace>/<folder>`, so reopening one
+// shows it the same way. Browser-local: a missing or unreadable list reads as
+// "none", and storage that throws (private mode, blocked site data) is ignored.
+const KEY = 'pipeline-full-view-folders'
+
+function read(): string[] {
+	try {
+		const parsed = JSON.parse(localStorage.getItem(KEY) ?? '[]')
+		return Array.isArray(parsed) ? parsed.filter((f) => typeof f === 'string') : []
+	} catch {
+		return []
+	}
+}
+
+export function isAssetsOnlyFolder(folder: string): boolean {
+	return !read().includes(folder)
+}
+
+export function setAssetsOnlyFolder(folder: string, on: boolean): void {
+	const rest = read().filter((f) => f !== folder)
+	try {
+		localStorage.setItem(KEY, JSON.stringify(on ? rest : [...rest, folder]))
+	} catch {}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.test.ts b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.test.ts
new file mode 100644
index 0000000000..0f2cf472ac
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it } from 'vitest'
+import {
+	assetsOnlyView,
+	upstreamDeletion,
+	noAssetNodeId,
+	withoutPassiveReads,
+	type AssetUpstream
+} from './assetsOnlyView'
+
+const node = (id: string, type: string, data: any = {}) => ({ id, type, data })
+const edge = (source: string, target: string, kind: string) => ({
+	id: `${kind}:${source}->${target}`,
+	source,
+	target,
+	kind
+})
+
+describe('assetsOnlyView', () => {
+	const nodes = [
+		node('asset:ducklake:raw', 'asset'),
+		node('asset:ducklake:clean', 'asset'),
+		node('asset:ducklake:report', 'asset'),
+		node('script:f/p/clean', 'runnable'),
+		node('script:f/p/report', 'runnable'),
+		node('script:f/p/other', 'runnable'),
+		node('trigger:schedule:f/p/daily', 'trigger', { kind: 'schedule', schedule: '0 0 4 * * *' })
+	]
+	const edges = [
+		edge('trigger:schedule:f/p/daily', 'script:f/p/clean', 'trigger-native'),
+		edge('asset:ducklake:raw', 'script:f/p/clean', 'lineage-read'),
+		edge('script:f/p/clean', 'asset:ducklake:clean', 'lineage-write'),
+		// read-modify-write: no self edge
+		edge('asset:ducklake:clean', 'script:f/p/clean', 'lineage-read'),
+		edge('asset:ducklake:clean', 'script:f/p/report', 'trigger-asset'),
+		edge('asset:ducklake:clean', 'script:f/p/report', 'lineage-read'),
+		edge('script:f/p/report', 'asset:ducklake:report', 'lineage-write'),
+		edge('script:f/p/other', 'asset:ducklake:report', 'lineage-write')
+	]
+	const v = assetsOnlyView(nodes, edges)
+
+	it('joins each script input to its outputs, once', () => {
+		expect(v.edges.map((e) => `${e.source} -> ${e.target}`).sort()).toEqual([
+			'asset:ducklake:clean -> asset:ducklake:report',
+			'asset:ducklake:raw -> asset:ducklake:clean'
+		])
+		expect([...v.nodeIds].sort()).toEqual([
+			'asset:ducklake:clean',
+			'asset:ducklake:raw',
+			'asset:ducklake:report'
+		])
+	})
+
+	it('names the single producer and its trigger, or marks the asset ambiguous', () => {
+		expect(v.upstream.get('asset:ducklake:raw')).toBeUndefined()
+		expect(v.upstream.get('asset:ducklake:clean')).toMatchObject({
+			multiple: false,
+			runnableId: 'script:f/p/clean',
+			trigger: { kind: 'schedule', data: { schedule: '0 0 4 * * *' } }
+		})
+		expect(v.upstream.get('asset:ducklake:report')).toEqual({
+			multiple: true,
+			runnableIds: ['script:f/p/report', 'script:f/p/other']
+		})
+	})
+})
+
+describe('the No asset nodes', () => {
+	it('give each script that builds nothing its own node, fed by what it reads', () => {
+		const v = assetsOnlyView(
+			[
+				node('asset:ducklake:a', 'asset'),
+				node('asset:ducklake:b', 'asset'),
+				node('script:f/p/on_a', 'runnable'),
+				node('script:f/p/on_b', 'runnable'),
+				node('script:f/p/dbt', 'runnable', { dbt: { model_count: 3 } }),
+				node('script:f/p/macros', 'runnable', { macros: [{ name: 'm' }] })
+			],
+			[
+				edge('asset:ducklake:a', 'script:f/p/on_a', 'trigger-asset'),
+				edge('asset:ducklake:b', 'script:f/p/on_b', 'trigger-asset')
+			]
+		)
+		const onA = noAssetNodeId('script:f/p/on_a')
+		const onB = noAssetNodeId('script:f/p/on_b')
+		expect(v.noAssetNodeIds).toEqual([onA, onB])
+		expect(v.upstream.get(onA)).toMatchObject({ runnableId: 'script:f/p/on_a' })
+		expect(v.edges.map((e) => `${e.source} -> ${e.target}`)).toEqual([
+			`asset:ducklake:a -> ${onA}`,
+			`asset:ducklake:b -> ${onB}`
+		])
+	})
+})
+
+describe('upstreamDeletion', () => {
+	const script = { runnable_kind: 'script', path: 'f/p/a' }
+	const schedule = (targets: string[]) => ({
+		kind: 'schedule',
+		nodeId: 'trigger:schedule:f/p/a_schedule',
+		data: { ref: 'f/p/a_schedule', runnable_paths: targets }
+	})
+	const own = (trigger?: any): AssetUpstream & { multiple: false } => ({
+		multiple: false,
+		runnableId: 'script:f/p/a',
+		trigger
+	})
+
+	it('deletes the script and a trigger that fires only it', () => {
+		const u = own(schedule(['f/p/a']))
+		expect(upstreamDeletion(u, script, new Map([['asset:x', u]]))).toEqual({
+			script: { path: 'f/p/a', unsaved: false },
+			trigger: { kind: 'schedule', path: 'f/p/a_schedule', draft: false }
+		})
+	})
+
+	it('keeps a trigger that fires other scripts', () => {
+		const u = own(schedule(['f/p/a', 'f/p/b']))
+		expect(upstreamDeletion(u, script, new Map([['asset:x', u]]))?.trigger).toBeUndefined()
+	})
+
+	it('deletes nothing when the script also co-produces another asset', () => {
+		const u = own(schedule(['f/p/a']))
+		const all = new Map<string, AssetUpstream>([
+			['asset:x', u],
+			['asset:y', { multiple: true, runnableIds: ['script:f/p/a', 'script:f/p/b'] }]
+		])
+		expect(upstreamDeletion(u, script, all)).toBeUndefined()
+	})
+
+	it('deletes nothing when the script builds another asset too', () => {
+		const u = own(schedule(['f/p/a']))
+		const all = new Map([
+			['asset:x', u],
+			['asset:y', u]
+		])
+		expect(upstreamDeletion(u, script, all)).toBeUndefined()
+	})
+})
+
+describe('withoutPassiveReads', () => {
+	it('drops reads that trigger nothing, and the assets only they drew', () => {
+		const nodes = [
+			node('asset:src', 'asset'),
+			node('asset:lookup', 'asset'),
+			node('asset:out', 'asset'),
+			node('script:a', 'runnable')
+		]
+		const edges = [
+			edge('asset:src', 'script:a', 'lineage-read'),
+			edge('asset:src', 'script:a', 'trigger-asset'),
+			edge('asset:lookup', 'script:a', 'lineage-read'),
+			edge('asset:out', 'script:a', 'lineage-read'),
+			edge('script:a', 'asset:out', 'lineage-write')
+		]
+		const r = withoutPassiveReads(nodes, edges)
+		expect(r.nodes.map((n) => n.id)).toEqual(['asset:src', 'asset:out', 'script:a'])
+		expect(r.edges.map((e) => e.id)).toEqual([
+			'lineage-read:asset:src->script:a',
+			'trigger-asset:asset:src->script:a',
+			'lineage-write:script:a->asset:out'
+		])
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.ts b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.ts
new file mode 100644
index 0000000000..c7bf85d144
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/assetsOnlyView.ts
@@ -0,0 +1,234 @@
+import type { NativeTriggerKind } from './types'
+
+/** A node or edge of the canvas model, reduced to what the assets-only view reads. */
+export type ViewNode = { id: string; type: string; data: any }
+export type ViewEdge = {
+	id: string
+	source: string
+	target: string
+	kind: string
+	unsaved?: boolean
+	/** Assets-only edges: the folded runnables the data goes through. */
+	via?: string[]
+	/** Assets-only edges: a write to the source reruns one of `via`. */
+	reactive?: boolean
+}
+
+/** The assets-only node standing for a script that builds no asset: one per
+ * script, so scripts reacting to different inputs stay apart. */
+export const noAssetNodeId = (runnableId: string) => `no-asset:${runnableId}`
+export const isNoAssetNode = (id: string) => id.startsWith('no-asset:')
+
+/** What an assets-only delete removes: the script, its trigger, or both. */
+export type AssetUpstreamDelete = {
+	script?: { path: string; unsaved: boolean }
+	trigger?: { kind: NativeTriggerKind; path: string; draft: boolean }
+}
+
+/** What an asset shows of the script and trigger that produce it, in the assets-only view. */
+export type AssetUpstream =
+	/** Several producing scripts, or one with several triggers. */
+	| { multiple: true; runnableIds: string[] }
+	| {
+			multiple: false
+			/** Canvas id of the producing runnable (`script:<path>`). */
+			runnableId: string
+			/** The producer's trigger; undefined when nothing triggers it (run by hand). */
+			trigger?: { nodeId?: string; kind: string; data?: any }
+	  }
+
+/**
+ * The asset → asset view of a pipeline graph: runnables and triggers disappear,
+ * and every read (or asset trigger) of a script is joined to each of its writes,
+ * so an asset points at the assets computed from it. Each produced asset keeps a
+ * reference to its single producer and that producer's single trigger, or is
+ * marked `multiple` when either is ambiguous.
+ */
+export function assetsOnlyView<N extends ViewNode, E extends ViewEdge>(
+	nodes: N[],
+	edges: E[]
+): {
+	nodeIds: Set<string>
+	edges: Array<ViewEdge>
+	upstream: Map<string, AssetUpstream>
+	/** A node per script that builds no asset (`noAssetNodeId`), its upstream
+	 * under that id. */
+	noAssetNodeIds: string[]
+} {
+	const nodeById = new Map(nodes.map((n) => [n.id, n]))
+	const inputsOf = new Map<string, E[]>()
+	const triggersOf = new Map<string, E[]>()
+	const producersOf = new Map<string, E[]>()
+	const push = (m: Map<string, E[]>, k: string, e: E) => m.set(k, [...(m.get(k) ?? []), e])
+	for (const e of edges) {
+		if (e.kind === 'lineage-write') push(producersOf, e.target, e)
+		else if (e.kind === 'lineage-read' || e.kind === 'trigger-asset') {
+			push(inputsOf, e.target, e)
+			if (e.kind === 'trigger-asset') push(triggersOf, e.target, e)
+		} else if (e.kind === 'trigger-native') push(triggersOf, e.target, e)
+	}
+
+	const triggered = new Set(
+		edges.filter((e) => e.kind === 'trigger-asset').map((e) => `${e.source}\n${e.target}`)
+	)
+	const out = new Map<string, ViewEdge>()
+	for (const [assetId, writes] of producersOf) {
+		for (const w of writes) {
+			for (const r of inputsOf.get(w.source) ?? []) {
+				// A read-modify-write of the same table is not a dependency on itself.
+				if (r.source === assetId) continue
+				const id = `flow:${r.source}->${assetId}`
+				const prev = out.get(id)
+				const unsaved = !!(w.unsaved || r.unsaved)
+				const reactive = triggered.has(`${r.source}\n${w.source}`)
+				if (prev) {
+					prev.unsaved = prev.unsaved && unsaved
+					prev.reactive ||= reactive
+					if (!prev.via?.includes(w.source)) prev.via = [...(prev.via ?? []), w.source]
+				} else {
+					out.set(id, {
+						id,
+						source: r.source,
+						target: assetId,
+						kind: 'asset-flow',
+						unsaved,
+						reactive,
+						via: [w.source]
+					})
+				}
+			}
+		}
+	}
+	for (const e of edges) if (e.kind === 'dbt-ref') out.set(e.id, e)
+
+	function describe(runnableIds: string[]): AssetUpstream {
+		if (runnableIds.length !== 1) return { multiple: true, runnableIds }
+		const runnableId = runnableIds[0]
+		// Every asset trigger of a script is one cause, "an input changed".
+		const triggers = [
+			...new Map(
+				(triggersOf.get(runnableId) ?? []).map((t) => [
+					t.kind === 'trigger-asset' ? 'asset' : t.source,
+					t
+				])
+			).values()
+		]
+		if (triggers.length > 1) return { multiple: true, runnableIds }
+		const t = triggers[0]
+		const tNode = t && nodeById.get(t.source)
+		return {
+			multiple: false,
+			runnableId,
+			trigger: !t
+				? undefined
+				: t.kind === 'trigger-asset'
+					? { kind: 'asset' }
+					: { nodeId: t.source, kind: tNode?.data?.kind, data: tNode?.data }
+		}
+	}
+
+	const upstream = new Map<string, AssetUpstream>()
+	for (const [assetId, writes] of producersOf) {
+		upstream.set(assetId, describe([...new Set(writes.map((w) => w.source))]))
+	}
+
+	// Scripts that build no asset have nowhere to fold into, so each gets a "No
+	// asset" node, fed by what it reads. dbt projects (whose writes are not drawn)
+	// and macro libraries (which build nothing by design) get none.
+	const writers = new Set([...producersOf.values()].flat().map((w) => w.source))
+	const orphans = nodes
+		.filter(
+			(n) => n.type === 'runnable' && !writers.has(n.id) && !n.data?.dbt && !n.data?.macros?.length
+		)
+		.map((n) => n.id)
+	for (const id of orphans) {
+		const nodeId = noAssetNodeId(id)
+		upstream.set(nodeId, describe([id]))
+		for (const r of inputsOf.get(id) ?? []) {
+			const eid = `flow:${r.source}->${nodeId}`
+			const reactive = triggered.has(`${r.source}\n${id}`)
+			const prev = out.get(eid)
+			if (prev) {
+				prev.unsaved = prev.unsaved && !!r.unsaved
+				prev.reactive ||= reactive
+			} else {
+				out.set(eid, {
+					id: eid,
+					source: r.source,
+					target: nodeId,
+					kind: 'asset-flow',
+					unsaved: !!r.unsaved,
+					reactive,
+					via: [id]
+				})
+			}
+		}
+	}
+
+	const nodeIds = new Set(nodes.filter((n) => n.type === 'asset').map((n) => n.id))
+	return {
+		nodeIds,
+		edges: [...out.values()],
+		upstream,
+		noAssetNodeIds: orphans.map(noAssetNodeId)
+	}
+}
+
+/** What deleting an asset's upstream removes: the script unless another asset
+ * is also built by it, and with it the trigger unless that fires other scripts.
+ * Undefined when nothing can go. */
+export function upstreamDeletion(
+	u: AssetUpstream & { multiple: false },
+	r: { runnable_kind: string; path: string; unsaved?: boolean },
+	all: Map<string, AssetUpstream>
+): AssetUpstreamDelete | undefined {
+	if (r.runnable_kind !== 'script') return undefined
+	const producesOthers =
+		[...all.values()].filter((o) =>
+			o.multiple ? o.runnableIds.includes(u.runnableId) : o.runnableId === u.runnableId
+		).length > 1
+	if (producesOthers) return undefined
+	const t = u.trigger
+	const kind = t?.kind as NativeTriggerKind | undefined
+	const targets: string[] = t?.data?.runnable_paths ?? []
+	const ownTrigger =
+		kind &&
+		kind !== 'webhook' &&
+		kind !== 'data_upload' &&
+		t?.data?.ref &&
+		!t.data.missing &&
+		targets.every((p) => p === r.path)
+	return {
+		script: { path: r.path, unsaved: !!r.unsaved },
+		trigger: ownTrigger ? { kind, path: t.data.ref, draft: !!t.data.draft } : undefined
+	}
+}
+
+/**
+ * The graph without its reads that start nothing: a read edge with no asset
+ * trigger along it, and the assets only such reads drew.
+ */
+export function withoutPassiveReads<N extends ViewNode, E extends ViewEdge>(
+	nodes: N[],
+	edges: E[]
+): { nodes: N[]; edges: E[]; dropped: number } {
+	const triggers = new Set(
+		edges.filter((e) => e.kind === 'trigger-asset').map((e) => `${e.source}\n${e.target}`)
+	)
+	const passive = (e: E) =>
+		e.kind === 'lineage-read' && !triggers.has(`${e.source}\n${e.target}`)
+	const kept = edges.filter((e) => !passive(e))
+	const dropped = edges.length - kept.length
+	if (dropped === 0) return { nodes, edges, dropped }
+	const linked = new Set(
+		kept.filter((e) => e.kind !== 'add-anchor').flatMap((e) => [e.source, e.target])
+	)
+	const readOnly = new Set(
+		edges.filter(passive).map((e) => e.source).filter((id) => !linked.has(id))
+	)
+	return {
+		nodes: nodes.filter((n) => !readOnly.has(n.id)),
+		edges: kept.filter((e) => !readOnly.has(e.source) && !readOnly.has(e.target)),
+		dropped
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/edgeDescription.test.ts b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.test.ts
new file mode 100644
index 0000000000..2aff7a0e81
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { describeEdge } from './edgeDescription'
+
+const names: Record<string, string> = {
+	'asset:ducklake:main/raw': 'raw',
+	'asset:ducklake:main/clean': 'clean',
+	'script:f/p/clean': 'Clean',
+	'trigger:schedule:f/p/daily': 'Daily'
+}
+const nameOf = (id: string) => names[id] ?? id
+const dataOf = (id: string) =>
+	id === 'trigger:schedule:f/p/daily'
+		? { kind: 'schedule', schedule: '0 0 12 * * *', timezone: 'UTC' }
+		: undefined
+
+describe('describeEdge', () => {
+	it('names an asset trigger by what runs it: any write, changed or not', () => {
+		expect(
+			describeEdge(
+				{ source: 'asset:ducklake:main/raw', target: 'script:f/p/clean', kind: 'trigger-asset' },
+				nameOf,
+				dataOf
+			)
+		).toEqual({ subject: 'Clean', phrase: 'runs after each write to', object: 'raw' })
+	})
+
+	it("gives a schedule's cadence", () => {
+		expect(
+			describeEdge(
+				{ source: 'trigger:schedule:f/p/daily', target: 'script:f/p/clean', kind: 'trigger-native' },
+				nameOf,
+				dataOf
+			)?.phrase
+		).toBe('runs on schedule: Every day at 12:00 UTC')
+	})
+
+	it('names the folded script on an assets-only edge', () => {
+		expect(
+			describeEdge(
+				{
+					source: 'asset:ducklake:main/raw',
+					target: 'asset:ducklake:main/clean',
+					kind: 'asset-flow',
+					via: ['script:f/p/clean']
+				},
+				nameOf,
+				dataOf
+			)
+		).toEqual({ subject: 'clean', phrase: 'is built from', object: 'raw', note: 'By Clean. A write to raw does not rerun it.' })
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/edgeDescription.ts b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.ts
new file mode 100644
index 0000000000..72d8eb103b
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/edgeDescription.ts
@@ -0,0 +1,110 @@
+import { describeSchedule } from '$lib/utils/describeCron'
+import { isNoAssetNode } from './assetsOnlyView'
+
+/** What a hovered edge says: "`subject` `phrase` `object`", then a note. */
+export type EdgeDescription = { subject: string; phrase: string; object?: string; note?: string }
+
+/** The edge fields the description reads (the canvas model's edge). */
+export type DescribedEdge = {
+	source: string
+	target: string
+	kind: string
+	unsaved?: boolean
+	muted?: boolean
+	missing?: boolean
+	via?: string[]
+	reactive?: boolean
+	macro_names?: string[]
+	via_use?: boolean
+}
+
+// What starts a script, per trigger kind: "runs on <event>".
+const TRIGGER_EVENT: Record<string, string> = {
+	kafka: 'Kafka message',
+	mqtt: 'MQTT message',
+	amqp: 'AMQP message',
+	nats: 'NATS message',
+	sqs: 'SQS message',
+	gcp: 'Pub/Sub message',
+	email: 'incoming email',
+	postgres: 'Postgres event',
+	webhook: 'webhook call',
+	data_upload: 'data upload'
+}
+
+/**
+ * The relationship an edge draws, as a sentence about its two ends. `nameOf`
+ * names a node, `dataOf` gives its data (a trigger's kind and cadence).
+ */
+export function describeEdge(
+	e: DescribedEdge,
+	nameOf: (id: string) => string,
+	dataOf: (id: string) => any
+): EdgeDescription | undefined {
+	const src = nameOf(e.source)
+	const tgt = nameOf(e.target)
+	const draft = e.unsaved ? 'Not deployed yet.' : undefined
+	switch (e.kind) {
+		case 'lineage-write':
+			return { subject: src, phrase: 'writes to', object: tgt, note: draft }
+		case 'lineage-read':
+			return {
+				subject: tgt,
+				phrase: 'reads from',
+				object: src,
+				note: e.muted ? 'A write to it does not run the script (muted).' : draft
+			}
+		case 'trigger-asset':
+			return { subject: tgt, phrase: 'runs after each write to', object: src, note: draft }
+		case 'trigger-native': {
+			const t = dataOf(e.source) ?? {}
+			if (e.missing) {
+				return {
+					subject: tgt,
+					phrase: `declares \`// on ${t.kind}\`, but no trigger of that kind targets it`
+				}
+			}
+			const phrase =
+				t.kind === 'schedule' && t.schedule
+					? `runs on schedule: ${describeSchedule(t.schedule, t.timezone) ?? t.schedule}`
+					: `runs on ${TRIGGER_EVENT[t.kind] ?? `${t.kind} trigger`}`
+			return { subject: tgt, phrase, note: t.draft ? 'Draft trigger, created on save.' : draft }
+		}
+		case 'asset-flow': {
+			const via = (e.via ?? []).map(nameOf).join(', ')
+			const rerun = e.reactive
+				? `Each write to ${src} reruns it.`
+				: `A write to ${src} does not rerun it.`
+			// The scripts that build nothing only read: name them, not the node.
+			if (isNoAssetNode(e.target)) {
+				return { subject: src, phrase: 'is read by', object: via || tgt, note: rerun }
+			}
+			return {
+				subject: tgt,
+				phrase: 'is built from',
+				object: src,
+				note: via ? `By ${via}. ${rerun}` : rerun
+			}
+		}
+		case 'dbt-ref':
+			return { subject: tgt, phrase: 'references', object: src, note: 'dbt ref().' }
+		case 'macro':
+			return {
+				subject: tgt,
+				phrase: e.via_use ? 'uses the macro library' : 'uses macros from',
+				object: src,
+				note: e.macro_names?.length ? e.macro_names.join(', ') : undefined
+			}
+		case 'test-dependency':
+			return {
+				subject: src,
+				phrase: 'must run before',
+				object: tgt,
+				note: 'Its data test reads what the first one builds.'
+			}
+		case 'data-test':
+			return { subject: tgt, phrase: 'tests', object: src }
+		default:
+			return undefined
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts
index 197d7eca6c..d6cf76c389 100644
--- a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from 'vitest'
 import type { AssetGraphResponse } from './types'
 import {
+	hoverLineage,
+	transitivelyImpliedEdges,
 	buildDownstreamMap,
 	computeDownstreamClosure,
 	computeInducedSchedule
@@ -225,3 +227,44 @@ describe('computeInducedSchedule', () => {
 		expect(sched.cyclic.sort()).toEqual(['b', 'c'])
 	})
 })
+
+describe('hoverLineage', () => {
+	// a → b → c → d, with a side branch x → c and c → y; z is unrelated to b.
+	const edges = [
+		{ source: 'a', target: 'b' },
+		{ source: 'b', target: 'c' },
+		{ source: 'x', target: 'c' },
+		{ source: 'c', target: 'd' },
+		{ source: 'c', target: 'y' },
+		{ source: 'z', target: 'y' }
+	]
+
+	it('reaches everything upstream and downstream, recursively', () => {
+		const l = hoverLineage(edges, 'b')
+		expect([...l.upstream].sort()).toEqual(['a', 'b'])
+		expect([...l.downstream].sort()).toEqual(['b', 'c', 'd', 'y'])
+	})
+
+	it('keeps only the edges on a path through the node', () => {
+		const l = hoverLineage(edges, 'b')
+		expect(edges.filter(l.hasEdge)).toEqual([
+			{ source: 'a', target: 'b' },
+			{ source: 'b', target: 'c' },
+			{ source: 'c', target: 'd' },
+			{ source: 'c', target: 'y' }
+		])
+	})
+})
+
+describe('transitivelyImpliedEdges', () => {
+	it('flags an edge another path already implies, and only that one', () => {
+		const edges = [
+			{ id: 'ab', source: 'a', target: 'b' },
+			{ id: 'bc', source: 'b', target: 'c' },
+			{ id: 'ac', source: 'a', target: 'c' },
+			{ id: 'ad', source: 'a', target: 'd' },
+			{ id: 'ad2', source: 'a', target: 'd' }
+		]
+		expect([...transitivelyImpliedEdges(edges)]).toEqual(['ac'])
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts
index cc59e8f3a8..0c9fad6c83 100644
--- a/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/graphTraversal.ts
@@ -226,3 +226,76 @@ export function computeInducedSchedule(
 	const roots = ordered.filter((n) => (cleanIndegree.get(n) ?? 0) === 0)
 	return { nodes: ordered, edges: cleanEdges, indegree: cleanIndegree, roots, cyclic }
 }
+
+/** What is linked to a node through the drawn graph: everything it depends on
+ * (upstream) and everything depending on it (downstream), both recursive, the
+ * node itself in each. An edge lies on a path through the node exactly when
+ * both its ends are upstream, or both downstream. */
+export type HoverLineage = {
+	upstream: Set<string>
+	downstream: Set<string>
+	hasEdge: (e: { source: string; target: string }) => boolean
+}
+
+export function hoverLineage(
+	edges: ReadonlyArray<{ source: string; target: string }>,
+	id: string
+): HoverLineage {
+	const walk = (from: 'source' | 'target', to: 'source' | 'target') => {
+		const next = new Map<string, string[]>()
+		for (const e of edges) next.set(e[from], [...(next.get(e[from]) ?? []), e[to]])
+		const seen = new Set([id])
+		const stack = [id]
+		while (stack.length) {
+			for (const n of next.get(stack.pop()!) ?? []) {
+				if (!seen.has(n)) {
+					seen.add(n)
+					stack.push(n)
+				}
+			}
+		}
+		return seen
+	}
+	const upstream = walk('target', 'source')
+	const downstream = walk('source', 'target')
+	return {
+		upstream,
+		downstream,
+		hasEdge: (e) =>
+			(upstream.has(e.source) && upstream.has(e.target)) ||
+			(downstream.has(e.source) && downstream.has(e.target))
+	}
+}
+
+/** Ids of the edges another path already implies: an edge A → C when C can be
+ * reached from A through at least one other node (A → B → … → C). Edges joining
+ * the same two nodes don't make each other redundant. */
+export function transitivelyImpliedEdges(
+	edges: ReadonlyArray<{ id: string; source: string; target: string }>
+): Set<string> {
+	const next = new Map<string, Set<string>>()
+	for (const e of edges) {
+		if (e.source === e.target) continue
+		next.set(e.source, (next.get(e.source) ?? new Set()).add(e.target))
+	}
+	// Whether `to` is reachable from `from` without taking the direct step.
+	const reachableAround = (from: string, to: string) => {
+		const seen = new Set<string>([from])
+		const stack = [...(next.get(from) ?? [])].filter((n) => n !== to)
+		for (const n of stack) seen.add(n)
+		while (stack.length) {
+			const cur = stack.pop()!
+			for (const n of next.get(cur) ?? []) {
+				if (n === to) return true
+				if (!seen.has(n)) {
+					seen.add(n)
+					stack.push(n)
+				}
+			}
+		}
+		return false
+	}
+	const implied = new Set<string>()
+	for (const e of edges) if (e.source !== e.target && reachableAround(e.source, e.target)) implied.add(e.id)
+	return implied
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.test.ts b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.test.ts
new file mode 100644
index 0000000000..bcd9a2c6fd
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { onDirectiveTargets } from './onDirectiveTargets'
+
+describe('onDirectiveTargets', () => {
+	it('leaves out what the script feeds, directly or not, and what already triggers it', () => {
+		const nodes = [
+			{ id: 'script:a', type: 'runnable' },
+			{ id: 'script:b', type: 'runnable' },
+			{ id: 'asset:out', type: 'asset' },
+			{ id: 'asset:later', type: 'asset' },
+			{ id: 'asset:in', type: 'asset' },
+			{ id: 'asset:free', type: 'asset' }
+		]
+		const edges = [
+			{ source: 'script:a', target: 'asset:out', kind: 'lineage-write' },
+			{ source: 'asset:out', target: 'script:b', kind: 'trigger-asset' },
+			{ source: 'script:b', target: 'asset:later', kind: 'lineage-write' },
+			{ source: 'asset:in', target: 'script:a', kind: 'trigger-asset' }
+		]
+		expect([...onDirectiveTargets(nodes, edges, 'script:a')]).toEqual(['asset:free'])
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.ts b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.ts
new file mode 100644
index 0000000000..4fc348dd51
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/onDirectiveTargets.ts
@@ -0,0 +1,34 @@
+/**
+ * The asset nodes a script can be subscribed to (`// on <asset>`) by dragging:
+ * every asset except those downstream of it, whose writes it would then run on
+ * in a loop, and those that already trigger it.
+ */
+export function onDirectiveTargets(
+	nodes: Array<{ id: string; type: string }>,
+	edges: Array<{ source: string; target: string; kind: string }>,
+	scriptId: string
+): Set<string> {
+	const next = new Map<string, string[]>()
+	for (const e of edges) {
+		if (e.kind === 'add-anchor') continue
+		next.set(e.source, [...(next.get(e.source) ?? []), e.target])
+	}
+	const downstream = new Set<string>([scriptId])
+	const stack = [scriptId]
+	while (stack.length) {
+		for (const n of next.get(stack.pop()!) ?? []) {
+			if (!downstream.has(n)) {
+				downstream.add(n)
+				stack.push(n)
+			}
+		}
+	}
+	const triggering = new Set(
+		edges.filter((e) => e.kind === 'trigger-asset' && e.target === scriptId).map((e) => e.source)
+	)
+	return new Set(
+		nodes
+			.filter((n) => n.type === 'asset' && !downstream.has(n.id) && !triggering.has(n.id))
+			.map((n) => n.id)
+	)
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
index d1d5c1b233..713ef8f6b2 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
@@ -8,7 +8,8 @@ import type { AssetGraphResponse } from './types'
 function makeHandle(
 	initial: Array<[string, PipelineDraft]> = [],
 	runnables: Array<{ path: string }> = [],
-	folder = 'x'
+	folder = 'x',
+	triggers: unknown[] = []
 ) {
 	let drafts = new Map(initial)
 	let forgotten: string[] = []
@@ -16,11 +17,13 @@ function makeHandle(
 		getFolder: () => folder,
 		getWorkspace: () => 'w',
 		getResolvedGraph: () =>
-			({ assets: [], runnables, edges: [], triggers: [] }) as unknown as AssetGraphResponse,
+			({ assets: [], runnables, edges: [], triggers }) as unknown as AssetGraphResponse,
 		getDrafts: () => drafts,
 		setDrafts: (next) => (drafts = next),
 		newDraftLocalId: () => 'id',
-		onForgetPath: (p) => forgotten.push(p)
+		onForgetPath: (p) => forgotten.push(p),
+		getTriggerDrafts: () => new Map(),
+		setTriggerDraft: () => true
 	})
 	return { handle, drafts: () => drafts, forgotten: () => forgotten }
 }
@@ -155,6 +158,30 @@ describe('pipeline AI direct-draft helpers', () => {
 		expect(res.detectedWrites).toEqual(['ducklake://main/out'])
 	})
 
+	// The canvas draws an inactive draft's stored outputs beside its materialize
+	// target, so a seeded default left on a materialize node shows a phantom asset.
+	it('keeps no seeded or stale output on a node with a materialize target', async () => {
+		vi.spyOn(ScriptService, 'getScriptByPath').mockRejectedValue(new Error('404'))
+		const { handle, drafts } = makeHandle()
+		await handle.proposeNode({
+			path: 'f/x/mat',
+			language: 'duckdb' as any,
+			content: '-- pipeline\n-- materialize ducklake://main/abc\nSELECT 1',
+			outputKind: 'ducklake' as any
+		})
+		expect(drafts().get('f/x/mat')?.outputAssets).toBeUndefined()
+
+		await handle.proposeNode({
+			path: 'f/x/later',
+			language: 'duckdb' as any,
+			content: '-- pipeline\nSELECT 1',
+			outputKind: 'ducklake' as any
+		})
+		expect(drafts().get('f/x/later')?.outputAssets?.length).toBeGreaterThan(0)
+		await handle.editNode('f/x/later', '-- pipeline\n-- materialize ducklake://main/abc\nSELECT 1')
+		expect(drafts().get('f/x/later')?.outputAssets).toBeUndefined()
+	})
+
 	it('editNode rejects a path outside the open folder', async () => {
 		const { handle, drafts } = makeHandle()
 		await expect(handle.editNode('f/other/foo', '-- pipeline')).rejects.toThrow(/open folder/)
@@ -181,4 +208,24 @@ describe('pipeline AI direct-draft helpers', () => {
 		expect(d?.script.tag).toBe('custom')
 		expect(d?.script.content).toBe('-- pipeline\nSELECT 2')
 	})
+
+	it("does not take a flow's schedule at the same path for the script's", async () => {
+		const flowSchedule = {
+			trigger_kind: 'schedule',
+			runnable_kind: 'flow',
+			runnable_path: 'f/x/ingest',
+			path: 'f/x/flow_schedule'
+		}
+		const content = '# pipeline\n# on schedule\ndef main():\n    return 1'
+		const { handle } = makeHandle(
+			[['f/x/ingest', draft({ script: { content, language: 'python3' } as any })]],
+			[],
+			'x',
+			[flowSchedule]
+		)
+		expect(await handle.unconfiguredTriggers('f/x/ingest')).toEqual(['schedule'])
+		await expect(
+			handle.setNodeTrigger('f/x/ingest', 'schedule', { schedule: '0 0 6 * * *', timezone: 'UTC' })
+		).resolves.toMatchObject({ path: 'f/x/ingest_schedule' })
+	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
index 5b22a098b1..f84848ee95 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
@@ -9,7 +9,12 @@ import {
 import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import { assetUri, autoOutputAsset, type PipelineOutputKind } from './pipelineTemplates'
 import { parsePipelineAnnotations, scd2CurrentTargetPath } from './parsePipelineAnnotations'
-import type { AssetGraphResponse } from './types'
+import type {
+	AssetGraphResponse,
+	PipelineTriggerDraft,
+	PipelineTriggerDraftKind
+} from './types'
+import { defaultTriggerPath, isDraftableTriggerKind, triggerDraftKey } from './pipelineTriggerDrafts'
 import type {
 	PipelineAIChatHelpers,
 	PipelineContext,
@@ -62,20 +67,26 @@ export type PipelineAiHelperDeps = {
 	onForgetPath?: (path: string) => void
 	/** Notify the caller a test run started so it can light up its run UI. */
 	onRunStarted?: (jobId: string, path: string) => void
+	/** Whether the folder has trigger drafts, which live beside the script drafts. */
+	hasTriggerDrafts?: () => boolean
+	getTriggerDrafts: () => Map<string, PipelineTriggerDraft>
+	/** False when another trigger draft already holds the config's path. */
+	setTriggerDraft: (d: PipelineTriggerDraft, previousKey?: string) => boolean
 }
 
 export function makePipelineScript(
 	language: ScriptLang,
 	scriptPath: string,
 	content: string,
-	createdAt: string
+	createdAt: string,
+	summary = ''
 ): Script {
 	// Cast through unknown: a local draft only needs path/language/content/schema;
 	// the many readonly deployment fields on Script don't matter until createScript.
 	return {
 		hash: '',
 		path: scriptPath,
-		summary: '',
+		summary,
 		description: '',
 		content,
 		schema: emptySchema(),
@@ -199,7 +210,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 					path: r.path,
 					language: draft?.script.language,
 					unsaved: r.unsaved ?? false,
-					summary: draft?.script.summary || undefined,
+					summary: (draft ? draft.script.summary : r.summary) || undefined,
 					writes: [...new Set(writes)],
 					reads: [...new Set(reads)],
 					triggers: [...new Set(triggers)]
@@ -213,7 +224,36 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 		}
 	}
 
+	// Declared `on <kind>` bindings of a node that a trigger row or draft fills.
+	// Webhook and data-upload need none, so they never count as unconfigured.
+	function unconfiguredTriggers(path: string, content: string): PipelineTriggerDraftKind[] {
+		const declared = parsePipelineAnnotations(content)
+			.nativeTriggers.map((n) => n.kind)
+			.filter(isDraftableTriggerKind)
+		const drafted = new Set(
+			[...deps.getTriggerDrafts().values()]
+				.filter((d) => d.config.script_path === path)
+				.map((d) => d.kind)
+		)
+		const deployed = new Set(
+			deps
+				.getResolvedGraph()
+				.triggers.filter(
+					(t) =>
+						t.trigger_kind !== 'asset' &&
+						t.runnable_kind === 'script' &&
+						t.runnable_path === path &&
+						t.path &&
+						!t.missing
+				)
+				.map((t) => t.trigger_kind)
+		)
+		return [...new Set(declared)].filter((k) => !drafted.has(k) && !deployed.has(k))
+	}
+
 	const helpers: PipelineAIChatHelpers = {
+		getFolder: folderName,
+		hasDrafts: () => deps.getDrafts().size > 0 || (deps.hasTriggerDrafts?.() ?? false),
 		getPipelineContext: buildContext,
 		getNodeBody: async (path) => {
 			const draft = deps.getDrafts().get(path)
@@ -227,7 +267,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				return undefined
 			}
 		},
-		proposeNode: async ({ path, language, content, outputKind }) => {
+		proposeNode: async ({ path, language, content, outputKind, summary }) => {
 			deps.ensureEditable?.()
 			// build_pipeline_node creates a NEW node in the OPEN folder. Reject a path
 			// outside the folder (it would silently stage into this folder's bundle)
@@ -267,10 +307,13 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			}
 			const inferred = await inferDraftAssets(language, content)
 			// Fall back to a seeded output (from the declared output_kind) when the
-			// body doesn't yet write anything inferable.
+			// body doesn't yet write anything inferable. A `materialize` target is the
+			// output already (the canvas adds it from the annotation): a seed beside it
+			// would show as a second, default-named output.
+			const materialized = materializeWrites(content).length > 0
 			const seeded =
 				inferred.writes[0] ??
-				(outputKind
+				(outputKind && !materialized
 					? autoOutputAsset(outputKind as PipelineOutputKind, folderName(), language)
 					: undefined)
 			// Effective outputs = what actually becomes an output edge on the canvas:
@@ -280,7 +323,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			const next = new Map(drafts)
 			next.set(path, {
 				localId: deps.newDraftLocalId(),
-				script: makePipelineScript(language, path, content, new Date().toISOString()),
+				script: makePipelineScript(language, path, content, new Date().toISOString(), summary),
 				outputAssets,
 				inputAssets: inferred.reads
 			})
@@ -298,7 +341,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				)
 			}
 		},
-		editNode: async (path, content) => {
+		editNode: async (path, content, summary) => {
 			deps.ensureEditable?.()
 			assertInFolder(path)
 			assertPipelineAnnotation(content)
@@ -319,11 +362,19 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				baseScript = await ScriptService.getScriptByPath({ workspace, path })
 			}
 			const inferred = await inferDraftAssets(baseScript.language, content)
-			const outputAssets = inferred.writes.length > 0 ? inferred.writes : existing?.outputAssets
+			// The stored outputs only stand in for a body that writes nothing inferable;
+			// with a `materialize` target the annotation is the output, so stale ones
+			// (a seeded default name, the target before a rename) must not linger.
+			const outputAssets =
+				inferred.writes.length > 0
+					? inferred.writes
+					: materializeWrites(content).length > 0
+						? undefined
+						: existing?.outputAssets
 			const next = new Map(drafts)
 			next.set(path, {
 				localId: existing?.localId ?? deps.newDraftLocalId(),
-				script: { ...baseScript, content },
+				script: { ...baseScript, content, ...(summary !== undefined ? { summary } : {}) },
 				outputAssets,
 				inputAssets: inferred.reads
 			})
@@ -332,12 +383,61 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			deps.onProposeNode?.(path)
 			// Deployable lineage only (see proposeNode): body writes + materialize target.
 			return {
+				summary: summary ?? baseScript.summary ?? '',
 				detectedReads: inferred.reads.map(assetUri),
 				detectedWrites: dedupeAssets([...inferred.writes, ...materializeWrites(content)]).map(
 					assetUri
 				)
 			}
 		},
+		unconfiguredTriggers: async (path) => {
+			const body = await helpers.getNodeBody(path)
+			return body ? unconfiguredTriggers(path, body.content) : []
+		},
+		setNodeTrigger: async (path, kind, config) => {
+			deps.ensureEditable?.()
+			assertInFolder(path)
+			const body = await helpers.getNodeBody(path)
+			if (!body) throw new Error(`No pipeline node at '${path}'. Build it first.`)
+			const prefix = body.language === 'python3' || body.language === 'bash' ? '#' : body.language === 'duckdb' || body.language === 'postgresql' ? '--' : '//'
+			if (!parsePipelineAnnotations(body.content).nativeTriggers.some((n) => n.kind === kind)) {
+				throw new Error(
+					`'${path}' does not declare \`${prefix} on ${kind}\`. Add that annotation line with edit_pipeline_node first, so the trigger is wired to the node.`
+				)
+			}
+			const row = deps
+				.getResolvedGraph()
+				.triggers.find(
+					(t) =>
+						t.trigger_kind === kind &&
+						t.runnable_kind === 'script' &&
+						t.runnable_path === path &&
+						t.path &&
+						!t.missing &&
+						!(t as { draft?: boolean }).draft
+				)
+			if (row && 'path' in row) {
+				throw new Error(
+					`'${path}' already has a deployed ${kind} trigger at '${row.path}'. Change that one instead of adding a second.`
+				)
+			}
+			const existing = [...deps.getTriggerDrafts().values()].find(
+				(d) => d.kind === kind && d.config.script_path === path
+			)
+			const triggerPath =
+				(typeof config.path === 'string' && config.path) ||
+				existing?.config.path ||
+				defaultTriggerPath(path, kind)
+			const saved = deps.setTriggerDraft(
+				{ kind, config: { ...config, path: triggerPath, script_path: path, is_flow: false } },
+				existing ? triggerDraftKey(kind, existing.config.path) : undefined
+			)
+			if (!saved) {
+				throw new Error(`Another draft trigger already uses the path '${triggerPath}'. Pass a different config.path.`)
+			}
+			deps.onShowDrafts?.()
+			return { path: triggerPath, replaced: !!existing }
+		},
 		removeProposedNode: async (path) => {
 			if (!deps.getDrafts().has(path)) {
 				throw new Error(`No unsaved draft at '${path}' to discard.`)
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.test.ts
new file mode 100644
index 0000000000..8759f114b4
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import {
+	addTriggerDirective,
+	listenToAsset,
+	removeTriggerDirective,
+	stopListeningToAsset
+} from './pipelineAnnotationEdits'
+
+const table = { kind: 'datatable' as const, path: 'main/orders' }
+const lake = { kind: 'ducklake' as const, path: 'main/orders' }
+
+describe('pipeline annotation edits', () => {
+	it('adds `on` at the end of the header, in its comment style, leaving the body', () => {
+		const sql = '-- pipeline\n-- materialize ducklake://main/x\nSELECT 1; -- on nothing'
+		expect(listenToAsset(sql, table, false)).toBe(
+			'-- pipeline\n-- materialize ducklake://main/x\n-- on datatable://main/orders\nSELECT 1; -- on nothing'
+		)
+	})
+
+	it('adds `on` next to the existing `on` lines', () => {
+		const sql = '-- pipeline\n-- on schedule\n-- materialize ducklake://main/x\nSELECT 1;'
+		expect(listenToAsset(sql, table, false)).toBe(
+			'-- pipeline\n-- on schedule\n-- on datatable://main/orders\n-- materialize ducklake://main/x\nSELECT 1;'
+		)
+	})
+
+	it('removes an `on` line however it is spelled, options included', () => {
+		const py = '# pipeline\n# on datatable://main/orders debounce=60s\nprint(1)'
+		expect(stopListeningToAsset(py, table, true)).toBe('# pipeline\nprint(1)')
+	})
+
+	it('unmutes an auto-triggering read rather than adding `on`, and mutes it to stop', () => {
+		const muted = '// pipeline\n// mute ducklake://main/orders\nexport function main() {}'
+		expect(listenToAsset(muted, lake, true)).toBe('// pipeline\nexport function main() {}')
+		expect(stopListeningToAsset('// pipeline\nexport function main() {}', lake, true)).toBe(
+			'// pipeline\n// mute ducklake://main/orders\nexport function main() {}'
+		)
+	})
+
+	it('adds `on` for an auto-triggering kind the script does not read', () => {
+		expect(listenToAsset('-- pipeline\nSELECT 1;', lake, false)).toBe(
+			'-- pipeline\n-- on ducklake://main/orders\nSELECT 1;'
+		)
+	})
+
+	it('mutes only an auto-triggering asset the script reads', () => {
+		const sub = '-- pipeline\n-- on ducklake://main/orders\nSELECT 1;'
+		expect(stopListeningToAsset(sub, lake, false)).toBe('-- pipeline\nSELECT 1;')
+	})
+
+	it('adds `on` for an auto-triggering kind when every read is muted', () => {
+		const all = '// pipeline\n// mute all\nexport function main() {}'
+		expect(listenToAsset(all, lake, true)).toBe(
+			'// pipeline\n// mute all\n// on ducklake://main/orders\nexport function main() {}'
+		)
+	})
+
+	it('adds a trigger kind once, and drops it', () => {
+		expect(addTriggerDirective('// pipeline\n// on webhook\nx()', 'webhook')).toBe(
+			'// pipeline\n// on webhook\nx()'
+		)
+		expect(removeTriggerDirective('// pipeline\n// on kafka\nx()', 'kafka')).toBe(
+			'// pipeline\nx()'
+		)
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.ts
new file mode 100644
index 0000000000..70ab899412
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAnnotationEdits.ts
@@ -0,0 +1,149 @@
+import type { AssetKind } from '$lib/gen'
+import { parsePipelineAnnotations, type PipelineAnnotations } from './parsePipelineAnnotations'
+
+// Edits to a pipeline script's leading annotation header (`// on …`, `// mute …`),
+// the comment block `parsePipelineAnnotations` reads. Lines are kept in the
+// script's own comment style, and nothing past the header is touched.
+
+/** Asset kind → the prefix of its `// on <ref>` spelling. Mirrors ASSET_KINDS in
+ * backend/parsers/windmill-parser/src/asset_parser.rs. */
+export const ASSET_REF_PREFIX: Record<AssetKind, string> = {
+	s3object: 's3://',
+	resource: '$res:',
+	ducklake: 'ducklake://',
+	datatable: 'datatable://',
+	volume: 'volume://',
+	dbt: 'dbt://'
+}
+
+// A `// pipeline` script reading one of these kinds runs after each write to it
+// unless muted, with no `// on` line (see AUTO_TRIGGER_KINDS in resolveGraph).
+const AUTO_TRIGGER_KINDS: ReadonlySet<AssetKind> = new Set(['ducklake', 's3object'])
+
+export function assetRef(asset: { kind: AssetKind; path: string }): string {
+	return `${ASSET_REF_PREFIX[asset.kind]}${asset.path}`
+}
+
+const PREFIXES = ['//', '--', '#']
+
+type HeaderLine = { index: number; prefix: string; inner: string }
+
+/** The header: leading comment lines (blank lines allowed), up to the first code. */
+function header(lines: string[]): HeaderLine[] {
+	const out: HeaderLine[] = []
+	for (let i = 0; i < lines.length; i++) {
+		const t = lines[i].trimStart()
+		if (t === '') continue
+		const prefix = PREFIXES.find((p) => t.startsWith(p))
+		if (!prefix) break
+		out.push({ index: i, prefix, inner: t.slice(prefix.length).trim() })
+	}
+	return out
+}
+
+// A header line matched the way the parser reads it, so `on <ref> debounce=60s`,
+// `res://` vs `$res:` spellings and dbt path quoting all count as the same line.
+type LineMatch = (parsed: PipelineAnnotations) => boolean
+const onAsset =
+	(asset: { kind: AssetKind; path: string }): LineMatch =>
+	(p) =>
+		p.triggerAssets.some((a) => a.kind === asset.kind && a.path === asset.path)
+const muteAsset =
+	(asset: { kind: AssetKind; path: string }): LineMatch =>
+	(p) =>
+		p.muteAssets.some((a) => a.kind === asset.kind && a.path === asset.path)
+const muteAll: LineMatch = (p) => p.muteAll
+const onTrigger =
+	(kind: string): LineMatch =>
+	(p) =>
+		p.nativeTriggers.some((t) => t.kind === kind)
+
+function matches(line: HeaderLine, match: LineMatch): boolean {
+	return match(parsePipelineAnnotations(`${line.prefix} ${line.inner}`))
+}
+
+function hasDirective(content: string, match: LineMatch): boolean {
+	return header(content.split('\n')).some((l) => matches(l, match))
+}
+
+/** Adds `<prefix> <directive>` in the header's comment style: after the last line
+ * of the same directive (`on`, `mute`), so they stay grouped, else at its end. */
+function addDirective(content: string, directive: string): string {
+	const lines = content.split('\n')
+	const h = header(lines)
+	const keyword = directive.split(/\s/)[0]
+	const sameKind = h.filter((l) => l.inner.split(/\s/)[0] === keyword)
+	const after = sameKind[sameKind.length - 1] ?? h[h.length - 1]
+	const line = `${after?.prefix ?? '//'} ${directive}`
+	lines.splice(after ? after.index + 1 : 0, 0, line)
+	return lines.join('\n')
+}
+
+function removeDirective(content: string, match: LineMatch): string {
+	const lines = content.split('\n')
+	const drop = new Set(
+		header(lines)
+			.filter((l) => matches(l, match))
+			.map((l) => l.index)
+	)
+	return lines.filter((_, i) => !drop.has(i)).join('\n')
+}
+
+/** The script runs after each write to the asset: `// on <ref>`, and any
+ * `// mute <ref>` lifted. An auto-triggering kind it `reads` needs no `// on`
+ * once unmuted, unless `// mute all` still silences it. */
+export function listenToAsset(
+	content: string,
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	const ref = assetRef(asset)
+	let out = removeDirective(content, muteAsset(asset))
+	const auto = reads && AUTO_TRIGGER_KINDS.has(asset.kind) && !hasDirective(out, muteAll)
+	if (!auto && !hasDirective(out, onAsset(asset))) out = addDirective(out, `on ${ref}`)
+	return out
+}
+
+/** The script no longer runs after writes to the asset: its `// on <ref>` goes,
+ * and an auto-triggering kind it `reads` is muted, since the read alone would
+ * still trigger it. */
+export function stopListeningToAsset(
+	content: string,
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	const ref = assetRef(asset)
+	let out = removeDirective(content, onAsset(asset))
+	if (reads && AUTO_TRIGGER_KINDS.has(asset.kind) && !hasDirective(out, muteAsset(asset))) {
+		out = addDirective(out, `mute ${ref}`)
+	}
+	return out
+}
+
+/** Adds a `// on <trigger kind>` line (`schedule`, `webhook`, …) unless it has one. */
+export function addTriggerDirective(content: string, kind: string): string {
+	return hasDirective(content, onTrigger(kind)) ? content : addDirective(content, `on ${kind}`)
+}
+
+/** Drops a `// on <trigger kind>` line (`kafka`, `schedule`, …). */
+export function removeTriggerDirective(content: string, kind: string): string {
+	return removeDirective(content, onTrigger(kind))
+}
+
+/** What each edit says it changes, for the button that applies it. */
+export function listenChangeText(
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	return reads && AUTO_TRIGGER_KINDS.has(asset.kind)
+		? `Removes any \`mute ${assetRef(asset)}\` line (adds \`on ${assetRef(asset)}\` if all reads are muted)`
+		: `Adds \`on ${assetRef(asset)}\``
+}
+export function stopListeningChangeText(
+	asset: { kind: AssetKind; path: string },
+	reads: boolean
+): string {
+	return reads && AUTO_TRIGGER_KINDS.has(asset.kind)
+		? `Removes \`on ${assetRef(asset)}\` and adds \`mute ${assetRef(asset)}\``
+		: `Removes \`on ${assetRef(asset)}\``
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte.ts
new file mode 100644
index 0000000000..004c6ab8c1
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte.ts
@@ -0,0 +1,164 @@
+import { untrack } from 'svelte'
+import { ScriptService, type AssetKind, type ScriptLang } from '$lib/gen'
+import { inferAssets } from '$lib/infer'
+import {
+	extractReads,
+	extractWrites,
+	type AssetWithAltAccessType
+} from '$lib/components/assets/lib'
+import { parsePipelineAnnotations } from './parsePipelineAnnotations'
+import type { AssetGraphResponse, NativeTriggerKind } from './types'
+import type { PipelineEditorState } from './pipelineEditorState.svelte'
+
+type AssetRef = { kind: AssetKind; path: string }
+
+/**
+ * Reads the body of every deployed script of a pipeline's graph and infers its
+ * asset reads/writes and `// on <native trigger>` annotations, so the canvas
+ * draws the edges of scripts the user never opened. The open script's live
+ * buffer wins over its cached body.
+ *
+ * The caches are only-add and keyed by path: the derived maps iterate the
+ * current graph's scripts, so a renamed or deleted script drops out when the
+ * graph refetches. A stale value under a live path does not, so a save through
+ * the editor must `forget` its path for the sweep to read it again.
+ */
+export function usePipelineAssetPrefetch(deps: {
+	getWorkspace: () => string | undefined
+	getGraph: () => AssetGraphResponse | undefined
+	editor: PipelineEditorState
+}) {
+	const pe = deps.editor
+	let bodies = $state<Map<string, string>>(new Map())
+	// Deployed summary + language from the same fetch, for node titles and icons.
+	let scriptMeta = $state<Map<string, { summary?: string; language: ScriptLang }>>(new Map())
+	let inferredAssets = $state<Map<string, AssetWithAltAccessType[]>>(new Map())
+	let prefetching = $state(false)
+	// Bumped by every sweep so one started for an older graph stops writing.
+	let gen = 0
+
+	$effect(() => {
+		const ws = deps.getWorkspace()
+		const g = deps.getGraph()
+		if (!ws || !g) return
+		const sweep = ++gen
+		const targets = untrack(() =>
+			g.runnables
+				.filter((r) => r.usage_kind === 'script')
+				.map((r) => r.path)
+				.filter((p) => !pe.drafts.has(p) && !bodies.has(p))
+		)
+		if (targets.length === 0) return
+		let i = 0
+		const POOL = 6
+		const worker = async () => {
+			while (i < targets.length && sweep === gen) {
+				const path = targets[i++]
+				try {
+					const s = await ScriptService.getScriptByPath({ workspace: ws, path })
+					if (sweep !== gen) return
+					const content = s.content ?? ''
+					const res = await inferAssets(s.language, content)
+					if (sweep !== gen) return
+					const inferred = (res?.assets ?? []) as AssetWithAltAccessType[]
+					untrack(() => {
+						if (!bodies.has(path)) bodies = new Map(bodies).set(path, content)
+						if (!scriptMeta.has(path)) {
+							scriptMeta = new Map(scriptMeta).set(path, {
+								summary: s.summary || undefined,
+								language: s.language
+							})
+						}
+						if (!inferredAssets.has(path)) {
+							inferredAssets = new Map(inferredAssets).set(path, inferred)
+						}
+					})
+				} catch {
+					// Skip — that node just falls back to base-graph edges.
+				}
+			}
+		}
+		prefetching = true
+		const pool = Array.from({ length: Math.min(POOL, targets.length) }, () => worker())
+		void Promise.all(pool).then(() => {
+			if (sweep === gen) prefetching = false
+		})
+	})
+
+	// Both edge maps in one pass over the graph's scripts; they only differ by
+	// extractWrites vs extractReads over the same source.
+	const edges = $derived.by(() => {
+		const writes = new Map<string, AssetRef[]>()
+		const reads = new Map<string, AssetRef[]>()
+		const g = deps.getGraph()
+		if (!g) return { writes, reads }
+		for (const r of g.runnables) {
+			if (r.usage_kind !== 'script') continue
+			const assets =
+				pe.liveBodyAssets.scriptPath === r.path
+					? pe.liveBodyAssets.assets
+					: inferredAssets.get(r.path)
+			if (!assets) continue
+			const w = extractWrites(assets)
+			if (w.length > 0) writes.set(r.path, w)
+			const rd = extractReads(assets)
+			if (rd.length > 0) reads.set(r.path, rd)
+		}
+		return { writes, reads }
+	})
+
+	const annotatedNativeKinds = $derived.by(() => {
+		const out = new Map<string, Set<NativeTriggerKind>>()
+		const g = deps.getGraph()
+		if (!g) return out
+		const livePath = pe.liveAnnotations.scriptPath
+		for (const r of g.runnables) {
+			if (r.usage_kind !== 'script') continue
+			let kinds: Set<NativeTriggerKind>
+			if (r.path === livePath) {
+				kinds = new Set(pe.liveAnnotations.annotations.nativeTriggers.map((n) => n.kind))
+			} else {
+				const body = bodies.get(r.path)
+				if (!body) continue
+				kinds = new Set(parsePipelineAnnotations(body).nativeTriggers.map((n) => n.kind))
+			}
+			if (kinds.size > 0) out.set(r.path, kinds)
+		}
+		return out
+	})
+
+	return {
+		get bodies(): ReadonlyMap<string, string> {
+			return bodies
+		},
+		get scriptMeta(): ReadonlyMap<string, { summary?: string; language: ScriptLang }> {
+			return scriptMeta
+		},
+		get inferredWritesByPath() {
+			return edges.writes
+		},
+		get inferredReadsByPath() {
+			return edges.reads
+		},
+		get annotatedNativeKindsByPath() {
+			return annotatedNativeKinds
+		},
+		get prefetching() {
+			return prefetching
+		},
+		/** Drop cached paths so the next sweep re-reads them (after a save). */
+		forget(...paths: string[]) {
+			const nextBodies = new Map(bodies)
+			const nextMeta = new Map(scriptMeta)
+			const nextInferred = new Map(inferredAssets)
+			for (const p of paths) {
+				nextBodies.delete(p)
+				nextMeta.delete(p)
+				nextInferred.delete(p)
+			}
+			bodies = nextBodies
+			scriptMeta = nextMeta
+			inferredAssets = nextInferred
+		}
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDataUploads.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDataUploads.svelte.ts
new file mode 100644
index 0000000000..8205b5f903
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDataUploads.svelte.ts
@@ -0,0 +1,87 @@
+import { untrack } from 'svelte'
+import type { AssetGraphResponse } from './types'
+
+type Staged = { args: Record<string, any>; valid: boolean }
+
+// An S3Object-shaped value (the file picker writes `{ s3: '<path>' }`).
+function isS3Object(v: any): boolean {
+	return !!v && typeof v === 'object' && !Array.isArray(v) && 's3' in v
+}
+
+// Whether a staged value carries actual data. Covers the two shapes a
+// data-upload entry takes: an S3Object (file picker → `{ s3: '<path>' }`) and
+// a plain required input (e.g. a JSON array pasted into the run form).
+function hasMeaningfulValue(v: any): boolean {
+	if (v == null) return false
+	if (typeof v === 'string') return v.length > 0
+	if (Array.isArray(v)) return v.length > 0
+	if (typeof v === 'object')
+		return isS3Object(v) ? typeof v.s3 === 'string' && v.s3.length > 0 : Object.keys(v).length > 0
+	return true // numbers / booleans count as provided
+}
+
+/**
+ * Staged run-form input for the graph's data-upload entry scripts, keyed by path.
+ * Lifted out of the (transient, per-selection) run form so the uploaded/entered
+ * data persists across selection changes: it drives each entry node's green
+ * "ready" state and seeds a run with that input. `valid` is the run form's
+ * full-schema validity (all required fields satisfied).
+ */
+export function usePipelineDataUploads(getGraph: () => AssetGraphResponse) {
+	let staged = $state<Record<string, Staged>>({})
+
+	// Scripts that are data-upload entry points (a `data_upload` trigger in the
+	// displayed graph). They can't auto-run — they need their data first.
+	const entryPaths = $derived(
+		new Set(
+			getGraph()
+				.triggers.filter((t) => t.trigger_kind === 'data_upload' && t.runnable_kind === 'script')
+				.map((t) => t.runnable_path)
+		)
+	)
+
+	// Ready once the user actually provided its data, not just opened the form. Two
+	// guards: the form's own full-schema `valid` (every required field — including
+	// non-file ones — is satisfied), AND that any declared S3Object file field
+	// actually carries a file (the picker can leave an empty `{ s3: '' }` on a
+	// non-required file field, which `valid` alone wouldn't catch).
+	function isReady(path: string): boolean {
+		const s = staged[path]
+		if (!s || !s.valid) return false
+		const values = Object.values(s.args)
+		const s3s = values.filter(isS3Object)
+		if (s3s.length > 0) return s3s.every(hasMeaningfulValue)
+		return values.some(hasMeaningfulValue)
+	}
+
+	const readyPaths = $derived(new Set([...entryPaths].filter((p) => isReady(p))))
+
+	return {
+		get entryPaths(): ReadonlySet<string> {
+			return entryPaths
+		},
+		/** Entry scripts with their data provided — drives the green node treatment. */
+		get readyPaths(): ReadonlySet<string> {
+			return readyPaths
+		},
+		isReady,
+		argsFor: (path: string): Record<string, any> | undefined => staged[path]?.args,
+		// Persist the run form's args + validity, but only for data-upload entries —
+		// other run forms (partitioned producers) run their own way and must not be
+		// mistaken for a staged upload. Idempotent: the run form re-emits on every
+		// keystroke/validation pass, so bail when the value is unchanged — otherwise
+		// each emit would reassign `staged`, giving `readyPaths` a fresh Set identity
+		// that re-syncs the canvas and re-fires the form's emit effect
+		// (effect_update_depth_exceeded).
+		// Called from the run forms' own effects, so its reads are untracked: a form
+		// must not re-run because the store it just wrote to changed.
+		stage: (path: string, args: Record<string, any>, valid: boolean) =>
+			untrack(() => {
+				if (!entryPaths.has(path)) return
+				const prev = staged[path]
+				if (prev && prev.valid === valid && JSON.stringify(prev.args) === JSON.stringify(args))
+					return
+				staged = { ...staged, [path]: { args, valid } }
+			})
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.test.ts
new file mode 100644
index 0000000000..1e0c77aa70
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.test.ts
@@ -0,0 +1,52 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { DraftService, ScriptService } from '$lib/gen'
+import { planPipelineDelete } from './pipelineDelete'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('planPipelineDelete', () => {
+	it("takes only the pipeline's own triggers and addresses draft-only nodes by storage key", async () => {
+		vi.spyOn(ScriptService, 'listRunnables').mockResolvedValue({
+			items: [
+				{ type: 'script', path: 'f/sales/ingest', auto_kind: 'pipeline' },
+				{ type: 'script', path: 'f/sales/report' },
+				{
+					type: 'script',
+					path: 'u/alice/draft_abc',
+					draft_only: true,
+					draft_path: 'f/sales/unpublished',
+					auto_kind: 'pipeline'
+				}
+			]
+		} as any)
+		vi.spyOn(DraftService, 'getOwnDraft').mockResolvedValue(undefined as any)
+		const trigger = (runnable_kind: string, runnable_path: string, path: string) => ({
+			trigger_kind: 'schedule',
+			runnable_kind,
+			runnable_path,
+			path
+		})
+		vi.stubGlobal(
+			'fetch',
+			vi.fn().mockResolvedValue({
+				ok: true,
+				json: async () => ({
+					triggers: [
+						trigger('script', 'f/sales/ingest', 'f/sales/ingest_schedule'),
+						trigger('script', 'f/sales/report', 'f/sales/report_schedule'),
+						trigger('flow', 'f/sales/ingest', 'f/sales/flow_schedule')
+					]
+				})
+			})
+		)
+
+		const plan = await planPipelineDelete('w', 'sales')
+
+		expect(plan.triggers).toEqual([{ kind: 'schedule', path: 'f/sales/ingest_schedule' }])
+		expect(plan.scripts).toEqual([
+			{ path: 'f/sales/ingest', displayPath: 'f/sales/ingest', draftOnly: false },
+			{ path: 'u/alice/draft_abc', displayPath: 'f/sales/unpublished', draftOnly: true }
+		])
+		vi.unstubAllGlobals()
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.ts
new file mode 100644
index 0000000000..62e8e2ea4a
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDelete.ts
@@ -0,0 +1,135 @@
+import { DraftService, OpenAPI, ScriptService, type RunnableItem } from '$lib/gen'
+import { discardDraft } from '$lib/utils_draft_deploy'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath, pipelineLocalMirrorKey } from '$lib/pipelinePaths'
+import { deleteTriggerRow } from './pipelineTriggerDraftDeploy'
+import type { AssetGraphResponse, NativeTriggerKind } from './types'
+
+export type PipelineDeleteResult = { removed: number; failures: string[] }
+
+/** The folder's pipeline-member scripts, deployed and draft-only alike: every one of
+ * them makes the home list show the pipeline, so one left behind brings it back. */
+async function listPipelineScripts(workspace: string, folder: string): Promise<RunnableItem[]> {
+	const out: RunnableItem[] = []
+	let cursor: string | undefined
+	do {
+		const res = await ScriptService.listRunnables({
+			workspace,
+			kinds: 'script',
+			pathStart: `f/${folder}/`,
+			includeDraftOnly: true,
+			perPage: 100,
+			cursor
+		})
+		out.push(...res.items.filter((it) => it.auto_kind === 'pipeline'))
+		cursor = res.next_cursor ?? undefined
+	} while (cursor)
+	return out
+}
+
+/** Trigger rows starting one of `scripts`. The folder graph also carries the
+ * triggers of the folder's ordinary scripts and flows, which are not the pipeline's. */
+async function listNativeTriggers(workspace: string, folder: string, scripts: ReadonlySet<string>) {
+	const res = await fetch(
+		`${OpenAPI.BASE ?? ''}/w/${workspace}/assets/graph?${new URLSearchParams({ folder })}`,
+		{ credentials: 'include' }
+	)
+	if (!res.ok) throw new Error(`GET /assets/graph → ${res.status}`)
+	const graph = (await res.json()) as AssetGraphResponse
+	return graph.triggers.flatMap((t) =>
+		t.trigger_kind !== 'asset' &&
+			t.runnable_kind === 'script' &&
+			scripts.has(t.runnable_path) &&
+			t.trigger_kind !== 'webhook' &&
+			t.trigger_kind !== 'data_upload' &&
+			t.path &&
+			!t.unsaved
+			? [{ kind: t.trigger_kind, path: t.path }]
+			: []
+	)
+}
+
+export type PipelineDeletePlan = {
+	/** `path` is what the API addresses (a draft-only node's storage key);
+	 * `displayPath` is the path the user typed for it. */
+	scripts: { path: string; displayPath: string; draftOnly: boolean }[]
+	triggers: { kind: NativeTriggerKind; path: string }[]
+	/** Whether the caller has an unsaved pipeline draft for this folder. */
+	hasDraft: boolean
+}
+
+/** Everything `deletePipeline` would remove, so it can be listed before it is. */
+export async function planPipelineDelete(
+	workspace: string,
+	folder: string
+): Promise<PipelineDeletePlan> {
+	const scripts = await listPipelineScripts(workspace, folder)
+	const deployed = new Set(scripts.filter((s) => !s.draft_only).map((s) => s.path))
+	const [triggers, draft] = await Promise.all([
+		listNativeTriggers(workspace, folder, deployed),
+		DraftService.getOwnDraft({
+			workspace,
+			kind: PIPELINE_DRAFT_KIND,
+			path: pipelineBundlePath(folder)
+		}).catch(() => undefined)
+	])
+	return {
+		scripts: scripts.map((s) => ({
+			path: s.path,
+			displayPath: (s.draft_only && s.draft_path) || s.path,
+			draftOnly: !!s.draft_only
+		})),
+		triggers,
+		hasDraft: !!draft
+	}
+}
+
+/** Removes what `plan` lists: the trigger rows, the scripts (deleted when
+ * `hardDelete`, which the backend allows admins only, archived otherwise; a
+ * draft-only node is discarded) and the caller's pipeline draft. The data the
+ * nodes wrote (DuckLake tables, S3 objects) is left alone. Triggers go first: a
+ * script refused afterwards loses its trigger, but no trigger outlives the script
+ * it starts. */
+export async function deletePipeline(
+	workspace: string,
+	folder: string,
+	plan: PipelineDeletePlan,
+	hardDelete: boolean
+): Promise<PipelineDeleteResult> {
+	const failures: string[] = []
+	let removed = 0
+	const fail = (what: string, e: any) =>
+		failures.push(`${what}: ${e?.body ?? e?.message ?? String(e)}`)
+
+	for (const t of plan.triggers) {
+		try {
+			if (await deleteTriggerRow(t.kind, t.path, workspace)) removed++
+		} catch (e) {
+			fail(`${t.kind} trigger ${t.path}`, e)
+		}
+	}
+	for (const s of plan.scripts) {
+		try {
+			if (s.draftOnly) {
+				const r = await discardDraft('script', s.path, workspace, true, false, false)
+				if (!r.success) throw new Error(r.error)
+			} else if (hardDelete) {
+				await ScriptService.deleteScriptByPath({ workspace, path: s.path })
+			} else {
+				await ScriptService.archiveScriptByPath({ workspace, path: s.path })
+			}
+			removed++
+		} catch (e) {
+			fail(s.displayPath, e)
+		}
+	}
+	if (plan.hasDraft) {
+		const bundle = await discardDraft(PIPELINE_DRAFT_KIND, pipelineBundlePath(folder), workspace, true)
+		if (!bundle.success) failures.push(`pipeline draft: ${bundle.error}`)
+	}
+	try {
+		localStorage.removeItem(pipelineLocalMirrorKey(folder))
+	} catch {
+		// Storage unavailable: nothing was mirrored either.
+	}
+	return { removed, failures }
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.svelte.ts
new file mode 100644
index 0000000000..508b705e11
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.svelte.ts
@@ -0,0 +1,230 @@
+import { DraftService, ScriptService, type Script } from '$lib/gen'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
+import type { PipelineTriggerDraft } from './types'
+import type { Schema } from '$lib/common'
+import { emptySchema } from '$lib/utils'
+import { inferArgs, inferAssets } from '$lib/infer'
+import type { AssetWithAltAccessType } from '$lib/components/assets/lib'
+import type { PipelineDraft } from './pipelineAiHelpers'
+import type { PipelineEditorState } from './pipelineEditorState.svelte'
+import { deployTriggerDraft } from './pipelineTriggerDraftDeploy'
+
+// Deploying a pipeline's drafts: the scripts first, then the trigger drafts whose
+// script is now deployed. Shared by the pipeline page's "Save all" and the AI
+// session's "Deploy pipeline", so both deploy exactly the same way.
+
+/** Deploy one pipeline script draft; resolves to the new version's hash. */
+export async function deployPipelineScript(
+	draft: PipelineDraft,
+	workspace: string
+): Promise<string> {
+	const script = structuredClone($state.snapshot(draft.script) as Script)
+	script.schema = script.schema ?? emptySchema()
+	try {
+		const result = await inferArgs(script.language, script.content, script.schema as Schema)
+		;(script as any).auto_kind = result?.auto_kind || undefined
+		script.has_preprocessor = result?.has_preprocessor ?? false
+	} catch {
+		// Inference failures don't block deploys (the same fallback the per-pane
+		// save uses): createScript is the real validation gate.
+	}
+	// Re-infer the lineage from the CURRENT body. `script.assets` is a snapshot
+	// that isn't refreshed on edit, so a renamed/removed output would otherwise be
+	// re-deployed as a phantom write edge.
+	let assets: AssetWithAltAccessType[] = []
+	try {
+		const inferred = await inferAssets(script.language, script.content)
+		if (inferred?.status !== 'error') assets = (inferred?.assets ?? []) as AssetWithAltAccessType[]
+	} catch {
+		// An unparsable body deploys with no lineage rather than the stale snapshot.
+	}
+	return await ScriptService.createScript({
+		workspace,
+		requestBody: {
+			...script,
+			language: script.language,
+			description: script.description ?? '',
+			// A brand-new draft has an empty hash (the backend rejects an empty hex
+			// string); a draft of a deployed script chains off its hash, since
+			// createScript rejects a parentless deploy to an occupied path.
+			parent_hash: script.hash ? String(script.hash) : undefined,
+			is_template: false,
+			tag: script.tag,
+			kind: script.kind as Script['kind'] | undefined,
+			lock: undefined,
+			assets: assets as any
+		}
+	})
+}
+
+// Every field a deploy sends: a draft differing from the live script in any of
+// them still has something to deploy.
+const DEPLOYED_FIELDS = [
+	'content',
+	'language',
+	'summary',
+	'description',
+	'tag',
+	'kind',
+	'labels'
+] as const
+
+/** Whether two versions of a script agree on everything a deploy sends. */
+function sameDeployedFields(a: Partial<Script>, b: Partial<Script>): boolean {
+	const norm = (v: unknown) => JSON.stringify(Array.isArray(v) && v.length === 0 ? null : (v ?? null))
+	return DEPLOYED_FIELDS.every(
+		(f) =>
+			norm(f === 'description' ? (a[f] ?? '') : a[f]) ===
+			norm(f === 'description' ? (b[f] ?? '') : b[f])
+	)
+}
+
+/** Whether a draft equals the live script at its path, i.e. has nothing to deploy. */
+export async function matchesDeployedScript(
+	path: string,
+	d: PipelineDraft,
+	workspace: string
+): Promise<boolean> {
+	try {
+		const live = await ScriptService.getScriptByPath({ workspace, path })
+		return sameDeployedFields(live, d.script)
+	} catch {
+		return false
+	}
+}
+
+/**
+ * A folder's draft bundle against what is deployed, one entry per node (and the
+ * trigger drafts), for a diff viewer: the unit a session reviews and deploys.
+ */
+export async function loadPipelineDraftDiff(
+	workspace: string,
+	folder: string
+): Promise<{ before: unknown; after: unknown }> {
+	const row = await DraftService.getOwnDraft({
+		workspace,
+		kind: PIPELINE_DRAFT_KIND,
+		path: pipelineBundlePath(folder)
+	}).catch(() => undefined)
+	const bundle = (row?.value ?? {}) as {
+		drafts?: Array<[string, PipelineDraft]>
+		triggerDrafts?: PipelineTriggerDraft[]
+	}
+	const drafts = Array.isArray(bundle.drafts) ? bundle.drafts : []
+	const before: Record<string, string> = {}
+	const after: Record<string, string> = {}
+	await Promise.all(
+		drafts.map(async ([path, d]) => {
+			after[path] = d.script?.content ?? ''
+			const live = await ScriptService.getScriptByPath({ workspace, path }).catch(() => undefined)
+			if (live) before[path] = live.content
+		})
+	)
+	const triggers = (bundle.triggerDrafts ?? []).map((t) => ({
+		kind: t.kind,
+		path: t.config.path,
+		script_path: t.config.script_path
+	}))
+	return {
+		before: { nodes: before },
+		after: { nodes: after, ...(triggers.length > 0 ? { new_triggers: triggers } : {}) }
+	}
+}
+
+export type PipelineDeployOutcome = {
+	savedPaths: string[]
+	/** Keys of the trigger drafts that deployed. */
+	savedTriggers: string[]
+	/** Failures by script or trigger path. */
+	errors: Map<string, string>
+}
+
+/**
+ * Deploy every draft of `editor` into `workspace`, dropping from it what deployed:
+ * failed drafts stay so they can be fixed and retried. The open pane's unsaved
+ * keystrokes are deployed with their draft.
+ */
+export async function deployPipelineDrafts(
+	editor: PipelineEditorState,
+	workspace: string
+): Promise<PipelineDeployOutcome> {
+	// Closing the pane lands an open deployed script's edits as its draft, so they
+	// deploy too. It reopens on that script once the deploy is done, unless another
+	// one was opened meanwhile.
+	const reopen =
+		editor.liveEditPath != undefined || editor.activeDraftPath != undefined
+			? await editor.closePane()
+			: undefined
+	const entries = [...editor.drafts.entries()]
+	const errors = new Map<string, string>()
+	const savedPaths: string[] = []
+	const hashes = new Map<string, string>()
+	// Parallel: every createScript is independent, and one bad body must not block
+	// the others.
+	const results = await Promise.allSettled(
+		entries.map(([, d]) => deployPipelineScript(d, workspace))
+	)
+	for (let i = 0; i < results.length; i++) {
+		const r = results[i]
+		const [path, d] = entries[i]
+		if (r.status === 'fulfilled') {
+			savedPaths.push(path)
+			if (r.value) hashes.set(path, r.value)
+			continue
+		}
+		// A refused draft that equals the deployed script has nothing left to deploy.
+		// A duplicate refusal alone does not prove it: it is checked against every
+		// past version, not just the live one.
+		if (await matchesDeployedScript(path, d, workspace)) {
+			savedPaths.push(path)
+			continue
+		}
+		const msg = String((r.reason as any)?.body ?? (r.reason as any)?.message ?? r.reason)
+		errors.set(
+			path,
+			/same hash/i.test(msg)
+				? 'This is the content of an earlier version, which cannot be deployed again as is. Change anything in it (a comment will do) to deploy it.'
+				: msg
+		)
+	}
+
+	// A trigger's `script_path` must already exist, so triggers whose script is
+	// still an undeployed draft stay drafts.
+	const ready = [...editor.triggerDrafts].filter(
+		([, d]) => !editor.drafts.has(d.config.script_path) || savedPaths.includes(d.config.script_path)
+	)
+	const triggerResults = await Promise.all(ready.map(([, d]) => deployTriggerDraft(d, workspace)))
+	const savedTriggers: string[] = []
+	triggerResults.forEach((ok, i) => {
+		const [key, d] = ready[i]
+		if (ok) savedTriggers.push(key)
+		else errors.set(d.config.path, `Could not create the ${d.kind} trigger, see the notification`)
+	})
+	for (const key of savedTriggers) editor.discardTriggerDraft(key)
+
+	if (savedPaths.length > 0) {
+		// A draft edited again while it deployed (its node reopened from the canvas)
+		// keeps the newer edits, now on top of the version just deployed; only a draft
+		// still holding exactly what was sent is done.
+		const sent = new Map(entries.map(([p, d]) => [p, d.script]))
+		const next = new Map<string, PipelineDraft>()
+		for (const [k, d] of editor.drafts) {
+			if (!savedPaths.includes(k)) {
+				next.set(k, d)
+				continue
+			}
+			const open = editor.liveContent.scriptPath === k ? editor.liveContent.content : undefined
+			const now = open === undefined ? d.script : { ...d.script, content: open }
+			const was = sent.get(k)
+			if (was && sameDeployedFields(now, was)) continue
+			const hash = hashes.get(k)
+			next.set(k, hash ? { ...d, script: { ...d.script, hash } } : d)
+		}
+		editor.drafts = next
+	}
+	if (reopen && editor.activeDraftPath === undefined && editor.selection === undefined) {
+		if (editor.drafts.has(reopen)) editor.activeDraftPath = reopen
+		else editor.selection = { kind: 'runnable', runnable_kind: 'script', path: reopen }
+	}
+	return { savedPaths, savedTriggers, errors }
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.test.ts
new file mode 100644
index 0000000000..53df48717a
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineDeploy.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const createScript = vi.fn()
+vi.mock('$lib/gen', () => ({
+	ScriptService: { createScript: (a: unknown) => createScript(a) },
+	DraftService: {}
+}))
+vi.mock('$lib/infer', () => ({
+	inferArgs: async () => undefined,
+	inferAssets: async () => ({ status: 'ok', assets: [] })
+}))
+vi.mock('./pipelineTriggerDraftDeploy', () => ({ deployTriggerDraft: async () => true }))
+
+const { deployPipelineDrafts } = await import('./pipelineDeploy.svelte')
+const { PipelineEditorState } = await import('./pipelineEditorState.svelte')
+
+const draft = (content: string) => ({
+	localId: 'pe-1',
+	script: { path: 'f/x/n', language: 'duckdb', content, hash: 'aaaa' } as any
+})
+
+describe('deployPipelineDrafts', () => {
+	it('drops a draft once what it holds is deployed', async () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		createScript.mockResolvedValueOnce('bbbb')
+		await deployPipelineDrafts(pe, 'ws')
+		expect(pe.drafts.has('f/x/n')).toBe(false)
+	})
+
+	it('keeps edits made while the deploy was in flight, on top of the new version', async () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		createScript.mockImplementationOnce(async () => {
+			pe.drafts = new Map([['f/x/n', draft('SELECT 3')]])
+			return 'bbbb'
+		})
+		await deployPipelineDrafts(pe, 'ws')
+		expect(pe.drafts.get('f/x/n')?.script.content).toBe('SELECT 3')
+		expect(pe.drafts.get('f/x/n')?.script.hash).toBe('bbbb')
+	})
+})
+
+describe('deployPipelineDrafts metadata', () => {
+	it('keeps a summary edited while the deploy was in flight', async () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		createScript.mockImplementationOnce(async () => {
+			const d = draft('SELECT 2')
+			pe.drafts = new Map([['f/x/n', { ...d, script: { ...d.script, summary: 'Renamed' } }]])
+			return 'bbbb'
+		})
+		await deployPipelineDrafts(pe, 'ws')
+		expect(pe.drafts.get('f/x/n')?.script.summary).toBe('Renamed')
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts
index 086abc1bf8..6f9a109f5f 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.svelte.ts
@@ -1,6 +1,8 @@
+import { tick } from 'svelte'
 import type { AssetKind, Script } from '$lib/gen'
 import type { AssetWithAltAccessType } from '$lib/components/assets/lib'
-import type { AssetGraphSelection } from './types'
+import type { AssetGraphSelection, PipelineTriggerDraft } from './types'
+import { defaultTriggerPath, triggerDraftKey } from './pipelineTriggerDrafts'
 import {
 	parsePipelineAnnotations,
 	type ColumnLineage,
@@ -26,11 +28,18 @@ type LiveBodyAssets = {
 	assets: AssetWithAltAccessType[]
 	columnLineage?: ColumnLineage[]
 }
-type LiveContent = { scriptPath: string | undefined; content: string }
+type LiveContent = {
+	scriptPath: string | undefined
+	content: string
+	/** The deployed script the buffer was opened from; unset for a draft. */
+	base?: Script
+}
 
 export class PipelineEditorState {
 	/** In-flight drafts keyed by script path (manual + AI-staged). */
 	drafts = $state<Map<string, PipelineDraft>>(new Map())
+	/** Undeployed triggers keyed by `triggerDraftKey`, persisted in the same bundle. */
+	triggerDrafts = $state<Map<string, PipelineTriggerDraft>>(new Map())
 	/** Draft open in the details pane (mutually exclusive with `selection`). */
 	activeDraftPath = $state<string | undefined>(undefined)
 	/** The persisted node/asset selected on the canvas. */
@@ -51,23 +60,22 @@ export class PipelineEditorState {
 	 * autosave hydrate when persistence is enabled. */
 	loadedFromDbDraft = $state(false)
 
-	/** Folder this state is scoped to. Used by the in-session preview (where one
-	 * instance is reused across editor hide/show) to detect a retarget to a
-	 * different folder and reset, so stale drafts don't bleed across folders. */
+	/** Folder this state is scoped to. The route page compares it on a folder
+	 * switch and resets, so one folder's drafts don't bleed into the next. */
 	folder = $state<string | undefined>(undefined)
 
 	/** True once the DB draft bundle for the current folder has been hydrated
-	 * into this instance. Gated per-instance (not per component mount) so the
-	 * in-session preview hydrates ONCE when its runtime is fresh and then keeps
-	 * the in-memory drafts across editor hide/show — re-reading the DB on every
-	 * remount would race a not-yet-flushed autosave and drop a just-staged draft.
-	 * Reset to false on a folder retarget so the new folder re-hydrates. */
+	 * into this instance. Gated per-instance (not per component mount) so an AI
+	 * session's folder hydrates ONCE and then keeps its in-memory drafts across
+	 * editor remounts — re-reading the DB on every remount would race a
+	 * not-yet-flushed autosave and drop a just-staged draft. `reset` clears it
+	 * so a new folder re-hydrates. */
 	hydratedFromDb = $state(false)
 
-	/** Clear all in-flight state. Used when the session preview retargets a
-	 * different pipeline folder (a same-folder remount keeps the drafts). */
+	/** Clear all in-flight state, for the route page switching folders. */
 	reset = () => {
 		this.drafts = new Map()
+		this.triggerDrafts = new Map()
 		this.activeDraftPath = undefined
 		this.selection = undefined
 		this.clearLiveOverlays()
@@ -84,6 +92,18 @@ export class PipelineEditorState {
 		return `pe-${this.#nextDraftLocalId}`
 	}
 
+	// A deployed script with unsaved edits is autosaved as a draft before the pane
+	// promotes it, so both must give it the same id.
+	#promotedLocalIds = new Map<string, string>()
+	promotedDraftLocalId = (path: string): string => {
+		let id = this.#promotedLocalIds.get(path)
+		if (!id) {
+			id = this.newDraftLocalId()
+			this.#promotedLocalIds.set(path, id)
+		}
+		return id
+	}
+
 	handleAnnotationsChange = (scriptPath: string | undefined, annotations: PipelineAnnotations) => {
 		this.liveAnnotations = { scriptPath, annotations }
 	}
@@ -94,8 +114,34 @@ export class PipelineEditorState {
 	) => {
 		this.liveBodyAssets = { scriptPath, assets, columnLineage }
 	}
-	handleContentChange = (scriptPath: string | undefined, content: string) => {
-		this.liveContent = { scriptPath, content }
+	handleContentChange = (scriptPath: string | undefined, content: string, base?: Script) => {
+		this.liveContent = { scriptPath, content, base }
+	}
+
+	/** The open deployed script's unsaved edits, which live only in `liveContent`
+	 * until its pane closes: the path, or undefined when there are none. */
+	get liveEditPath(): string | undefined {
+		const { scriptPath, content, base } = this.liveContent
+		if (scriptPath == undefined || !base || this.drafts.has(scriptPath)) return undefined
+		return content !== (base.content ?? '') ? scriptPath : undefined
+	}
+
+	/** Closes the open pane and waits for its edits to land as a draft, as closing
+	 * it by hand does: what is deployed or discarded next then includes them, and
+	 * no pane is left holding a stale copy. Returns the path the pane was on. */
+	closePane = async (): Promise<string | undefined> => {
+		const path =
+			this.activeDraftPath ?? (this.selection?.kind === 'runnable' ? this.selection.path : undefined)
+		if (this.activeDraftPath === undefined && this.selection === undefined) return undefined
+		this.activeDraftPath = undefined
+		this.selection = undefined
+		// The pane unmounts on the next flush; its save-back commits a microtask later.
+		await tick()
+		await new Promise<void>((resolve) => queueMicrotask(resolve))
+		// Its buffer now lives in the draft; left here, autosave would serialize it
+		// again once that draft is deployed or discarded.
+		this.clearLiveOverlays()
+		return path
 	}
 
 	clearLiveOverlays = () => {
@@ -125,6 +171,72 @@ export class PipelineEditorState {
 		next.delete(path)
 		this.drafts = next
 		this.forgetPath(path)
+		this.discardTriggerDraftsFor(path)
+	}
+
+	/** Summary and labels of a script draft, edited from the pane header. */
+	setDraftMeta = (path: string, meta: { summary: string; labels: string[] | undefined }) => {
+		const d = this.drafts.get(path)
+		if (!d) return
+		this.drafts = new Map(this.drafts).set(path, {
+			...d,
+			script: { ...d.script, summary: meta.summary, labels: meta.labels }
+		})
+	}
+
+	/** Add or replace a trigger draft; `previousKey` is the entry being edited, which
+	 * a rename drops. False, and nothing changes, when the path is another draft's:
+	 * both would deploy to one trigger. */
+	setTriggerDraft = (d: PipelineTriggerDraft, previousKey?: string): boolean => {
+		const key = triggerDraftKey(d.kind, d.config.path)
+		if (key !== previousKey && this.triggerDrafts.has(key)) return false
+		const next = new Map(this.triggerDrafts)
+		if (previousKey) next.delete(previousKey)
+		next.set(key, d)
+		this.triggerDrafts = next
+		return true
+	}
+
+	discardTriggerDraft = (key: string) => {
+		if (!this.triggerDrafts.has(key)) return
+		const next = new Map(this.triggerDrafts)
+		next.delete(key)
+		this.triggerDrafts = next
+	}
+
+	/** A trigger draft cannot outlive the script draft it was configured with:
+	 * deploying it would target a path nothing is deployed at. */
+	discardTriggerDraftsFor = (scriptPath: string) => {
+		const next = new Map(
+			[...this.triggerDrafts].filter(([, d]) => d.config.script_path !== scriptPath)
+		)
+		if (next.size !== this.triggerDrafts.size) this.triggerDrafts = next
+	}
+
+	/** Follow a script draft rename, keeping default `<script>_<kind>` names in step. */
+	/** Returns the trigger path another draft already holds, and changes nothing,
+	 * when a renamed default name would land on it. */
+	retargetTriggerDrafts = (oldScriptPath: string, newScriptPath: string): string | undefined => {
+		const moved = new Map<string, PipelineTriggerDraft>()
+		const kept = new Map<string, PipelineTriggerDraft>()
+		for (const [k, d] of this.triggerDrafts) {
+			if (d.config.script_path !== oldScriptPath) {
+				kept.set(k, d)
+				continue
+			}
+			const path =
+				d.config.path === defaultTriggerPath(oldScriptPath, d.kind)
+					? defaultTriggerPath(newScriptPath, d.kind)
+					: d.config.path
+			moved.set(triggerDraftKey(d.kind, path), {
+				...d,
+				config: { ...d.config, path, script_path: newScriptPath }
+			})
+		}
+		if (moved.size === 0) return undefined
+		for (const [k, d] of moved) if (kept.has(k)) return d.config.path
+		this.triggerDrafts = new Map([...kept, ...moved])
+		return undefined
 	}
 
 	/** Commit body edits + inferred outputs back into the drafts Map on pane
@@ -147,7 +259,7 @@ export class PipelineEditorState {
 				if (!snapshot.script) return
 				const next = new Map(this.drafts)
 				next.set(p, {
-					localId: this.newDraftLocalId(),
+					localId: this.promotedDraftLocalId(p),
 					script: snapshot.script,
 					outputAssets: snapshot.writes.length > 0 ? snapshot.writes : undefined,
 					inputAssets: snapshot.reads
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts
index 2ec06bc8cc..09cec13a37 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineEditorState.test.ts
@@ -104,3 +104,72 @@ describe('PipelineEditorState.handleDraftPersist — read capture', () => {
 		expect(pe.drafts.get('f/x/n')?.inputAssets).toBeUndefined()
 	})
 })
+
+describe('PipelineEditorState trigger drafts', () => {
+	it('follow their script draft: renamed with it, discarded with it', () => {
+		const pe = new PipelineEditorState()
+		pe.drafts = new Map([['f/x/n', draft('SELECT 1')]])
+		pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/n_kafka', script_path: 'f/x/n' } })
+		pe.setTriggerDraft({ kind: 'schedule', config: { path: 'f/x/nightly', script_path: 'f/x/n' } })
+
+		pe.retargetTriggerDrafts('f/x/n', 'f/x/m')
+		// A default `<script>_<kind>` name follows the script; a chosen one stays.
+		expect([...pe.triggerDrafts.keys()].sort()).toEqual([
+			'kafka:f/x/m_kafka',
+			'schedule:f/x/nightly'
+		])
+		expect([...pe.triggerDrafts.values()].every((d) => d.config.script_path === 'f/x/m')).toBe(true)
+
+		pe.drafts = new Map([['f/x/m', draft('SELECT 1')]])
+		pe.discardDraft('f/x/m')
+		expect(pe.triggerDrafts.size).toBe(0)
+	})
+
+	it('refuse a path another draft holds, but let a draft keep its own', () => {
+		const pe = new PipelineEditorState()
+		const a = { kind: 'kafka' as const, config: { path: 'f/x/k', script_path: 'f/x/a' } }
+		expect(pe.setTriggerDraft(a)).toBe(true)
+		expect(
+			pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/k', script_path: 'f/x/b' } })
+		).toBe(false)
+		expect(pe.triggerDrafts.get('kafka:f/x/k')?.config.script_path).toBe('f/x/a')
+		expect(pe.setTriggerDraft({ ...a, config: { ...a.config, topics: ['t'] } }, 'kafka:f/x/k')).toBe(
+			true
+		)
+	})
+
+	it('refuse a script rename that moves a default name onto another draft', () => {
+		const pe = new PipelineEditorState()
+		pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/a_kafka', script_path: 'f/x/a' } })
+		pe.setTriggerDraft({ kind: 'kafka', config: { path: 'f/x/b_kafka', script_path: 'f/x/c' } })
+		expect(pe.retargetTriggerDrafts('f/x/a', 'f/x/b')).toBe('f/x/b_kafka')
+		expect([...pe.triggerDrafts.keys()].sort()).toEqual(['kafka:f/x/a_kafka', 'kafka:f/x/b_kafka'])
+	})
+})
+
+describe('PipelineEditorState.liveEditPath', () => {
+	const base = { path: 'f/x/n', language: 'duckdb', content: 'SELECT 1' } as PipelineDraft['script']
+
+	it('counts an open deployed script with unsaved edits, until it has a draft', () => {
+		const pe = new PipelineEditorState()
+		pe.liveContent = { scriptPath: 'f/x/n', content: 'SELECT 1', base }
+		expect(pe.liveEditPath).toBeUndefined()
+		pe.liveContent = { scriptPath: 'f/x/n', content: 'SELECT 2', base }
+		expect(pe.liveEditPath).toBe('f/x/n')
+		pe.drafts = new Map([['f/x/n', draft('SELECT 2')]])
+		expect(pe.liveEditPath).toBeUndefined()
+	})
+})
+
+describe('PipelineEditorState.closePane', () => {
+	it("leaves no open buffer behind for autosave to bring back once the draft is gone", async () => {
+		const pe = new PipelineEditorState()
+		const base = { path: 'f/x/n', language: 'duckdb', content: 'SELECT 1' } as PipelineDraft['script']
+		pe.selection = { kind: 'runnable', runnable_kind: 'script', path: 'f/x/n' }
+		pe.liveContent = { scriptPath: 'f/x/n', content: 'SELECT 2', base }
+		expect(await pe.closePane()).toBe('f/x/n')
+		expect(pe.selection).toBeUndefined()
+		expect(pe.liveEditPath).toBeUndefined()
+		expect(pe.liveContent.scriptPath).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineLanguages.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineLanguages.ts
index 26d3e24d84..b50491620f 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineLanguages.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineLanguages.ts
@@ -4,7 +4,7 @@ import type { ScriptLang } from '$lib/gen'
 // actually reach for first: duckdb for in-place SQL on parquet/s3 (the
 // default), bun for ergonomic data wrangling, python for ML/pandas, then
 // the sql dialects for warehouse-resident transforms. Everything else
-// (bash/go/deno) sits below — still creatable, just not the default
+// (bash/go) sits below — still creatable, just not the default
 // suggestion.
 export const PIPELINE_LANGUAGES: Array<{ label: string; lang: ScriptLang }> = [
 	{ label: 'DuckDB', lang: 'duckdb' },
@@ -16,6 +16,5 @@ export const PIPELINE_LANGUAGES: Array<{ label: string; lang: ScriptLang }> = [
 	{ label: 'MySQL', lang: 'mysql' },
 	{ label: 'MS SQL', lang: 'mssql' },
 	{ label: 'Bash', lang: 'bash' },
-	{ label: 'Go', lang: 'go' },
-	{ label: 'Deno', lang: 'deno' }
+	{ label: 'Go', lang: 'go' }
 ]
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy.ts
new file mode 100644
index 0000000000..3b37ac43a5
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy.ts
@@ -0,0 +1,89 @@
+import { usedTriggerKinds } from '$lib/stores'
+import { formatCron } from '$lib/utils'
+import { saveScheduleFromCfg } from '$lib/components/flows/scheduleUtils'
+import { saveEmailTriggerFromCfg } from '$lib/components/triggers/email/utils'
+import { saveKafkaTriggerFromCfg } from '$lib/components/triggers/kafka/utils'
+import { saveMqttTriggerFromCfg } from '$lib/components/triggers/mqtt/utils'
+import { saveAmqpTriggerFromCfg } from '$lib/components/triggers/amqp/utils'
+import { saveNatsTriggerFromCfg } from '$lib/components/triggers/nats/utils'
+import { savePostgresTriggerFromCfg } from '$lib/components/triggers/postgres/utils'
+import { saveSqsTriggerFromCfg } from '$lib/components/triggers/sqs/utils'
+import { saveGcpTriggerFromCfg } from '$lib/components/triggers/gcp/utils'
+import {
+	AmqpTriggerService,
+	EmailTriggerService,
+	GcpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	ScheduleService,
+	SqsTriggerService
+} from '$lib/gen'
+import type { NativeTriggerKind, PipelineTriggerDraft } from './types'
+
+/** Creates the trigger through the same helper its editor saves with; that helper
+ * reports the outcome as a toast and resolves to whether it succeeded. */
+export function deployTriggerDraft(d: PipelineTriggerDraft, workspace: string): Promise<boolean> {
+	const cfg = d.config
+	switch (d.kind) {
+		case 'schedule':
+			return saveScheduleFromCfg({ ...cfg, schedule: formatCron(cfg.schedule) }, false, workspace)
+		case 'email':
+			return saveEmailTriggerFromCfg('', cfg, false, workspace, false, usedTriggerKinds)
+		case 'kafka':
+			return saveKafkaTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'mqtt':
+			return saveMqttTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'amqp':
+			return saveAmqpTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'nats':
+			return saveNatsTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'postgres':
+			return savePostgresTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'sqs':
+			return saveSqsTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+		case 'gcp':
+			return saveGcpTriggerFromCfg('', cfg, false, workspace, usedTriggerKinds)
+	}
+}
+
+/** Deletes a deployed trigger row. False for the kinds that have none (webhook,
+ * data upload). */
+export async function deleteTriggerRow(
+	kind: NativeTriggerKind,
+	path: string,
+	workspace: string
+): Promise<boolean> {
+	switch (kind) {
+		case 'schedule':
+			await ScheduleService.deleteSchedule({ workspace, path })
+			return true
+		case 'kafka':
+			await KafkaTriggerService.deleteKafkaTrigger({ workspace, path })
+			return true
+		case 'mqtt':
+			await MqttTriggerService.deleteMqttTrigger({ workspace, path })
+			return true
+		case 'amqp':
+			await AmqpTriggerService.deleteAmqpTrigger({ workspace, path })
+			return true
+		case 'nats':
+			await NatsTriggerService.deleteNatsTrigger({ workspace, path })
+			return true
+		case 'postgres':
+			await PostgresTriggerService.deletePostgresTrigger({ workspace, path })
+			return true
+		case 'sqs':
+			await SqsTriggerService.deleteSqsTrigger({ workspace, path })
+			return true
+		case 'gcp':
+			await GcpTriggerService.deleteGcpTrigger({ workspace, path })
+			return true
+		case 'email':
+			await EmailTriggerService.deleteEmailTrigger({ workspace, path })
+			return true
+		default:
+			return false
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDrafts.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDrafts.ts
new file mode 100644
index 0000000000..7fd2998923
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTriggerDrafts.ts
@@ -0,0 +1,26 @@
+import type { PipelineTriggerDraftKind } from './types'
+
+export const DRAFTABLE_TRIGGER_KINDS: readonly PipelineTriggerDraftKind[] = [
+	'schedule',
+	'email',
+	'kafka',
+	'mqtt',
+	'amqp',
+	'nats',
+	'postgres',
+	'sqs',
+	'gcp'
+]
+
+export function isDraftableTriggerKind(kind: string): kind is PipelineTriggerDraftKind {
+	return (DRAFTABLE_TRIGGER_KINDS as readonly string[]).includes(kind)
+}
+
+/** Drafts are keyed by kind too: two kinds may share a trigger path. */
+export function triggerDraftKey(kind: string, path: string): string {
+	return `${kind}:${path}`
+}
+
+export function defaultTriggerPath(scriptPath: string, kind: PipelineTriggerDraftKind): string {
+	return `${scriptPath}_${kind}`
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
index c57687d78b..6d38a8c119 100644
--- a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
 	resolveGraph,
 	computeMutedReadKeys,
+	pipelineNodeErrors,
 	dbtAssociations,
 	type ResolveGraphInput
 } from './resolveGraph'
@@ -492,6 +493,49 @@ describe('resolveGraph', () => {
 		expect(r.edges.some((e) => e.asset_path === 'main/out' && e.access_type === 'w')).toBe(true)
 	})
 
+	it('drops a persisted asset the open script renamed away, unless something still uses it', () => {
+		const write = (runnable_path: string, asset_path: string) => ({
+			runnable_path,
+			runnable_kind: 'script' as const,
+			asset_kind: 's3object' as const,
+			asset_path,
+			access_type: 'w' as const
+		})
+		const base = baseGraph({
+			assets: [
+				{ kind: 's3object', path: '/old.json' },
+				{ kind: 's3object', path: '/shared.json' },
+				{ kind: 's3object', path: '/unreferenced.json' }
+			],
+			runnables: [
+				{ path: 'f/x/prod', usage_kind: 'script' },
+				{ path: 'f/x/other', usage_kind: 'script' }
+			],
+			edges: [write('f/x/prod', '/old.json'), write('f/x/prod', '/shared.json')],
+			triggers: [
+				{
+					trigger_kind: 'asset',
+					asset_kind: 's3object',
+					asset_path: '/shared.json',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/other'
+				}
+			]
+		})
+		const r = resolveGraph(
+			input({
+				base,
+				liveAnnotations: { scriptPath: 'f/x/prod', annotations: ann() },
+				liveBodyAssets: { scriptPath: 'f/x/prod', assets: [s3('/new.json', 'w')] }
+			})
+		)
+		expect(r.assets.map((a) => a.path).sort()).toEqual([
+			'/new.json',
+			'/shared.json',
+			'/unreferenced.json'
+		])
+	})
+
 	it('editing a saved scd2 producer keeps both the base and _current persisted write edges', () => {
 		// Deploy persists a write to both `main/dim` and `main/dim_current`.
 		// Opening the producer for editing must not judge the companion `_current`
@@ -656,6 +700,31 @@ describe('resolveGraph', () => {
 		})
 	})
 
+	it('a trigger draft stands in for its draft script’s missing trigger of that kind', () => {
+		const drafts = new Map([['f/x/new', { script: { content: '// on schedule\n// on kafka' } }]])
+		const r = resolveGraph(
+			input({
+				drafts,
+				triggerDrafts: [
+					{ kind: 'schedule', config: { path: 'f/x/new_schedule', script_path: 'f/x/new' } }
+				]
+			})
+		)
+		expect(r.triggers.filter((t) => t.trigger_kind === 'kafka')).toEqual([
+			expect.objectContaining({ runnable_path: 'f/x/new', missing: true })
+		])
+		expect(r.triggers.filter((t) => t.trigger_kind === 'schedule')).toEqual([
+			{
+				trigger_kind: 'schedule',
+				path: 'f/x/new_schedule',
+				runnable_kind: 'script',
+				runnable_path: 'f/x/new',
+				unsaved: true,
+				draft: true
+			}
+		])
+	})
+
 	it('macro edges: base passes through; live `// use` adds an unsaved via_use edge', () => {
 		const base = baseGraph({
 			runnables: [
@@ -884,11 +953,11 @@ describe('live buffer overlays (open script)', () => {
 			access_type: 'w',
 			unsaved: true
 		})
-		// …the stale write edge is dropped, but the deployed dataset node stays.
+		// …the stale write edge is dropped, and with nothing else using it, so is the node.
 		expect(
 			r.edges.filter((e) => e.asset_path === 'main/orders' && e.runnable_path === 'f/x/prod')
 		).toEqual([])
-		expect(r.assets).toContainEqual({ kind: 'ducklake', path: 'main/orders' })
+		expect(r.assets).not.toContainEqual({ kind: 'ducklake', path: 'main/orders' })
 	})
 
 	it('open saved script: unchanged materialize target dedups against the persisted write edge', () => {
@@ -1083,9 +1152,7 @@ describe('dbtAssociations', () => {
 	it('counts only what the project materializes as its transforms', () => {
 		const { writesByOwner } = dbtAssociations(runnables, edges)
 		// Hovering the project highlights the models it builds, not its inputs.
-		expect([...(writesByOwner.get('script:f/a/dbtproj') ?? [])]).toEqual([
-			'asset:dbt:wh/s/model_a'
-		])
+		expect([...(writesByOwner.get('script:f/a/dbtproj') ?? [])]).toEqual(['asset:dbt:wh/s/model_a'])
 	})
 
 	it('ignores runnables that are not dbt', () => {
@@ -1162,8 +1229,160 @@ describe('dbtAssociations with two writers of one relation', () => {
 			writeBy('f/a/downstream')
 		])
 		expect(writesByOwner.get('script:f/a/upstream')).toEqual(new Set(['asset:dbt:wh/s/shared']))
-		expect(writesByOwner.get('script:f/a/downstream')).toEqual(
-			new Set(['asset:dbt:wh/s/shared'])
+		expect(writesByOwner.get('script:f/a/downstream')).toEqual(new Set(['asset:dbt:wh/s/shared']))
+	})
+})
+
+describe('pipelineNodeErrors', () => {
+	const edge = (runnable_path: string, asset_path: string, access_type: 'r' | 'w') => ({
+		runnable_path,
+		runnable_kind: 'script' as const,
+		asset_kind: 'ducklake' as const,
+		asset_path,
+		access_type
+	})
+	const graph = baseGraph({
+		assets: [
+			{ kind: 'ducklake', path: 'main/orphan' },
+			{ kind: 'ducklake', path: 'main/produced' },
+			{ kind: 'ducklake', path: 'main/external' }
+		],
+		runnables: [
+			{ path: 'f/x/prod', usage_kind: 'script' },
+			{ path: 'f/x/cons', usage_kind: 'script' }
+		],
+		edges: [
+			edge('f/x/prod', 'main/produced', 'w'),
+			edge('f/x/cons', 'main/produced', 'r'),
+			edge('f/x/cons', 'main/external', 'r')
+		]
+	})
+
+	it('flags an unused asset, and a `// on` with no producer and its script, but not a plain read', () => {
+		const onRefs = (...paths: string[]) =>
+			paths.map((path) => ({ kind: 'ducklake' as const, path }))
+		const none = pipelineNodeErrors(graph, new Map())
+		expect([...none.assets.keys()]).toEqual(['ducklake:main/orphan'])
+		expect(none.scripts.size).toBe(0)
+		const errors = pipelineNodeErrors(
+			graph,
+			new Map([['f/x/cons', onRefs('main/produced', 'main/external')]])
 		)
+		// The subscriber is at fault, not the asset nothing writes.
+		expect([...errors.assets.keys()]).toEqual(['ducklake:main/orphan'])
+		expect([...errors.scripts.keys()]).toEqual(['f/x/cons'])
+		expect([...errors.unwritten.keys()]).toEqual(['ducklake:main/external'])
+	})
+
+	it('flags a pipeline script nothing starts, but not a macro library or a triggered one', () => {
+		const g = baseGraph({
+			runnables: [
+				{ path: 'f/x/stray', usage_kind: 'script', in_pipeline: true },
+				{ path: 'f/x/lib', usage_kind: 'script', in_pipeline: true, macros: [{ name: 'm' }] },
+				{ path: 'f/x/timed', usage_kind: 'script', in_pipeline: true }
+			] as any,
+			triggers: [
+				{
+					trigger_kind: 'schedule',
+					path: 'f/x/timed_schedule',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/timed'
+				}
+			]
+		})
+		expect([...pipelineNodeErrors(g, new Map()).untriggered.keys()]).toEqual(['f/x/stray'])
+	})
+
+	it('flags a script only started by reads of assets nothing writes', () => {
+		const g = baseGraph({
+			assets: [{ kind: 'ducklake', path: 'main/raw' }],
+			runnables: [{ path: 'f/x/reader', usage_kind: 'script', in_pipeline: true }] as any,
+			edges: [
+				{
+					runnable_path: 'f/x/reader',
+					runnable_kind: 'script',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					access_type: 'r'
+				}
+			],
+			triggers: [
+				{
+					trigger_kind: 'asset',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/reader'
+				}
+			]
+		})
+		expect(pipelineNodeErrors(g, new Map()).untriggered.get('f/x/reader')).toBe('unwritten-inputs')
+		expect(
+			pipelineNodeErrors(g, new Map(), new Set(['ducklake:main/raw'])).untriggered.size
+		).toBe(0)
+	})
+
+	it('does not count a flow write as starting an asset-triggered script', () => {
+		const g = baseGraph({
+			assets: [{ kind: 'ducklake', path: 'main/raw' }],
+			runnables: [
+				{ path: 'f/x/reader', usage_kind: 'script', in_pipeline: true },
+				{ path: 'f/x/loader', usage_kind: 'flow' }
+			] as any,
+			edges: [
+				{
+					runnable_path: 'f/x/loader',
+					runnable_kind: 'flow',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					access_type: 'w'
+				}
+			],
+			triggers: [
+				{
+					trigger_kind: 'asset',
+					asset_kind: 'ducklake',
+					asset_path: 'main/raw',
+					runnable_kind: 'script',
+					runnable_path: 'f/x/reader'
+				}
+			]
+		} as any)
+		expect(pipelineNodeErrors(g, new Map()).untriggered.get('f/x/reader')).toBe('unwritten-inputs')
+	})
+
+	it('clears a subscription the workspace writes outside the pipeline', () => {
+		const errors = pipelineNodeErrors(
+			graph,
+			new Map([['f/x/cons', [{ kind: 'ducklake' as const, path: 'main/external' }]]]),
+			new Set(['ducklake:main/external'])
+		)
+		expect(errors.scripts.size).toBe(0)
+		expect(errors.unwritten.size).toBe(0)
+	})
+
+	it('treats dbt models as used and written by their (hidden) project, but not dbt sources', () => {
+		const dbt = (path: string, resource_type: string) => ({
+			kind: 'dbt' as const,
+			path,
+			dbt: { unique_id: `x.${path}`, resource_type } as any
+		})
+		const errors = pipelineNodeErrors(
+			baseGraph({
+				assets: [dbt('mart', 'model'), dbt('raw', 'source')],
+				runnables: [{ path: 'f/x/s', usage_kind: 'script' }]
+			}),
+			new Map([
+				[
+					'f/x/s',
+					[
+						{ kind: 'dbt', path: 'mart' },
+						{ kind: 'dbt', path: 'raw' }
+					]
+				]
+			])
+		)
+		expect([...errors.unwritten.keys()]).toEqual(['dbt:raw'])
+		expect([...errors.scripts.keys()]).toEqual(['f/x/s'])
 	})
 })
diff --git a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
index 5c8aa697a4..b178de3387 100644
--- a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
@@ -1,4 +1,9 @@
-import type { AssetGraphMacroEdge, AssetGraphResponse, NativeTriggerKind } from './types'
+import type {
+	AssetGraphMacroEdge,
+	AssetGraphResponse,
+	NativeTriggerKind,
+	PipelineTriggerDraft
+} from './types'
 import {
 	mergeColumnLineage,
 	parsePipelineAnnotations,
@@ -46,6 +51,8 @@ export type ResolveGraphInput = {
 	 * annotation has no matching trigger row in `base.triggers`.
 	 */
 	annotatedNativeKindsByPath: Map<string, Set<NativeTriggerKind>>
+	/** Undeployed triggers; each stands in for its script's missing trigger of that kind. */
+	triggerDrafts?: Iterable<PipelineTriggerDraft>
 }
 
 /** Mutable bag the sequential passes accumulate the resolved graph into. */
@@ -264,16 +271,200 @@ export function resolveGraph(input: ResolveGraphInput): AssetGraphResponse {
 	// there is nothing to show (also keeps the no-macros response shape
 	// byte-identical to before the feature).
 	const macroEdges = resolveMacroEdges(input)
+	const triggers = withTriggerDrafts(
+		[...baseTriggers, ...acc.extraTriggers],
+		input.triggerDrafts ?? []
+	)
 	return {
 		...base,
-		assets: acc.assets,
+		assets: dropOrphanedAssets(acc.assets, base, acc.edges, triggers),
 		runnables: acc.runnables,
 		edges: acc.edges,
-		triggers: [...baseTriggers, ...acc.extraTriggers],
+		triggers,
 		...(macroEdges.length > 0 || base.macro_edges ? { macro_edges: macroEdges } : {})
 	}
 }
 
+function withTriggerDrafts(
+	triggers: AssetGraphResponse['triggers'],
+	triggerDrafts: Iterable<PipelineTriggerDraft>
+): AssetGraphResponse['triggers'] {
+	const drafts = [...triggerDrafts]
+	if (drafts.length === 0) return triggers
+	const drafted = new Set(drafts.map((d) => `${d.kind}:${d.config.script_path}`))
+	return [
+		...triggers.filter(
+			(t) =>
+				!(
+					t.trigger_kind !== 'asset' &&
+					t.missing &&
+					t.runnable_kind === 'script' &&
+					drafted.has(`${t.trigger_kind}:${t.runnable_path}`)
+				)
+		),
+		...drafts.map((d) => ({
+			trigger_kind: d.kind,
+			path: d.config.path,
+			runnable_kind: 'script' as const,
+			runnable_path: d.config.script_path,
+			unsaved: true,
+			draft: true,
+			...(d.kind === 'schedule'
+				? { schedule: d.config.schedule as string, timezone: d.config.timezone as string }
+				: {}),
+			...(d.config.summary ? { summary: d.config.summary as string } : {})
+		}))
+	]
+}
+
+/** Why a node is red, and what the Fix actions act on. */
+export type PipelineNodeErrors = {
+	/** `kind:path` → reason. */
+	assets: Map<string, string>
+	/** Script path → reason. */
+	scripts: Map<string, string>
+	/** Subscribed assets nothing writes: `kind:path` → the asset and its subscribers. */
+	unwritten: Map<string, { asset: { kind: AssetKind; path: string }; subscribers: string[] }>
+	/** Script path → the unwritten asset it runs on (its first, when several). */
+	waitsOn: Map<string, { kind: AssetKind; path: string }>
+	/** Pipeline scripts nothing starts → why: no trigger at all, or only asset
+	 * triggers on assets nothing writes (an auto-triggering read included). */
+	untriggered: Map<string, 'no-trigger' | 'unwritten-inputs'>
+	/** Assets some asset trigger waits on that nothing in the pipeline writes: the
+	 * ones to look up across the workspace for `writtenElsewhere`. */
+	unwrittenTriggerAssets: Set<string>
+}
+
+/**
+ * Nodes the pipeline cannot work with, with the reason. Assets (keyed
+ * `kind:path`): one nothing uses at all. Scripts (keyed by path): one
+ * subscribed (`// on <asset>`) to an asset nothing writes, in the pipeline or,
+ * per `writtenElsewhere`, by a script anywhere else in the workspace, since the subscription can never fire; the asset itself is
+ * fine, and is reported in `unwritten`. A body read of an external asset is fine and is not passed here:
+ * only the explicit `// on` annotations, per script path, count as subscriptions.
+ */
+export function pipelineNodeErrors(
+	graph: AssetGraphResponse,
+	explicitOnByPath: Map<string, Array<{ kind: AssetKind; path: string }>>,
+	writtenElsewhere: ReadonlySet<string> = new Set()
+): PipelineNodeErrors {
+	const referenced = referencedAssetKeys(graph)
+	// Only a script's write fires an asset trigger: a flow's never does.
+	const written = new Set(
+		graph.edges
+			.filter(
+				(e) => e.runnable_kind === 'script' && (e.access_type === 'w' || e.access_type === 'rw')
+			)
+			.map((e) => `${e.asset_kind}:${e.asset_path}`)
+	)
+	for (const k of writtenElsewhere) written.add(k)
+	// The dbt project's own edges are hidden from the pipeline graph (see
+	// `hideDbtRunnables`), so its relations are judged by their provenance: the
+	// project uses every one, and materializes all but its sources.
+	for (const a of graph.assets) {
+		if (!a.dbt) continue
+		referenced.add(`${a.kind}:${a.path}`)
+		if (a.dbt.resource_type !== 'source') written.add(`${a.kind}:${a.path}`)
+	}
+	const errors = new Map<string, string>()
+	const scriptErrors = new Map<string, string>()
+	const unwritten: PipelineNodeErrors['unwritten'] = new Map()
+	const waitsOn: PipelineNodeErrors['waitsOn'] = new Map()
+	for (const a of graph.assets) {
+		const key = `${a.kind}:${a.path}`
+		if (!referenced.has(key)) errors.set(key, 'nothing in the pipeline uses it')
+	}
+	const scripts = new Set(
+		graph.runnables.filter((r) => r.usage_kind === 'script').map((r) => r.path)
+	)
+	for (const [path, refs] of explicitOnByPath) {
+		if (!scripts.has(path)) continue
+		for (const ref of refs) {
+			const key = `${ref.kind}:${ref.path}`
+			if (written.has(key)) continue
+			const entry = unwritten.get(key) ?? { asset: ref, subscribers: [] }
+			if (!entry.subscribers.includes(path)) entry.subscribers.push(path)
+			unwritten.set(key, entry)
+			if (!scriptErrors.has(path)) {
+				scriptErrors.set(path, `runs on ${ref.path}, which nothing writes`)
+				waitsOn.set(path, ref)
+			}
+		}
+	}
+	// A pipeline script nothing starts runs only by hand. An asset trigger starts
+	// it only if something writes that asset, which covers the automatic trigger
+	// of a ducklake/s3 read too. dbt projects and macro libraries are never
+	// started on their own, so they are left out.
+	const assetKey = (t: { asset_kind: AssetKind; asset_path: string }) =>
+		`${t.asset_kind}:${t.asset_path}`
+	const unwrittenTriggerAssets = new Set<string>()
+	const hasTrigger = new Set<string>()
+	const started = new Set<string>()
+	for (const t of graph.triggers) {
+		hasTrigger.add(t.runnable_path)
+		if (t.trigger_kind !== 'asset') started.add(t.runnable_path)
+		else if (written.has(assetKey(t))) started.add(t.runnable_path)
+		else unwrittenTriggerAssets.add(assetKey(t))
+	}
+	for (const k of unwritten.keys()) unwrittenTriggerAssets.add(k)
+	const untriggered: PipelineNodeErrors['untriggered'] = new Map()
+	for (const r of graph.runnables) {
+		if (r.usage_kind !== 'script' || !r.in_pipeline || r.dbt || r.macros?.length) continue
+		if (started.has(r.path) || scriptErrors.has(r.path)) continue
+		const why = hasTrigger.has(r.path) ? 'unwritten-inputs' : 'no-trigger'
+		untriggered.set(r.path, why)
+		scriptErrors.set(
+			r.path,
+			why === 'no-trigger'
+				? 'nothing starts it: it has no trigger'
+				: 'nothing starts it: nothing writes the assets it runs after'
+		)
+	}
+	return {
+		assets: errors,
+		scripts: scriptErrors,
+		unwritten,
+		waitsOn,
+		untriggered,
+		unwrittenTriggerAssets
+	}
+}
+
+function referencedAssetKeys(
+	graph: Pick<AssetGraphResponse, 'edges' | 'triggers' | 'test_edges' | 'dbt_edges'>
+): Set<string> {
+	const keys = new Set<string>()
+	for (const e of graph.edges) keys.add(`${e.asset_kind}:${e.asset_path}`)
+	for (const t of graph.triggers)
+		if (t.trigger_kind === 'asset') keys.add(`${t.asset_kind}:${t.asset_path}`)
+	for (const e of graph.test_edges ?? []) keys.add(`${e.asset_kind}:${e.asset_path}`)
+	for (const e of graph.dbt_edges ?? []) {
+		keys.add(`dbt:${e.from_asset_path}`)
+		keys.add(`dbt:${e.to_asset_path}`)
+	}
+	return keys
+}
+
+/**
+ * The backend only returns assets something references, so a deployed asset
+ * whose every edge and trigger the draft/live overlays stripped — an output the
+ * open script renamed — would linger as an edgeless node until the deploy
+ * lands. Assets that were already unreferenced in `base` are left alone.
+ */
+function dropOrphanedAssets(
+	assets: AssetGraphResponse['assets'],
+	base: AssetGraphResponse,
+	edges: AssetGraphResponse['edges'],
+	triggers: AssetGraphResponse['triggers']
+): AssetGraphResponse['assets'] {
+	const before = referencedAssetKeys(base)
+	const after = referencedAssetKeys({ ...base, edges, triggers })
+	return assets.filter((a) => {
+		const key = `${a.kind}:${a.path}`
+		return !before.has(key) || after.has(key)
+	})
+}
+
 /**
  * Macro-library → consumer edges: the deployed base edges, with `// use`
  * declarations of overlaid scripts (drafts + the open buffer) taking over
@@ -848,7 +1039,6 @@ function overlayInferredLineage(acc: Accumulator, input: ResolveGraphInput) {
 	overlayLineage(inferredReadsByPath, 'r')
 }
 
-
 /** dbt project ↔ relation association, for a graph that does NOT draw it.
  *
  * A dbt script owns every relation of its project, so drawing one edge per
diff --git a/frontend/src/lib/components/assets/AssetGraph/types.ts b/frontend/src/lib/components/assets/AssetGraph/types.ts
index 023f71e218..4ee7aa0216 100644
--- a/frontend/src/lib/components/assets/AssetGraph/types.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/types.ts
@@ -6,6 +6,12 @@ export type GraphUsageKind = 'script' | 'flow'
 export interface AssetGraphAssetNode {
 	kind: AssetKind
 	path: string
+	// Filled in client-side: the node is misconfigured (see `pipelineNodeErrors`).
+	error?: string
+	// Filled in client-side: no script in the workspace writes it, so a step
+	// downstream of it would never run on its writes (a flow's write fires no
+	// asset trigger).
+	never_written?: boolean
 	// Fork workspaces only: 'fork' when this ducklake asset was materialized in
 	// the fork itself, 'deferred' when reads fall back to the parent workspace's
 	// current table via a defer view. Absent outside forks / for other kinds /
@@ -70,6 +76,12 @@ export interface DbtDataTest {
 export interface AssetGraphRunnableNode {
 	path: string
 	usage_kind: GraphUsageKind
+	// Filled in client-side (not sent by the backend): the canvas titles the
+	// node with the summary over the path, and shows the language's icon.
+	summary?: string
+	language?: import('$lib/gen').ScriptLang
+	// Why the script is misconfigured, when it is (see `pipelineNodeErrors`).
+	error?: string
 	// Script has `// pipeline` annotation. Drives the pipeline-member
 	// visual state; unrelated to what the script actually writes (that's
 	// parsed separately into lineage edges).
@@ -170,6 +182,17 @@ export type NativeTriggerKind =
 	| 'gcp'
 	| 'data_upload'
 
+export type PipelineTriggerDraftKind = Exclude<NativeTriggerKind, 'webhook' | 'data_upload'>
+
+/** A trigger configured in the pipeline editor but not deployed yet. It lives only
+ * in the pipeline's draft bundle, never as a workspace trigger draft, and is
+ * created when the pipeline is saved. `config` is what the kind's editor saves
+ * (for a schedule, a `NewSchedule`). */
+export type PipelineTriggerDraft = {
+	kind: PipelineTriggerDraftKind
+	config: Record<string, any> & { path: string; script_path: string }
+}
+
 export type AssetGraphTrigger =
 	| {
 			trigger_kind: 'asset'
@@ -192,6 +215,13 @@ export type AssetGraphTrigger =
 			// the canvas renders a red placeholder with a "Create trigger"
 			// affordance instead of a fully-wired source.
 			missing?: boolean
+			// A pipeline-local `PipelineTriggerDraft`: `path` is the trigger it
+			// will be deployed as, and no row exists yet.
+			draft?: boolean
+			// A schedule's cron, zone and summary, filled in client-side, for the node's labels.
+			schedule?: string
+			timezone?: string
+			summary?: string
 	  }
 
 // Macro-library → consumer edge: the consumer calls `macro_names` of
diff --git a/frontend/src/lib/components/assets/AssetGraph/upstreamScriptItems.ts b/frontend/src/lib/components/assets/AssetGraph/upstreamScriptItems.ts
new file mode 100644
index 0000000000..43090adb48
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/upstreamScriptItems.ts
@@ -0,0 +1,32 @@
+import type { Item } from '$lib/utils'
+import type { ScriptLang } from '$lib/gen'
+import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
+import { Code2 } from 'lucide-svelte'
+
+export type UpstreamScript = { path: string; summary?: string; language?: ScriptLang }
+
+/** A menu of the scripts that produce an asset, to pick the one to open. */
+export function upstreamScriptItems(
+	scripts: UpstreamScript[],
+	onPick: (path: string) => void
+): Item[] {
+	return scripts.map((s) => ({
+		displayName: s.summary || s.path,
+		description: s.summary ? s.path : undefined,
+		...(s.language
+			? { icon: LanguageIcon, iconProps: { lang: s.language, width: 14, height: 14 } }
+			: { icon: Code2 }),
+		action: () => onPick(s.path)
+	}))
+}
+
+/** An upstream trigger the asset pane can open, and how. */
+export type UpstreamTriggerAction = { label: string; detail?: string; onOpen: () => void }
+
+export function upstreamTriggerItems(triggers: UpstreamTriggerAction[]): Item[] {
+	return triggers.map((t) => ({
+		displayName: t.label,
+		description: t.detail,
+		action: () => t.onOpen()
+	}))
+}
diff --git a/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte b/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte
index 392018750d..508543b49b 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte
@@ -1,14 +1,16 @@
 <script lang="ts">
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { type AuditLog } from '$lib/gen'
-	import { ArrowRight } from 'lucide-svelte'
+	import { displayDate } from '$lib/utils'
+	import { ExternalLink, X } from 'lucide-svelte'
 
 	interface Props {
 		logs: AuditLog[]
 		selectedId?: number | undefined
+		onClose?: () => void
 	}
 
-	let { logs, selectedId = undefined }: Props = $props()
+	let { logs, selectedId = undefined, onClose }: Props = $props()
 
 	// `span` holds the caller's token prefix, except for job-minted worker tokens, which
 	// stamp the job they run for instead.
@@ -19,11 +21,27 @@
 	const ViewAppOp: AuditLog['operation'][] = ['apps.create', 'apps.update']
 </script>
 
-<div class="p-4 flex flex-col gap-2 border-t items-start">
+<div class="flex flex-col items-start">
 	{#if selectedId}
 		{@const log = logs.find((e) => e.id === selectedId)}
 		{#if log}
-			<div class="flex flex-col gap-6 w-full">
+			<div class="flex flex-row items-center justify-between gap-2 w-full px-4 py-2 border-b">
+				<div class="flex flex-col min-w-0">
+					<span class="text-xs font-semibold text-emphasis truncate">{log.operation}</span>
+					<span class="text-2xs text-secondary">{displayDate(log.timestamp)}</span>
+				</div>
+				{#if onClose}
+					<Button
+						variant="subtle"
+						unifiedSize="sm"
+						iconOnly
+						startIcon={{ icon: X }}
+						onClick={onClose}
+						aria-label="Close log details"
+					/>
+				{/if}
+			</div>
+			<div class="flex flex-col gap-6 w-full p-4">
 				<div class="flex flex-col gap-1">
 					<span class="font-semibold text-xs text-emphasis">ID</span>
 					<span class="text-xs">{log.id}</span>
@@ -49,9 +67,10 @@
 				{#if log?.parameters?.uuid}
 					<Button
 						href={`run/${log.parameters.uuid}`}
-						variant="accent"
+						variant="default"
 						unifiedSize="md"
 						target="_blank"
+						endIcon={{ icon: ExternalLink }}
 						wrapperClasses="w-fit"
 					>
 						View run
@@ -64,6 +83,7 @@
 						variant="default"
 						unifiedSize="md"
 						target="_blank"
+						endIcon={{ icon: ExternalLink }}
 						wrapperClasses="w-fit"
 					>
 						View script
@@ -76,7 +96,7 @@
 						variant="default"
 						unifiedSize="md"
 						target="_blank"
-						endIcon={{ icon: ArrowRight }}
+						endIcon={{ icon: ExternalLink }}
 						wrapperClasses="w-fit"
 					>
 						View flow
@@ -88,7 +108,7 @@
 						variant="default"
 						unifiedSize="md"
 						target="_blank"
-						endIcon={{ icon: ArrowRight }}
+						endIcon={{ icon: ExternalLink }}
 						wrapperClasses="w-fit"
 					>
 						View app
@@ -97,6 +117,6 @@
 			</div>
 		{/if}
 	{:else}
-		<span class="text-xs text-primary font-normal">No log selected</span>
+		<span class="p-4 text-xs text-primary font-normal">No log selected</span>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte
index f1c123bb11..f3d84f872b 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogMobileFilters.svelte
@@ -14,7 +14,7 @@
 	contentClasses="p-4 flex flex-col w-80 pt-8 bg-surface"
 >
 	{#snippet trigger()}
-		<Button variant="accent" unifiedSize="md" nonCaptureEvent={true} startIcon={{ icon: Filter }}>
+		<Button variant="accent" unifiedSize="sm" nonCaptureEvent={true} startIcon={{ icon: Filter }}>
 			Filters
 		</Button>
 	{/snippet}
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index 4090a39dbb..e2e502b30c 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -18,7 +18,10 @@
 	import type { ActionKind } from '$lib/common'
 
 	import Button from '$lib/components/common/button/Button.svelte'
-	import CalendarPicker from '$lib/components/common/calendarPicker/CalendarPicker.svelte'
+	import TimeframeSelect, {
+		auditTimeframes,
+		useSyncedTimeframe
+	} from '$lib/components/runs/TimeframeSelect.svelte'
 	import {
 		type AuditLog,
 		ResourceService,
@@ -29,7 +32,7 @@
 	} from '$lib/gen'
 
 	import { userStore, workspaceStore } from '$lib/stores'
-	import { ChevronDown, Download, Loader2, RefreshCcw } from 'lucide-svelte'
+	import { ChevronDown, Download } from 'lucide-svelte'
 	import { onDestroy, onMount, untrack } from 'svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
@@ -44,7 +47,6 @@
 	interface Props {
 		logs?: AuditLog[]
 		username?: string
-		pageIndex?: number | undefined
 		before?: string | undefined
 		after?: string | undefined
 		perPage?: number | undefined
@@ -53,13 +55,14 @@
 		actionKind?: ActionKind | 'all'
 		scope?: undefined | 'all_workspaces' | 'instance'
 		loading?: boolean
+		/** Lay the filters out in a row (the page header band) rather than stacked (the popover). */
+		inline?: boolean
 		onRefresh?: () => void
 	}
 
 	let {
 		logs = undefined,
 		username = $bindable('all'),
-		pageIndex = $bindable(1),
 		before = $bindable(undefined),
 		after = $bindable(undefined),
 		perPage = $bindable(100),
@@ -68,6 +71,7 @@
 		actionKind = $bindable(undefined),
 		scope = $bindable(undefined),
 		loading = false,
+		inline = false,
 		onRefresh
 	}: Props = $props()
 
@@ -100,7 +104,6 @@
 		}
 
 		addQueryParam('username', username)
-		addQueryParam('page', pageIndex)
 		addQueryParam('perPage', perPage)
 		addQueryParam('before', before)
 		addQueryParam('after', after)
@@ -120,7 +123,6 @@
 	function handlePopState() {
 		const urlSearchParams = new URLSearchParams(window.location.search)
 		username = urlSearchParams.get('username') ?? 'all'
-		pageIndex = Number(urlSearchParams.get('page')) || 1
 		before = urlSearchParams.get('before') ?? undefined
 		after = urlSearchParams.get('after') ?? undefined
 		perPage = Number(urlSearchParams.get('perPage')) || 100
@@ -263,15 +265,38 @@
 
 	// observe all the variables that should be reflected in the url
 	$effect(() => {
-		;[username, perPage, before, after, operation, resource, actionKind, scope, pageIndex]
+		;[username, perPage, before, after, operation, resource, actionKind, scope]
 		untrack(() => updateQueryParams())
 	})
+
+	// The bounds stay the filters' own `after`/`before`, because the timeline's zoom writes them
+	// too; picking a preset resolves it to a concrete pair here rather than keeping a label that
+	// the chart could then contradict.
+	const _timeframe = useSyncedTimeframe(
+		auditTimeframes,
+		() => ({ minTs: after, maxTs: before }),
+		(v) => {
+			const { minTs, maxTs } = v.timeframe
+				? (auditTimeframes.find((t) => t.label === v.timeframe)?.computeMinMax() ?? {
+						minTs: null,
+						maxTs: null
+					})
+				: { minTs: v.minTs ?? null, maxTs: v.maxTs ?? null }
+			after = minTs ?? undefined
+			before = maxTs ?? undefined
+		}
+	)
 </script>
 
-<div class="flex flex-col gap-8 2xl:gap-2 2xl:flex-row mt-4 xl:mt-0 pr-2">
+<!-- No labels above the controls: each one says what it filters while it is unset ("all usernames"),
+     and once it is set the value names the field by itself. That halves the row's height, which is
+     what lets it sit in the header band, and halves its width, which is what lets it stay there.
+     `inline` rather than a breakpoint: the caller measures whether the row fits the width the band
+     leaves it, which a media query cannot see — the sidebar, a side panel and the filters' own
+     values all move that width without moving the viewport's. -->
+<div class={inline ? 'flex flex-row gap-2 items-center pr-2' : 'flex flex-col gap-2'}>
 	{#if $workspaceStore == 'admins'}
-		<div class="flex gap-1 relative">
-			<span class="text-xs absolute font-semibold text-emphasis -top-4">Scope</span>
+		<div class="flex min-w-0 shrink-0">
 			<ToggleButtonGroup
 				selected={scope ?? 'admins'}
 				on:selected={({ detail }) => {
@@ -301,49 +326,31 @@
 			</ToggleButtonGroup>
 		</div>
 	{/if}
-	<div class="flex relative bg-surface-input">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">From</span>
-		<input type="text" value={after ?? 'From'} disabled />
-		<CalendarPicker
-			clearable
-			date={after}
-			placement="bottom-end"
-			label="From"
-			on:change={({ detail }) => {
-				after = new Date(detail).toISOString()
-			}}
-			on:clear={() => {
-				after = undefined
-			}}
-		/>
-	</div>
-	<div class="flex relative bg-surface-input">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">To</span>
-		<input type="text" value={before ?? 'To'} disabled />
-		<CalendarPicker
-			clearable
-			bind:date={before}
-			label="To"
-			placement="bottom-end"
-			on:change={({ detail }) => {
-				before = new Date(detail).toISOString()
-			}}
-			on:clear={() => {
-				before = undefined
-			}}
-		/>
-	</div>
+	<!-- The same control the runs page uses: presets and a two-calendar range in one popover,
+	     in place of the two date fields this row used to carry. -->
+	<TimeframeSelect
+		unifiedSize="sm"
+		items={auditTimeframes}
+		bind:value={_timeframe.val}
+		{loading}
+		wrapperClasses="shrink-0"
+		onClick={() => {
+			loadUsers()
+			resources.refresh()
+			onRefresh?.()
+		}}
+	/>
 
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Username</span>
+	<div class="w-40 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			bind:value={username}
 			RightIcon={ChevronDown}
 			items={usernames
 				? [
 						...($userStore?.is_admin || $userStore?.is_super_admin
-							? [{ value: 'all', label: 'all' }]
+							? [{ value: 'all', label: 'all usernames' }]
 							: []),
 						...usernames.map((e) => ({
 							value: e,
@@ -354,41 +361,41 @@
 				: []}
 		/>
 	</div>
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Resource</span>
-
+	<div class="w-40 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			onCreateItem={(r) => (resources.value?.push(r), (resource = r))}
 			createText="Press enter to use this value"
 			bind:value={resource}
-			items={safeSelectItems(['all', ...(resources.value ?? [])])}
+			items={[{ value: 'all', label: 'all resources' }, ...safeSelectItems(resources.value ?? [])]}
 			inputClass="dark:!bg-gray-700"
 			RightIcon={ChevronDown}
 		/>
 	</div>
 
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Operation</span>
-
+	<div class="w-40 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			bind:value={operation}
-			items={['all', ...Object.values(operations)].map((r) => ({ value: r, label: r }))}
+			items={[
+				{ value: 'all', label: 'all operations' },
+				...Object.values(operations).map((r) => ({ value: r, label: r }))
+			]}
 			inputClass="dark:!bg-gray-700"
 			RightIcon={ChevronDown}
 		/>
 	</div>
 
-	<div class="flex relative">
-		<span class="text-xs absolute font-semibold text-emphasis -top-4">Action</span>
-
+	<div class="w-36 min-w-0 shrink">
 		<Select
 			class="w-full"
+			size="sm"
 			bind:value={actionKind}
 			RightIcon={ChevronDown}
 			items={[
-				{ value: 'all', label: 'all' },
+				{ value: 'all', label: 'all actions' },
 				{ value: 'create', label: 'Create' },
 				{ value: 'update', label: 'Update' },
 				{ value: 'delete', label: 'Delete' },
@@ -397,7 +404,7 @@
 		/>
 	</div>
 
-	<div class="flex flex-row">
+	<div class="flex flex-row items-center gap-1">
 		<Button
 			variant="subtle"
 			on:click={() => {
@@ -406,41 +413,21 @@
 				username = 'all'
 				operation = 'all'
 				actionKind = 'all'
-				pageIndex = 1
 				perPage = 100
 				resource = 'all'
 				scope = undefined
 			}}
-			unifiedSize="md"
+			unifiedSize="sm"
 		>
 			Clear filters
 		</Button>
 		<Button
 			variant="subtle"
 			on:click={downloadAuditLogsAsJson}
-			unifiedSize="md"
+			unifiedSize="sm"
 			title="Downloads currently displayed logs only (up to {perPage} entries)"
 			startIcon={{ icon: Download }}
 			iconOnly
 		/>
-		<Button
-			variant="accent"
-			on:click={() => {
-				loadUsers()
-				resources.refresh()
-				onRefresh?.()
-			}}
-			unifiedSize="md"
-			wrapperClasses="ml-auto"
-		>
-			<div class="flex flex-row gap-1 items-center">
-				{#if loading}
-					<Loader2 size={14} class="animate-spin" />
-				{:else}
-					<RefreshCcw size={14} />
-				{/if}
-				Refresh
-			</div>
-		</Button>
 	</div>
 </div>
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte b/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte
index 372b2aadd3..5c2c140632 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte
@@ -1,17 +1,16 @@
 <script lang="ts">
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import type { AuditLog } from '$lib/gen'
-	import { displayDate } from '$lib/utils'
-	import { onMount, tick } from 'svelte'
+	import { displayDate, pluralize } from '$lib/utils'
 	import Button from '../common/button/Button.svelte'
-	import { ChevronLeft, ChevronRight, ListFilterPlus, Loader2 } from 'lucide-svelte'
+	import Select from '../select/Select.svelte'
+	import { ListFilterPlus, Loader2 } from 'lucide-svelte'
 	import VirtualList from '@tutorlatin/svelte-tiny-virtual-list'
 	import { twMerge } from 'tailwind-merge'
 	import BatchLoadProgress from '../BatchLoadProgress.svelte'
 
 	interface Props {
 		logs?: AuditLog[]
-		pageIndex?: number | undefined
 		perPage?: number | undefined
 		hasMore?: boolean
 		actionKind?: string | undefined
@@ -21,6 +20,8 @@
 		resourceFilter?: string | undefined
 		showWorkspace?: boolean
 		loading?: boolean
+		loadingExtra?: boolean
+		onLoadMore?: () => void
 		batchProgress?: { loaded: number; total: number } | null
 		batchSize?: number | null
 		onBatchSizeChange?: (batchSize: number) => void
@@ -30,7 +31,6 @@
 
 	let {
 		logs = [],
-		pageIndex = $bindable(1),
 		perPage = $bindable(100),
 		hasMore = true,
 		actionKind = $bindable(),
@@ -44,7 +44,9 @@
 		onBatchSizeChange,
 		onStopLoading,
 		onselect,
-		loading
+		loading,
+		loadingExtra = false,
+		onLoadMore
 	}: Props = $props()
 
 	function groupLogsByDay(logs: AuditLog[]): Record<string, AuditLog[]> {
@@ -92,18 +94,7 @@
 		return flatLogs
 	}
 
-	let tableHeight: number = $state(0)
-	let headerHeight: number = $state(0)
-	let footerHeight: number = $state(48)
-
-	function computeHeight() {
-		tableHeight =
-			document.querySelector('#audit-logs-table-wrapper')!.parentElement?.clientHeight ?? 0
-	}
-
-	onMount(() => {
-		tick().then(computeHeight)
-	})
+	let height: number = $state(0)
 
 	let groupedLogs = $derived(groupLogsByDay(logs))
 	let flatLogs = $derived(groupedLogs ? flattenLogs(groupedLogs) : undefined)
@@ -131,159 +122,165 @@
 		}
 		return 'gray'
 	}
-	let height = $derived(tableHeight - headerHeight - footerHeight)
 </script>
 
-<svelte:window onresize={() => computeHeight()} />
-
-<div class="divide-y min-w-[640px] h-full" id="audit-logs-table-wrapper">
-	<div bind:clientHeight={headerHeight}>
-		<div
-			class="flex flex-row bg-surface-secondary sticky top-0 w-full p-2 pr-4 text-2xs font-normal text-primary"
-		>
-			<div class="w-1/12">ID</div>
-			<div class={showWorkspace ? 'w-2/12' : 'w-3/12'}>Timestamp</div>
-			<div class={showWorkspace ? 'w-2/12' : 'w-3/12'}>Username</div>
-			{#if showWorkspace}
-				<div class="w-2/12">Workspace</div>
-			{/if}
-			<div class={showWorkspace ? 'w-2/12' : 'w-3/12'}>Operation</div>
-			<div class="w-2/12">Resource</div>
-		</div>
+<div class="flex flex-col min-w-[640px] h-full">
+	<!-- h-8 is mirrored by the detail pane's top offset on the audit logs page, so both cards
+	     start at the same height. -->
+	<div
+		class="flex flex-row items-center h-8 shrink-0 w-full px-2 pr-4 text-xs font-semibold text-emphasis"
+	>
+		<div class="w-1/12">ID</div>
+		<div class={showWorkspace ? 'w-2/12' : 'w-3/12'}>Timestamp</div>
+		<div class={showWorkspace ? 'w-2/12' : 'w-3/12'}>Username</div>
+		{#if showWorkspace}
+			<div class="w-2/12">Workspace</div>
+		{/if}
+		<div class={showWorkspace ? 'w-2/12' : 'w-3/12'}>Operation</div>
+		<div class="w-2/12">Resource</div>
 	</div>
 
-	{#if loading}
-		<div style="height: {height}px;" class="flex justify-center items-center">
-			<Loader2 class="animate-spin" />
-		</div>
-	{:else if !logs?.length}
-		<div
-			class="text-xs text-secondary p-8 flex justify-center items-center"
-			style="height: {height}px;"
-		>
-			No logs found for the selected filters.
-		</div>
-	{:else}
-		<VirtualList
-			width="100%"
-			{height}
-			itemCount={flatLogs?.length ?? 0}
-			itemSize={(index) => {
-				if (flatLogs?.[index]?.type === 'date') {
-					return 33
-				}
-				return 42
-			}}
-			overscanCount={20}
-			{stickyIndices}
-			scrollToAlignment="center"
-		>
-			{#snippet header()}{/snippet}
-			{#snippet item({ index, style })}
-				<div {style} class="w-full">
-					{#if flatLogs}
-						{@const logOrDate = flatLogs[index]}
+	<div
+		class="flex-1 min-h-0 border rounded-t-md overflow-clip bg-surface-tertiary"
+		bind:clientHeight={height}
+	>
+		{#if loading}
+			<div style="height: {height}px;" class="flex justify-center items-center">
+				<Loader2 class="animate-spin" />
+			</div>
+		{:else if !logs?.length}
+			<div
+				class="text-xs text-secondary p-8 flex justify-center items-center"
+				style="height: {height}px;"
+			>
+				No logs found for the selected filters.
+			</div>
+		{:else}
+			<VirtualList
+				width="100%"
+				{height}
+				itemCount={flatLogs?.length ?? 0}
+				itemSize={(index) => {
+					if (flatLogs?.[index]?.type === 'date') {
+						return 33
+					}
+					return 42
+				}}
+				overscanCount={20}
+				{stickyIndices}
+				scrollToAlignment="center"
+			>
+				{#snippet header()}{/snippet}
+				{#snippet item({ index, style })}
+					<div {style} class="w-full">
+						{#if flatLogs}
+							{@const logOrDate = flatLogs[index]}
 
-						{#if logOrDate}
-							{#if logOrDate?.type === 'date'}
-								<div
-									class="bg-surface-secondary py-2 border-b font-normal text-primary text-xs pl-5"
-								>
-									{logOrDate.date}
-								</div>
-							{:else}
-								<!-- svelte-ignore a11y_click_events_have_key_events -->
-								<!-- svelte-ignore a11y_no_static_element_interactions -->
-								<div
-									class={twMerge(
-										'flex flex-row items-center h-full w-full px-2 py-1 hover:bg-surface-hover cursor-pointer',
-										'text-primary text-xs',
-										logOrDate.log.id === selectedId ? 'bg-blue-50 dark:bg-blue-900/50' : ''
-									)}
-									role="button"
-									tabindex="0"
-									onclick={() => {
-										onselect?.(logOrDate.log.id)
-									}}
-								>
-									<div class="w-1/12 text-xs truncate">
-										{logOrDate.log.id}
+							{#if logOrDate}
+								{#if logOrDate?.type === 'date'}
+									<div
+										class="bg-surface-secondary py-2 border-b font-normal text-primary text-xs pl-5"
+									>
+										{logOrDate.date}
 									</div>
-									<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
-										{displayDate(logOrDate.log.timestamp)}
-									</div>
-									<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
-										<div class="flex flex-row gap-2 items-center">
-											<!-- end_user can be an arbitrarily long token label; truncate it rather
+								{:else}
+									<!-- svelte-ignore a11y_click_events_have_key_events -->
+									<!-- svelte-ignore a11y_no_static_element_interactions -->
+									<div
+										class={twMerge(
+											'flex flex-row items-center h-full w-full px-2 py-1 hover:bg-surface-hover cursor-pointer',
+											'text-primary text-xs',
+											logOrDate.log.id === selectedId ? 'bg-blue-50 dark:bg-blue-900/50' : ''
+										)}
+										role="button"
+										tabindex="0"
+										onclick={() => {
+											onselect?.(logOrDate.log.id)
+										}}
+									>
+										<div class="w-1/12 text-xs truncate">
+											{logOrDate.log.id}
+										</div>
+										<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
+											{displayDate(logOrDate.log.timestamp)}
+										</div>
+										<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
+											<div class="flex flex-row gap-2 items-center">
+												<!-- end_user can be an arbitrarily long token label; truncate it rather
 											than let it push the username out of the cell. -->
-											<div class="flex flex-row min-w-0 max-w-60 overflow-hidden">
-												<span class="whitespace-nowrap shrink-0" title={logOrDate.log.username}>
-													{logOrDate.log.username}
-												</span>
-												{#if logOrDate.log.parameters && 'end_user' in logOrDate.log.parameters}
-													<span
-														class="truncate pl-1"
-														title={String(logOrDate.log.parameters.end_user)}
-													>
-														({logOrDate.log.parameters.end_user})
+												<div class="flex flex-row min-w-0 max-w-60 overflow-hidden">
+													<span class="whitespace-nowrap shrink-0" title={logOrDate.log.username}>
+														{logOrDate.log.username}
 													</span>
-												{/if}
+													{#if logOrDate.log.parameters && 'end_user' in logOrDate.log.parameters}
+														<span
+															class="truncate pl-1"
+															title={String(logOrDate.log.parameters.end_user)}
+														>
+															({logOrDate.log.parameters.end_user})
+														</span>
+													{/if}
+												</div>
+												<Button
+													variant="subtle"
+													unifiedSize="sm"
+													iconOnly
+													startIcon={{ icon: ListFilterPlus }}
+													on:click={() => {
+														usernameFilter = logOrDate.log.username
+													}}
+												/>
+											</div>
+										</div>
+										{#if showWorkspace}
+											<div class="w-2/12 text-xs">
+												<div class="whitespace-nowrap overflow-x-auto no-scrollbar max-w-60">
+													{logOrDate.log.workspace_id}
+												</div>
+											</div>
+										{/if}
+										<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
+											<div class="flex flex-row gap-1">
+												<Badge
+													clickable
+													onclick={() => {
+														actionKind = logOrDate.log.action_kind.toLocaleLowerCase()
+													}}
+													color={kindToBadgeColor(logOrDate.log.action_kind)}
+												>
+													{logOrDate.log.action_kind}
+												</Badge>
+												<Badge
+													clickable
+													onclick={() => {
+														operation = logOrDate.log.operation
+													}}
+												>
+													{logOrDate.log.operation}
+												</Badge>
 											</div>
-											<Button
-												variant="subtle"
-												unifiedSize="sm"
-												iconOnly
-												startIcon={{ icon: ListFilterPlus }}
-												on:click={() => {
-													usernameFilter = logOrDate.log.username
-												}}
-											/>
 										</div>
-									</div>
-									{#if showWorkspace}
 										<div class="w-2/12 text-xs">
-											<div class="whitespace-nowrap overflow-x-auto no-scrollbar max-w-60">
-												{logOrDate.log.workspace_id}
+											<div class="flex flex-row gap-2 items-center">
+												<div class="whitespace-nowrap overflow-x-auto no-scrollbar max-w-60">
+													{logOrDate.log.resource}
+												</div>
+												<Button
+													variant="subtle"
+													unifiedSize="sm"
+													iconOnly
+													startIcon={{ icon: ListFilterPlus }}
+													on:click={() => {
+														resourceFilter = logOrDate.log.resource
+													}}
+												/>
 											</div>
 										</div>
-									{/if}
-									<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
-										<div class="flex flex-row gap-1">
-											<Badge
-												clickable
-												onclick={() => {
-													actionKind = logOrDate.log.action_kind.toLocaleLowerCase()
-												}}
-												color={kindToBadgeColor(logOrDate.log.action_kind)}
-											>
-												{logOrDate.log.action_kind}
-											</Badge>
-											<Badge
-												clickable
-												onclick={() => {
-													operation = logOrDate.log.operation
-												}}
-											>
-												{logOrDate.log.operation}
-											</Badge>
-										</div>
-									</div>
-									<div class="w-2/12 text-xs">
-										<div class="flex flex-row gap-2 items-center">
-											<div class="whitespace-nowrap overflow-x-auto no-scrollbar max-w-60">
-												{logOrDate.log.resource}
-											</div>
-											<Button
-												variant="subtle"
-												unifiedSize="sm"
-												iconOnly
-												startIcon={{ icon: ListFilterPlus }}
-												on:click={() => {
-													resourceFilter = logOrDate.log.resource
-												}}
-											/>
-										</div>
 									</div>
+								{/if}
+							{:else}
+								<div class="flex flex-row items-center h-full w-full px-2">
+									<div class="text-xs text-secondary">Loading...</div>
 								</div>
 							{/if}
 						{:else}
@@ -291,46 +288,29 @@
 								<div class="text-xs text-secondary">Loading...</div>
 							</div>
 						{/if}
-					{:else}
-						<div class="flex flex-row items-center h-full w-full px-2">
-							<div class="text-xs text-secondary">Loading...</div>
+					</div>
+				{/snippet}
+				{#snippet footer()}
+					{#if hasMore && !batchProgress}
+						<div class="flex justify-center py-1">
+							<Button
+								variant="subtle"
+								unifiedSize="sm"
+								loading={loadingExtra}
+								onClick={() => onLoadMore?.()}
+							>
+								Load next {perPage} logs
+							</Button>
 						</div>
 					{/if}
-				</div>
-			{/snippet}
-			{#snippet footer()}{/snippet}
-		</VirtualList>
-	{/if}
-	<!-- Pagination footer - always visible -->
+				{/snippet}
+			</VirtualList>
+		{/if}
+	</div>
 	<div
-		class="flex flex-row justify-between items-center p-2 bg-surface-primary border-t"
-		style:height={`${footerHeight}px`}
+		class="flex flex-row shrink-0 justify-between items-center h-12 px-2 py-1 bg-surface-tertiary border-x border-b rounded-b-md text-xs"
 	>
-		<div class="flex flex-row gap-2 items-center">
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				startIcon={{ icon: ChevronLeft }}
-				on:click={() => {
-					pageIndex = (pageIndex ?? 1) - 1
-				}}
-				disabled={pageIndex <= 1}
-			>
-				Previous
-			</Button>
-			<span class="text-xs text-secondary px-2">Page {pageIndex}</span>
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				endIcon={{ icon: ChevronRight }}
-				on:click={() => {
-					pageIndex = (pageIndex ?? 1) + 1
-				}}
-				disabled={!hasMore}
-			>
-				Next
-			</Button>
-		</div>
+		<span class="text-secondary px-2">{pluralize(logs?.length ?? 0, 'log')}</span>
 		{#if batchProgress}
 			<div class="flex-1 min-w-0 px-4">
 				<BatchLoadProgress
@@ -343,14 +323,16 @@
 				/>
 			</div>
 		{/if}
-		<div class="flex flex-row gap-2 items-center">
-			<span class="text-xs text-secondary">Per page:</span>
-			<select bind:value={perPage} class="text-xs border rounded-md px-2 py-1">
-				<option value={25}>25</option>
-				<option value={100}>100</option>
-				<option value={1000}>1000</option>
-			</select>
-		</div>
+		<Select
+			class="w-28"
+			bind:value={perPage}
+			items={[
+				{ value: 25, label: '25' },
+				{ value: 100, label: '100' },
+				{ value: 1000, label: '1000' }
+			]}
+			transformInputSelectedText={(_, v) => `${v} / page`}
+		/>
 	</div>
 </div>
 
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsTimeline.svelte b/frontend/src/lib/components/auditLogs/AuditLogsTimeline.svelte
index 4275b49e3b..0ec00b0d36 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsTimeline.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsTimeline.svelte
@@ -550,7 +550,7 @@
 	)
 </script>
 
-<div class="p-4 bg-surface mb-4 h-full text-xs">
+<div class="h-full text-xs">
 	{#if logs.length === 0}
 		<div class="text-center py-8 text-secondary"> No audit logs to display </div>
 	{:else if !groupedData || groupedData.status === 'loading'}
diff --git a/frontend/src/lib/components/auditLogs/useAuditLogsLoader.svelte.ts b/frontend/src/lib/components/auditLogs/useAuditLogsLoader.svelte.ts
index a7327fa942..4c76290b27 100644
--- a/frontend/src/lib/components/auditLogs/useAuditLogsLoader.svelte.ts
+++ b/frontend/src/lib/components/auditLogs/useAuditLogsLoader.svelte.ts
@@ -13,7 +13,6 @@ export interface AuditLogsLoaderArgs {
 	actionKind: ActionKind | 'all'
 	before: string | undefined
 	after: string | undefined
-	pageIndex: number
 	perPage: number
 }
 
@@ -23,44 +22,32 @@ const SMALL_BATCH_SIZE = 25
 const MAX_PER_PAGE = 1000
 
 /**
- * Where the first batch of a page starts. Rows are ordered by descending id, so the batches after
- * it follow a `before_id` cursor and only this one needs an offset. `page` can only express
- * offsets that are multiples of `batchSize`: land on the closest one at or below the page start,
- * and report how many rows of that batch belong to the previous page.
- */
-export function computeFirstBatch(
-	pageIndex: number,
-	perPage: number,
-	batchSize: number
-): { firstPage: number; skipFirst: number } {
-	const startOffset = (Math.max(1, pageIndex) - 1) * perPage
-	const firstPage = Math.floor(startOffset / batchSize) + 1
-	return { firstPage, skipFirst: startOffset - (firstPage - 1) * batchSize }
-}
-
-/**
- * Loads one page of audit logs, optionally streaming it in smaller batches so rows show up as
- * they arrive on instances where a full page takes a long time to come back.
+ * Loads the newest audit logs, optionally streaming them in smaller batches so rows show up as
+ * they arrive on instances where a full load takes a long time to come back, and appends older
+ * ones on demand. Rows are ordered by descending id, so every batch after the first follows a
+ * `before_id` cursor.
  */
 export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 	let logs: AuditLog[] | undefined = $state()
 	let loading = $state(false)
+	let loadingExtra = $state(false)
 	let hasMore = $state(false)
 	let batchProgress = $state<{ loaded: number; total: number } | null>(null)
 	let currentBatchSize = $state<number | null>(null)
 
 	let pendingLoad: CancelablePromise<void> | undefined
 	let pendingLoadHasRows = false
+	let pendingExtra: CancelablePromise<void> | undefined
+	// The batch size the user last picked, so a load-more after a streamed load streams too.
+	let streamBatchSize: number | undefined
 
 	function fetchBatch(
 		a: AuditLogsLoaderArgs,
-		page: number,
 		limit: number,
 		beforeId: number | undefined
 	): CancelablePromise<AuditLog[]> {
 		return AuditService.listAuditLogs({
 			workspace: a.scope === 'instance' ? 'global' : a.workspace!,
-			page,
 			perPage: limit,
 			beforeId,
 			before: a.before,
@@ -96,6 +83,8 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 		pendingLoad?.cancel()
 		pendingLoad = undefined
 		pendingLoadHasRows = false
+		cancelExtra()
+		streamBatchSize = batchSize
 
 		const a = args()
 		if (a.workspace == undefined && a.scope !== 'instance') {
@@ -106,7 +95,6 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 		const total = Math.min(Math.max(1, Math.floor(a.perPage) || 1), MAX_PER_PAGE)
 		const size = Math.min(Math.max(1, batchSize ?? total), total)
 		const isBatched = size < total
-		const { firstPage, skipFirst } = computeFirstBatch(a.pageIndex, total, size)
 
 		loading = true
 		batchProgress = isBatched ? { loaded: 0, total } : null
@@ -115,8 +103,8 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 		const acc: AuditLog[] = []
 		let slowBatchToastShown = false
 
-		function loadBatch(beforeId: number | undefined, skip: number): CancelablePromise<void> {
-			let fetch = fetchBatch(a, beforeId === undefined ? firstPage : 1, size, beforeId)
+		function loadBatch(beforeId: number | undefined): CancelablePromise<void> {
+			let fetch = fetchBatch(a, size, beforeId)
 			if (isBatched && size > 1) {
 				fetch = CancelablePromiseUtils.onTimeout(fetch, 4000, () => {
 					if (slowBatchToastShown) return
@@ -129,7 +117,7 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 				})
 			}
 			return CancelablePromiseUtils.then(fetch, (rows) => {
-				acc.push(...(skip > 0 ? rows.slice(skip) : rows).slice(0, total - acc.length))
+				acc.push(...rows.slice(0, total - acc.length))
 				logs = [...acc]
 				loading = false
 				pendingLoadHasRows = true
@@ -137,12 +125,12 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 					batchProgress = { loaded: acc.length, total }
 				}
 				if (rows.length < size || acc.length >= total) {
-					// Only once the page is complete: a half-streamed page says nothing about
-					// whether there is a next one.
+					// Only once the load is complete: a half-streamed one says nothing about
+					// whether older logs exist.
 					hasMore = acc.length >= total
 					return CancelablePromiseUtils.pure<void>(undefined)
 				}
-				return loadBatch(rows[rows.length - 1].id, 0)
+				return loadBatch(rows[rows.length - 1].id)
 			})
 		}
 
@@ -159,7 +147,7 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 			}, 15000)
 		}
 
-		let promise = loadBatch(undefined, skipFirst)
+		let promise = loadBatch(undefined)
 		if (!isBatched) {
 			promise = CancelablePromiseUtils.onTimeout(promise, 4000, () => {
 				const smaller = total > SMALL_BATCH_SIZE ? SMALL_BATCH_SIZE : 1
@@ -213,6 +201,82 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 		abandonLoad()
 	}
 
+	function cancelExtra() {
+		pendingExtra?.cancel()
+		pendingExtra = undefined
+		loadingExtra = false
+	}
+
+	function loadMore(batchSize: number | undefined = streamBatchSize) {
+		const last = logs?.[logs.length - 1]
+		if (!last || !hasMore || pendingLoad || pendingExtra) return
+		streamBatchSize = batchSize
+		const a = args()
+		const total = Math.min(Math.max(1, Math.floor(a.perPage) || 1), MAX_PER_PAGE)
+		const size = Math.min(Math.max(1, batchSize ?? total), total)
+		let appended = 0
+		loadingExtra = true
+
+		// Rows are appended as each batch lands, so stopping keeps them and the next load-more
+		// continues from the last one.
+		function extraBatch(beforeId: number): CancelablePromise<void> {
+			return CancelablePromiseUtils.then(fetchBatch(a, size, beforeId), (rows) => {
+				const kept = rows.slice(0, total - appended)
+				appended += kept.length
+				logs = [...(logs ?? []), ...kept]
+				// Checked before the short-batch end: a short batch trimmed to fit `total` still has
+				// rows left past the cut.
+				if (appended >= total) return CancelablePromiseUtils.pure<void>(undefined)
+				if (rows.length < size) {
+					hasMore = false
+					return CancelablePromiseUtils.pure<void>(undefined)
+				}
+				return extraBatch(rows[rows.length - 1].id)
+			})
+		}
+
+		let promise = CancelablePromiseUtils.onTimeout(extraBatch(last.id), 4000, () => {
+			const smaller = total > SMALL_BATCH_SIZE ? SMALL_BATCH_SIZE : 1
+			const offerBatches = size === total && total > 1
+			sendUserToast('Loading more audit logs is taking longer than expected...', 'warning', [
+				{
+					label: 'Stop loading',
+					callback: () => {
+						if (pendingExtra === thisExtra) cancelExtra()
+					}
+				},
+				...(offerBatches
+					? [
+							{
+								label: smaller === 1 ? 'Stream 1 by 1' : `Stream by batches of ${smaller}`,
+								callback: () => {
+									if (pendingExtra !== thisExtra) return
+									cancelExtra()
+									loadMore(smaller)
+								}
+							}
+						]
+					: [])
+			])
+		})
+		promise = CancelablePromiseUtils.catchErr(promise, (e) => {
+			if (e instanceof CancelError) return CancelablePromiseUtils.pure<void>(undefined)
+			sendUserToast(
+				'There was an issue loading more audit logs, see browser console for more details',
+				true
+			)
+			console.error(e)
+			return CancelablePromiseUtils.pure<void>(undefined)
+		})
+		const thisExtra = CancelablePromiseUtils.pipe(promise, () => {
+			if (pendingExtra === thisExtra) {
+				pendingExtra = undefined
+				loadingExtra = false
+			}
+		})
+		pendingExtra = thisExtra
+	}
+
 	$effect(() => {
 		// Building the args reads every filter, which is what registers this effect's dependencies.
 		args()
@@ -220,6 +284,7 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 		return () => {
 			pendingLoad?.cancel()
 			pendingLoad = undefined
+			cancelExtra()
 		}
 	})
 
@@ -227,12 +292,16 @@ export function useAuditLogsLoader(args: () => AuditLogsLoaderArgs) {
 		reload: () => load(),
 		restreamWithBatchSize,
 		stopBatchLoading,
+		loadMore,
 		get logs() {
 			return logs
 		},
 		get loading() {
 			return loading
 		},
+		get loadingExtra() {
+			return loadingExtra
+		},
 		get hasMore() {
 			return hasMore
 		},
diff --git a/frontend/src/lib/components/auditLogs/useAuditLogsLoader.test.ts b/frontend/src/lib/components/auditLogs/useAuditLogsLoader.test.ts
deleted file mode 100644
index a244ed18b9..0000000000
--- a/frontend/src/lib/components/auditLogs/useAuditLogsLoader.test.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { computeFirstBatch } from './useAuditLogsLoader.svelte'
-
-describe('computeFirstBatch', () => {
-	it('starts at the page itself when nothing is batched', () => {
-		expect(computeFirstBatch(3, 100, 100)).toEqual({ firstPage: 3, skipFirst: 0 })
-	})
-
-	it('lands exactly on the page start when the batch size divides the offset', () => {
-		expect(computeFirstBatch(1, 100, 25)).toEqual({ firstPage: 1, skipFirst: 0 })
-		expect(computeFirstBatch(3, 100, 25)).toEqual({ firstPage: 9, skipFirst: 0 })
-		expect(computeFirstBatch(2, 100, 1)).toEqual({ firstPage: 101, skipFirst: 0 })
-	})
-
-	it('drops the rows before the page start when it does not', () => {
-		// page 2 of 100 starts at offset 100, batches of 30 can only land on offset 90
-		expect(computeFirstBatch(2, 100, 30)).toEqual({ firstPage: 4, skipFirst: 10 })
-	})
-})
diff --git a/frontend/src/lib/components/breadcrumbPath.test.ts b/frontend/src/lib/components/breadcrumbPath.test.ts
new file mode 100644
index 0000000000..427b153800
--- /dev/null
+++ b/frontend/src/lib/components/breadcrumbPath.test.ts
@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest'
+import { splitItemPath } from './breadcrumbPath'
+
+describe('splitItemPath', () => {
+	it('walks the scope, each subfolder, then the item, each with its cumulative path', () => {
+		expect(splitItemPath('f/demo/sub/weather_report')).toEqual({
+			dirs: [
+				{ name: 'f/demo', fullPath: 'f/demo' },
+				{ name: 'sub', fullPath: 'f/demo/sub' }
+			],
+			leaf: { name: 'weather_report', fullPath: 'f/demo/sub/weather_report' }
+		})
+	})
+
+	it('gives up before there is a scope', () => {
+		expect(splitItemPath('f/demo')).toBeUndefined()
+	})
+
+	it('keeps the folders while the name is still being typed', () => {
+		// The editor binds the path live, so every keystroke reaches the breadcrumb: the trail must
+		// not drop out and come back on the first character of the name.
+		expect(splitItemPath('f/demo/')).toEqual({
+			dirs: [{ name: 'f/demo', fullPath: 'f/demo' }],
+			leaf: undefined
+		})
+	})
+})
diff --git a/frontend/src/lib/components/breadcrumbPath.ts b/frontend/src/lib/components/breadcrumbPath.ts
new file mode 100644
index 0000000000..880d558360
--- /dev/null
+++ b/frontend/src/lib/components/breadcrumbPath.ts
@@ -0,0 +1,30 @@
+/** A directory level of an item's path, with the full path down to it. */
+export type PathDir = { name: string; fullPath: string }
+
+/**
+ * Splits `f/demo/weather_report` into the levels a breadcrumb walks: the scope (`f/<folder>` or
+ * `u/<user>`), then each subfolder, then the item itself. Each level carries the cumulative path,
+ * which is what the picker opens and highlights.
+ *
+ * Returns undefined before there is even a scope. The leaf is undefined while the path names a
+ * folder but no item yet (`f/demo/`) — the levels it does name still come back.
+ */
+export function splitItemPath(
+	path: string
+): { dirs: PathDir[]; leaf: PathDir | undefined } | undefined {
+	const parts = path.split('/')
+	if (parts.length < 3) return undefined
+	const scope = parts.slice(0, 2).join('/')
+	const slug = parts.slice(2)
+	const dirs: PathDir[] = [{ name: scope, fullPath: scope }]
+	let acc = scope
+	for (let i = 0; i < slug.length - 1; i++) {
+		acc = `${acc}/${slug[i]}`
+		dirs.push({ name: slug[i], fullPath: acc })
+	}
+	// A leaf with an empty name draws a blank segment. The editor binds the path live, so the
+	// breadcrumb sees every keystroke: the folders stay put while the name is being typed rather
+	// than the whole trail dropping out and coming back.
+	const name = slug[slug.length - 1]
+	return { dirs, leaf: name ? { name, fullPath: path } : undefined }
+}
diff --git a/frontend/src/lib/components/common/ViewportOverlays.svelte b/frontend/src/lib/components/common/ViewportOverlays.svelte
new file mode 100644
index 0000000000..59dc2e55b6
--- /dev/null
+++ b/frontend/src/lib/components/common/ViewportOverlays.svelte
@@ -0,0 +1,10 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { clearOverlayHost } from './overlayHost.svelte'
+
+	let { children }: { children?: Snippet } = $props()
+
+	clearOverlayHost()
+</script>
+
+{@render children?.()}
diff --git a/frontend/src/lib/components/common/alert/Alert.svelte b/frontend/src/lib/components/common/alert/Alert.svelte
index 7d22320867..b7639e1104 100644
--- a/frontend/src/lib/components/common/alert/Alert.svelte
+++ b/frontend/src/lib/components/common/alert/Alert.svelte
@@ -17,6 +17,8 @@
 		bgClass?: string | undefined
 		bgStyle?: string | undefined
 		iconClass?: string | undefined
+		/** Drop the type's icon; the text starts at the alert's edge. */
+		hideIcon?: boolean
 		iconStyle?: string | undefined
 		titleClass?: string | undefined
 		titleStyle?: string | undefined
@@ -41,6 +43,7 @@
 		bgClass = undefined,
 		bgStyle = undefined,
 		iconClass = undefined,
+		hideIcon = false,
 		iconStyle = undefined,
 		titleClass = undefined,
 		titleStyle = undefined,
@@ -78,14 +81,16 @@
 	<div class="flex flex-row items-center">
 		<!-- shrink-0: the badge's min-content width is the 16px icon, so without it a
 		     narrow container squeezes the circle into an oval. -->
-		<div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full">
-			<SvelteComponent
-				class={twMerge(classes[type].iconClass, iconClass)}
-				style={iconStyle}
-				size={16}
-			/>
-		</div>
-		<div class={twMerge('ml-1 w-full')}>
+		{#if !hideIcon}
+			<div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full">
+				<SvelteComponent
+					class={twMerge(classes[type].iconClass, iconClass)}
+					style={iconStyle}
+					size={16}
+				/>
+			</div>
+		{/if}
+		<div class={twMerge(!hideIcon && 'ml-1', 'w-full')}>
 			{#if hasTitleRow}
 				<div class={twMerge('w-full flex flex-row items-center justify-between')}>
 					<span
diff --git a/frontend/src/lib/components/common/badge/Badge.svelte b/frontend/src/lib/components/common/badge/Badge.svelte
index c57d41029c..09a56c427a 100644
--- a/frontend/src/lib/components/common/badge/Badge.svelte
+++ b/frontend/src/lib/components/common/badge/Badge.svelte
@@ -85,7 +85,8 @@
 		['dark-indigo']: 'bg-indigo-700 text-indigo-100 dark:bg-indigo-800 dark:text-indigo-200',
 		['dark-orange']: 'bg-orange-700 text-orange-100 dark:bg-orange-800 dark:text-orange-200',
 		['dark-violet']: 'bg-violet-700 text-violet-100 dark:bg-violet-800 dark:text-violet-200',
-		transparent: 'bg-surface-accent-selected text-accent border-gray-400 dark:border-gray-500'
+		// Keeps the unselected chip's border, so selecting one does not change its height.
+		transparent: 'bg-surface-accent-selected text-accent border border-surface-accent-selected'
 	}
 
 	const hovers: Partial<Record<BadgeColor, string>> = {
diff --git a/frontend/src/lib/components/common/button/Button.svelte b/frontend/src/lib/components/common/button/Button.svelte
index f684d79a9f..f3cfc78478 100644
--- a/frontend/src/lib/components/common/button/Button.svelte
+++ b/frontend/src/lib/components/common/button/Button.svelte
@@ -148,6 +148,13 @@
 	}: Props = $props()
 
 	const activeTone = $derived(dropdownItems ? undefined : tone)
+	// `dropdownItems` may be a function, whose `.length` is its arity — 0 for the `() => [...]`
+	// every caller writes. Asking it for its items is the only way to know whether there are any,
+	// and a split button that answers `.length` instead renders no caret at all.
+	const hasDropdown = $derived(
+		!!dropdownItems &&
+			(typeof dropdownItems === 'function' ? dropdownItems().length : dropdownItems.length) > 0
+	)
 
 	function computeDropdowns(menuItems: MenuItem[] | (() => MenuItem[])): Item[] {
 		const items = typeof menuItems === 'function' ? menuItems() : menuItems
@@ -197,12 +204,7 @@
 						]
 					: ButtonType.VariantStyles[variant]
 			// For default variant with dropdowns, remove border from button since it's on wrapper
-			if (
-				variant === 'default' &&
-				dropdownItems &&
-				((typeof dropdownItems === 'function' && dropdownItems().length > 0) ||
-					dropdownItems.length > 0)
-			) {
+			if (variant === 'default' && hasDropdown) {
 				style = style.replace('border border-border-light', '')
 			}
 			return style
@@ -278,7 +280,7 @@
 			getSpacingClass(variant, size, spacingSize, iconOnly, unifiedSize, extendedSize),
 			unifiedSize ? ButtonType.UnifiedFontSizes[unifiedSize] : '',
 			'focus-visible:ring-2',
-			dropdownItems && dropdownItems.length > 0 ? 'rounded-l-md' : 'rounded-md',
+			hasDropdown ? 'rounded-l-md' : 'rounded-md',
 			'justify-center items-center text-center inline-flex gap-2',
 			'active:opacity-80 transition-[background-color,opacity] duration-150',
 			disabled
@@ -345,7 +347,7 @@
 
 <div
 	class={twMerge(
-		dropdownItems && dropdownItems.length > 0 ? dividerClass : '',
+		hasDropdown ? dividerClass : '',
 		'shrink-0',
 		wrapperClasses,
 		'flex flex-row rounded-md',
@@ -385,6 +387,7 @@
 			class={buttonClass}
 			{id}
 			{target}
+			{title}
 			tabindex={disabled ? -1 : 0}
 			{...rest}
 			{style}
@@ -484,7 +487,7 @@
 		{/if}
 	{/if}
 
-	{#if dropdownItems && dropdownItems.length > 0}
+	{#if hasDropdown && dropdownItems}
 		<Dropdown
 			aiId={aiId ? `${aiId}-dropdown` : undefined}
 			aiDescription={aiDescription ? `${aiDescription} dropdown` : undefined}
diff --git a/frontend/src/lib/components/common/button/model.ts b/frontend/src/lib/components/common/button/model.ts
index 8497ab1a87..c40e0b5b29 100644
--- a/frontend/src/lib/components/common/button/model.ts
+++ b/frontend/src/lib/components/common/button/model.ts
@@ -264,7 +264,9 @@ export namespace ButtonType {
 	export const UnifiedSizingClasses: Record<ButtonType.UnifiedSize, string> = {
 		'2xs': 'px-1', // Compact horizontal padding
 		xs: 'px-2',
-		sm: 'px-2', // Regular horizontal padding
+		// One step of its own rather than sharing xs's: sm is the size a page's header buttons are,
+		// where a label needs room to read as a button rather than as text with a box around it.
+		sm: 'px-3',
 		md: 'px-4',
 		lg: 'px-6'
 	}
diff --git a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
index 524817ba34..4b419536fc 100644
--- a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
@@ -29,6 +29,8 @@
 		 * up confines it. Off by default: it moves the dialog out of its DOM position, so opt
 		 * in per call site rather than assuming every caller wants it. */
 		alwaysPortal?: boolean
+		/** For a notice with nothing to decide: the confirm button is the only one. */
+		hideCancel?: boolean
 		children?: Snippet
 		onConfirmed?: () => void | Promise<void>
 		onCanceled?: () => void
@@ -47,6 +49,7 @@
 		trashbin = false,
 		zIndexClass = 'z-[9999]',
 		alwaysPortal = false,
+		hideCancel = false,
 		children,
 		onConfirmed,
 		onCanceled
@@ -228,15 +231,17 @@
 								{/if}
 								<span class="min-w-20">{confirmationText} </span>
 							</Button>
-							<Button
-								disabled={loading}
-								on:click={() => (dispatch('canceled'), onCanceled?.())}
-								variant="default"
-								size="sm"
-								shortCut={{ key: 'Esc', hide: !keyListen, withoutModifier: true }}
-							>
-								Cancel
-							</Button>
+							{#if !hideCancel}
+								<Button
+									disabled={loading}
+									on:click={() => (dispatch('canceled'), onCanceled?.())}
+									variant="default"
+									size="sm"
+									shortCut={{ key: 'Esc', hide: !keyListen, withoutModifier: true }}
+								>
+									Cancel
+								</Button>
+							{/if}
 						</div>
 					</div>
 				</div>
diff --git a/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte b/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte
index 20c29286b5..63e6b13994 100644
--- a/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte
@@ -15,7 +15,6 @@
 	import OtherUsersDraftsModal, { type OtherDraftUser } from './OtherUsersDraftsModal.svelte'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { base } from '$app/paths'
 	import { goto } from '$app/navigation'
 	import StaleDraftModal from './StaleDraftModal.svelte'
 	import ConfirmationModal from './ConfirmationModal.svelte'
@@ -163,7 +162,7 @@
 			}
 			const target = destination ?? newPath
 			sendUserToast(`This item was moved to ${target}. You are now editing it there.`)
-			await goto(`${base}/${seg}/${target}`)
+			await goto(`/${seg}/${target}`)
 		})
 	})
 </script>
diff --git a/frontend/src/lib/components/common/confirmationModal/OtherUsersDraftsModal.svelte b/frontend/src/lib/components/common/confirmationModal/OtherUsersDraftsModal.svelte
index 49356d888e..b6ec78f336 100644
--- a/frontend/src/lib/components/common/confirmationModal/OtherUsersDraftsModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/OtherUsersDraftsModal.svelte
@@ -7,7 +7,8 @@
 	 */
 	import { DraftService, type UserDraftItemKind } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { Users, Pencil, GitCompareArrows, Wrench } from 'lucide-svelte'
+	import { Users, Pencil, GitCompareArrows, Wrench, Trash2 } from 'lucide-svelte'
+	import ConfirmationModal from './ConfirmationModal.svelte'
 	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
@@ -17,6 +18,10 @@
 	import { OtherUserDraftLoad } from '$lib/components/otherUserDraftLoad.svelte'
 	import { displayDate } from '$lib/utils'
 	import { userStore } from '$lib/stores'
+	import { armRestartOnFirstInteraction } from '$lib/userDraftToast'
+	import { UserDraft } from '$lib/userDraft.svelte'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { goto } from '$app/navigation'
 
 	export type OtherDraftUser = { username?: string | null; draft_saved_at?: string }
 
@@ -54,8 +59,70 @@
 	let diffDrawer: DiffDrawer | undefined = $state(undefined)
 	let migrateOpen = $state(false)
 
-	// Legacy (no-owner) drafts can only be resolved by workspace admins / superadmins.
-	const canMigrateLegacy = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin)
+	// One owner's draft, or every draft at the path.
+	let deleting = $state<OtherDraftUser | 'all' | undefined>(undefined)
+	let deleteBusy = $state(false)
+
+	// Legacy (no-owner) drafts can only be resolved by workspace admins / superadmins,
+	// and only they can delete a draft that belongs to someone else.
+	const isAdmin = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin)
+
+	async function deleteDraft(target: OtherDraftUser | 'all') {
+		const username = target === 'all' ? undefined : target.username
+		if (target !== 'all' && !username) return
+		deleteBusy = true
+		const query = { workspace, itemKind, path }
+		try {
+			// A path-wide delete takes our own draft too. Mute autosave and let any save
+			// already in flight land first: one committing after the delete would put the
+			// draft back for the reload below to read.
+			if (target === 'all') {
+				UserDraft.stopSync(itemKind, path, { workspace })
+				await UserDraftDbSyncer.quiesce(query)
+			}
+			await DraftService.deleteDraftForUser({
+				workspace,
+				kind: itemKind,
+				path,
+				username: username ?? undefined
+			})
+		} catch (e) {
+			if (target === 'all') {
+				UserDraft.restartSync(itemKind, path, { workspace })
+				// `quiesce` cancelled the timer of an edit still waiting to save.
+				void UserDraftDbSyncer.flush(query, { honorAutosaveToggle: true })
+			}
+			sendUserToast(`Could not delete draft: ${e.body ?? e.message}`, true)
+			return
+		} finally {
+			deleteBusy = false
+		}
+		sendUserToast(username ? `Deleted ${username}'s draft` : `Deleted all drafts at ${path}`)
+		deleting = undefined
+		isOpen = false
+
+		// Drop the editor's copy of our draft as well, or its next write would save
+		// it right back. Autosave re-arms on the next interaction.
+		if (target === 'all') {
+			UserDraft.remove(itemKind, path, { workspace })
+			await UserDraftDbSyncer.flush(query)
+			armRestartOnFirstInteraction(workspace, itemKind, path)
+		}
+		// Nothing is left at a never-deployed path once its last draft is gone, so
+		// there is no item to reload the editor on.
+		const lastDraftGone =
+			target === 'all' ||
+			(!hasOwnDraft && otherDraftsUsers.every((o) => ownerKey(o) === ownerKey(target)))
+		if (draftOnly && lastDraftGone) {
+			await goto('/')
+			return
+		}
+		try {
+			await onReload?.()
+		} catch (e) {
+			sendUserToast(`Could not reload the editor: ${e.body ?? e.message}`, true)
+		}
+	}
 
 	function ownerLabel(owner: OtherDraftUser): string {
 		return owner.username ?? 'Legacy draft'
@@ -184,7 +251,7 @@
 					>
 						Load
 					</Button>
-					{#if !owner.username && canMigrateLegacy}
+					{#if !owner.username && isAdmin}
 						<Button
 							variant="default"
 							size="xs"
@@ -193,12 +260,35 @@
 						>
 							Migrate
 						</Button>
+					{:else if owner.username && isAdmin}
+						<Button
+							variant="default"
+							unifiedSize="sm"
+							destructive
+							startIcon={{ icon: Trash2 }}
+							disabled={busyFor !== null}
+							onclick={() => (deleting = owner)}
+						>
+							Delete
+						</Button>
 					{/if}
 				</li>
 			{/each}
 		</ul>
 
-		<div class="flex justify-end">
+		<div class="flex justify-end gap-2">
+			{#if isAdmin}
+				<Button
+					variant="default"
+					unifiedSize="md"
+					destructive
+					startIcon={{ icon: Trash2 }}
+					disabled={busyFor !== null}
+					onclick={() => (deleting = 'all')}
+				>
+					Delete all drafts
+				</Button>
+			{/if}
 			<Button variant="default" size="sm" on:click={() => (isOpen = false)}>Close</Button>
 		</div>
 	</div>
@@ -206,6 +296,29 @@
 
 <DiffDrawer bind:this={diffDrawer} isFlow={itemKind === 'flow'} />
 
+<ConfirmationModal
+	open={deleting !== undefined}
+	title={deleting === 'all' ? 'Delete all drafts?' : `Delete ${deleting?.username}'s draft?`}
+	confirmationText="Delete"
+	loading={deleteBusy}
+	onConfirmed={() => {
+		if (deleting) void deleteDraft(deleting)
+	}}
+	onCanceled={() => (deleting = undefined)}
+>
+	<span class="text-sm">
+		{#if deleting === 'all'}
+			This permanently deletes every draft at
+			<span class="font-medium text-primary">{path}</span>, yours included. All unsaved work there
+			is lost and can't be recovered.
+		{:else}
+			This permanently deletes the draft {deleting?.username} has at
+			<span class="font-medium text-primary">{path}</span>. Their unsaved work there is lost and
+			can't be recovered.
+		{/if}
+	</span>
+</ConfirmationModal>
+
 <MigrateLegacyDraftModal
 	bind:isOpen={migrateOpen}
 	{workspace}
diff --git a/frontend/src/lib/components/common/contextmenu/fromMenuItems.ts b/frontend/src/lib/components/common/contextmenu/fromMenuItems.ts
new file mode 100644
index 0000000000..1ba6c0bac8
--- /dev/null
+++ b/frontend/src/lib/components/common/contextmenu/fromMenuItems.ts
@@ -0,0 +1,18 @@
+import type { Item } from '$lib/utils'
+import type { ContextMenuItem } from './ContextMenu.svelte'
+
+/** A dropdown's items as the same entries of a right-click menu. */
+export function contextMenuItemsFromMenu(items: Item[]): ContextMenuItem[] {
+	return items.flatMap((item) => [
+		...(item.separatorTop ? [{ id: `${item.displayName}-divider`, label: '', divider: true }] : []),
+		{
+			id: item.displayName,
+			label: item.displayName,
+			icon: item.icon,
+			disabled: item.disabled,
+			type: item.type,
+			shortcut: item.shortcut,
+			onClick: item.action as (() => void) | undefined
+		}
+	])
+}
diff --git a/frontend/src/lib/components/common/drawer/Disposable.svelte b/frontend/src/lib/components/common/drawer/Disposable.svelte
index 886c14042b..4fd472729f 100644
--- a/frontend/src/lib/components/common/drawer/Disposable.svelte
+++ b/frontend/src/lib/components/common/drawer/Disposable.svelte
@@ -32,6 +32,9 @@
 		children?: import('svelte').Snippet<[any]>
 		onOpen?: () => void
 		onClose?: () => void
+		/** Asked before a click away or Escape closes it; resolving false keeps it open, e.g. to
+		 *  confirm discarding unsaved changes. */
+		confirmClose?: () => boolean | Promise<boolean>
 	}
 
 	let {
@@ -42,9 +45,25 @@
 		minZIndex = 0,
 		children,
 		onOpen,
-		onClose
+		onClose,
+		confirmClose
 	}: Props = $props()
 
+	// While the question is on screen, the keys and clicks are its own.
+	let confirming = false
+	async function requestClose() {
+		if (confirming) return
+		if (confirmClose) {
+			confirming = true
+			try {
+				if (!(await confirmClose())) return
+			} finally {
+				confirming = false
+			}
+		}
+		closeDrawer()
+	}
+
 	let offset = $state(untrack(() => initialOffset))
 	// Note: when a Modal with minZIndex is open, all disposables (including
 	// already-open Drawers) are elevated. This is acceptable — relative
@@ -115,7 +134,7 @@
 		const last = stack.val[stack.val.length - 1]
 		if (last === id) {
 			e.stopPropagation()
-			closeDrawer()
+			requestClose()
 		}
 	}
 
@@ -125,7 +144,16 @@
 		if (open) {
 			switch (event.key) {
 				case 'Escape':
+					// The confirmation on screen answers this Escape itself, as its Cancel.
+					if (confirming) break
 					if ((id == stack.val[stack.val.length - 1] || stack.val.length == 0) && !preventEscape) {
+						if (confirmClose) {
+							event.preventDefault()
+							event.stopPropagation()
+							event.stopImmediatePropagation()
+							requestClose()
+							break
+						}
 						stack.val.pop()
 						event.preventDefault()
 						event.stopPropagation()
diff --git a/frontend/src/lib/components/common/drawer/Drawer.svelte b/frontend/src/lib/components/common/drawer/Drawer.svelte
index 76502735ca..45cf99c7be 100644
--- a/frontend/src/lib/components/common/drawer/Drawer.svelte
+++ b/frontend/src/lib/components/common/drawer/Drawer.svelte
@@ -28,6 +28,8 @@
 		positionClass?: string | undefined
 		name?: string
 		children?: import('svelte').Snippet<[any]>
+		/** Asked before a click away or Escape closes it; resolving false keeps it open. */
+		confirmClose?: () => boolean | Promise<boolean>
 	}
 
 	let {
@@ -43,7 +45,8 @@
 		class: clazz = '',
 		positionClass = undefined,
 		name = undefined,
-		children: children_render
+		children: children_render,
+		confirmClose
 	}: Props = $props()
 
 	if (open === undefined) {
@@ -146,6 +149,7 @@
 		onOpen={() => dispatch('open')}
 		onClose={() => dispatch('close')}
 		{preventEscape}
+		{confirmClose}
 	>
 		{#snippet children({ handleClickAway, zIndex, isTop })}
 			<aside
diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index c1a29fae70..7f9187da62 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { Download } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
@@ -26,7 +25,7 @@
 			s3object?.storage ? `&storage=${s3object.storage}` : ''
 		}${appPath && s3object?.presigned ? `&${s3object?.presigned}` : ''}`
 	)
-	let href = $derived(`${base}/api${apiPath}`)
+	let href = $derived(`/api${apiPath}`)
 
 	const sharedClass = `relative center-center flex w-full text-center font-normal text-primary text-sm
 border border-dashed border-gray-400 hover:border-blue-500
diff --git a/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte b/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
index 617f5206dc..7635b900bb 100644
--- a/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
+++ b/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
@@ -28,6 +28,7 @@
 	import RIcon from '$lib/components/icons/RIcon.svelte'
 	import ClaudeIcon from '$lib/components/icons/ClaudeIcon.svelte'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import { Pi } from 'lucide-svelte'
 
 	interface Props {
 		lang:
@@ -41,6 +42,7 @@
 			| 'powershell'
 			| 'bunnative'
 			| 'claudesandbox'
+			| 'pisandbox'
 		width?: number
 		height?: number
 		scale?: number
@@ -50,7 +52,10 @@
 
 	let { lang, width = 30, height = 30, scale = 1, size = undefined, ...rest }: Props = $props()
 
-	const languageLabel: Record<Script['language'] | 'bunnative' | 'claudesandbox', String> = {
+	const languageLabel: Record<
+		Script['language'] | 'bunnative' | 'claudesandbox' | 'pisandbox',
+		String
+	> = {
 		python3: 'Python',
 		deno: 'TypeScript',
 		go: 'Go',
@@ -76,12 +81,21 @@
 		ruby: 'Ruby',
 		rlang: 'R',
 		dbt: 'dbt',
-		claudesandbox: 'Claude Sandbox'
+		claudesandbox: 'Claude Sandbox',
+		pisandbox: 'Pi Sandbox'
 		// for related places search: ADD_NEW_LANG
 	}
 
 	const langToComponent: Record<
-		SupportedLanguage | 'pgsql' | 'javascript' | 'fetch' | 'docker' | 'powershell' | 'bunnative' | 'claudesandbox',
+		| SupportedLanguage
+		| 'pgsql'
+		| 'javascript'
+		| 'fetch'
+		| 'docker'
+		| 'powershell'
+		| 'bunnative'
+		| 'claudesandbox'
+		| 'pisandbox',
 		any
 	> = {
 		go: GoIcon,
@@ -114,7 +128,8 @@
 		rlang: RIcon,
 		duckdb: DuckDbIcon,
 		dbt: DbtIcon,
-		claudesandbox: TypeScriptIcon
+		claudesandbox: TypeScriptIcon,
+		pisandbox: TypeScriptIcon
 		// for related places search: ADD_NEW_LANG
 	}
 
@@ -166,4 +181,14 @@
 			/>
 		</div>
 	{/if}
+	{#if lang === 'pisandbox'}
+		<div
+			class="absolute -top-1.5 -right-1.5 bg-surface rounded-full flex items-center justify-center text-primary"
+			style={`width: ${width * scale * subIconScale}px; height: ${
+				height * scale * subIconScale
+			}px;`}
+		>
+			<Pi size={width * scale * (subIconScale - 0.1)} />
+		</div>
+	{/if}
 </div>
diff --git a/frontend/src/lib/components/common/overlayHost.svelte.ts b/frontend/src/lib/components/common/overlayHost.svelte.ts
index e556b51e67..824e239519 100644
--- a/frontend/src/lib/components/common/overlayHost.svelte.ts
+++ b/frontend/src/lib/components/common/overlayHost.svelte.ts
@@ -25,6 +25,12 @@ export function setOverlayHost(host: OverlayHostContext) {
 	setContext<OverlayHostContext>(OVERLAY_HOST_KEY, host)
 }
 
+/** Hand this subtree's overlays back to the viewport, for one that speaks for the whole
+ *  page rather than the pane it happens to be opened from. */
+export function clearOverlayHost() {
+	setContext<OverlayHostContext | undefined>(OVERLAY_HOST_KEY, undefined)
+}
+
 export function getOverlayHost(): OverlayHostContext | undefined {
 	return getContext<OverlayHostContext | undefined>(OVERLAY_HOST_KEY)
 }
diff --git a/frontend/src/lib/components/common/slack/SlackConnectionStatus.svelte b/frontend/src/lib/components/common/slack/SlackConnectionStatus.svelte
index 8658c462ab..d79491b0fc 100644
--- a/frontend/src/lib/components/common/slack/SlackConnectionStatus.svelte
+++ b/frontend/src/lib/components/common/slack/SlackConnectionStatus.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { Badge, Button } from '$lib/components/common'
 	import { Plug, RotateCw, Unplug } from 'lucide-svelte'
-	import { base } from '$lib/base'
 
 	interface Props {
 		isConnected: boolean | undefined
@@ -16,8 +15,8 @@
 	// Connection URLs based on mode
 	let connectUrl = $derived(
 		mode === 'instance'
-			? `${base}/api/oauth/connect_slack?instance=true`
-			: `${base}/workspace_settings?tab=slack`
+			? '/api/oauth/connect_slack?instance=true'
+			: '/workspace_settings?tab=slack'
 	)
 </script>
 
diff --git a/frontend/src/lib/components/common/table/AgentRow.svelte b/frontend/src/lib/components/common/table/AgentRow.svelte
index ecde985be4..aca6ae7f9c 100644
--- a/frontend/src/lib/components/common/table/AgentRow.svelte
+++ b/frontend/src/lib/components/common/table/AgentRow.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import SharedBadge from '$lib/components/SharedBadge.svelte'
 	import DraftBadge from '$lib/components/DraftBadge.svelte'
@@ -16,6 +15,7 @@
 	import { agentMenuItems, deleteAgent } from '$lib/components/flows/agentActions'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
 	import Row from './Row.svelte'
+	import { selectMenuItems, type RowSelection } from './rowSelection'
 
 	/**
 	 * A home-page row for a saved agent. The agent is an `ai_agent` resource, so the row opens the
@@ -30,6 +30,7 @@
 		depth?: number
 		menuOpen: boolean
 		keyboardSelected?: boolean
+		rowSelection?: RowSelection
 	}
 
 	let {
@@ -40,7 +41,8 @@
 		deleteConfirmedCallback = $bindable(),
 		depth = 0,
 		menuOpen = $bindable(),
-		keyboardSelected = false
+		keyboardSelected = false,
+		rowSelection = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -49,9 +51,9 @@
 		if (await deleteAgent($workspaceStore!, path)) dispatch('change')
 	}
 
-	let editHref = $derived(`${base}/agents/edit/${agent.path}`)
+	let editHref = $derived(`/agents/edit/${agent.path}`)
 	// A draft-only agent has nothing deployed for its page to run, so it opens in the editor.
-	let rowHref = $derived(agent.draft_only ? editHref : `${base}/agents/get/${agent.path}`)
+	let rowHref = $derived(agent.draft_only ? editHref : `/agents/get/${agent.path}`)
 </script>
 
 {#snippet chatBadge()}
@@ -69,6 +71,7 @@
 	workspaceId={agent.workspace_id ?? $workspaceStore ?? ''}
 	canFavorite={false}
 	{depth}
+	{rowSelection}
 >
 	{#snippet badges()}
 		<SharedBadge canWrite={agent.canWrite} extraPerms={agent.extra_perms} />
@@ -99,8 +102,9 @@
 			</span>
 		{/if}
 		<Dropdown
-			items={async () =>
-				agentMenuItems({
+			items={async () => [
+				...selectMenuItems(rowSelection),
+				...agentMenuItems({
 					deployUiSettings: await getDeployUiSettings(),
 					path: agent.path,
 					canWrite: agent.canWrite,
@@ -113,7 +117,8 @@
 						if (event?.shiftKey) remove(path)
 						else deleteConfirmedCallback = () => remove(path)
 					}
-				})}
+				})
+			]}
 			on:open={() => {
 				menuOpen = true
 			}}
diff --git a/frontend/src/lib/components/common/table/AppRow.svelte b/frontend/src/lib/components/common/table/AppRow.svelte
index bd881a31b7..a318c1f412 100644
--- a/frontend/src/lib/components/common/table/AppRow.svelte
+++ b/frontend/src/lib/components/common/table/AppRow.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import type MoveDrawer from '$lib/components/MoveDrawer.svelte'
 	import SharedBadge from '$lib/components/SharedBadge.svelte'
@@ -7,6 +6,7 @@
 	import type ShareModal from '$lib/components/ShareModal.svelte'
 	import { AppService, type ListableApp } from '$lib/gen'
 	import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { useOperatorBuilderApps } from '$lib/operatorWriteRights'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { createEventDispatcher } from 'svelte'
 	import Button from '../button/Button.svelte'
@@ -68,6 +68,7 @@
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
+	const operatorBuilderApps = useOperatorBuilderApps()
 
 	let appExport: { open: (path: string, rawApp?: boolean) => void } | undefined = $state(undefined)
 	let appDeploymentHistory: AppDeploymentHistory | undefined = $state(undefined)
@@ -106,8 +107,8 @@
 
 <Row
 	href={app.draft_only
-		? `${base}/apps${app.raw_app ? '_raw' : ''}/edit/${app.path}`
-		: `${base}/apps${app.raw_app ? '_raw' : ''}/get/${app.path}`}
+		? `/apps${app.raw_app ? '_raw' : ''}/edit/${app.path}`
+		: `/apps${app.raw_app ? '_raw' : ''}/get/${app.path}`}
 	kind="app"
 	{keyboardSelected}
 	{marked}
@@ -159,24 +160,22 @@
 	{/snippet}
 	{#snippet actions()}
 		<span class="hidden md:inline-flex gap-x-1">
-			{#if !$userStore?.operator}
-				{#if showEditButton && app.canWrite}
-					<div>
-						<Button
-							aiId={`edit-app-button-${app.summary?.length > 0 ? app.summary : app.path}`}
-							aiDescription={`Edits the app ${app.summary?.length > 0 ? app.summary : app.path}`}
-							variant="subtle"
-							wrapperClasses="w-20"
-							startIcon={{ icon: Pen }}
-							href="{base}/apps{app.raw_app ? '_raw' : ''}/edit/{app.path}"
-						>
-							Edit
-						</Button>
-					</div>
-				{/if}
-				{#if !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !app.canWrite)}
-					<EditInForkButton itemType={app.raw_app ? 'raw_app' : 'app'} path={app.path} />
-				{/if}
+			{#if showEditButton && app.canWrite}
+				<div>
+					<Button
+						aiId={`edit-app-button-${app.summary?.length > 0 ? app.summary : app.path}`}
+						aiDescription={`Edits the app ${app.summary?.length > 0 ? app.summary : app.path}`}
+						variant="subtle"
+						wrapperClasses="w-20"
+						startIcon={{ icon: Pen }}
+						href="/apps{app.raw_app ? '_raw' : ''}/edit/{app.path}"
+					>
+						Edit
+					</Button>
+				</div>
+			{/if}
+			{#if !$userStore?.operator && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !app.canWrite)}
+				<EditInForkButton itemType={app.raw_app ? 'raw_app' : 'app'} path={app.path} />
 			{/if}
 		</span>
 		<Dropdown
@@ -224,7 +223,7 @@
 							// list endpoint only surfaces own/legacy draft-only rows), so
 							// discarding it never requires write permission on the path.
 							disabled: !showEditButton,
-							hide: $userStore?.operator
+							hide: $userStore?.operator && !($operatorBuilderApps && app.raw_app)
 						},
 						{
 							displayName: $userStore?.operator ? 'View JSON' : 'View/Edit JSON',
@@ -240,7 +239,7 @@
 					{
 						displayName: 'Duplicate/Fork',
 						icon: GitFork,
-						href: `${base}/apps${app.raw_app ? '_raw' : ''}/add?template=${path}`,
+						href: `/apps${app.raw_app ? '_raw' : ''}/add?template=${path}`,
 						disabled: !showEditButton,
 						hide: $userStore?.operator
 					},
@@ -287,7 +286,7 @@
 						displayName: 'Deployments',
 						icon: History,
 						action: () => appDeploymentHistory?.open(),
-						hide: $userStore?.operator
+						hide: $userStore?.operator && !($operatorBuilderApps && app.raw_app)
 					},
 					{
 						displayName: 'Permissions',
@@ -295,7 +294,7 @@
 						action: () => {
 							shareModal.openDrawer && shareModal.openDrawer(path, 'app')
 						},
-						hide: $userStore?.operator
+						hide: $userStore?.operator && !($operatorBuilderApps && app.raw_app)
 					},
 					{
 						displayName: 'Copy path',
@@ -341,7 +340,7 @@
 						},
 						type: 'delete',
 						disabled: !canEdit,
-						hide: $userStore?.operator
+						hide: $userStore?.operator && !($operatorBuilderApps && app.raw_app)
 					}
 				]
 			}}
diff --git a/frontend/src/lib/components/common/table/FlowRow.svelte b/frontend/src/lib/components/common/table/FlowRow.svelte
index e000ee25bc..65690121ab 100644
--- a/frontend/src/lib/components/common/table/FlowRow.svelte
+++ b/frontend/src/lib/components/common/table/FlowRow.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import type MoveDrawer from '$lib/components/MoveDrawer.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
@@ -9,7 +8,7 @@
 	import type ShareModal from '$lib/components/ShareModal.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
 	import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
-	import { useOperatorBuilderFlows } from '$lib/operatorWriteRights'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { createEventDispatcher } from 'svelte'
 	import Badge from '../badge/Badge.svelte'
@@ -43,7 +42,7 @@
 	import EditInForkButton from './EditInForkButton.svelte'
 	import { isCloudHosted } from '$lib/cloud'
 
-	const operatorBuilderFlows = useOperatorBuilderFlows()
+	const editRights = useEditRights()
 
 	interface Props {
 		flow: Flow & {
@@ -124,6 +123,8 @@
 	}
 	let scheduleEditor: ScheduleEditor | undefined = $state(undefined)
 	let flowHistory: FlowHistory | undefined = $state(undefined)
+
+	let hideForOperator = $derived(!editRights.roleCanAuthor('flow'))
 </script>
 
 {#if menuOpen}
@@ -139,8 +140,8 @@
 	aiId={`flow-row-${flow.path}`}
 	aiDescription={`Button to access the form to run the flow ${flow.summary ?? flow.path}`}
 	href={flow.draft_only
-		? `${base}/flows/edit/${flow.path}`
-		: `${base}/flows/get/${flow.path}?workspace=${$workspaceStore}`}
+		? `/flows/edit/${flow.path}`
+		: `/flows/get/${flow.path}?workspace=${$workspaceStore}`}
 	kind="flow"
 	workspaceId={flow.workspace_id ?? $workspaceStore ?? ''}
 	{keyboardSelected}
@@ -191,25 +192,24 @@
 	{/snippet}
 	{#snippet actions()}
 		<span class="hidden md:inline-flex gap-x-1">
-			{#if !$userStore?.operator}
-				{#if showEditButton && flow.canWrite && !flow.archived}
-					<div>
-						<Button
-							variant="subtle"
-							wrapperClasses="w-20"
-							unifiedSize="md"
-							startIcon={{ icon: Pen }}
-							href="{base}/flows/edit/{flow.path}"
-							aiId={`edit-flow-button-${flow.summary?.length > 0 ? flow.summary : flow.path}`}
-							aiDescription={`Edits the flow ${flow.summary?.length > 0 ? flow.summary : flow.path}`}
-						>
-							Edit
-						</Button>
-					</div>
-				{/if}
-				{#if !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !flow.canWrite)}
-					<EditInForkButton itemType="flow" path={flow.path} />
-				{/if}
+			{#if !hideForOperator && showEditButton && flow.canWrite && !flow.archived}
+				<div>
+					<Button
+						variant="subtle"
+						wrapperClasses="w-20"
+						unifiedSize="md"
+						startIcon={{ icon: Pen }}
+						href="/flows/edit/{flow.path}"
+						aiId={`edit-flow-button-${flow.summary?.length > 0 ? flow.summary : flow.path}`}
+						aiDescription={`Edits the flow ${flow.summary?.length > 0 ? flow.summary : flow.path}`}
+					>
+						Edit
+					</Button>
+				</div>
+			{/if}
+			<!-- Hidden from every operator, builder rights included. -->
+			{#if !$userStore?.operator && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !flow.canWrite)}
+				<EditInForkButton itemType="flow" path={flow.path} />
 			{/if}
 		</span>
 
@@ -220,7 +220,6 @@
 				let { draft_only, path, archived } = flow
 				let owner = isOwner(path, $userStore, $workspaceStore)
 				const canEdit = flow.canWrite && showEditButton
-				const hideForOperator = $userStore?.operator && !$operatorBuilderFlows
 				if (draft_only) {
 					return [
 						...selectMenuItems(rowSelection),
@@ -264,12 +263,12 @@
 					{
 						displayName: 'View runs',
 						icon: List,
-						href: `${base}/runs/${path}`
+						href: `/runs/${path}`
 					},
 					{
 						displayName: 'Duplicate/Fork',
 						icon: GitFork,
-						href: `${base}/flows/add?template=${path}`,
+						href: `/flows/add?template=${path}`,
 						disabled: !showEditButton,
 						hide: hideForOperator
 					},
@@ -287,7 +286,7 @@
 					{
 						displayName: 'Audit logs',
 						icon: Eye,
-						href: `${base}/audit_logs?resource=${path}`,
+						href: `/audit_logs?resource=${path}`,
 						hide: $userStore?.operator
 					},
 					{
diff --git a/frontend/src/lib/components/common/table/PipelineRow.svelte b/frontend/src/lib/components/common/table/PipelineRow.svelte
new file mode 100644
index 0000000000..334c8fb5fd
--- /dev/null
+++ b/frontend/src/lib/components/common/table/PipelineRow.svelte
@@ -0,0 +1,154 @@
+<script lang="ts">
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import ConfirmationModal from '../confirmationModal/ConfirmationModal.svelte'
+	import {
+		deletePipeline,
+		planPipelineDelete,
+		type PipelineDeletePlan
+	} from '$lib/components/assets/AssetGraph/pipelineDelete'
+	import { userStore, workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { Loader2, Trash } from 'lucide-svelte'
+	import Row from './Row.svelte'
+
+	interface Props {
+		folder: string
+		depth?: number
+		/** Shown instead of `f/<folder>`, e.g. under the folder's own tree node. */
+		label?: string
+		onDeleted?: () => void
+	}
+
+	let { folder, depth = 0, label, onDeleted }: Props = $props()
+
+	let confirmOpen = $state(false)
+	let deleting = $state(false)
+	let plan = $state<PipelineDeletePlan | undefined>(undefined)
+	let planError = $state<string | undefined>(undefined)
+	// The backend deletes scripts for admins only; everyone else archives them.
+	let hardDelete = $derived(!!($userStore?.is_admin || $userStore?.is_super_admin))
+
+	async function openConfirm() {
+		const ws = $workspaceStore
+		if (!ws) return
+		plan = undefined
+		planError = undefined
+		confirmOpen = true
+		try {
+			plan = await planPipelineDelete(ws, folder)
+		} catch (e: any) {
+			planError = e?.body ?? e?.message ?? String(e)
+		}
+	}
+
+	async function confirmDelete() {
+		const ws = $workspaceStore
+		if (!ws || !plan) return
+		deleting = true
+		try {
+			const { removed, failures } = await deletePipeline(ws, folder, plan, hardDelete)
+			// Loaded on demand: the home list should not pull in the session runtime.
+			const { forgetDeletedPipeline } = await import(
+				'$lib/components/sessions/sessionRuntime.svelte'
+			)
+			forgetDeletedPipeline(ws, folder)
+			if (failures.length) {
+				sendUserToast(`Pipeline f/${folder} was only partly removed`, true, [], failures.join('\n'))
+			} else {
+				sendUserToast(`Removed pipeline f/${folder} (${removed} item${removed === 1 ? '' : 's'})`)
+			}
+			onDeleted?.()
+		} catch (e: any) {
+			sendUserToast(`Could not remove pipeline f/${folder}: ${e?.body ?? e?.message ?? e}`, true)
+		} finally {
+			deleting = false
+			confirmOpen = false
+		}
+	}
+</script>
+
+<Row
+	kind="data_pipeline"
+	marked={undefined}
+	href="/pipeline/{encodeURIComponent(folder)}"
+	workspaceId={$workspaceStore ?? ''}
+	path={`f/${folder}`}
+	summary={label ?? `Pipeline · ${folder}`}
+	canFavorite={false}
+	{depth}
+>
+	{#snippet actions()}
+		{#if !$userStore?.operator}
+			<Dropdown
+				items={[
+					{
+						displayName: 'Delete',
+						icon: Trash,
+						type: 'delete',
+						action: () => void openConfirm()
+					}
+				]}
+			/>
+		{/if}
+	{/snippet}
+</Row>
+
+<ConfirmationModal
+	open={confirmOpen}
+	title="Delete pipeline f/{folder}"
+	confirmationText={hardDelete ? 'Delete' : 'Archive'}
+	loading={deleting}
+	confirmDisabled={!plan}
+	trashbin={hardDelete}
+	on:canceled={() => (confirmOpen = false)}
+	on:confirmed={confirmDelete}
+>
+	<div class="flex flex-col gap-3 text-xs">
+		{#if planError}
+			<span class="text-red-600 dark:text-red-400">Could not list the pipeline: {planError}</span>
+		{:else if !plan}
+			<span class="flex items-center gap-2 text-secondary">
+				<Loader2 size={14} class="animate-spin" /> Listing what this removes…
+			</span>
+		{:else}
+			{#if plan.scripts.some((s) => !s.draftOnly)}
+				{@render group(
+					hardDelete ? 'Scripts deleted' : 'Scripts archived',
+					plan.scripts.filter((s) => !s.draftOnly).map((s) => s.displayPath)
+				)}
+			{/if}
+			{#if plan.scripts.some((s) => s.draftOnly)}
+				{@render group(
+					'Draft scripts discarded',
+					plan.scripts.filter((s) => s.draftOnly).map((s) => s.displayPath)
+				)}
+			{/if}
+			{#if plan.triggers.length}
+				{@render group(
+					'Triggers deleted',
+					plan.triggers.map((t) => `${t.path} (${t.kind})`)
+				)}
+			{/if}
+			{#if plan.hasDraft}
+				{@render group('Unsaved pipeline changes discarded', ['Your pipeline draft'])}
+			{/if}
+			{#if !plan.scripts.length && !plan.triggers.length && !plan.hasDraft}
+				<span class="text-secondary">Nothing left to remove in this pipeline.</span>
+			{/if}
+			<span class="text-secondary">
+				The tables and files the pipeline wrote are kept, and so is the folder f/{folder}.
+			</span>
+		{/if}
+	</div>
+</ConfirmationModal>
+
+{#snippet group(title: string, entries: string[])}
+	<div class="flex flex-col gap-1">
+		<span class="font-semibold text-emphasis">{title} ({entries.length})</span>
+		<ul class="max-h-40 overflow-auto rounded-md border bg-surface-secondary px-3 py-1.5">
+			{#each entries as entry (entry)}
+				<li class="font-mono text-2xs text-primary truncate">{entry}</li>
+			{/each}
+		</ul>
+	</div>
+{/snippet}
diff --git a/frontend/src/lib/components/common/table/RawAppRow.svelte b/frontend/src/lib/components/common/table/RawAppRow.svelte
index ff31eb1aea..be1c9f0150 100644
--- a/frontend/src/lib/components/common/table/RawAppRow.svelte
+++ b/frontend/src/lib/components/common/table/RawAppRow.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import SharedBadge from '$lib/components/SharedBadge.svelte'
 	import type ShareModal from '$lib/components/ShareModal.svelte'
@@ -33,7 +32,7 @@
 </script>
 
 <Row
-	href="{base}/apps_raw/get/{app.path}"
+	href="/apps_raw/get/{app.path}"
 	kind="raw_app"
 	{keyboardSelected}
 	{marked}
diff --git a/frontend/src/lib/components/common/table/ScriptRow.svelte b/frontend/src/lib/components/common/table/ScriptRow.svelte
index 938086a0e8..7ba327f343 100644
--- a/frontend/src/lib/components/common/table/ScriptRow.svelte
+++ b/frontend/src/lib/components/common/table/ScriptRow.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import type MoveDrawer from '$lib/components/MoveDrawer.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
@@ -157,8 +156,8 @@
 	aiId={`script-run-button-${script.path}`}
 	aiDescription={`Button to access the form to run the script ${script.summary ?? script.path}`}
 	href={script.draft_only || (script.auto_kind === 'lib' && script.kind !== 'preprocessor')
-		? `${base}/scripts/edit/${script.path}`
-		: `${base}/scripts/get/${script.hash}?workspace=${$workspaceStore}`}
+		? `/scripts/edit/${script.path}`
+		: `/scripts/get/${script.hash}?workspace=${$workspaceStore}`}
 	kind="script"
 	{keyboardSelected}
 	{marked}
@@ -261,7 +260,7 @@
 								wrapperClasses="w-20"
 								unifiedSize="md"
 								startIcon={{ icon: Pen }}
-								href="{base}/scripts/edit/{script.path}"
+								href="/scripts/edit/{script.path}"
 							>
 								Edit
 							</Button>
@@ -351,7 +350,7 @@
 					{
 						displayName: 'Duplicate/Fork',
 						icon: GitFork,
-						href: `${base}/scripts/add?template=${script.path}`,
+						href: `/scripts/add?template=${script.path}`,
 						disabled: !showEditButton,
 						hide: $userStore?.operator
 					},
@@ -391,7 +390,7 @@
 					{
 						displayName: 'View runs',
 						icon: List,
-						href: `${base}/runs/${script.path}`
+						href: `/runs/${script.path}`
 					},
 					{
 						displayName: 'Versions',
@@ -403,7 +402,7 @@
 					{
 						displayName: 'Audit logs',
 						icon: Eye,
-						href: `${base}/audit_logs?resource=${script.path}`,
+						href: `/audit_logs?resource=${script.path}`,
 						hide: $userStore?.operator
 					},
 					{
diff --git a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
index d89bd37fa6..ae2c4c4bae 100644
--- a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
+++ b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
@@ -50,6 +50,9 @@
 		/** Render after the right-pinned tabs, outside the scroll area so it stays
 		 * pinned (e.g. a "Split with Preview" toggle). */
 		trailing?: import('svelte').Snippet
+		/** Tab height. `sm` (the default) is the 24px pill the panel strips use; `md` is 28px, for a
+		 * strip that fills a 44px bar, where the smaller pill leaves too much air around it. */
+		size?: 'sm' | 'md'
 		/** Render inside each tab (after the label; receives the tab + isActive). Clicks
 		 * bubble to the tab unless the accessory stops them. The tab is position:relative
 		 * so an `absolute inset-0 pointer-events-none` child can anchor a whole-tab
@@ -65,6 +68,7 @@
 		onReorder,
 		onActiveClick,
 		class: c = '',
+		size = 'sm',
 		afterTabs,
 		trailing,
 		tabAccessory
@@ -180,7 +184,8 @@
 
 	function tabClasses(isActive: boolean) {
 		return twMerge(
-			'group relative inline-flex items-center gap-1.5 px-2.5 h-6 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
+			'group relative inline-flex items-center gap-1.5 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
+			size === 'md' ? 'h-7 px-3 gap-2' : 'h-6 px-2.5',
 			isActive
 				? 'bg-surface-tertiary text-emphasis'
 				: 'bg-transparent text-hint hover:text-secondary'
@@ -197,6 +202,8 @@
 	// would fire, so the tab must claim its keys first via stopPropagation.
 	function handleKeydown(e: KeyboardEvent, tab: TabItem) {
 		if (e.target !== e.currentTarget) return // let nested controls (close ×) act
+		// A modified key is the host page's shortcut (e.g. Cmd+Enter to run), not a tab action.
+		if (e.ctrlKey || e.metaKey || e.altKey) return
 		if (e.key === 'Delete' || e.key === 'Backspace') {
 			if (tab.closable !== false) {
 				e.preventDefault()
@@ -221,6 +228,19 @@
 		}
 	}
 
+	// svelte-dnd-action claims every Enter/Space on a focused tab or on its (also focusable)
+	// item wrapper to start a keyboard drag, and stops it there — so a modified one, the host
+	// page's shortcut, is stopped first and re-sent from the strip, above the dnd zone. The
+	// target test mirrors dnd's own skip, leaving nested buttons and inputs alone.
+	function forwardModifiedKey(e: KeyboardEvent) {
+		if (!(e.ctrlKey || e.metaKey || e.altKey) || (e.key !== 'Enter' && e.key !== ' ')) return
+		const target = e.target as HTMLElement & { disabled?: boolean; href?: string }
+		if (target === stripEl || target.disabled !== undefined || target.href) return
+		if (target.isContentEditable) return
+		e.stopPropagation()
+		stripEl?.dispatchEvent(new KeyboardEvent(e.type, e))
+	}
+
 	function handleAuxClick(e: MouseEvent, tab: TabItem) {
 		if (e.button === 1 && tab.closable !== false) {
 			e.preventDefault()
@@ -269,7 +289,12 @@
 	</div>
 {/snippet}
 
-<div bind:this={stripEl} class={twMerge('flex items-center bg-surface min-h-8', c)}>
+<div
+	bind:this={stripEl}
+	class={twMerge('flex items-center bg-surface min-h-8', c)}
+	onkeydowncapture={forwardModifiedKey}
+	role="presentation"
+>
 	<!-- The tabs centre in the full strip and the bar overlays the air under them,
 	     flush with the strip's bottom edge — it takes no height of its own, so the
 	     strip never resizes and the tabs sit at the same place whether or not they
diff --git a/frontend/src/lib/components/common/teams/TeamsConnectionStatus.svelte b/frontend/src/lib/components/common/teams/TeamsConnectionStatus.svelte
index ce368e93b9..64b9269f3d 100644
--- a/frontend/src/lib/components/common/teams/TeamsConnectionStatus.svelte
+++ b/frontend/src/lib/components/common/teams/TeamsConnectionStatus.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { Badge, Button } from '$lib/components/common'
 	import { Plug, RotateCw, Unplug } from 'lucide-svelte'
-	import { base } from '$lib/base'
 
 	interface Props {
 		isConnected: boolean | undefined
@@ -15,7 +14,7 @@
 
 	// Connection URLs based on mode
 	let connectUrl = $derived(
-		mode === 'instance' ? `${base}/#superadmin-settings` : `${base}/workspace_settings?tab=teams`
+		mode === 'instance' ? `/#superadmin-settings` : `/workspace_settings?tab=teams`
 	)
 </script>
 
diff --git a/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte b/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte
index 1300dc4322..86f04dfa9f 100644
--- a/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte
+++ b/frontend/src/lib/components/common/toggleButton-v2/ToggleButtonMore.svelte
@@ -70,7 +70,14 @@
 		<div class="flex items-center">
 			<!-- The tooltip fixes a bug where the other tooltips won't disappear -->
 			<Tooltip disablePopup>
-				<DropdownV2 {btnText} enableFlyTransition {items} size={small ? 'sm' : 'md'} />
+				<!-- fixedHeight pins the wrapper at h-8, which overhangs a small group's 28px row. -->
+				<DropdownV2
+					{btnText}
+					enableFlyTransition
+					{items}
+					size={small ? 'sm' : 'md'}
+					fixedHeight={!small}
+				/>
 			</Tooltip>
 		</div>
 	</div>
diff --git a/frontend/src/lib/components/copilot/AIFormAssistant.svelte b/frontend/src/lib/components/copilot/AIFormAssistant.svelte
index aab3c73a1e..48a46ad182 100644
--- a/frontend/src/lib/components/copilot/AIFormAssistant.svelte
+++ b/frontend/src/lib/components/copilot/AIFormAssistant.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
-	import { Pencil, WandSparkles } from 'lucide-svelte'
+	import { ChevronDown, ChevronRight, Pencil, WandSparkles } from 'lucide-svelte'
+	import { slide } from 'svelte/transition'
 	import { aiChatManager } from './chat/AIChatManager.svelte'
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { AIBtnClasses } from './chat/AIButtonStyle'
@@ -9,7 +10,10 @@
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 
 	interface Props {
-		onEditInstructions: () => void
+		/** Unset for a viewer who cannot edit the item: the card then offers no way to the editor. */
+		onEditInstructions: (() => void) | undefined
+		/** Empty renders the AI button alone, sized for the run form's action row, which
+		 * is where the host places it; a prompt makes this a card of its own. */
 		instructions: string
 		runnableType: 'script' | 'flow'
 		path: string | undefined
@@ -19,6 +23,8 @@
 
 	const operatingWorkspace = useOperatingWorkspace()
 
+	let expanded = $state(false)
+
 	// Anonymous counter for this card being acted on, keyed by what it sits above. The two
 	// branches share one counter: they are the same intent, and which of them is on screen
 	// follows the user's session gate rather than a choice made here. `beforeOpen` is the
@@ -33,66 +39,69 @@
 		aiChatManager.askAi(`Analyze the ${runnableType} form on this page and fill the inputs for me`)
 	}
 
-	// A session cannot reach this page's form (the preview is a separate editor,
-	// and form filling drives the DOM through NAVIGATOR mode), so the hand-off
-	// asks it to run the item instead. Naming the DEPLOYED version matters: the
-	// test_run_* tools prefer drafts, which is not what this page runs.
+	// The session's preview opens on this same deployed page (`/get/`), not the item's
+	// editor: someone on a run page came to run the item, not to change it.
 	const sessionSource = $derived(
 		path
 			? {
-					target: { kind: runnableType, path } as const,
+					page: () => `/${runnableType}s/get/${path}`,
 					workspaceId: $operatingWorkspace ?? undefined,
-					beforeOpen: logAsked,
-					seedPrompt:
-						`Run the deployed ${runnableType} \`${path}\` for me. Pick sensible inputs, ` +
-						`tell me what you chose, then run it.` +
-						(instructions ? `\n\nHow to choose the inputs:\n${instructions}` : '')
+					beforeOpen: logAsked
 				}
 			: undefined
 	)
 </script>
 
-{#if !$copilotInfo.workspaceDisabled}
-	<div class="my-3 p-3 bg-surface-secondary rounded-md relative flex flex-col gap-3">
-		<div class="flex flex-row gap-2 justify-between items-center">
-			<!-- Heading stays neutral because the two branches do different things: the
-		     hand-off runs the item, the legacy path fills the form. Each button
-		     names its own action. A plain Button rather than AskAiButton, whose own
-		     session branch would fire here too and open an empty session. -->
-			<h3 class="text-sm font-medium">AI can help with these inputs</h3>
-			<OpenInSessionButton
-				source={sessionSource}
-				label="Run in AI session"
-				tooltip="Open an AI session that picks inputs and runs this"
-				btnProps={{ iconOnly: false, startIcon: { icon: WandSparkles } }}
-			>
-				{#snippet fallback()}
-					<Button
-						unifiedSize="md"
-						startIcon={{ icon: WandSparkles }}
-						btnClasses={AIBtnClasses('default')}
-						on:click={fillFormWithAI}
-					>
-						Fill with AI
-					</Button>
-				{/snippet}
-			</OpenInSessionButton>
-		</div>
-		<div class="flex flex-row gap-2 items-center">
-			<p class="text-sm text-primary">
-				{instructions
-					? 'Instructions: ' + instructions
-					: 'No AI instructions provided. Click edit to add guidance for AI form filling.'}
-			</p>
+{#snippet aiButton(unifiedSize: 'sm' | 'md')}
+	<!-- The fallback is a plain Button rather than AskAiButton, whose own session branch
+	     would fire here too and open an empty session. -->
+	<OpenInSessionButton source={sessionSource} btnProps={{ unifiedSize }}>
+		{#snippet fallback()}
 			<Button
-				color="light"
-				size="xs2"
-				startIcon={{
-					icon: Pencil
-				}}
-				iconOnly
-				on:click={onEditInstructions}
-			/>
+				{unifiedSize}
+				startIcon={{ icon: WandSparkles }}
+				btnClasses={AIBtnClasses('default')}
+				onclick={fillFormWithAI}
+			>
+				Fill with AI
+			</Button>
+		{/snippet}
+	</OpenInSessionButton>
+{/snippet}
+
+{#if $copilotInfo.workspaceDisabled}
+	<!-- The workspace hid the assistant. -->
+{:else if instructions}
+	<div class="my-2 flex flex-col gap-1">
+		<div class="flex flex-row gap-2 justify-between items-center">
+			<Button
+				variant="subtle"
+				unifiedSize="sm"
+				startIcon={{ icon: expanded ? ChevronDown : ChevronRight }}
+				onclick={() => (expanded = !expanded)}
+			>
+				AI prompt
+			</Button>
+			{@render aiButton('sm')}
 		</div>
+		{#if expanded}
+			<div
+				transition:slide={{ duration: 120 }}
+				class="flex flex-row gap-2 items-start justify-between p-2 bg-surface-secondary rounded-md"
+			>
+				<p class="text-xs text-primary whitespace-pre-wrap">{instructions}</p>
+				{#if onEditInstructions}
+					<Button
+						variant="subtle"
+						unifiedSize="xs"
+						startIcon={{ icon: Pencil }}
+						iconOnly
+						onclick={onEditInstructions}
+					/>
+				{/if}
+			</div>
+		{/if}
 	</div>
+{:else}
+	{@render aiButton('md')}
 {/if}
diff --git a/frontend/src/lib/components/copilot/AIFormSettings.svelte b/frontend/src/lib/components/copilot/AIFormSettings.svelte
index ef627ace4b..4bae2a825a 100644
--- a/frontend/src/lib/components/copilot/AIFormSettings.svelte
+++ b/frontend/src/lib/components/copilot/AIFormSettings.svelte
@@ -1,8 +1,6 @@
 <script lang="ts">
-	import { slide } from 'svelte/transition'
 	import Label from '../Label.svelte'
-	import Toggle from '../Toggle.svelte'
-	import Tooltip from '../Tooltip.svelte'
+	import TextInput from '../text_input/TextInput.svelte'
 	import { copilotInfo } from '$lib/aiStore'
 
 	interface Props {
@@ -10,40 +8,21 @@
 		type?: 'flow' | 'script'
 	}
 
-	let { prompt = $bindable(undefined), type = 'script' }: Props = $props()
+	let { prompt = $bindable(), type = 'script' }: Props = $props()
 </script>
 
 {#if !$copilotInfo.workspaceDisabled}
-	<div>
-		<Toggle
-			textClass="font-medium"
-			size="xs"
-			checked={prompt !== undefined}
-			on:change={() => {
-				if (prompt !== undefined) {
-					prompt = undefined
-				} else {
-					prompt = ''
-				}
+	<Label
+		label="AI prompt"
+		tooltip="An AI choosing this {type}'s inputs already reads its description and each field's description. Anything written here is given to it as extra guidance: mention specific fields and how they interact."
+	>
+		<TextInput
+			underlyingInputEl="textarea"
+			bind:value={() => prompt ?? '', (v) => (prompt = v === '' ? undefined : String(v))}
+			inputProps={{
+				placeholder: `Instructions for the AI about how to choose this ${type}'s inputs`,
+				rows: 3
 			}}
-			options={{ right: `Enable filling ${type} inputs with AI` }}
 		/>
-		{#if prompt !== undefined}
-			<div transition:slide={{ duration: 120 }} class="mt-6">
-				<Label label="Additional prompt for AI">
-					{#snippet header()}
-						<Tooltip>
-							AI will use script description and each field description to fill the inputs form. In
-							addition, any prompt passed here will be used by AI to guide it. You can mention
-							specific fields and interaction between fields here.
-						</Tooltip>
-					{/snippet}
-					<textarea
-						bind:value={prompt}
-						placeholder="Instructions for the AI about how to fill the form"
-					></textarea>
-				</Label>
-			</div>
-		{/if}
-	</div>
+	</Label>
 {/if}
diff --git a/frontend/src/lib/components/copilot/CronGen.svelte b/frontend/src/lib/components/copilot/CronGen.svelte
index 94715a0f18..fb5806234c 100644
--- a/frontend/src/lib/components/copilot/CronGen.svelte
+++ b/frontend/src/lib/components/copilot/CronGen.svelte
@@ -5,7 +5,6 @@
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import { sendUserToast } from '$lib/toast'
 
-	import { base } from '$lib/base'
 	import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
 	import { copilotInfo } from '$lib/aiStore'
 	import { untrack } from 'svelte'
@@ -132,7 +131,7 @@
 					<div class="block text-primary">
 						<p class="text-sm"
 							>Enable Windmill AI in the <a
-								href="{base}/workspace_settings?tab=ai"
+								href="/workspace_settings?tab=ai"
 								target="_blank"
 								class="inline-flex flex-row items-center gap-1"
 								>workspace settings <ExternalLink size={16} /></a
diff --git a/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte b/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte
index 29ce045042..45df865c11 100644
--- a/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte
+++ b/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte
@@ -3,7 +3,6 @@
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Button from '../common/button/Button.svelte'
 	import { ExternalLink, WandSparkles } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { twMerge } from 'tailwind-merge'
 	import { aiChatManager, AIMode } from './chat/AIChatManager.svelte'
 	import { chatState } from './chat/sharedChatState.svelte'
@@ -97,7 +96,7 @@
 						<div class="p-4">
 							<p class="text-sm">
 								Enable Windmill AI in the <a
-									href="{base}/workspace_settings?tab=ai"
+									href="/workspace_settings?tab=ai"
 									target="_blank"
 									class="inline-flex flex-row items-center gap-1"
 								>
diff --git a/frontend/src/lib/components/copilot/RegexGen.svelte b/frontend/src/lib/components/copilot/RegexGen.svelte
index f399726988..32fdc4a5f1 100644
--- a/frontend/src/lib/components/copilot/RegexGen.svelte
+++ b/frontend/src/lib/components/copilot/RegexGen.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { run } from 'svelte/legacy'
 
-	import { base } from '$lib/base'
 	import { Button } from '../common'
 
 	import { getNonStreamingMetadataCompletion } from './lib'
@@ -172,7 +171,7 @@
 				{:else}
 					<p class="text-sm">
 						Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
+							href="/workspace_settings?tab=ai"
 							target="_blank"
 							class="inline-flex flex-row items-center gap-1"
 						>
diff --git a/frontend/src/lib/components/copilot/ResourceGen.svelte b/frontend/src/lib/components/copilot/ResourceGen.svelte
index 2fc3cfa646..0d21635e77 100644
--- a/frontend/src/lib/components/copilot/ResourceGen.svelte
+++ b/frontend/src/lib/components/copilot/ResourceGen.svelte
@@ -4,7 +4,6 @@
 	import { getNonStreamingMetadataCompletion } from './lib'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { base } from '$lib/base'
 	import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
 	import { copilotInfo } from '$lib/aiStore'
 	import type { Schema } from '$lib/common'
@@ -175,7 +174,7 @@
 					<div class="block text-primary">
 						<p class="text-sm"
 							>Enable Windmill AI in the <a
-								href="{base}/workspace_settings?tab=ai"
+								href="/workspace_settings?tab=ai"
 								target="_blank"
 								class="inline-flex flex-row items-center gap-1"
 								>workspace settings <ExternalLink size={16} /></a
diff --git a/frontend/src/lib/components/copilot/ScriptFix.svelte b/frontend/src/lib/components/copilot/ScriptFix.svelte
index 78c4804cc8..bc6fca10d5 100644
--- a/frontend/src/lib/components/copilot/ScriptFix.svelte
+++ b/frontend/src/lib/components/copilot/ScriptFix.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { Button } from '../common'
 
 	import { SUPPORTED_LANGUAGES } from './lib'
@@ -139,7 +138,7 @@
 								<p class="text-sm"
 									>Enable Windmill AI in the <a
 										class="inline-flex flex-row items-center gap-1"
-										href="{base}/workspace_settings?tab=ai"
+										href="/workspace_settings?tab=ai"
 										target="_blank">workspace settings</a
 									></p
 								></div
diff --git a/frontend/src/lib/components/copilot/ScriptGen.svelte b/frontend/src/lib/components/copilot/ScriptGen.svelte
index fea738b8f1..4b141ec228 100644
--- a/frontend/src/lib/components/copilot/ScriptGen.svelte
+++ b/frontend/src/lib/components/copilot/ScriptGen.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { Button } from '../common'
 
 	import { MAX_SCHEMA_LENGTH, SUPPORTED_LANGUAGES, addThousandsSeparator, copilot } from './lib'
@@ -528,7 +527,7 @@
 				{:else}
 					<p class="text-sm">
 						Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
+							href="/workspace_settings?tab=ai"
 							target="_blank"
 							class="inline-flex flex-row items-center gap-1"
 						>
diff --git a/frontend/src/lib/components/copilot/StepInputsGen.svelte b/frontend/src/lib/components/copilot/StepInputsGen.svelte
index c9ef616aa5..2fd93866d3 100644
--- a/frontend/src/lib/components/copilot/StepInputsGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputsGen.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import YAML from 'yaml'
 	import { yamlStringifyExceptKeys } from './utils'
 	import { sliceModules } from '../flows/flowStateUtils.svelte'
@@ -252,7 +251,7 @@ input_name2: expression2
 						{#if !$copilotInfo.enabled}
 							Enable Windmill AI in the{' '}
 							<a
-								href="{base}/workspace_settings?tab=ai"
+								href="/workspace_settings?tab=ai"
 								target="_blank"
 								class="inline-flex flex-row items-center gap-1"
 							>
diff --git a/frontend/src/lib/components/copilot/chat/AIButton.svelte b/frontend/src/lib/components/copilot/chat/AIButton.svelte
index 7420e8d6b7..8b23237ebf 100644
--- a/frontend/src/lib/components/copilot/chat/AIButton.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIButton.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { copilotInfo } from '$lib/aiStore'
 	import { aiUserDisabled } from '$lib/stores'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
@@ -50,7 +49,7 @@
 				{:else}
 					<p class="text-sm"
 						>Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
+							href="/workspace_settings?tab=ai"
 							target="_blank"
 							class="inline-flex flex-row items-center gap-1"
 							>workspace settings <ExternalLink size={16} /></a
diff --git a/frontend/src/lib/components/copilot/chat/AIChat.svelte b/frontend/src/lib/components/copilot/chat/AIChat.svelte
index fd95613f2e..301a8dba54 100644
--- a/frontend/src/lib/components/copilot/chat/AIChat.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChat.svelte
@@ -7,7 +7,6 @@
 	import { getAiChatManager } from './aiChatManagerContext'
 
 	const aiChatManager = getAiChatManager()
-	import { base } from '$lib/base'
 	import HideButton from '$lib/components/apps/editor/settingsPanel/HideButton.svelte'
 	import { SUPPORTED_CHAT_SCRIPT_LANGUAGES } from './script/core'
 	import { copilotInfo } from '$lib/aiStore'
@@ -74,7 +73,7 @@
 							: $aiUserDisabled
 								? 'Windmill AI is disabled in your account settings'
 								: isAdmin
-									? `Enable Windmill AI in your [workspace settings](${base}/workspace_settings?tab=ai) to use this chat`
+									? 'Enable Windmill AI in your [workspace settings](/workspace_settings?tab=ai) to use this chat'
 									: 'Ask an admin to enable Windmill AI in this workspace to use this chat'
 						: aiChatManager.mode === AIMode.SCRIPT &&
 							  aiChatManager.scriptEditorOptions?.lang &&
diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index d5406aeca2..1060a64110 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -71,7 +71,6 @@
 	import { sendUserToast } from '$lib/toast'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { copilotInfo } from '$lib/aiStore'
-	import { base } from '$lib/base'
 
 	const MAX_YOLO_TOOLTIP_TOOLS = 8
 	const chatHost = getChatViewHost()
@@ -713,7 +712,7 @@
 					unifiedSize="2xs"
 					variant="accent"
 					startIcon={{ icon: KeyRound }}
-					href="{base}/workspace_settings?tab=ai"
+					href="/workspace_settings?tab=ai"
 				>
 					Add your own API key
 				</Button>
@@ -733,7 +732,7 @@
 			unifiedSize="2xs"
 			variant="default"
 			startIcon={{ icon: KeyRound }}
-			href="{base}/workspace_settings?tab=ai"
+			href="/workspace_settings?tab=ai"
 		>
 			Configure your API key
 		</Button>
@@ -1107,16 +1106,13 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 							</Tooltip>
 						{:else if canAttachFiles}
 							<DropdownV2
-								items={async () => {
-									// Both submenus fetch on the menu's first open, so they start
-									// together: awaited inline they queue, and the whole menu —
-									// attachments included — waits out two round trips.
+								items={() => {
 									const closeMenu = () => (plusMenuOpen = false)
 									const inGlobal = chatHost.mode === AIMode.GLOBAL
-									const [skillItems, mcpItems] = await Promise.all([
-										inGlobal ? skillsMenu.items(closeMenu) : undefined,
-										inGlobal ? mcpMenu.items(closeMenu) : undefined
-									])
+									if (inGlobal) {
+										skillsMenu.refresh()
+										mcpMenu.refresh()
+									}
 									return [
 										{
 											displayName: 'Attach file or image',
@@ -1156,23 +1152,24 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 													}
 												]
 											: []),
-										...(skillItems
+										...(inGlobal
 											? [
 													{
 														displayName: 'Skills',
 														icon: BookOpen,
 														separatorTop: true,
-														submenuItems: skillItems
-													}
-												]
-											: []),
-										...(mcpItems
-											? [
+														// Getters so the submenus fill in when their fetch lands
+														// rather than the whole menu waiting on it.
+														get submenuItems() {
+															return skillsMenu.items(closeMenu)
+														}
+													},
 													{
 														displayName: 'MCP connections',
 														icon: Plug,
-														separatorTop: !skillItems,
-														submenuItems: mcpItems
+														get submenuItems() {
+															return mcpMenu.items(closeMenu)
+														}
 													}
 												]
 											: [])
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index bcea3a26d6..41ea788fac 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -50,6 +50,7 @@
 		type AttachedBlob
 	} from './blobUtils'
 	import { MessageDraft } from './messageDraft.svelte'
+	import { useSessionPermissions } from '$lib/components/sessions/sessionPermissions.svelte'
 	import ExpandableImage, {
 		isImageViewerOpen
 	} from '$lib/components/common/image/ExpandableImage.svelte'
@@ -134,10 +135,28 @@
 		'Refactor a script to add error handling',
 		'List my workspace flows and scripts'
 	]
-	const globalSuggestion =
-		GLOBAL_PLACEHOLDER_SUGGESTIONS[
-			Math.floor(Math.random() * GLOBAL_PLACEHOLDER_SUGGESTIONS.length)
-		]
+	// An operator authors nothing, so nothing above is theirs to ask for; one with the
+	// workspace's builder right can compose flows out of deployed scripts as well.
+	const OPERATOR_PLACEHOLDER_SUGGESTIONS = [
+		'List my workspace flows and scripts',
+		'Show the runs that failed today and why',
+		'Find the script that sends a report and run it',
+		'Rerun the last failed run of a flow'
+	]
+	const BUILDER_PLACEHOLDER_SUGGESTIONS = [
+		...OPERATOR_PLACEHOLDER_SUGGESTIONS,
+		'Compose a flow that chains two deployed scripts'
+	]
+	const permissions = useSessionPermissions(() => chatHost.operatingWorkspace)
+	const suggestionPick = Math.random()
+	const globalSuggestion = $derived.by(() => {
+		const pool = permissions.canOpenEditor('script')
+			? GLOBAL_PLACEHOLDER_SUGGESTIONS
+			: permissions.canOpenEditor('flow')
+				? BUILDER_PLACEHOLDER_SUGGESTIONS
+				: OPERATOR_PLACEHOLDER_SUGGESTIONS
+		return pool[Math.floor(suggestionPick * pool.length)]
+	})
 
 	// Generate mode-specific placeholder
 	const modePlaceholder = $derived.by(() => {
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 7bf9685e87..6c49effb81 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -52,7 +52,7 @@ import { loadApiTools } from './api/apiTools'
 import { prepareScriptUserMessage } from './script/core'
 import { prepareNavigatorUserMessage } from './navigator/core'
 import { sendUserToast } from '$lib/toast'
-import { workspaceAIClients, getNonStreamingCompletion } from '../lib'
+import { workspaceAIClients, getStreamedCompletionText } from '../lib'
 import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { modelSupportsVision } from '../modelConfig'
 import { getEffectiveModelContextWindow } from '../modelConfig'
@@ -168,7 +168,11 @@ import type { ArtifactVersionTarget } from '$lib/components/sessions/previewRout
 import { appendAttachedFilesRoster } from './files/fileTools'
 import { ENTER_PLAN_MODE_TOOL, EXIT_PLAN_MODE_TOOL } from './planMode'
 import { PlanModeController, type PlanModeHost } from './planModeController.svelte'
-import { navigationOperatorBuilderFlows } from '$lib/operatorWriteRights'
+import {
+	navigationOperatorBuilderApps,
+	navigationOperatorBuilderFlows,
+	navigationOperatorBuilderRights
+} from '$lib/operatorWriteRights'
 
 // Compaction of the stored history: once the projected request size
 // (contextTokens — the provider's report when current, a fresh chars/4
@@ -301,7 +305,9 @@ export function supportsPlanMode(mode: AIMode): boolean {
 	return PLAN_MODES.has(mode)
 }
 
+const isOperatorBuilder = fromStore(navigationOperatorBuilderRights)
 const isOperatorBuilderFlows = fromStore(navigationOperatorBuilderFlows)
+const isOperatorBuilderApps = fromStore(navigationOperatorBuilderApps)
 
 export function isAIModeVisible(mode: AIMode): boolean {
 	return mode !== AIMode.GLOBAL || isGlobalAiEnabled()
@@ -501,11 +507,17 @@ export class AIChatManager implements ChatViewHost {
 	skipResponsesApi = $state(false)
 
 	mode = $state<AIMode>(AIMode.NAVIGATOR)
-	pipelineAiChatHelpers = $state<PipelineAIChatHelpers | undefined>(undefined)
+	// One per mounted pipeline editor; a session can have several folders open.
+	#pipelineEditors = new Set<PipelineAIChatHelpers>()
 	// Resolved when a pipeline editor registers its tools. open_preview(pipeline)
 	// awaits this so the model's next build_pipeline_node call can't race ahead of
 	// the async canvas mount and hit "Unknown tool call".
-	#pipelineHelpersWaiters = new Set<() => void>()
+	#pipelineHelpersWaiters = new Set<(helpers: PipelineAIChatHelpers) => void>()
+	// A session's pipeline editor unmounts whenever another tab takes the preview
+	// panel. Its tools stay offered for every folder the session opened, and a call
+	// reopens the tab through this, so a page shown in between costs no failed call.
+	#pipelineReopener: ((folder: string) => void) | undefined = undefined
+	#openedPipelineFolders = new Set<string>()
 	readonly isOpen = $derived(chatState.size > 0)
 	savedSize = $state<number>(0)
 	instructions = $state<string>('')
@@ -900,6 +912,15 @@ export class AIChatManager implements ChatViewHost {
 		await this.#persistModifiedItems()
 	}
 
+	// Record the items deploying a chat-modified item produced — a pipeline's
+	// scripts — so a fork review selects exactly them. Persisted at once, like a
+	// discard: the deploy can run outside any turn.
+	async recordDeployedItems(itemKind: UserDraftItemKind, storagePaths: string[]) {
+		if (!this.modifiedItems || storagePaths.length === 0) return
+		for (const p of storagePaths) this.modifiedItems.add(maskKey(itemKind, p))
+		await this.#persistModifiedItems()
+	}
+
 	// Move a mask entry to the path a draft actually deployed to. A draft-only
 	// flow/app parks at a synthetic `draft_{uuid}` storage path and deploys to
 	// its chosen path — without the move, the existence check at the synthetic
@@ -1438,20 +1459,23 @@ export class AIChatManager implements ChatViewHost {
 			.map((s) => ({ ...s, kind: 'skill' as const }))
 	])
 
-	// The flow and script builders both write code, which the backend refuses from an operator
-	// with the builder right: leaving them reachable would only produce work that cannot be
+	// The flow, app and script builders all write code, which the backend refuses from an
+	// operator with builder rights: leaving them reachable would only produce work that cannot be
 	// deployed.
 	allowedModes: Record<AIMode, boolean> = $derived({
 		script:
 			this.flowAiChatHelpers === undefined &&
 			this.scriptEditorOptions !== undefined &&
 			!this.disabledModes.script &&
-			!isOperatorBuilderFlows.current,
+			!isOperatorBuilder.current,
 		flow:
 			this.flowAiChatHelpers !== undefined &&
 			!this.disabledModes.flow &&
 			!isOperatorBuilderFlows.current,
-		app: this.appAiChatHelpers !== undefined && !this.disabledModes.app,
+		app:
+			this.appAiChatHelpers !== undefined &&
+			!this.disabledModes.app &&
+			!isOperatorBuilderApps.current,
 		navigator: !this.disabledModes.navigator,
 		ask: !this.disabledModes.ask,
 		API: !this.disabledModes.API,
@@ -1587,10 +1611,8 @@ export class AIChatManager implements ChatViewHost {
 		this.compacting = true
 		try {
 			// Cap the summarizer's output at the budget already reserved for the
-			// summary. Without a cap the model's default max_tokens applies, and the
-			// Anthropic SDK rejects non-streaming requests whose max_tokens implies
-			// >10 minutes of generation (~21k tokens) before anything is sent.
-			const raw = await getNonStreamingCompletion(
+			// summary: without a cap the model's default max_tokens applies.
+			const raw = await getStreamedCompletionText(
 				[
 					// Strip image blobs from the summarizer input — the summary text stands in
 					// for them, so re-sending base64 to the summarizer only wastes tokens.
@@ -1600,7 +1622,7 @@ export class AIChatManager implements ChatViewHost {
 				abortController,
 				{ maxTokensCap: SUMMARY_OUTPUT_RESERVE_TOKENS }
 			)
-			const formatted = formatCompactSummary(raw ?? '')
+			const formatted = formatCompactSummary(raw)
 			if (!formatted) {
 				return 'empty'
 			}
@@ -2494,8 +2516,27 @@ export class AIChatManager implements ChatViewHost {
 
 	// Public because it is purely local, unlike `changeMode(GLOBAL)`, which also
 	// fires the three network refreshes.
+	setPipelineReopener = (reopen: (folder: string) => void) => {
+		this.#pipelineReopener = reopen
+	}
+
+	#pipelineFolders = (): string[] => [
+		...new Set([
+			...[...this.#pipelineEditors].map((p) => p.getFolder()),
+			...(this.#pipelineReopener ? this.#openedPipelineFolders : [])
+		])
+	]
+
+	#ensurePipeline = async (folder: string): Promise<PipelineAIChatHelpers | undefined> => {
+		const find = () => [...this.#pipelineEditors].find((p) => p.getFolder() === folder)
+		const live = find()
+		if (live || !this.#pipelineReopener) return live
+		this.#pipelineReopener(folder)
+		return (await this.waitForPipelineHelpers(folder)) ? find() : undefined
+	}
+
 	configureGlobalMode = () => {
-		const pipeline = this.pipelineAiChatHelpers
+		const hasPipelines = this.#pipelineFolders().length > 0
 		const opts = this.globalAssemblyOpts()
 		const baseHelpers: GlobalToolHelpers = {
 			// A session targets its own fixed (possibly forked) workspace, so capture it for
@@ -2527,7 +2568,14 @@ export class AIChatManager implements ChatViewHost {
 			}
 		}
 		this.#assembledTools = assembleGlobalTools(opts)
-		this.helpers = pipeline ? { ...baseHelpers, pipeline } : baseHelpers
+		this.helpers = hasPipelines
+			? {
+					...baseHelpers,
+					pipelines: () => [...this.#pipelineEditors],
+					pipelineFolders: this.#pipelineFolders,
+					ensurePipeline: this.#ensurePipeline
+				}
+			: baseHelpers
 		this.systemMessage = assembleGlobalSystemMessage(getCustomPromptParts(AIMode.GLOBAL), opts)
 		this.syncArtifactsSession()
 	}
@@ -2540,7 +2588,7 @@ export class AIChatManager implements ChatViewHost {
 		mcpServers: this.mcpServers,
 		access: this.sessionAccess,
 		sessionContext: this.sessionContextResolver?.(),
-		pipelineContext: this.pipelineAiChatHelpers?.getPipelineContext()
+		pipelineFolders: this.#pipelineFolders()
 	})
 
 	// Fetch the workspace's AI skills and, if GLOBAL mode is still active, rebuild
@@ -4872,19 +4920,18 @@ export class AIChatManager implements ChatViewHost {
 	// AI edits apply directly as drafts, so there is nothing to auto-accept.
 	// Returns a cleanup that tears the registration back down.
 	setPipelineHelpers = (pipelineHelpers: PipelineAIChatHelpers) => {
-		this.pipelineAiChatHelpers = pipelineHelpers
+		this.#pipelineEditors.add(pipelineHelpers)
+		this.#openedPipelineFolders.add(pipelineHelpers.getFolder())
 		untrack(() => {
 			if (this.mode === AIMode.GLOBAL) {
 				this.configureGlobalMode()
 			}
 		})
 		// The pipeline tools are now registered — release anything awaiting them.
-		const waiters = [...this.#pipelineHelpersWaiters]
-		this.#pipelineHelpersWaiters.clear()
-		waiters.forEach((resolve) => resolve())
+		;[...this.#pipelineHelpersWaiters].forEach((notify) => notify(pipelineHelpers))
 
 		return () => {
-			this.pipelineAiChatHelpers = undefined
+			this.#pipelineEditors.delete(pipelineHelpers)
 			untrack(() => {
 				if (this.mode === AIMode.GLOBAL) {
 					this.configureGlobalMode()
@@ -4894,15 +4941,16 @@ export class AIChatManager implements ChatViewHost {
 	}
 
 	/**
-	 * Await the pipeline editor's tool registration. Resolves `true` immediately
-	 * when a pipeline editor is already mounted, or when the next one registers;
-	 * resolves `false` after `timeoutMs` if none registers (e.g. a backgrounded
-	 * session whose preview tab is not mounted, or a closed tab). Callers must
-	 * treat `false` as "tools NOT available" rather than silently reporting
-	 * success — the open_preview handler surfaces that to the model.
+	 * Await the tool registration of the pipeline editor for `folder` (any folder
+	 * when unset). Resolves `true` immediately when one is already mounted, or when
+	 * it registers; resolves `false` after `timeoutMs` if none registers (e.g. a
+	 * session whose runtime is not mounted, or a closed tab). Callers must treat
+	 * `false` as "tools NOT available" rather than silently reporting success —
+	 * the open_preview handler surfaces that to the model.
 	 */
-	waitForPipelineHelpers = (timeoutMs = 8000): Promise<boolean> => {
-		if (this.pipelineAiChatHelpers) return Promise.resolve(true)
+	waitForPipelineHelpers = (folder?: string, timeoutMs = 8000): Promise<boolean> => {
+		const matches = (p: PipelineAIChatHelpers) => folder === undefined || p.getFolder() === folder
+		if ([...this.#pipelineEditors].some(matches)) return Promise.resolve(true)
 		return new Promise<boolean>((resolve) => {
 			let settled = false
 			const finish = (registered: boolean) => {
@@ -4911,7 +4959,9 @@ export class AIChatManager implements ChatViewHost {
 				this.#pipelineHelpersWaiters.delete(onRegister)
 				resolve(registered)
 			}
-			const onRegister = () => finish(true)
+			const onRegister = (p: PipelineAIChatHelpers) => {
+				if (matches(p)) finish(true)
+			}
 			this.#pipelineHelpersWaiters.add(onRegister)
 			setTimeout(() => finish(false), timeoutMs)
 		})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 97a1afb2ff..19d432bd37 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -24,7 +24,6 @@ vi.mock('$app/navigation', () => ({
 	afterNavigate: vi.fn(),
 	beforeNavigate: vi.fn()
 }))
-vi.mock('$app/paths', () => ({ base: '', assets: '' }))
 
 const mocks = vi.hoisted(() => ({
 	getCurrentModel: vi.fn(),
@@ -33,7 +32,7 @@ const mocks = vi.hoisted(() => ({
 	sendUserToast: vi.fn(),
 	getOpenaiClient: vi.fn(),
 	getAnthropicClient: vi.fn(),
-	getNonStreamingCompletion: vi.fn(),
+	getStreamedCompletionText: vi.fn(),
 	runChatLoop: vi.fn(),
 	listResource: vi.fn(),
 	getJob: vi.fn(),
@@ -143,7 +142,7 @@ vi.mock('../lib', () => ({
 		getOpenaiClient: mocks.getOpenaiClient,
 		getAnthropicClient: mocks.getAnthropicClient
 	},
-	getNonStreamingCompletion: mocks.getNonStreamingCompletion,
+	getStreamedCompletionText: mocks.getStreamedCompletionText,
 	providerSupportsWebSearch: (provider: string) => provider === 'openai' || provider === 'anthropic'
 }))
 
@@ -3350,7 +3349,7 @@ describe('AIChatManager context compaction', () => {
 	it('summarizes the older prefix and keeps the recent tail verbatim', async () => {
 		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
 		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
-		mocks.getNonStreamingCompletion.mockResolvedValue(
+		mocks.getStreamedCompletionText.mockResolvedValue(
 			'<analysis>scratchpad</analysis><summary>SUMMARY TEXT</summary>'
 		)
 		const manager = new AIChatManager()
@@ -3360,8 +3359,8 @@ describe('AIChatManager context compaction', () => {
 
 		// The prefix (the four OLD messages) was sent to the summarizer, followed
 		// by the summary-instruction user message.
-		expect(mocks.getNonStreamingCompletion).toHaveBeenCalledTimes(1)
-		const summaryReq = mocks.getNonStreamingCompletion.mock.calls[0][0]
+		expect(mocks.getStreamedCompletionText).toHaveBeenCalledTimes(1)
+		const summaryReq = mocks.getStreamedCompletionText.mock.calls[0][0]
 		expect(summaryReq).toHaveLength(5)
 		expect(summaryReq[0].content).toContain('OLD1')
 		expect(summaryReq[3].content).toContain('OLD4')
@@ -3392,7 +3391,7 @@ describe('AIChatManager context compaction', () => {
 	it('carries folded-away message files on the summary', async () => {
 		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
 		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
-		mocks.getNonStreamingCompletion.mockResolvedValue(
+		mocks.getStreamedCompletionText.mockResolvedValue(
 			'<analysis>s</analysis><summary>SUM</summary>'
 		)
 		const manager = new AIChatManager()
@@ -3423,7 +3422,7 @@ describe('AIChatManager context compaction', () => {
 	it('never lands the tail boundary on a screenshot follow-up that has no display counterpart', async () => {
 		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
 		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
-		mocks.getNonStreamingCompletion.mockResolvedValue('<summary>SUMMARY TEXT</summary>')
+		mocks.getStreamedCompletionText.mockResolvedValue('<summary>SUMMARY TEXT</summary>')
 		const manager = new AIChatManager()
 		manager.messages = [
 			{ role: 'user', content: 'OLD1' + 'a'.repeat(100_000) },
@@ -3471,7 +3470,7 @@ describe('AIChatManager context compaction', () => {
 	it('falls back to drop-oldest when summarization fails', async () => {
 		mocks.getCurrentModel.mockReturnValue(gpt4oModel)
 		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
-		mocks.getNonStreamingCompletion.mockRejectedValue(new Error('summary boom'))
+		mocks.getStreamedCompletionText.mockRejectedValue(new Error('summary boom'))
 		const manager = new AIChatManager()
 		seedForSummary(manager)
 
@@ -3479,7 +3478,7 @@ describe('AIChatManager context compaction', () => {
 
 		// Summarization was attempted, then the request still went out — via
 		// drop-oldest, so no summary boundary anywhere.
-		expect(mocks.getNonStreamingCompletion).toHaveBeenCalledTimes(1)
+		expect(mocks.getStreamedCompletionText).toHaveBeenCalledTimes(1)
 		expect(mocks.runChatLoop).toHaveBeenCalledTimes(1)
 		const sent = mocks.runChatLoop.mock.calls[0][0].messages
 		expect(sent[0].content).not.toContain('continued from a previous conversation')
@@ -3501,7 +3500,7 @@ describe('AIChatManager context compaction', () => {
 		await manager.sendRequest()
 
 		// A two-message prefix isn't worth a summary round-trip.
-		expect(mocks.getNonStreamingCompletion).not.toHaveBeenCalled()
+		expect(mocks.getStreamedCompletionText).not.toHaveBeenCalled()
 		expect(manager.displayMessages.some((m) => m.role === 'summary')).toBe(false)
 	})
 
@@ -3510,7 +3509,7 @@ describe('AIChatManager context compaction', () => {
 		mocks.tryGetCurrentModel.mockReturnValue(gpt4oModel)
 		// The user hits Stop while the summary request is in flight: it aborts the
 		// turn's controller and rejects.
-		mocks.getNonStreamingCompletion.mockImplementation(async (_msgs: any, ac: AbortController) => {
+		mocks.getStreamedCompletionText.mockImplementation(async (_msgs: any, ac: AbortController) => {
 			ac.abort('user_cancelled')
 			throw new Error('aborted')
 		})
@@ -3530,7 +3529,7 @@ describe('AIChatManager context compaction', () => {
 		// Summarization was attempted and aborted, but the abort must NOT trigger a
 		// destructive drop-oldest fallback: the full prefix survives and the unsent
 		// turn is rolled back to the pre-send history (the head pair is still there).
-		expect(mocks.getNonStreamingCompletion).toHaveBeenCalledTimes(1)
+		expect(mocks.getStreamedCompletionText).toHaveBeenCalledTimes(1)
 		expect(manager.messages).toHaveLength(6)
 		expect(manager.messages[0].content).toContain('OLD1')
 		expect(manager.displayMessages.some((m) => m.role === 'summary')).toBe(false)
@@ -3565,7 +3564,7 @@ describe('AIChatManager manual compaction', () => {
 	}
 
 	it('folds the whole history into a single summary boundary, keeping nothing verbatim', async () => {
-		mocks.getNonStreamingCompletion.mockResolvedValue('<summary>MANUAL SUMMARY</summary>')
+		mocks.getStreamedCompletionText.mockResolvedValue('<summary>MANUAL SUMMARY</summary>')
 		const manager = new AIChatManager()
 		seedExchange(manager)
 		manager.contextUsage = 123
@@ -3574,15 +3573,15 @@ describe('AIChatManager manual compaction', () => {
 		await manager.compactManually()
 
 		// The summarizer saw the entire history, then the summary instruction.
-		expect(mocks.getNonStreamingCompletion).toHaveBeenCalledTimes(1)
-		const summaryReq = mocks.getNonStreamingCompletion.mock.calls[0][0]
+		expect(mocks.getStreamedCompletionText).toHaveBeenCalledTimes(1)
+		const summaryReq = mocks.getStreamedCompletionText.mock.calls[0][0]
 		expect(summaryReq).toHaveLength(5)
 		expect(summaryReq[0].content).toBe('q1')
 		expect(summaryReq[3].content).toBe('a2')
 		expect(summaryReq[4].content).toContain('detailed summary')
-		// The summarizer's output must stay capped: without it the model default
-		// applies and the Anthropic SDK rejects the non-streaming call pre-flight.
-		expect(mocks.getNonStreamingCompletion.mock.calls[0][2]).toEqual({ maxTokensCap: 8000 })
+		// The summarizer's output must stay capped at the budget reserved for the
+		// summary: without it the model default applies.
+		expect(mocks.getStreamedCompletionText.mock.calls[0][2]).toEqual({ maxTokensCap: 8000 })
 
 		// Nothing kept verbatim: messages collapse to just the summary user message.
 		expect(manager.messages).toHaveLength(1)
@@ -3608,13 +3607,13 @@ describe('AIChatManager manual compaction', () => {
 
 		await manager.compactManually()
 
-		expect(mocks.getNonStreamingCompletion).not.toHaveBeenCalled()
+		expect(mocks.getStreamedCompletionText).not.toHaveBeenCalled()
 		expect(mocks.sendUserToast).toHaveBeenCalledWith('Nothing to compact yet.')
 		expect(manager.messages).toHaveLength(1)
 	})
 
 	it('leaves history untouched when the user stops mid-summary', async () => {
-		mocks.getNonStreamingCompletion.mockImplementation(async (_msgs: any, ac: AbortController) => {
+		mocks.getStreamedCompletionText.mockImplementation(async (_msgs: any, ac: AbortController) => {
 			ac.abort('user_cancelled')
 			throw new Error('aborted')
 		})
@@ -3631,7 +3630,7 @@ describe('AIChatManager manual compaction', () => {
 	})
 
 	it('routes the /compact session command to manual compaction instead of the model', async () => {
-		mocks.getNonStreamingCompletion.mockResolvedValue('<summary>VIA COMMAND</summary>')
+		mocks.getStreamedCompletionText.mockResolvedValue('<summary>VIA COMMAND</summary>')
 		const manager = new AIChatManager()
 		manager.isSessionChat = true
 		seedExchange(manager)
@@ -3643,13 +3642,13 @@ describe('AIChatManager manual compaction', () => {
 		expect(sent).toBe(true)
 		expect(mocks.runChatLoop).not.toHaveBeenCalled()
 		// ...it ran the summarizer and compacted in place, clearing the composer.
-		expect(mocks.getNonStreamingCompletion).toHaveBeenCalledTimes(1)
+		expect(mocks.getStreamedCompletionText).toHaveBeenCalledTimes(1)
 		expect(manager.displayMessages[0]).toMatchObject({ role: 'summary', content: 'VIA COMMAND' })
 		expect(manager.instructions).toBe('')
 	})
 
 	it('auto-sends a message queued while compaction was running', async () => {
-		mocks.getNonStreamingCompletion.mockResolvedValue('<summary>S</summary>')
+		mocks.getStreamedCompletionText.mockResolvedValue('<summary>S</summary>')
 		mocks.runChatLoop.mockImplementation(async (config: any) => {
 			const message = { role: 'assistant' as const, content: 'done' }
 			config.addedMessages?.push(message)
@@ -3669,7 +3668,7 @@ describe('AIChatManager manual compaction', () => {
 		await manager.compactManually()
 
 		// Compaction ran once, then the queued message went out as a real turn.
-		expect(mocks.getNonStreamingCompletion).toHaveBeenCalledTimes(1)
+		expect(mocks.getStreamedCompletionText).toHaveBeenCalledTimes(1)
 		expect(mocks.runChatLoop).toHaveBeenCalledTimes(1)
 		const sent = mocks.runChatLoop.mock.calls[0][0].messages
 		expect(sent[sent.length - 1].content).toContain('follow-up question')
@@ -3687,7 +3686,7 @@ describe('AIChatManager manual compaction', () => {
 		// without ever reaching the model...
 		expect(sent).toBe(true)
 		expect(mocks.runChatLoop).not.toHaveBeenCalled()
-		expect(mocks.getNonStreamingCompletion).not.toHaveBeenCalled()
+		expect(mocks.getStreamedCompletionText).not.toHaveBeenCalled()
 		// ...it reset the conversation and cleared the composer.
 		expect(manager.displayMessages).toEqual([])
 		expect(manager.messages).toEqual([])
@@ -3758,7 +3757,7 @@ describe('AIChatManager manual compaction', () => {
 
 		// Without the session-chat command surface, /compact is a normal message.
 		expect(mocks.runChatLoop).toHaveBeenCalledTimes(1)
-		expect(mocks.getNonStreamingCompletion).not.toHaveBeenCalled()
+		expect(mocks.getStreamedCompletionText).not.toHaveBeenCalled()
 	})
 
 	it('shadows a selected skill that collides with a built-in command', () => {
@@ -4329,11 +4328,15 @@ describe('DOM selector chips scoped by app path', () => {
 describe('AIChatManager.waitForPipelineHelpers', () => {
 	function fakePipelineHelpers(): PipelineAIChatHelpers {
 		return {
+			getFolder: () => 'f',
+			hasDrafts: () => false,
 			getPipelineContext: () => ({ folder: 'f', mode: 'edit', nodes: [], assets: [] }),
 			getNodeBody: async () => undefined,
 			proposeNode: async () => ({ path: '', detectedReads: [], detectedWrites: [] }),
 			editNode: async () => ({ detectedReads: [], detectedWrites: [] }),
 			removeProposedNode: async () => {},
+			unconfiguredTriggers: async () => [],
+			setNodeTrigger: async () => ({ path: '', replaced: false }),
 			testNode: async () => undefined
 		}
 	}
@@ -4341,13 +4344,13 @@ describe('AIChatManager.waitForPipelineHelpers', () => {
 	it('resolves true immediately when a pipeline editor is already registered', async () => {
 		const manager = new AIChatManager()
 		manager.setPipelineHelpers(fakePipelineHelpers())
-		await expect(manager.waitForPipelineHelpers(1000)).resolves.toBe(true)
+		await expect(manager.waitForPipelineHelpers(undefined, 1000)).resolves.toBe(true)
 	})
 
 	it('resolves true once a pipeline editor registers', async () => {
 		const manager = new AIChatManager()
 		let outcome: boolean | undefined
-		const wait = manager.waitForPipelineHelpers(1000).then((v) => (outcome = v))
+		const wait = manager.waitForPipelineHelpers(undefined, 1000).then((v) => (outcome = v))
 		await Promise.resolve()
 		expect(outcome).toBeUndefined()
 		manager.setPipelineHelpers(fakePipelineHelpers())
@@ -4355,12 +4358,24 @@ describe('AIChatManager.waitForPipelineHelpers', () => {
 		expect(outcome).toBe(true)
 	})
 
+	it('waits for the editor of the requested folder, not any editor', async () => {
+		const manager = new AIChatManager()
+		manager.setPipelineHelpers(fakePipelineHelpers())
+		let outcome: boolean | undefined
+		const wait = manager.waitForPipelineHelpers('sales', 1000).then((v) => (outcome = v))
+		await Promise.resolve()
+		expect(outcome).toBeUndefined()
+		manager.setPipelineHelpers({ ...fakePipelineHelpers(), getFolder: () => 'sales' })
+		await wait
+		expect(outcome).toBe(true)
+	})
+
 	// The false result is the signal the open_preview handler needs: a backgrounded
 	// session's editor never mounts, so it must report "tools unavailable" rather
 	// than silently claim success.
 	it('resolves false after the timeout when no editor ever registers', async () => {
 		const manager = new AIChatManager()
-		await expect(manager.waitForPipelineHelpers(10)).resolves.toBe(false)
+		await expect(manager.waitForPipelineHelpers(undefined, 10)).resolves.toBe(false)
 	})
 })
 
diff --git a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
index 7bf1d99693..d11375b89b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
@@ -22,7 +22,6 @@
 	} from '$lib/aiStore'
 	import { WorkspaceService, type AIProvider, type AIProviderModel } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { base } from '$lib/base'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import { thinkingPreferences } from './thinkingPreferences.svelte'
 	import {
@@ -47,7 +46,7 @@
 	}: { promptSettings?: boolean } = $props()
 
 	const aiChatManager = getAiChatManager()
-	const AI_SETTINGS_HREF = `${base}/workspace_settings?tab=ai`
+	const AI_SETTINGS_HREF = '/workspace_settings?tab=ai'
 
 	let providerModel = $derived(
 		($copilotSessionModel ??
diff --git a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
index 1a1412b9f8..3e0351f249 100644
--- a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
+++ b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
@@ -3,14 +3,12 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import SessionsBetaBanner from '$lib/components/sessions/SessionsBetaBanner.svelte'
 	import { zIndexes } from '$lib/zIndexes'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { workspaceStore } from '$lib/stores'
 	import { chatState } from './sharedChatState.svelte'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { copilotInfo } from '$lib/aiStore'
 	import { aiChatManager } from './AIChatManager.svelte'
 	import { onDestroy } from 'svelte'
-	import Button from '$lib/components/common/button/Button.svelte'
-	import { Menu } from 'lucide-svelte'
 	import CreatedResourceActionDrawers from './CreatedResourceActionDrawers.svelte'
 
 	interface Props {
@@ -20,7 +18,6 @@
 		transitionClass?: string
 		isMobile?: boolean
 		children: any
-		onMenuOpen?: () => void
 		disableAi?: boolean
 		// Whether this layout loads the workspace AI config. It gates far more than
 		// the docked pane (code completion, metadata generation, the "open in AI
@@ -40,15 +37,14 @@
 		transitionClass = 'transition-all ease-in-out duration-200',
 		isMobile = false,
 		children,
-		onMenuOpen,
 		disableAi,
 		loadAiConfig = true,
 		showSessionsBetaBanner = false
 	}: Props = $props()
 
 	// The desktop rail is fixed-positioned, so the content is offset by a matching
-	// left padding (in rem, matching the rail). Mobile/operator/borderless: no rail.
-	let contentPadLeft = $derived(noBorder || $userStore?.operator || isMobile ? 0 : sidebarWidth)
+	// left padding (in rem, matching the rail). Drawer (mobile or detached)/borderless: no rail.
+	let contentPadLeft = $derived(noBorder || isMobile ? 0 : sidebarWidth)
 
 	$effect(() => {
 		chatState.dockedChatAvailable = !disableAi
@@ -83,23 +79,6 @@
 	})
 </script>
 
-{#snippet burgerRow()}
-	<div
-		class={classNames(
-			'py-0.5 px-4 sm:px-4 shadow-sm max-w-7xl md:hidden justify-start flex',
-			noBorder || $userStore?.operator ? 'hidden' : ''
-		)}
-	>
-		<Button
-			variant="subtle"
-			unifiedSize="lg"
-			onClick={() => onMenuOpen?.()}
-			startIcon={{ icon: Menu }}
-			iconOnly
-		/>
-	</div>
-{/snippet}
-
 {#if !disableAi}
 	<CreatedResourceActionDrawers />
 	<Splitpanes horizontal={false} class="flex-1 min-h-0">
@@ -111,7 +90,6 @@
 			>
 				<main class="flex-1 flex flex-col min-h-0">
 					<div class="relative w-full flex-1 flex flex-col min-h-0">
-						{@render burgerRow()}
 						<div class="flex-1 min-h-0">
 							{@render children?.()}
 						</div>
@@ -138,12 +116,14 @@
 		{/if}
 	</Splitpanes>
 {:else}
+	<!-- The scroll lives here, below the page header, exactly as it does in the docked-chat layout
+	     above: a page taller than the window scrolls inside this box, so the band stays on screen
+	     instead of leaving with the content. -->
 	<div
 		id="content"
-		class={classNames('flex-1 min-h-0 flex flex-col', transitionClass)}
+		class={classNames('flex-1 min-h-0 flex flex-col overflow-y-auto', transitionClass)}
 		style:padding-left="{contentPadLeft}rem"
 	>
-		{@render burgerRow()}
 		<div class="flex-1 min-h-0 flex flex-col">
 			{@render children?.()}
 		</div>
diff --git a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
index 5d825bd5c8..324082e3e0 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
@@ -20,7 +20,6 @@ writes whichever of the two changed, including the tab that is not on screen.
 	import { userStore, type UserExt } from '$lib/stores'
 	import { getUserExt } from '$lib/user'
 	import { sendUserToast } from '$lib/toast'
-	import { base } from '$lib/base'
 	import { Building2, ExternalLink, User } from 'lucide-svelte'
 	import { untrack } from 'svelte'
 	import { getAiChatManager } from './aiChatManagerContext'
@@ -50,7 +49,7 @@ writes whichever of the two changed, including the tab that is not on screen.
 	const aiChatManager = getAiChatManager()
 	// The section acts on `ws`, which in a session is not the nav workspace, so the link
 	// has to name it or it opens settings the user may not administer.
-	let aiSettingsHref = $derived(`${base}/workspace_settings?workspace=${ws}&tab=ai`)
+	let aiSettingsHref = $derived(`/workspace_settings?workspace=${ws}&tab=ai`)
 
 	let mode = $derived(aiChatManager.mode)
 	let tab = $state<'workspace' | 'user'>('workspace')
diff --git a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
index b6455980a3..3050dcedf3 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
@@ -15,7 +15,6 @@
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import { Bot, ExternalLink } from 'lucide-svelte'
 	import CopyButton from '$lib/components/common/button/CopyButton.svelte'
-	import { base } from '$lib/base'
 	import { displayDate, truncateRev } from '$lib/utils'
 
 	interface Props {
@@ -35,7 +34,7 @@
 	// the browser — so the job link is absent rather than empty elsewhere.
 	const jobId = $derived(message.role === 'assistant' ? message.jobId : undefined)
 	const createdAt = $derived(message.role === 'assistant' ? message.createdAt : undefined)
-	const runHref = $derived(jobId ? `${base}/run/${jobId}?workspace=${workspace}` : undefined)
+	const runHref = $derived(jobId ? `/run/${jobId}?workspace=${workspace}` : undefined)
 	// Today's answers show the time alone; the day earns its place only on a conversation
 	// read back later. Resolved at render, so a chat left open across midnight keeps
 	// yesterday's format until it is reopened.
diff --git a/frontend/src/lib/components/copilot/chat/JobsSegment.svelte b/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
index b8a59d5bc9..31fce8fd6e 100644
--- a/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
+++ b/frontend/src/lib/components/copilot/chat/JobsSegment.svelte
@@ -8,7 +8,6 @@
 	import JobStatusIcon from '$lib/components/runs/JobStatusIcon.svelte'
 	import FlowStatusWaitingForEvents from '$lib/components/FlowStatusWaitingForEvents.svelte'
 	import { ChevronUp, Hourglass, ThumbsUp, TimerOff } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { slide } from 'svelte/transition'
 	import { JobService, type Job } from '$lib/gen'
 	import { msToReadableTime } from '$lib/utils'
@@ -211,7 +210,7 @@
 	}
 
 	function runHref(job: ChatJob): string {
-		return `${base}/run/${job.jobId}?workspace=${job.workspace}`
+		return `/run/${job.jobId}?workspace=${job.workspace}`
 	}
 
 	function openRun(job: ChatJob) {
diff --git a/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte b/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte
index ca5e717891..4b3fa0b5be 100644
--- a/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte
+++ b/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte
@@ -10,7 +10,6 @@
 	import { msToReadableTime } from '$lib/utils'
 	import JobArgs from '$lib/components/JobArgs.svelte'
 	import { JobService, type CompletedJob, type Job } from '$lib/gen'
-	import { base } from '$lib/base'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import ChatCollapsibleCard from './ChatCollapsibleCard.svelte'
 	import RunArgsFormDisplay from './RunArgsFormDisplay.svelte'
@@ -102,7 +101,16 @@
 						canceled ||
 						(chatJob !== undefined && ['success', 'failure', 'canceled'].includes(chatJob.status)))
 	)
-	const running = $derived(!pending && !settled)
+	// The form is answered but no job exists yet: the round trip that creates it, or a start
+	// that is about to fail. Saying Running here would claim a job before there is one.
+	const starting = $derived(!pending && !settled && !ran)
+	const running = $derived(!pending && !settled && ran)
+	// A new job is registered as `queued` with no snapshot, so until the first poll returns one
+	// its status is a placeholder, not something seen: the row keeps saying Starting.
+	const unseen = $derived(running && !chatJob?.job)
+	// The job exists but no worker has taken it. Still `running` for everything that only needs
+	// a live job (cancel, logs); only the row tells the two apart. As fresh as the last poll.
+	const waiting = $derived(running && !unseen && chatJob?.status === 'queued')
 	// The job the card is about has not been read yet, or could not be: no pane has anything
 	// to show, but the call's own result still has.
 	const jobPending = $derived(Boolean(inspected) && !inspectedJob)
@@ -170,7 +178,17 @@
 	// Inspecting is done the moment the tool returned, whatever the run it looked at is
 	// still doing — the tense belongs to the call, not to its subject.
 	const verb = $derived(
-		inspected ? 'Inspected' : running ? verbs.present : settled && ran ? verbs.past : verbs.future
+		inspected
+			? 'Inspected'
+			: starting || unseen
+				? 'Starting'
+				: waiting
+					? ''
+					: running
+						? verbs.present
+						: settled && ran
+							? verbs.past
+							: verbs.future
 	)
 
 	// Being cancelled is an outcome like any other, and it is the one the card has to say out
@@ -331,12 +349,28 @@
 	// keeps no timers at all.
 	let now = $state(Date.now())
 	$effect(() => {
-		if (!running || !chatJob) return
+		if (!running || unseen || waiting || !chatJob) return
+		// `now` last moved whenever the card mounted or a previous run stopped ticking, so the
+		// job's first frame would otherwise read as a negative elapsed time.
+		now = Date.now()
 		const timer = setInterval(() => (now = Date.now()), 500)
 		return () => clearInterval(timer)
 	})
 
-	const elapsed = $derived(chatJob ? msToReadableTime(now - chatJob.createdAt, 2) : '')
+	// The clock counts from when a worker took the job, as `duration_ms` does, so the time in the
+	// queue never shows as run time. The server's own `started_at - created_at` is added to the
+	// local creation time rather than reading `started_at` against the browser's clock, which
+	// can be off from the server's by more than the run lasts.
+	const runStartedAt = $derived.by(() => {
+		if (!chatJob) return undefined
+		const j = chatJob.job
+		const queuedMs =
+			j?.started_at && j.created_at ? Date.parse(j.started_at) - Date.parse(j.created_at) : NaN
+		return chatJob.createdAt + (Number.isFinite(queuedMs) ? Math.max(0, queuedMs) : 0)
+	})
+	const elapsed = $derived(
+		runStartedAt !== undefined ? msToReadableTime(Math.max(0, now - runStartedAt), 2) : ''
+	)
 	const duration = $derived(
 		chatJob?.durationMs !== undefined ? msToReadableTime(chatJob.durationMs, 2) : ''
 	)
@@ -370,7 +404,17 @@
 	// has no time to give, so its outcome takes the slot — as a word, never "Not run", which
 	// stutters against the "Run <name>" label beside it.
 	const outcome = $derived(failed ? 'Failed' : canceled ? 'Cancelled' : 'Done')
-	const statusTime = $derived(running ? elapsed : duration || outcome)
+	// No job seen yet, so no time and no outcome: the verb already says Starting. A queued job has
+	// no run time either, and says why in the slot, in the queued hue, in place of the verb.
+	const statusTime = $derived(
+		starting || unseen
+			? ''
+			: waiting
+				? 'Waiting for a worker ·'
+				: running
+					? elapsed
+					: duration || outcome
+	)
 
 	// What the preview button opens changes with the card: the form while the call is still
 	// waiting on one, the run once a job exists. Neither, and there is nothing to open, so
@@ -404,7 +448,7 @@
 		if (aiChatManager.openRunInPreview) {
 			aiChatManager.openRunInPreview({ jobId: job.jobId, workspace: job.workspace, label })
 		} else {
-			window.open(`${base}/run/${job.jobId}?workspace=${job.workspace}`, '_blank', 'noreferrer')
+			window.open(`/run/${job.jobId}?workspace=${job.workspace}`, '_blank', 'noreferrer')
 		}
 	}
 </script>
@@ -416,7 +460,7 @@
 {#snippet status()}
 	<!-- An inspection reports nothing here: the card is a snapshot the chat will never
 	     update, so a status on it would be frozen at whatever the run happened to be. -->
-	{#if !pending && !inspected}
+	{#if !pending && !inspected && statusTime}
 		<span class={twMerge('shrink-0 whitespace-nowrap text-2xs font-medium', statusClass)}>
 			{statusTime}
 		</span>
@@ -591,7 +635,7 @@
 													: 'No logs.'}
 										</p>
 									{/if}
-									{#if running && !inspected}
+									{#if running && !waiting && !inspected}
 										<div class="mt-1 flex items-center gap-1.5 text-2xs text-tertiary">
 											<Loader2 class="h-3 w-3 animate-spin" />
 											streaming
diff --git a/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte b/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte
index 6f74ff7a80..2a63c58308 100644
--- a/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte
@@ -24,6 +24,7 @@
 	const diffRows = $derived(diffLines ?? toolDiffLines(diff, streaming))
 	const visibleRows = $derived(visibleToolDiffRows(diffRows, expansions))
 	const language = $derived(toolCodeDiffLanguage(diff.lang))
+	const beforeLanguage = $derived(toolCodeDiffLanguage(diff.beforeLang ?? diff.lang))
 	const lastLines = $derived.by(() => {
 		let old = 0
 		let current = 0
@@ -38,10 +39,12 @@
 		`max(0.875rem, ${String(Math.max(lastLines.old, lastLines.current)).length}ch)`
 	)
 	const highlighted = $derived.by(() => {
-		if (!hljs.getLanguage(language.name)) hljs.registerLanguage(language.name, language.register)
+		for (const { name, register } of [language, beforeLanguage]) {
+			if (!hljs.getLanguage(name)) hljs.registerLanguage(name, register)
+		}
 
 		return {
-			original: highlightedSourceLines(diff.before, language.name, lastLines.old),
+			original: highlightedSourceLines(diff.before, beforeLanguage.name, lastLines.old),
 			modified: highlightedSourceLines(diff.after, language.name, lastLines.current)
 		}
 	})
@@ -82,50 +85,54 @@
 	class="tool-code-diff max-h-[400px] overflow-auto bg-surface-tertiary text-xs leading-[18px] text-primary"
 	style="--line-number: {lineNumberWidth}"
 >
-	{#each visibleRows as row, index ('key' in row ? `${row.kind}:${row.key}` : `line:${row.oldLine}:${row.newLine}:${index}`)}
-		{#if row.kind === 'collapsed' || row.kind === 'omitted'}
-			<Button
-				unifiedSize="2xs"
-				variant="subtle"
-				btnClasses="grid min-h-7 w-full grid-cols-[var(--line-number)_calc(2.0625rem_+_var(--line-number))_minmax(0,1fr)] items-center gap-0 rounded-none bg-surface-secondary px-0 py-1 text-left text-xs font-normal leading-[18px] text-hint hover:bg-surface-hover"
-				onclick={() => expand(row.key)}
-			>
-				<span class="text-right">...</span>
-				<span class="grid grid-cols-[1.125rem_var(--line-number)_0.9375rem]">
-					<span></span><span class="text-right">...</span><span>...</span>
-				</span>
-				<span>{row.count} {row.kind === 'collapsed' ? 'unchanged lines' : 'more lines'}</span>
-			</Button>
-		{:else}
-			<div
-				class="diff-line-{row.kind} grid grid-cols-[var(--line-number)_calc(2.0625rem_+_var(--line-number))_minmax(0,1fr)]"
-			>
-				<span class="text-right text-hint">{row.oldLine ?? ''}</span>
-				<span class="grid grid-cols-[1.125rem_var(--line-number)_0.9375rem] text-hint">
-					<span></span><span class="text-right">{row.newLine ?? ''}</span><span
-						>{row.kind === 'added' ? '+' : row.kind === 'removed' ? '-' : ''}</span
-					>
-				</span>
-				<span
-					class="relative min-w-0 whitespace-pre {row.kind === 'added'
-						? 'bg-green-500/20'
-						: row.kind === 'removed'
-							? 'bg-red-500/20'
-							: ''}"
+	<!-- Rows take this wrapper's width, so the longest line sets it: sized to the scroller
+	     instead, a row's background stops at the visible edge when a line overflows. -->
+	<div class="w-max min-w-full">
+		{#each visibleRows as row, index ('key' in row ? `${row.kind}:${row.key}` : `line:${row.oldLine}:${row.newLine}:${index}`)}
+			{#if row.kind === 'collapsed' || row.kind === 'omitted'}
+				<Button
+					unifiedSize="2xs"
+					variant="subtle"
+					btnClasses="grid min-h-7 w-full grid-cols-[var(--line-number)_calc(2.0625rem_+_var(--line-number))_minmax(0,1fr)] items-center gap-0 rounded-none bg-surface-secondary px-0 py-1 text-left text-xs font-normal leading-[18px] text-hint hover:bg-surface-hover"
+					onclick={() => expand(row.key)}
 				>
-					{#each row.changedRanges ?? [] as range}
-						<span
-							class="pointer-events-none absolute top-0 z-0 h-[18px] {row.kind === 'added'
-								? 'bg-green-500/25'
-								: 'bg-red-500/20'}"
-							style={rangeStyle(row.content, range)}
-						></span>
-					{/each}
-					<span class="relative z-[1]">{@html highlightedLine(row) || '&nbsp;'}</span>
-				</span>
-			</div>
-		{/if}
-	{/each}
+					<span class="text-right">...</span>
+					<span class="grid grid-cols-[1.125rem_var(--line-number)_0.9375rem]">
+						<span></span><span class="text-right">...</span><span>...</span>
+					</span>
+					<span>{row.count} {row.kind === 'collapsed' ? 'unchanged lines' : 'more lines'}</span>
+				</Button>
+			{:else}
+				<div
+					class="diff-line-{row.kind} grid grid-cols-[var(--line-number)_calc(2.0625rem_+_var(--line-number))_minmax(0,1fr)]"
+				>
+					<span class="text-right text-hint">{row.oldLine ?? ''}</span>
+					<span class="grid grid-cols-[1.125rem_var(--line-number)_0.9375rem] text-hint">
+						<span></span><span class="text-right">{row.newLine ?? ''}</span><span
+							>{row.kind === 'added' ? '+' : row.kind === 'removed' ? '-' : ''}</span
+						>
+					</span>
+					<span
+						class="relative min-w-0 whitespace-pre {row.kind === 'added'
+							? 'bg-green-500/20'
+							: row.kind === 'removed'
+								? 'bg-red-500/20'
+								: ''}"
+					>
+						{#each row.changedRanges ?? [] as range}
+							<span
+								class="pointer-events-none absolute top-0 z-0 h-[18px] {row.kind === 'added'
+									? 'bg-green-500/25'
+									: 'bg-red-500/20'}"
+								style={rangeStyle(row.content, range)}
+							></span>
+						{/each}
+						<span class="relative z-[1]">{@html highlightedLine(row) || '&nbsp;'}</span>
+					</span>
+				</div>
+			{/if}
+		{/each}
+	</div>
 </div>
 
 <style>
diff --git a/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte b/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte
index a2ab9d341c..94e33374c3 100644
--- a/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte
@@ -4,7 +4,7 @@
 	import ToolCodeDiffView from './ToolCodeDiffView.svelte'
 	import ToolPreviewCard from './ToolPreviewCard.svelte'
 	import {
-		argumentsCarryWholeFile,
+		diffIsWholeFile,
 		diffLineCounts,
 		toolCodeDiff,
 		toolDiffLineCounts,
@@ -13,9 +13,10 @@
 
 	interface Props {
 		message: ToolDisplayMessage
+		hidePreviewChip?: boolean
 	}
 
-	let { message }: Props = $props()
+	let { message, hidePreviewChip = false }: Props = $props()
 
 	const diff = $derived(toolCodeDiff(message))
 	const isStreaming = $derived(Boolean(message.isStreamingArguments))
@@ -25,16 +26,17 @@
 
 	// Keyed by call id: a bare flag would carry the expansion onto the next message that
 	// reuses this instance. An active or failed call opens by itself, and remains open
-	// when it settles so the new diff does not disappear under the user. A call whose arguments
-	// are a whole file (`write_script`, full-code `edit_code`) opens only on failure. The key
-	// also changes on failure, so a collapse made while running cannot hide the error.
+	// when it settles so the new diff does not disappear under the user. A call whose diff is a
+	// whole file (`write_script`, full-code `edit_code`, raw app writes and deletes) opens only
+	// on failure. The key also changes on failure, so a collapse made while running cannot hide
+	// the error.
 	const toggleKey = $derived(`${message.tool_call_id}:${message.error ? 'error' : ''}`)
 	let toggled = $state<{ id: string; open: boolean } | undefined>(undefined)
 	const opensByDefault = $derived(
 		Boolean(
 			message.error ||
 				(hasDiff &&
-					!argumentsCarryWholeFile(message) &&
+					!diffIsWholeFile(message) &&
 					(message.isLoading || message.isQueued || message.isStreamingArguments))
 		)
 	)
@@ -43,9 +45,7 @@
 			toggled = { id: toggleKey, open: true }
 		}
 	})
-	const expanded = $derived(
-		hasBody && (toggled?.id === toggleKey ? toggled.open : opensByDefault)
-	)
+	const expanded = $derived(hasBody && (toggled?.id === toggleKey ? toggled.open : opensByDefault))
 	const lines = $derived(diff && expanded ? toolDiffLines(diff, isStreaming) : undefined)
 	const counts = $derived(
 		diff && expanded
@@ -57,7 +57,7 @@
 
 	const isRunning = $derived(Boolean(message.isLoading && !message.needsConfirmation))
 	const showPreviewChip = $derived(
-		Boolean(message.previewCard && !message.isLoading && !message.error)
+		Boolean(!hidePreviewChip && message.previewCard && !message.isLoading && !message.error)
 	)
 </script>
 
diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index e9eac7e8f4..832a96d6b4 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -13,7 +13,6 @@
 		ExternalLink,
 		BookOpen
 	} from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { truncateRev } from '$lib/utils'
 	import {
 		EXIT_PLAN_MODE_TOOL,
@@ -114,12 +113,22 @@
 	// otherwise the error set on its status would be invisible.
 	const detailsAvailable = $derived(message.showDetails === true || message.error !== undefined)
 
-	let isExpanded = $derived(
-		Boolean(
-			(detailsAvailable && (!isSuccessful || !autoCollapseDetails)) ||
-				(message.isStreamingArguments && hasParameters) ||
-				(message.isLoading && message.needsConfirmation)
-		)
+	// Queued and running calls stay closed: their label already says what they are doing, and
+	// opening them would only show empty logs and result. A call opens while its arguments
+	// stream, while it waits on the user, and once it has an error or details to keep in view.
+	// The user's toggle lives in state keyed by call id: the `message` prop is replaced on every
+	// chat update, so an override written onto a derived would be recomputed away. A pending
+	// confirmation wins over it, since the Run/Reject footer renders inside the card.
+	let toggled = $state<{ id: string | undefined; open: boolean } | undefined>(undefined)
+	const isExpanded = $derived(
+		Boolean(message.isLoading && message.needsConfirmation) ||
+			(toggled?.id === message.tool_call_id
+				? toggled.open
+				: Boolean(
+						(detailsAvailable &&
+							(message.error !== undefined || (isSuccessful && !autoCollapseDetails))) ||
+							(message.isStreamingArguments && hasParameters)
+					))
 	)
 
 	const visibleActions = $derived(
@@ -137,7 +146,7 @@
 	// A call that inspected a run rather than starting one gets the same card, bound to
 	// the job it named — what happened in a run reads the same either way.
 	const isRunCard = $derived(Boolean(message.runForm || message.inspectedRun))
-	const isDiffCard = $derived(Boolean(message.codeDiff) || hasToolCodeDiff(message.toolName))
+	const isDiffCard = $derived(hasToolCodeDiff(message))
 
 	// The preview chip sits on the header row (to the right of the tool-call text);
 	// shown once the tool settled, never while loading/erroring/awaiting confirmation.
@@ -193,7 +202,7 @@
 {:else if isRunCard}
 	<RunScriptCard {message} />
 {:else if isDiffCard}
-	<ToolDiffCard {message} />
+	<ToolDiffCard {message} {hidePreviewChip} />
 {:else if planState}
 	<!-- Same lean shape as a tool call below: a header row that collapses into the
 	     transcript, with everything else in one box under it. -->
@@ -291,7 +300,7 @@
 
 	{#snippet jobLink()}
 		<a
-			href="{base}/run/{message.jobId}?workspace={chatHost.operatingWorkspace}"
+			href="/run/{message.jobId}?workspace={chatHost.operatingWorkspace}"
 			target="_blank"
 			rel="noopener noreferrer"
 			class="shrink-0 inline-flex items-center gap-1 font-main text-2xs text-tertiary hover:text-primary hover:underline"
@@ -319,7 +328,7 @@
 	<ChatCollapsibleCard
 		{label}
 		expanded={isExpanded}
-		onToggle={() => (isExpanded = !isExpanded)}
+		onToggle={() => (toggled = { id: message.tool_call_id, open: !isExpanded })}
 		toggleable={detailsAvailable || message.isStreamingArguments === true}
 		shimmer={isRunning}
 		settleLabel
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index ab69d0b1a3..ce11b0dade 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -19,6 +19,7 @@ import { applyReasoningToConfig } from '../reasoningRegistry'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	type LiveToolSet,
 	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks,
@@ -197,7 +198,11 @@ export async function parseAnthropicCompletion(
 	tools: Tool<any>[],
 	helpers: any,
 	abortController?: AbortController,
-	options?: { workspace?: string; onTokenUsage?: (usage: ChatTokenUsage) => void }
+	options?: {
+		workspace?: string
+		onTokenUsage?: (usage: ChatTokenUsage) => void
+		live?: LiveToolSet
+	}
 ): Promise<ParsedCompletionResult> {
 	let toolCallsToProcess: ChatCompletionMessageFunctionToolCall[] = []
 	let error = null
@@ -447,7 +452,8 @@ export async function parseAnthropicCompletion(
 				helpers,
 				toolCallbacks: callbacks,
 				workspace: options?.workspace,
-				messages
+				messages,
+				live: options?.live
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
diff --git a/frontend/src/lib/components/copilot/chat/appFileEditorLang.ts b/frontend/src/lib/components/copilot/chat/appFileEditorLang.ts
new file mode 100644
index 0000000000..bb4c42325d
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/appFileEditorLang.ts
@@ -0,0 +1,25 @@
+// Kept apart from toolCodeDiff.ts, which imports Monaco's diff engine: the chat core runs in
+// the app shell and must not statically reach Monaco.
+const LANGUAGE_BY_APP_FILE_EXTENSION: Record<string, string> = {
+	ts: 'typescript',
+	tsx: 'typescript',
+	mts: 'typescript',
+	js: 'javascript',
+	jsx: 'javascript',
+	mjs: 'javascript',
+	py: 'python',
+	css: 'css',
+	html: 'xml',
+	svelte: 'xml',
+	vue: 'xml',
+	json: 'json',
+	yaml: 'yaml',
+	yml: 'yaml'
+}
+
+// A raw app's backend runnables are named `backend/<key>/main.ts|py`, so their extension
+// picks the language like any frontend file's.
+export function appFileEditorLang(filePath: string | undefined): string {
+	const extension = filePath?.split('/').pop()?.split('.').slice(1).pop()?.toLowerCase()
+	return (extension && LANGUAGE_BY_APP_FILE_EXTENSION[extension]) ?? 'plaintext'
+}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.test.ts
index 115343117a..da3ac686b3 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.test.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.test.ts
@@ -1,7 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
 
-vi.mock('$lib/base', () => ({ base: '' }))
-
 import { shareWorkspaceId } from './artifactSharing'
 
 describe('shareWorkspaceId', () => {
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.ts
index 57b08cba9b..269eb6354b 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactSharing.ts
@@ -1,5 +1,3 @@
-import { base } from '$lib/base'
-
 /**
  * The workspace a share from `workspaceId` lands in: the topmost ancestor the user still
  * belongs to. A session often runs in a fork, whose members are its creator alone, so a link
@@ -20,7 +18,7 @@ export function shareWorkspaceId(
 }
 
 export function sharedArtifactUrl(workspaceId: string, shareId: string): string {
-	return `${window.location.origin}${base}/shared_artifacts/${encodeURIComponent(
+	return `${window.location.origin}/shared_artifacts/${encodeURIComponent(
 		shareId
 	)}?workspace=${encodeURIComponent(workspaceId)}`
 }
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.ts b/frontend/src/lib/components/copilot/chat/chatLoop.ts
index cde9d554cd..1e27becba0 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.ts
@@ -453,7 +453,8 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 		const parseOptions = {
 			workspace,
 			provider: modelProvider.provider,
-			onTokenUsage: reportUsage
+			onTokenUsage: reportUsage,
+			live: () => ({ tools: config.tools, helpers: config.helpers })
 		}
 
 		if (isOpenAI) {
diff --git a/frontend/src/lib/components/copilot/chat/datatableTools.ts b/frontend/src/lib/components/copilot/chat/datatableTools.ts
index 0656bf43a9..7a743ab783 100644
--- a/frontend/src/lib/components/copilot/chat/datatableTools.ts
+++ b/frontend/src/lib/components/copilot/chat/datatableTools.ts
@@ -344,6 +344,7 @@ export function getDatatableTools(): SessionTool<{}>[] {
 			def: getExecDatatableSqlToolDef(),
 			requiresConfirmation: true,
 			confirmationMessage: 'Execute SQL on datatable',
+			queuedLabel: (args) => `Execute SQL on "${args?.datatable_name ?? 'datatable'}"`,
 			showDetails: true,
 			fn: async ({ args, workspace, toolId, toolCallbacks }) => {
 				const parsedArgs = getExecDatatableSqlSchema().parse(args)
diff --git a/frontend/src/lib/components/copilot/chat/flow/aiAgentProviderCatalog.ts b/frontend/src/lib/components/copilot/chat/flow/aiAgentProviderCatalog.ts
index 2e8751efcb..37bdec30ce 100644
--- a/frontend/src/lib/components/copilot/chat/flow/aiAgentProviderCatalog.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/aiAgentProviderCatalog.ts
@@ -1,5 +1,10 @@
 import { ResourceService, WorkspaceService, type AIConfig, type AIProvider } from '$lib/gen'
-import { AI_PROVIDERS, fetchAvailableModels } from '../../lib'
+import {
+	AI_PROVIDERS,
+	DECISION_AI_PROVIDERS,
+	aiProviderDetails,
+	fetchAvailableModels
+} from '../../lib'
 import {
 	collectAiAgentProviderRefs,
 	isModelId,
@@ -10,8 +15,13 @@ import {
 } from './aiAgentProviders'
 
 // Read lazily: evaluating this at module scope makes `AI_PROVIDERS` a load-time requirement
-// for everything that reaches this module, the whole global chat included.
-const aiResourceTypes = () => Object.keys(AI_PROVIDERS) as AIProvider[]
+// for everything that reaches this module, the whole global chat included. Decision kinds are
+// included so an AI decision step's resource validates; `validateAiAgentProviders` keeps each kind
+// to its step type.
+const aiResourceTypes = () =>
+	[
+		...new Set([...Object.keys(AI_PROVIDERS), ...Object.keys(DECISION_AI_PROVIDERS)])
+	] as AIProvider[]
 
 /** Kinds whose model listing `fetchAvailableModels` narrows before returning it: OpenAI and Azure
  * OpenAI keep only `gpt-`/`o`/`codex` ids (so a fine-tune never appears), Bedrock keeps text
@@ -27,8 +37,14 @@ const FILTERED_MODEL_LISTING_KINDS: ReadonlySet<string> = new Set([
 /** Kinds whose endpoint serves ids its listing does not contain, so an unlisted id is never
  * grounds for calling it wrong. OpenRouter appends routing suffixes — `:online`, `:nitro`,
  * `:floor` — to any listed model without listing the combinations, and it carries no `base_url`
- * of its own (the backend supplies it), so `customEndpoint` does not cover it. */
-const ALIASING_MODEL_LISTING_KINDS: ReadonlySet<string> = new Set(['openrouter'])
+ * of its own (the backend supplies it), so `customEndpoint` does not cover it. The decision
+ * providers' lists are the ids Windmill knows, not listings: TypeSafe also serves `jev-preview` and
+ * every pinned version. */
+const ALIASING_MODEL_LISTING_KINDS: ReadonlySet<string> = new Set([
+	'openrouter',
+	'typesafe',
+	'cloudflare'
+])
 
 /** Each resource costs one model listing call against the provider. A workspace with a
  * long tail of AI resources would otherwise stall every flow write. */
@@ -260,8 +276,6 @@ async function loadOption(
 	// Without a live listing, a model id cannot be ruled out: offer the configured
 	// models (then the curated defaults) as a hint, but leave the check off.
 	const fallback =
-		configuredModels.length > 0
-			? configuredModels
-			: (AI_PROVIDERS[candidate.kind]?.defaultModels ?? [])
+		configuredModels.length > 0 ? configuredModels : aiProviderDetails(candidate.kind).defaultModels
 	return { ...base, models: sanitizeModelListing(fallback, false), modelsAreLive: false }
 }
diff --git a/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.test.ts b/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.test.ts
index e91e8c498b..14720bb001 100644
--- a/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.test.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.test.ts
@@ -67,7 +67,13 @@ describe('validateAiAgentProviders', () => {
 		expect(() =>
 			validateAiAgentProviders(anthropicProvider('claude-something-new'), {
 				...COMPLETE,
-				options: [{ ...ANTHROPIC, modelsAreLive: false, models: { ids: ['claude-sonnet-5'], complete: false } }]
+				options: [
+					{
+						...ANTHROPIC,
+						modelsAreLive: false,
+						models: { ids: ['claude-sonnet-5'], complete: false }
+					}
+				]
 			})
 		).not.toThrow()
 	})
@@ -107,6 +113,42 @@ describe('validateAiAgentProviders', () => {
 		).not.toThrow()
 		expect(warnings).toHaveLength(1)
 	})
+
+	it('keeps decision providers to AI decision steps', () => {
+		const typesafe = {
+			type: 'static',
+			value: { kind: 'typesafe', resource: '$res:u/admin/typesafe', model: 'jev-latest' }
+		}
+		const anthropic = {
+			type: 'static',
+			value: { kind: 'anthropic', resource: '$res:u/admin/anthropic', model: 'claude-sonnet-5' }
+		}
+		const decision = (provider: unknown) => [
+			{ id: 'd', value: { type: 'aidecision', input_transforms: { provider } } }
+		]
+
+		expect(() => validateAiAgentProviders(decision(anthropic), undefined)).toThrow(
+			/Step "d".*must be "typesafe", "cloudflare" or "openai"/
+		)
+		// OpenAI runs both: its resource serves the decision model next to the chat ones.
+		const openai = (model: string) => ({
+			type: 'static',
+			value: { kind: 'openai', resource: '$res:u/admin/openai', model }
+		})
+		expect(() => validateAiAgentProviders(decision(openai('gpt-6-luna')), undefined)).not.toThrow()
+		expect(() => validateAiAgentProviders(agentStep(openai('gpt-5')), undefined)).not.toThrow()
+		expect(() => validateAiAgentProviders(agentStep(typesafe), undefined)).toThrow(
+			/Step "agent".*use an "aidecision" step/
+		)
+		const cloudflare = {
+			type: 'static',
+			value: { kind: 'cloudflare', resource: '$res:u/admin/cloudflare', model: 'clef' }
+		}
+		expect(() => validateAiAgentProviders(decision(cloudflare), undefined)).not.toThrow()
+		expect(() => validateAiAgentProviders(agentStep(cloudflare), undefined)).toThrow(
+			/Step "agent".*use an "aidecision" step/
+		)
+	})
 })
 
 describe('formatAiAgentProvidersPrompt', () => {
@@ -120,10 +162,12 @@ describe('formatAiAgentProvidersPrompt', () => {
 		expect(
 			formatAiAgentProvidersPrompt({ ...COMPLETE, defaultModel }, { canAskUser: true })
 		).toContain('the workspace default')
-		expect(formatAiAgentProvidersPrompt({ ...AMBIGUOUS, defaultModel }, { canAskUser: true })).toContain(
+		expect(
+			formatAiAgentProvidersPrompt({ ...AMBIGUOUS, defaultModel }, { canAskUser: true })
+		).toContain('askUserQuestion')
+		expect(formatAiAgentProvidersPrompt(COMPLETE, { canAskUser: true })).toContain(
 			'askUserQuestion'
 		)
-		expect(formatAiAgentProvidersPrompt(COMPLETE, { canAskUser: true })).toContain('askUserQuestion')
 	})
 
 	it('never names askUserQuestion for a chat that does not have the tool', () => {
@@ -135,9 +179,10 @@ describe('formatAiAgentProvidersPrompt', () => {
 
 describe('collectAiAgentProviderRefs', () => {
 	it('needs the catalog only for a step that states its own static provider', () => {
-		expect(
-			collectAiAgentProviderRefs(anthropicProvider('claude-sonnet-5'))
-		).toEqual({ needsCatalog: true, resourceRefs: ['$res:u/admin/anthropic'] })
+		expect(collectAiAgentProviderRefs(anthropicProvider('claude-sonnet-5'))).toEqual({
+			needsCatalog: true,
+			resourceRefs: ['$res:u/admin/anthropic']
+		})
 		expect(
 			collectAiAgentProviderRefs([{ id: 'a', value: { type: 'aiagent', agent: 'u/admin/saved' } }])
 		).toEqual({ needsCatalog: false, resourceRefs: [] })
@@ -159,7 +204,10 @@ describe('an authoritative empty catalog', () => {
 		)
 		// Not knowing the resources is not the same as knowing there are none.
 		expect(
-			formatAiAgentProvidersPrompt({ options: [], resourcesAreComplete: false }, { canAskUser: true })
+			formatAiAgentProvidersPrompt(
+				{ options: [], resourcesAreComplete: false },
+				{ canAskUser: true }
+			)
 		).toBe('')
 	})
 
diff --git a/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.ts b/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.ts
index b33e020611..799c1f0cef 100644
--- a/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/aiAgentProviders.ts
@@ -29,6 +29,16 @@ export type AiAgentProviderCatalog = {
 	defaultModel?: { kind: AIProvider; model: string }
 }
 
+/** The kinds that serve decision models only, which an AI agent step cannot run on. */
+const DECISION_ONLY_KINDS: readonly string[] = ['typesafe', 'cloudflare']
+
+/** The model of OpenAI's Decisions API, which an `openai` resource serves next to its chat
+ * models: the one kind both step types run on. */
+const OPENAI_DECISION_MODEL = 'gpt-6-luna'
+
+/** The providers an AI decision step runs on. */
+const DECISION_PROVIDER_KINDS: readonly string[] = [...DECISION_ONLY_KINDS, 'openai']
+
 /** A model id as every provider writes one: `claude-sonnet-5`, `meta-llama/Llama-3.3-70B`,
  * `anthropic.claude-haiku-4-5-20251001-v1:0`, `ft:gpt-4o:acme::abc`. Anything else is not
  * rendered: a resource may point at a gateway someone else controls, and its listing lands in a
@@ -146,11 +156,14 @@ This workspace has none, so an AI agent step has no model to run on. ${
 	const truncationLine = catalog.resourcesAreComplete
 		? ''
 		: '\nThis list is incomplete: the workspace has AI provider resources that are not shown.'
+	const decisionLine = catalog.options.some((o) => DECISION_PROVIDER_KINDS.includes(o.kind))
+		? `\nA \`typesafe\` or \`cloudflare\` resource serves AI decision steps only. AI decision steps run on those or on an \`openai\` resource with model \`${OPENAI_DECISION_MODEL}\`, and on nothing else.`
+		: ''
 	return `## AI provider resources in this workspace
 
 An AI agent step's \`model\` must be one of the ids listed below for the resource it references — never a model id from memory, which the endpoint would reject at run time.
 
-${catalog.options.map(describeOption).join('\n')}${truncationLine}
+${catalog.options.map(describeOption).join('\n')}${truncationLine}${decisionLine}
 ${choiceLine}`
 }
 
@@ -176,7 +189,9 @@ export function selectAiAgentProviderCandidates(
 		if (!configuredPaths.has(candidate.resourcePath)) return 2
 		return candidate.kind === defaultProviderKind ? 0 : 1
 	}
-	return candidates.sort((a, b) => rank(a) - rank(b) || a.resourcePath.localeCompare(b.resourcePath))
+	return candidates.sort(
+		(a, b) => rank(a) - rank(b) || a.resourcePath.localeCompare(b.resourcePath)
+	)
 }
 
 /** What a set of modules needs from the catalog: `needsCatalog` is false when no AI agent step
@@ -224,7 +239,8 @@ function blocking(message: string): ProviderIssue {
 
 function checkProviderValue(
 	value: unknown,
-	catalog: AiAgentProviderCatalog
+	catalog: AiAgentProviderCatalog,
+	stepType: string
 ): ProviderIssue | undefined {
 	if (typeof value === 'string') {
 		return blocking(
@@ -238,6 +254,16 @@ function checkProviderValue(
 	if (typeof kind !== 'string' || kind === '') {
 		return blocking(`provider.kind is missing. Expected ${PROVIDER_SHAPE}`)
 	}
+	if (stepType === 'aidecision' && !DECISION_PROVIDER_KINDS.includes(kind)) {
+		return blocking(
+			`an AI decision step runs on a decision model: provider.kind must be "typesafe", "cloudflare" or "openai", not "${kind}"`
+		)
+	}
+	if (stepType !== 'aidecision' && DECISION_ONLY_KINDS.includes(kind)) {
+		return blocking(
+			`"${kind}" serves decision models, which answer typed questions rather than messages: use an "aidecision" step rather than an AI agent`
+		)
+	}
 	if (typeof resource !== 'string' || !resource.startsWith('$res:')) {
 		return blocking(
 			`provider.resource must be a "$res:<resource path>" reference. Expected ${PROVIDER_SHAPE}`
@@ -267,6 +293,15 @@ function checkProviderValue(
 			`provider.kind "${kind}" does not match "${resource}", which is a \`${match.kind}\` resource`
 		)
 	}
+	// An OpenAI resource lists its chat models, which says nothing about its decision model.
+	if (stepType === 'aidecision' && kind === 'openai') {
+		return model === OPENAI_DECISION_MODEL
+			? undefined
+			: {
+					message: `model "${model}" is not the model OpenAI's Decisions API is known to serve, "${OPENAI_DECISION_MODEL}"`,
+					blocking: false
+				}
+	}
 	if (match.modelsAreLive && !match.models.ids.includes(model)) {
 		return {
 			message: `model "${model}" is not in the model listing of "${resource}"`,
@@ -277,9 +312,9 @@ function checkProviderValue(
 }
 
 /**
- * Reject AI agent steps whose provider config would fail at run time: a malformed provider, a
- * resource that is not an AI provider resource of the workspace, or a model the endpoint's own
- * listing rules out.
+ * Reject AI agent and AI decision steps whose provider config would fail at run time: a malformed
+ * provider, a kind the step cannot run on, a resource that is not an AI provider resource of the
+ * workspace, or a model the endpoint's own listing rules out.
  *
  * Everything the catalog could not establish is reported through `warnings` instead of blocking,
  * so an incomplete catalog never rejects a provider that would have worked.
@@ -297,7 +332,7 @@ export function validateAiAgentProviders(
 		// A missing provider is reported by collectProviderlessAgentIds, and a javascript
 		// transform resolves at run time with no value to check here.
 		if (!transform || transform.type !== 'static') return
-		const issue = checkProviderValue(transform.value, known)
+		const issue = checkProviderValue(transform.value, known, value.type)
 		if (!issue) return
 		if (issue.blocking) {
 			errors.push(`Step "${mod.id}": ${issue.message}`)
diff --git a/frontend/src/lib/components/copilot/chat/flow/openFlow.json b/frontend/src/lib/components/copilot/chat/flow/openFlow.json
index 68578aeb15..11cee5b724 100644
--- a/frontend/src/lib/components/copilot/chat/flow/openFlow.json
+++ b/frontend/src/lib/components/copilot/chat/flow/openFlow.json
@@ -1 +1 @@
-{"openapi":"3.0.3","info":{"version":"1.819.0","title":"OpenFlow Spec","contact":{"name":"Ruben Fiszel","email":"ruben@windmill.dev","url":"https://windmill.dev"},"license":{"name":"Apache 2.0","url":"https://www.apache.org/licenses/LICENSE-2.0.html"}},"paths":{},"externalDocs":{"description":"documentation portal","url":"https://windmill.dev"},"components":{"schemas":{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution — modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind"}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type"}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw",null]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw",null]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}]},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}}}
\ No newline at end of file
+{"openapi":"3.0.3","info":{"version":"1.825.0","title":"OpenFlow Spec","contact":{"name":"Ruben Fiszel","email":"ruben@windmill.dev","url":"https://windmill.dev"},"license":{"name":"Apache 2.0","url":"https://www.apache.org/licenses/LICENSE-2.0.html"}},"paths":{},"externalDocs":{"description":"documentation portal","url":"https://windmill.dev"},"components":{"schemas":{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier × seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution — modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind"}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type"}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw",null]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw",null]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}]},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}}}
\ No newline at end of file
diff --git a/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts b/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
index 6d19254630..88cb8fe875 100644
--- a/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
@@ -1,6 +1,6 @@
 import { z } from "zod"
 
-export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n").optional(), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("window"), "context_length": z.number().int().describe("Number of most recent messages to load and store. 0 turns memory off.") }).describe("Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n"), z.object({ "kind": z.literal("compaction"), "context_window": z.number().int().describe("Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n").optional() }).describe("Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.")]).describe("Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`."), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "memory_id": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n").optional(), "previous_messages": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "enabled_tools": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'.").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "value": z.any().superRefine((x, ctx) => {
+export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n").optional(), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("window"), "context_length": z.number().int().describe("Number of most recent messages to load and store. 0 turns memory off.") }).describe("Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n"), z.object({ "kind": z.literal("compaction"), "context_window": z.number().int().describe("Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n").optional() }).describe("Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.")]).describe("Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`."), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "memory_id": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n").optional(), "previous_messages": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "enabled_tools": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'.").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it.").optional(), "value": z.any().superRefine((x, ctx) => {
     const schemas = [z.intersection(z.object({ "tool_type": z.literal("flowmodule") }), z.lazy(() => flowModuleValueSchema)).describe("A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module"), z.object({ "tool_type": z.literal("mcp"), "resource_path": z.string().describe("Path to the MCP resource/server configuration"), "include_tools": z.array(z.string()).describe("Whitelist of specific tools to include from this MCP server").optional(), "exclude_tools": z.array(z.string()).describe("Blacklist of tools to exclude from this MCP server").optional() }).describe("Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers"), z.object({ "tool_type": z.literal("websearch") }).describe("A tool implemented as a websearch tool. The AI can call this like any other websearch tool")];
     const errors = schemas.reduce<z.ZodError[]>(
       (errors, schema) =>
@@ -17,10 +17,10 @@ export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "i
         message: "Invalid input: Should pass single schema",
       });
     }
-  }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type")
+  }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined"), "state": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"), "questions": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n") }).describe("Input parameters for the decision mapped to their values"), "type": z.literal("aidecision"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)").optional() }).describe("AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type")
 
 
-export const flowModuleSchema = z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n").optional(), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("window"), "context_length": z.number().int().describe("Number of most recent messages to load and store. 0 turns memory off.") }).describe("Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n"), z.object({ "kind": z.literal("compaction"), "context_window": z.number().int().describe("Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n").optional() }).describe("Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.")]).describe("Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`."), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "memory_id": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n").optional(), "previous_messages": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "enabled_tools": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'.").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "value": z.any().superRefine((x, ctx) => {
+export const flowModuleSchema = z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n").optional(), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("window"), "context_length": z.number().int().describe("Number of most recent messages to load and store. 0 turns memory off.") }).describe("Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n"), z.object({ "kind": z.literal("compaction"), "context_window": z.number().int().describe("Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n").optional() }).describe("Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.")]).describe("Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`."), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "memory_id": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n").optional(), "previous_messages": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "enabled_tools": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'.").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it.").optional(), "value": z.any().superRefine((x, ctx) => {
     const schemas = [z.intersection(z.object({ "tool_type": z.literal("flowmodule") }), z.lazy(() => flowModuleValueSchema)).describe("A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module"), z.object({ "tool_type": z.literal("mcp"), "resource_path": z.string().describe("Path to the MCP resource/server configuration"), "include_tools": z.array(z.string()).describe("Whitelist of specific tools to include from this MCP server").optional(), "exclude_tools": z.array(z.string()).describe("Blacklist of tools to exclude from this MCP server").optional() }).describe("Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers"), z.object({ "tool_type": z.literal("websearch") }).describe("A tool implemented as a websearch tool. The AI can call this like any other websearch tool")];
     const errors = schemas.reduce<z.ZodError[]>(
       (errors, schema) =>
@@ -37,7 +37,7 @@ export const flowModuleSchema = z.object({ "id": z.string().describe("Unique ide
         message: "Invalid input: Should pass single schema",
       });
     }
-  }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type"), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")
+  }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined"), "state": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"), "questions": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n") }).describe("Input parameters for the decision mapped to their values"), "type": z.literal("aidecision"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)").optional() }).describe("AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type"), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional(), "skin": z.enum(["detailed","minimal"]).describe("How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "job_token_scopes": z.array(z.string()).nullable().describe("Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff: the n-th retry waits multiplier × seconds^n").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")
 
 
 export const flowModulesSchema = z.array(flowModuleSchema)
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 63bfa6e1b2..d510b21826 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -2607,6 +2607,25 @@ describe('global AI tools', () => {
 		expect(raw).not.toContain('function New')
 	})
 
+	it('records the data setup a new app is initialized with', async () => {
+		await callGlobalTool('init_app', {
+			path: 'u/admin/tickets',
+			framework: 'react19',
+			data: {
+				datatable: 'main',
+				schema: 'helpdesk',
+				tables: ['helpdesk:tickets', 'notes', 'main/customers']
+			}
+		})
+
+		const draft = getBackendDraft('raw_app', 'u/admin/tickets', { workspace: WORKSPACE })
+		expect(draft?.data).toEqual({
+			datatable: 'main',
+			schema: 'helpdesk',
+			tables: ['main/helpdesk:tickets', 'main/helpdesk:notes', 'main/customers']
+		})
+	})
+
 	it('discards a draft without deleting the workspace item', async () => {
 		await callGlobalTool('write_script', {
 			path: 'f/scripts/discard-me',
@@ -4255,6 +4274,86 @@ describe('global AI tools', () => {
 		expect(getBackendDraft('raw_app', 'f/apps/report', { workspace: WORKSPACE })).toBeUndefined()
 	})
 
+	it('records the diff of the one raw app file a call changed', async () => {
+		seedBackendDraft(
+			'raw_app',
+			'u/admin/diffed_app',
+			{
+				summary: 'Diffed',
+				files: { '/index.tsx': 'untouched', '/styles.css': 'a { color: red; }\n' },
+				runnables: {
+					go: {
+						name: 'Go',
+						type: 'inline',
+						inlineScript: { language: 'python3', content: 'x = 1' }
+					},
+					greet: {
+						name: 'Greet',
+						type: 'inline',
+						inlineScript: { language: 'bun', content: 'export const main = () => 1' }
+					}
+				},
+				data: { tables: [] }
+			},
+			{ workspace: WORKSPACE }
+		)
+		const statuses: any[] = []
+		const callbacks = {
+			...toolCallbacks,
+			setToolStatus: (_toolId: string, status: any) => statuses.push(status)
+		}
+
+		await callGlobalTool(
+			'patch_app_file',
+			{
+				path: 'u/admin/diffed_app',
+				file_path: '/styles.css',
+				old_string: 'red',
+				new_string: 'blue',
+				replace_all: false
+			},
+			callbacks
+		)
+		await callGlobalTool(
+			'delete_app_runnable',
+			{ path: 'u/admin/diffed_app', key: 'go' },
+			callbacks
+		)
+		await callGlobalTool(
+			'write_app_runnable',
+			{
+				path: 'u/admin/diffed_app',
+				key: 'ref',
+				runnable: { name: 'Ref', type: 'flow', path: 'u/admin/hello_flow' }
+			},
+			callbacks
+		)
+		await callGlobalTool(
+			'write_app_runnable',
+			{
+				path: 'u/admin/diffed_app',
+				key: 'greet',
+				runnable: {
+					name: 'Greet',
+					type: 'inline',
+					inlineScript: { language: 'python3', content: 'def main(): return 1' }
+				}
+			},
+			callbacks
+		)
+
+		expect(statuses.filter((status) => status.codeDiff).map((status) => status.codeDiff)).toEqual([
+			{ before: 'a { color: red; }\n', after: 'a { color: blue; }\n', lang: 'css' },
+			{ before: 'x = 1', after: '', lang: 'python' },
+			{
+				before: 'export const main = () => 1',
+				after: 'def main(): return 1',
+				lang: 'python',
+				beforeLang: 'typescript'
+			}
+		])
+	})
+
 	it('does not persist a raw app draft when delete_app_file validation fails', async () => {
 		vi.mocked(AppService.getAppByPath).mockResolvedValueOnce({
 			path: 'f/apps/report',
@@ -4629,6 +4728,7 @@ describe('global AI tools', () => {
 			expect(onDeployed).toHaveBeenCalledWith({
 				sessionId: 'sess-123',
 				kind: 'raw_app',
+				storagePath: 'f/apps/report',
 				path: 'f/apps/report'
 			})
 		} finally {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 2a39ca1902..5295712626 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from '$lib/utils/uuid'
 import {
 	AppService,
+	AssetService,
 	AzureTriggerService,
 	EmailTriggerService,
 	FlowService,
@@ -25,7 +26,7 @@ import {
 import { createTwoFilesPatch } from 'diff'
 import { deepEqual } from 'fast-equals'
 import { promptSafe, type ArtifactVersionTarget } from '$lib/components/sessions/previewRouter'
-import { canWrite } from '$lib/utils'
+import { canDraftItem, roleCanDraft } from '$lib/editRights'
 import { $ScriptLang } from '$lib/gen/schemas.gen'
 import type {
 	AppWithLastVersion,
@@ -51,6 +52,7 @@ import { withAgentDrafts } from '$lib/components/flows/linkedAgentDrafts'
 import { resolveLinkedAgentTools } from '$lib/components/flows/flowState'
 import { enabledToolNames, type AgentTool } from '$lib/components/flows/agentToolUtils'
 import { evalValue } from '$lib/components/flows/utils.svelte'
+import { quickjsReady } from '$lib/utils/quickjsEval.svelte'
 import { updateRawAppPolicy } from '$lib/components/raw_apps/rawAppPolicy'
 import {
 	FRAMEWORK_TEMPLATES,
@@ -66,9 +68,15 @@ import {
 	stripFileArgs
 } from '$lib/components/job_args'
 import { processSecretArgs } from '$lib/components/secretArgUtils'
+import { parsePipelineAnnotations } from '$lib/components/assets/AssetGraph/parsePipelineAnnotations'
 import { PLAN_MODE_MESSAGES } from '../planModeMessages'
-import { DEFAULT_DATA as DEFAULT_RAW_APP_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
+import {
+	DEFAULT_DATA as DEFAULT_RAW_APP_DATA,
+	formatDataTableRef
+} from '$lib/components/raw_apps/dataTableRefUtils'
 import { appSourceToDraftValue } from '$lib/components/raw_apps/rawAppDraftValue'
+import { conformBuilderAppPolicy } from '$lib/components/raw_apps/builderAppPolicy'
+import { operatorBuilderAppsIn } from '$lib/operatorWriteRights'
 import type { RawAppDomQuery } from '$lib/components/raw_apps/rawAppDom'
 import { dataUrlToImagePart, normalizeImageDataUrl, type AttachedImage } from '../imageUtils'
 import { sanitizeAttachmentName, textLineCount, type AttachedTextFile } from '../textFileUtils'
@@ -148,6 +156,7 @@ import {
 	type ToolDisplayAction
 } from '../shared'
 import { scriptLangToEditorLang } from '$lib/scripts'
+import { appFileEditorLang } from '../appFileEditorLang'
 import { searchDocsTool, readDocsPageTool } from '../docs/core'
 import { createDbSchemaTool } from '../script/core'
 import type { ContextElement } from '../context'
@@ -205,10 +214,13 @@ import { invalidateWorkspaceComparison } from '$lib/workspaceComparison'
 import type { UserDraftItemKind } from '$lib/gen'
 import { bundleRawAppDraft } from './rawAppBundlerBridge'
 import {
+	canOpenEditor,
 	DEPLOY,
 	NONE,
+	RUN_FLOW_PREVIEW,
 	RUN_PREVIEW,
 	WRITE_DRAFT,
+	WRITE_FLOW_DRAFT,
 	type SessionAccess,
 	type SessionTool,
 	type SessionToolPolicy
@@ -234,7 +246,6 @@ import {
 	parseItemsMaskParam
 } from '$lib/components/sessions/modifiedItemsMask'
 import {
-	pageHref,
 	TRIGGER_PAGES,
 	type TriggerKind as PageTriggerKind
 } from '$lib/components/sessions/previewRouter'
@@ -315,6 +326,7 @@ export type GlobalActiveEditorContext = {
 	/** The key the draft is stored under, which `path` leaves behind on a rename. */
 	storagePath: string
 	isLiveDraft: true
+	isNew?: boolean
 }
 
 /** The page the session's side panel is showing, when it isn't one of the live
@@ -323,7 +335,7 @@ export type GlobalActiveEditorContext = {
 export type GlobalActivePreviewContext = {
 	/** Page name as the tab strip shows it, e.g. "Schedules". */
 	label: string
-	/** Base-stripped page path plus the request params the page declares — values kept
+	/** Page path plus the request params the page declares — values kept
 	 * only for the ones addressing a workspace object, and percent-encoded. Never a raw
 	 * location: a tab can host a legacy app whose hash is app state, and a filter value
 	 * can be free text the user typed. Build it with `previewLocationContext`. */
@@ -417,6 +429,8 @@ const updateUserInstructionsSchema = z.object({
 		)
 })
 
+const listPipelinesSchema = z.object({})
+
 const listWorkspaceItemsSchema = z.object({
 	types: z
 		.array(itemTypeSchema)
@@ -753,7 +767,7 @@ const listRunsSchema = z.object({
 // superadmin caller; every other caller gets the hedge even where nothing is hidden.
 const NO_WORKERS_VISIBLE_MESSAGE =
 	'No workers came back. This does NOT establish that no workers are running: an instance can hide workers from callers without the devops role, and it does so by returning an empty list rather than an error. ' +
-	'Tell the user you cannot see any workers and that worker visibility may be restricted for your account, and suggest they check the Workers page themselves. Never state that no workers are online or that the instance has none.'
+	'Tell the user you cannot see any workers and that worker visibility may be restricted for your account, and suggest they check the Workers page themselves if they can open it, or ask a workspace admin otherwise. Never state that no workers are online or that the instance has none.'
 const NO_WORKERS_CONNECTED_MESSAGE =
 	'No workers are connected to this instance (none pinged in the last 5 minutes). Queued runs will stay queued until a worker starts.'
 const WORKER_PAGE_SIZE = 100
@@ -900,7 +914,7 @@ const testRunArgsSchema = z
 	.nullable()
 	.optional()
 	.describe(
-		'Arguments to pass to the runnable. Omit or pass null when no arguments are needed. An argument typed as a resource (format "resource-<type>" in the input schema) takes the bare string "$res:<path>" as its whole value — never an object wrapper like {"$res": "<path>"}, and never a plain path, both of which reach the runnable unresolved. Same for a variable, with "$var:<path>". The prefixed string can also sit in a nested field, e.g. {"gh_auth": {"token": "$var:g/all/gh_token"}}.'
+		'Arguments to pass to the runnable. Omit or pass null when no arguments are needed. An argument typed as a resource (format "resource-<type>" in the input schema) takes the bare string "$res:<path>" as its whole value — never an object wrapper like {"$res": "<path>"}, and never a plain path, both of which reach the runnable unresolved. Same for a variable, with "$var:<path>". The prefixed string can also sit in a nested field, e.g. {"gh_auth": {"token": "$var:g/all/gh_token"}}. When the input schema carries a top-level "prompt_for_ai", it is the author\'s own instructions for choosing these arguments: follow it.'
 	)
 
 const backgroundArgSchema = z
@@ -1002,7 +1016,7 @@ const testRunStepSchema = z.object({
 const testRunStepToolDef = createToolDef(
 	testRunStepSchema,
 	'test_run_step',
-	"Execute a test run of one step in a flow by path, preferring draft flow/script content when it exists. `args` are the step's OWN inputs, not the flow's: a step is normally fed by its input transforms, so send what that step's code takes, not what the flow takes. An AI agent step takes the inputs a run supplies rather than code arguments, `user_message` above all; its form opens on the step's own configuration, so send only what this run should change. The user gets an argument form prefilled with `args` and may edit or dismiss it before it runs, so fill in every argument you can infer. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call.",
+	"Execute a test run of one step in a flow by path, preferring draft flow/script content when it exists. `args` are the step's OWN inputs, not the flow's: a step is normally fed by its input transforms, so send what that step's code takes, not what the flow takes. An AI agent step takes the inputs a run supplies rather than code arguments, `user_message` above all; its form opens on the step's own configuration, so send only what this run should change. An AI decision step takes `state`, what its questions are asked about; its provider and questions are the step's own. The user gets an argument form prefilled with `args` and may edit or dismiss it before it runs, so fill in every argument you can infer. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call.",
 	{ strict: false }
 )
 
@@ -1174,7 +1188,14 @@ const openPreviewSchema = z.object({
  * it can open, so it is not offered. Per-PATH write permission is unknowable here —
  * a workspace capability says nothing about `f/finance/*` — and is resolved in the
  * handler instead. Mirrors `open_page` re-narrowing its page enum per user. */
+const openPreviewNoPipelineKind = z
+	.enum(['script', 'flow', 'raw_app'])
+	.describe(
+		'Item kind to preview. Use "raw_app" for code-based apps. The legacy drag-and-drop app builder ("app") is not previewable in the session panel — don\'t pass it.'
+	)
+
 const openPreviewViewOnlySchema = openPreviewSchema.extend({
+	kind: openPreviewNoPipelineKind,
 	mode: z
 		.literal('view')
 		.optional()
@@ -1183,6 +1204,17 @@ const openPreviewViewOnlySchema = openPreviewSchema.extend({
 		)
 })
 
+/** A builder operator: the flow editor, and the deployed page for everything else. */
+const openPreviewFlowEditorSchema = openPreviewSchema.extend({
+	kind: openPreviewNoPipelineKind,
+	mode: z
+		.enum(['edit', 'view'])
+		.optional()
+		.describe(
+			'Which side to show. "edit" opens the flow editor and works for flows only: the only editor you can open in this workspace. Pass "view" for a script or app, the deployed page with its run form, triggers and past runs.'
+		)
+})
+
 const OPEN_PREVIEW_DESCRIPTION =
 	'Open the live preview / editor for a workspace item in the side panel next to the chat. ONLY works inside an AI session — call this after writing or editing a script, flow, or raw app to let the user see and interact with it. The path you pass is the path of the item; for code-based apps use kind="raw_app" (legacy drag-and-drop apps are not previewable). Returns an error if there is no active session.'
 
@@ -1274,12 +1306,7 @@ const readDomSchema = z.object({
 
 const takeScreenshotSchema = z.object({})
 
-const FRAMEWORK_KEYS = [
-	'react19',
-	'react18',
-	'svelte5',
-	'vue'
-] as const satisfies readonly FrameworkKey[]
+const FRAMEWORK_KEYS = ['react19', 'react18', 'svelte5'] as const satisfies readonly FrameworkKey[]
 
 const initAppSchema = z.object({
 	path: z
@@ -1291,7 +1318,22 @@ const initAppSchema = z.object({
 	framework: z
 		.enum(FRAMEWORK_KEYS)
 		.describe(
-			'Frontend framework template. Confirm with the user before calling — never default silently. react19 is recommended for new apps.'
+			'Frontend framework template: the one the user named or an app they point at uses, otherwise react19. Do not ask.'
+		),
+	data: z
+		.object({
+			datatable: z.string().describe('Data table the app stores its data in.'),
+			schema: z.string().optional().describe("Schema the app's new tables go in. Omit for public."),
+			tables: z
+				.array(z.string())
+				.optional()
+				.describe(
+					'Tables the app queries, reused or about to be created, each as `<datatable>/<table>` (public) or `<datatable>/<schema>:<table>`.'
+				)
+		})
+		.optional()
+		.describe(
+			'Data setup of an app that stores data, as the user gave or chose it. Omit for an app that stores nothing.'
 		)
 })
 
@@ -1382,7 +1424,14 @@ const buildGlobalSystemPrompt = (
 	// Each `can*` mirrors the capability the matching tools declare in `requires`, so a
 	// rule cannot outlive the tool it describes. An unresolved profile keeps every block.
 	const canWriteDraft = !access || access.has('write_draft')
+	const canWriteFlowDraft = !access || access.has('write_flow_draft')
+	// A builder operator: flow drafts and nothing else. Blocks about drafting in general
+	// follow `canWriteAnyDraft`; blocks naming scripts, apps or the other kinds keep `canWriteDraft`.
+	const flowsOnly = canWriteFlowDraft && !canWriteDraft
+	const canWriteAnyDraft = canWriteDraft || canWriteFlowDraft
 	const canRunPreview = !access || access.has('run_preview')
+	const canManageSchedules = !access || access.has('manage_schedules')
+	const canManageTriggers = !access || access.has('manage_triggers')
 	// The deploy tools take their kind as an argument, so `deploy` gates only the folder text.
 	const canCreateFolder = !access || access.has('deploy')
 	// Each gated block carries its own leading newline, so dropping one leaves no blank
@@ -1403,7 +1452,7 @@ const buildGlobalSystemPrompt = (
 	const activePreviewRule = previewTools
 		? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the item the user has open in its editor) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
 		: ''
-	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.${pipelineAlphaNote}`
+	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow. list_pipelines lists the existing ones by folder.${pipelineAlphaNote}`
 	// Hosting and edition come from the hostname and a store the app populates at init, so
 	// they are knowable only in the browser: a non-browser caller reads false for both and
 	// would be told "self-hosted Community Edition" whatever it targets. No base URL here
@@ -1423,9 +1472,12 @@ The current user's workspace username is "${username}".${instanceLine}
 ${
 	canWriteDraft
 		? 'Use tools to inspect workspace items and create per-user drafts (saved server-side, visible only to this user — not deployed) for scripts, flows, schedules, triggers, resources, variables, and raw apps.'
-		: "Use tools to inspect workspace items and the workspace's run history, and to run items that are already deployed. You cannot create or edit scripts, flows, apps, schedules, triggers, resources or variables here — this user's role does not allow it — so when they ask for such a change, say plainly that you cannot make it rather than describing steps as if you had. Their role is refused scripts, flows and apps outside this chat too, so for those suggest asking a workspace admin rather than creating them in the editor."
+		: `Use tools to inspect workspace items and the workspace's run history, and to run items that are already deployed. You cannot create or edit ${flowsOnly ? '' : 'flows, '}scripts, apps, schedules, triggers, resources or variables here — this user's role does not allow it — so when they ask for such a change, say plainly that you cannot make it rather than describing steps as if you had. Their role is refused ${flowsOnly ? 'scripts and apps' : 'scripts, flows and apps'} outside this chat too, so for those suggest asking a workspace admin rather than creating them in the editor. Resources and variables they can still edit themselves on their pages, so when open_page lists that page, open it for them instead.${when(
+				flowsOnly,
+				'\n\nFlows are the exception: this workspace lets them compose flows out of scripts and flows that are already deployed. Write flow drafts with write_flow and patch_flow_json, using only steps that call a deployed script or flow by path. The server refuses inline code anywhere in the flow, so never add a rawscript step or inline code; when the flow needs logic no deployed script provides, say so and suggest asking a workspace admin for that script.'
+			)}`
 }${when(
-		canWriteDraft,
+		canWriteAnyDraft,
 		`
 
 Path conventions:
@@ -1438,25 +1490,35 @@ Path conventions:
 			'; create one with `create_folder` only when the user explicitly asks for a new folder'
 		)}.${folderGuidanceBlock}`
 	)}${when(
-		canCreateFolder && !canWriteDraft,
+		canCreateFolder && !canWriteAnyDraft,
 		'\n- You can create a shared folder with `create_folder` when the user explicitly asks for one. You cannot create anything inside it here, so do not offer to.'
 	)}
 
 Rules:${when(
-		canWriteDraft,
+		canWriteAnyDraft,
 		`
 - Draft tools create or update drafts only; they do not deploy or mutate deployed workspace items.`
 	)}
 - Use list_workspace_items to find items and read_workspace_item before changing an existing item. For triggers, pass trigger_kind.
 - If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".${activePreviewRule}${when(
-		canWriteDraft,
+		canWriteAnyDraft,
 		`
 - Use deploy_workspace_item only after the user explicitly asks to deploy. It persists a draft to the workspace.
 - To undo something you created or changed in this chat, use discard_local_draft: everything you write is a draft until it is explicitly deployed, so "delete it" / "never mind" / "remove that" about your own work means discarding the draft (it also clears the matching open editor draft). Use delete_workspace_item only to remove an item that is already deployed in the workspace; it mutates the workspace and fails if nothing is deployed at that path.`
 	)}${when(
-		!canWriteDraft,
+		!canWriteAnyDraft,
 		`
-- Three changes are still open to you where the server allows them: discard_local_draft drops a draft this user left behind, deploy_workspace_item deploys one when the user asks, and delete_workspace_item removes an item already deployed in the workspace. You cannot create or edit one.`
+- Three changes are still open to you where the server allows them: discard_local_draft drops a draft this user left behind, deploy_workspace_item deploys one when the user asks, and delete_workspace_item removes an item already deployed in the workspace — each only for the kinds its type lists. You cannot create or edit one.`
+	)}${when(
+		!canManageSchedules || !canManageTriggers,
+		`
+- This workspace does not let this user change ${
+			!canManageSchedules && !canManageTriggers
+				? 'schedules or triggers'
+				: !canManageSchedules
+					? 'schedules'
+					: 'triggers'
+		}, here or in the editor, so never ask them to create or edit one: suggest asking a workspace admin.`
 	)}
 - Use diff to review changes — before deploying, or when the user asks what changed. It is read-only: without arguments it lists every draft in the workspace with its change status; with type+path it returns that item's unified diff (for multi-file apps, pass file to read one file's diff). In a fork, pass against="parent_workspace" to compare the deployed fork with its parent workspace instead. Pass search to grep changed lines across all diffs.${when(
 		canWriteDraft,
@@ -1474,6 +1536,10 @@ ${pipelineBullet}`
 		`
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Do the same for a raw app: run test_run_app_runnable on each backend runnable you wrote or changed before saying the app works. A bundle that compiles proves nothing about whether the runnables run. An inline runnable executes the app's draft code; a path runnable executes the DEPLOYED script/flow it names, so a path runnable aimed at something you have not deployed fails here — that failure is the point: report it and offer to deploy that one target. The app itself does not need deploying to be tested.`
+	)}${when(
+		flowsOnly && (!access || access.has('run_flow_preview')),
+		`
+- After creating or editing a flow draft, run test_run_flow with representative args before reporting that it works. It prefers drafts, so testing does not require deployment.`
 	)}
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_run with a returned id to see what that run was called with, what it returned and what it logged — without starting a new test run.
 - get_run also covers what a flow run did per step — statuses and results across the whole execution tree, subflow steps and loop iterations included — and works while the flow is still running. Pass step to read one step's result in full (capped at 12k chars).
@@ -1498,12 +1564,16 @@ ${pipelineBullet}`
 			? `${when(
 					!canWriteDraft,
 					`
-- open_preview(kind, path) shows a deployed script / flow / app in the side panel next to the chat — its run form, triggers and past runs, which the user can act on there. Use it when you surface an item they will want to run or inspect. You cannot open item editors in this workspace, so it only ever opens the deployed page.`
+- open_preview(kind, path) shows a deployed script / flow / app in the side panel next to the chat — its run form, triggers and past runs, which the user can act on there. Use it when you surface an item they will want to run or inspect. ${
+						flowsOnly
+							? 'The flow editor is the only editor you can open here: after writing or editing a flow draft, show it with open_preview(kind="flow", path, mode="edit").'
+							: 'You cannot open item editors in this workspace, so it only ever opens the deployed page.'
+					}`
 				)}${when(
 					canWriteDraft,
 					`
 - After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.
-- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty ${when(canCreateFolder, 'or not-yet-created ')}folder is fine${when(canCreateFolder, ' (create_folder first if needed, then open it)')}. Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
+- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty ${when(canCreateFolder, 'or not-yet-created ')}folder is fine${when(canCreateFolder, ' (create_folder first if needed, then open it)')}. Opening it adds build_pipeline_node / edit_pipeline_node to your tools from the next step on — they are not in your tool list before open_preview returns, so call open_preview on its own, wait for its result, then build. They then stay available for the rest of the session even while another tab (a page, another preview) is shown: a call brings the pipeline editor back by itself, so do not re-open it first. Use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
 				)}
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - Writing an app file does not compile it: the open preview rebuilds it afterwards. After editing a raw app's frontend files with its preview open, call get_app_runtime_logs to check the build — when it failed, it returns the build errors (e.g. syntax or import errors) and bundler logs to fix.
@@ -1530,7 +1600,7 @@ Documentation:
 Flows:
 - read_workspace_item returns compact flow JSON. Inline script bodies appear as "inline_script.<moduleId>".
 - Use read_flow_module_code${when(canWriteDraft, ' and set_flow_module_code')} for inline script bodies.${when(
-		canWriteDraft,
+		canWriteFlowDraft,
 		`
 - Use patch_flow_json for structural flow edits and write_flow for full flow rewrites.`
 	)}
@@ -1543,7 +1613,7 @@ Raw apps:
 - A draft app is reachable by nobody; deploying is what exposes its backend runnables. deploy_workspace_item says so when the deploy widens who may open the app: anonymous means anyone with the URL, without logging in; guest means anyone the instance's identity provider authenticates, member of this workspace or not. Relay that in plain words and carry on. This is disclosure, not a gate: do not stop and ask for permission, and do not refuse the deploy. You cannot change who may open an app from chat; it is set on the app's deploy settings.
 - Use write_app_file, patch_app_file, and delete_app_file for frontend files.
 - Use write_app_runnable and delete_app_runnable for backend runnables.
-- Use init_app only after confirming framework, path, and summary with the user.
+- Use init_app for a new app, with framework react19 unless the user named one or points at an app to follow: do not ask about the framework, and write the summary and pick the path (path conventions above) yourself. When the app has to store data and the user did not say where, settle the data setup with askUserQuestion BEFORE init_app or any SQL (get_instructions subject "app" lists the questions, one askUserQuestion each), then pass the outcome as init_app's data.
 - Use deploy_workspace_item after explicit user deploy intent; raw app deploy bundles JS/CSS before saving.`
 	)}
 
@@ -1995,6 +2065,11 @@ async function saveAppDraft(
 	path: string,
 	value: AppDraftValue
 ): Promise<DraftPersistResult> {
+	if (operatorBuilderAppsIn(workspace)) {
+		const role = await roleForWorkspace(workspace)
+		value.policy ??= {}
+		conformBuilderAppPolicy(value.policy, role.kind === 'resolved' ? role.user : undefined)
+	}
 	return saveGlobalAppDraft(workspace, path, value)
 }
 
@@ -2413,7 +2488,7 @@ function getAppInstructions(language?: ScriptLang): string {
 
 - Global mode edits raw app drafts only; it does not save or deploy unless the user explicitly asks to deploy.
 - App drafts are addressed by workspace path. Follow the path conventions in the system prompt: default to \`u/<current-user>/<name>\` for bare names; only use \`f/<folder>/<name>\` when the folder is known to exist. The first write tool snapshots the workspace app onto the draft, and subsequent writes accumulate.
-- To create a new app, use \`init_app\` with a path, optional summary, and a framework (\`react19\` / \`react18\` / \`svelte5\` / \`vue\`). Confirm framework + path + summary with the user before calling — do not silently default to \`react19\` even though it is the recommended choice. \`init_app\` errors if an app already exists at the path or a draft is already in flight; in that case, edit the existing one rather than re-initializing.
+- To create a new app, use \`init_app\` with a path, optional summary, a framework (\`react19\` / \`react18\` / \`svelte5\`) and, for an app that stores data, its \`data\` setup. "Starting a new app" below decides the framework and when the data setup is asked. Ask each of its questions with \`askUserQuestion\`, one question per call with the suggested answer first, before \`init_app\` and before any SQL. \`init_app\` only records \`data\`: a new schema is yours to create with the datatable SQL tool. \`init_app\` errors if an app already exists at the path or a draft is already in flight; in that case, edit the existing one rather than re-initializing.
 - \`init_app\` seeds a starter inline runnable named \`a\` (bun, \`main(x: string) => string\`) so the React/Svelte demo button works on first render. Replace or remove it once you start building real backend runnables.
 - Frontend file paths start with \`/\` (e.g. \`/index.tsx\`, \`/App.tsx\`, \`/styles.css\`). Use \`write_app_file\` / \`patch_app_file\` / \`delete_app_file\`.
 - Backend inline runnables are addressed as \`backend/<key>/main.{ts|py}\` from the file tools, but you create or update them via \`write_app_runnable\` / \`delete_app_runnable\` (which take the runnable shape directly: \`{ name, type, inlineScript?, path?, staticInputs? }\`).
@@ -2522,8 +2597,13 @@ export function getSessionContextPromptSection(
 	// Concatenated onto an already capability-gated prompt, so it has to honour the same
 	// profile rather than assume the gating happened upstream.
 	const canDeploy = !access || access.has('deploy')
-	const canWriteDraft = !access || access.has('write_draft')
-	const canRunPreview = !access || access.has('run_preview')
+	const canWriteDraft = !access || access.has('write_draft') || access.has('write_flow_draft')
+	const canRunPreview = !access || access.has('run_preview') || access.has('run_flow_preview')
+	// The kinds no deploy rule reaches, unless the workspace withdrew them from this user.
+	const unruledKinds = [
+		(!access || access.has('manage_schedules')) && 'schedules',
+		(!access || access.has('manage_triggers')) && 'triggers'
+	].filter((k): k is string => !!k)
 	const targets = ['reads', canWriteDraft && 'drafts', canRunPreview && 'test runs', 'deploys']
 		.filter(Boolean)
 		.join(', ')
@@ -2562,7 +2642,13 @@ export function getSessionContextPromptSection(
 	// promotes the rest instead. The rules gate deletes too, so it is owed to every such profile.
 	if (!canDeploy) {
 		lines.push(
-			"- This workspace refuses direct deployment for this user, except for schedules and triggers — those are the only kinds deploy_workspace_item and delete_workspace_item can still act on. Scripts, flows, apps, resources and variables must be promoted from the session's deploy panel (fork or pull request); do not offer to deploy or delete them directly."
+			`- This workspace refuses direct deployment for this user${
+				unruledKinds.length === 2
+					? ', except for schedules and triggers — those are the only kinds deploy_workspace_item and delete_workspace_item can still act on'
+					: unruledKinds.length === 1
+						? `, except for ${unruledKinds[0]} — the only kind deploy_workspace_item and delete_workspace_item can still act on`
+						: ''
+			}. Scripts, flows, apps, resources and variables must be promoted from the session's deploy panel (fork or pull request); do not offer to deploy or delete them directly.`
 		)
 	}
 	return lines.join('\n')
@@ -2698,7 +2784,7 @@ function allowedTriggerKinds(): PageTriggerKind[] {
 }
 
 // Pages an operator may reach: exactly the ones enabled in the workspace's
-// operator_settings, the same source OperatorMenu gates on. Operators are never admins, so
+// operator_settings, the same source the sidebar gates on. Operators are never admins, so
 // workspace_settings is excluded whatever the settings say.
 function operatorOpenPages(workspaceId: string | undefined): OpenPageName[] {
 	const settings = get(userWorkspaces).find((w) => w.id === workspaceId)?.operator_settings
@@ -3369,7 +3455,7 @@ export const openPageTool: SessionTool<{}> = {
 		// is no active session, in which case we offer a link chip instead.
 		const previewResult = openPagePreview({
 			sessionId: sessionIdFromCtx(ctx),
-			href: pageHref(url),
+			href: url,
 			label: pageLabel,
 			newTab: parsed.new_tab ?? false
 		})
@@ -3406,9 +3492,14 @@ export const globalTools: SessionTool<{}>[] = [
 			// Every subject is authoring guidance written around the draft tools by name, and a
 			// tool result is the one place the toolset filter cannot reach.
 			const access = (ctx.helpers as GlobalToolHelpers | undefined)?.access
-			if (access && !access.has('write_draft')) {
-				const message =
-					'This session cannot create or edit workspace items, so there is no authoring guidance to give. Tell the user plainly rather than describing how it would be done.'
+			const canAuthor =
+				!access ||
+				access.has('write_draft') ||
+				(parsed.subject === 'flow' && access.has('write_flow_draft'))
+			if (!canAuthor) {
+				const message = access?.has('write_flow_draft')
+					? 'This session can only compose flows, so flow is the one subject with authoring guidance here. Tell the user plainly that you cannot create or edit this kind of item.'
+					: 'This session cannot create or edit workspace items, so there is no authoring guidance to give. Tell the user plainly rather than describing how it would be done.'
 				toolCallbacks.setToolStatus(toolId, { content: 'No authoring guidance' })
 				return message
 			}
@@ -3633,6 +3724,23 @@ export const globalTools: SessionTool<{}>[] = [
 			return JSON.stringify(results, null, 2)
 		}
 	},
+	{
+		requires: NONE,
+		def: createToolDef(
+			listPipelinesSchema,
+			'list_pipelines',
+			'List the data pipelines of the workspace: each folder holding at least one pipeline script, with its number of scripts. A pipeline is named by its folder, not by an item path.'
+		),
+		planModeSafe: true,
+		fn: async ({ workspace, toolId, toolCallbacks }) => {
+			toolCallbacks.setToolStatus(toolId, { content: 'Listing data pipelines...' })
+			const pipelines = await AssetService.listPipelineFolders({ workspace })
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Listed ${pipelines.length} data pipeline(s)`
+			})
+			return JSON.stringify(pipelines)
+		}
+	},
 	{
 		requires: NONE,
 		def: createToolDef(
@@ -3739,7 +3847,7 @@ export const globalTools: SessionTool<{}>[] = [
 		}
 	},
 	{
-		requires: WRITE_DRAFT,
+		requires: WRITE_FLOW_DRAFT,
 		def: createToolDef(writeFlowSchema, 'write_flow', 'Create or overwrite a draft flow.'),
 		showDetails: true,
 		streamArguments: true,
@@ -3873,7 +3981,7 @@ export const globalTools: SessionTool<{}>[] = [
 		}
 	},
 	{
-		requires: WRITE_DRAFT,
+		requires: WRITE_FLOW_DRAFT,
 		def: createToolDef(
 			patchFlowJsonSchema,
 			'patch_flow_json',
@@ -3923,7 +4031,7 @@ export const globalTools: SessionTool<{}>[] = [
 		autoCollapseDetails: false
 	},
 	{
-		requires: RUN_PREVIEW,
+		requires: RUN_FLOW_PREVIEW,
 		def: testRunFlowToolDef,
 		fn: async (ctx) => {
 			const parsed = testRunFlowSchema.parse(ctx.args)
@@ -4103,16 +4211,17 @@ export const globalTools: SessionTool<{}>[] = [
 		// turns on the kind. Each kind's handler, reached through `deployDraft`'s switch:
 		requires: NONE,
 		kindRequires: {
-			// scripts.rs `create_script_internal`, flows.rs `create_flow`/`update_flow` and
-			// apps.rs `create_app_raw`/`update_app_raw` refuse operators; all run the rules.
+			// scripts.rs `create_script_internal` and apps.rs `create_app_raw`/`update_app_raw`
+			// refuse operators, flows.rs `create_flow`/`update_flow` those without builder
+			// rights; all run the rules.
 			script: ['deploy', 'manage_code'],
-			flow: ['deploy', 'manage_code'],
+			flow: ['deploy', 'manage_flows'],
 			app: ['deploy', 'manage_code'],
 			resource: DEPLOY,
 			variable: DEPLOY,
-			// The schedule and trigger handlers check neither.
-			schedule: NONE,
-			trigger: NONE
+			// No deploy rules here, but `gate_operator_writes` on their routers.
+			schedule: ['manage_schedules'],
+			trigger: ['manage_triggers']
 		} satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>,
 		def: createToolDef(
 			deployWorkspaceItemSchema,
@@ -4130,8 +4239,17 @@ export const globalTools: SessionTool<{}>[] = [
 		}
 	},
 	{
-		// Rebasing writes a fresh draft, so drafts.rs `require_can_write_path` applies.
-		requires: WRITE_DRAFT,
+		// Rebasing writes a fresh draft, so drafts.rs `require_can_write_path` applies per kind.
+		requires: NONE,
+		kindRequires: {
+			script: WRITE_DRAFT,
+			flow: WRITE_FLOW_DRAFT,
+			app: WRITE_DRAFT,
+			resource: WRITE_DRAFT,
+			variable: WRITE_DRAFT,
+			schedule: WRITE_DRAFT,
+			trigger: WRITE_DRAFT
+		} satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>,
 		def: createToolDef(
 			rebaseDraftSchema,
 			'rebase_draft',
@@ -4176,13 +4294,14 @@ export const globalTools: SessionTool<{}>[] = [
 		kindRequires: {
 			// scripts.rs `delete_script_by_path` calls `require_admin`; a non-admin archives.
 			script: ['admin'],
-			// flows.rs `delete_flow_by_path` and apps.rs `delete_app` refuse operators.
-			flow: ['deploy', 'manage_code'],
+			// apps.rs `delete_app` refuses operators, flows.rs `delete_flow_by_path` those
+			// without builder rights.
+			flow: ['deploy', 'manage_flows'],
 			app: ['deploy', 'manage_code'],
 			resource: DEPLOY,
 			variable: DEPLOY,
-			schedule: NONE,
-			trigger: NONE
+			schedule: ['manage_schedules'],
+			trigger: ['manage_triggers']
 		} satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>,
 		def: createToolDef(
 			deleteWorkspaceItemSchema,
@@ -4270,7 +4389,7 @@ export const globalTools: SessionTool<{}>[] = [
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Found ${results.length} resource type(s) for "${parsed.query}"`
 			})
-			return JSON.stringify(
+			const listing = JSON.stringify(
 				results.map((rt) => ({
 					name: rt.name,
 					schema: rt.schema
@@ -4278,6 +4397,15 @@ export const globalTools: SessionTool<{}>[] = [
 				null,
 				2
 			)
+			// The search is semantic and always returns its closest types, so a miss reads
+			// like a hit unless the absence is spelled out.
+			const words = (parsed.query.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter(
+				(w) => w.length >= 3
+			)
+			const named = results.some((rt) => words.some((w) => rt.name.toLowerCase().includes(w)))
+			return named || words.length === 0
+				? listing
+				: `${listing}\n\nNo resource type name contains "${parsed.query}": these are only the nearest matches, so no dedicated type exists. Searching again with synonyms will not find one — use a fitting generic type above, or create a custom c_<name> type.`
 		}
 	},
 	createDbSchemaTool<{}>({
@@ -4444,17 +4572,20 @@ export const globalTools: SessionTool<{}>[] = [
 	{
 		requires: NONE,
 		def: createToolDef(openPreviewSchema, 'open_preview', OPEN_PREVIEW_DESCRIPTION),
-		// Withhold the editor side from a session that cannot write drafts, so the model
-		// never offers the user a panel it would not get.
+		// Withhold the editors a session cannot save, so the model never offers the user a
+		// panel it would not get.
 		schemaFor: async (helpers) => {
 			const access = (helpers as GlobalToolHelpers | undefined)?.access
-			return access && !access.has('write_draft')
-				? createToolDef(
+			if (canOpenEditor(access, 'script')) {
+				return createToolDef(openPreviewSchema, 'open_preview', OPEN_PREVIEW_DESCRIPTION)
+			}
+			return canOpenEditor(access, 'flow')
+				? createToolDef(openPreviewFlowEditorSchema, 'open_preview', OPEN_PREVIEW_DESCRIPTION)
+				: createToolDef(
 						openPreviewViewOnlySchema,
 						'open_preview',
 						OPEN_PREVIEW_VIEW_ONLY_DESCRIPTION
 					)
-				: createToolDef(openPreviewSchema, 'open_preview', OPEN_PREVIEW_DESCRIPTION)
 		},
 		fn: async (ctx) => {
 			const parsed = openPreviewSchema.parse(ctx.args)
@@ -4497,7 +4628,6 @@ export const globalTools: SessionTool<{}>[] = [
 		),
 		planModeSafe: true,
 		showDetails: true,
-		autoCollapseDetails: false,
 		fn: async (ctx) => {
 			const parsed = getRuntimeLogsSchema.parse(ctx.args)
 			ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: 'Reading app runtime logs...' })
@@ -4791,22 +4921,25 @@ async function openSessionPreview(
 	if (!openPreviewHandler) {
 		return 'Error: open_preview is only available inside an AI session. Tell the user to switch to a session to view the preview, or describe the item textually.'
 	}
-	// A pipeline has only an editor, and its own capability gates already cover it.
+	// A pipeline has only an editor, so a session that cannot save its nodes has nothing to open.
 	if (args.kind === 'pipeline') {
+		if (!canOpenEditor(access, 'pipeline')) {
+			return 'Error: you cannot open the pipeline editor in this workspace: this user cannot save drafts. Show its scripts with open_preview mode "view" instead.'
+		}
 		return await openPreviewHandler({ ...args, mode: undefined, sessionId })
 	}
 	// Resolved before the gates, not after: the handler reads a missing mode as the editor, so
 	// gating on `args.mode === 'edit'` would wave through every call that simply omitted it —
 	// which is what a model whose schema only offers 'view' does.
 	const mode: 'edit' | 'view' = args.mode ?? 'edit'
-	// The advertised schema already withholds 'edit' from a session that cannot write
-	// drafts; re-check so a model asking outside the enum can't act outside it either.
-	if (mode === 'edit' && access && !access.has('write_draft')) {
+	// The advertised schema already narrows 'edit' to what this session can save; re-check so
+	// a model asking outside the enum can't act outside it either.
+	if (mode === 'edit' && !canOpenEditor(access, args.kind)) {
 		const opened = await openPreviewHandler({ ...args, mode: 'view', sessionId })
-		return `${opened}\nOpened the deployed page instead: you cannot open item editors in this workspace.`
+		return `${opened}\nOpened the deployed page instead: you cannot open ${args.kind === 'flow' ? 'flow' : 'item'} editors in this workspace.`
 	}
-	// `write_draft` is a workspace capability and says nothing about this path, so an
-	// edit that survived it is still checked against the item's own permissions.
+	// The draft capability is workspace-wide and says nothing about this path, so an edit
+	// that survived it is still checked against the item's own permissions.
 	if (mode === 'edit' && workspace) {
 		const verdict = await canEditItemPath(workspace, args.kind, args.path)
 		if (verdict !== 'allowed') {
@@ -4834,10 +4967,12 @@ async function canEditItemPath(
 	const role = await roleForWorkspace(workspace)
 	if (role.kind === 'not_a_member') return 'denied'
 	if (role.kind !== 'resolved' || !role.user) return 'unverified'
-	if (role.user.operator) return 'denied'
+	const user = role.user
+	const settings = get(userWorkspaces).find((w) => w.id === workspace)?.operator_settings
+	if (!roleCanDraft(kind, user, settings)) return 'denied'
 	// Folder and ownership rules answer most calls without a request. An item's own
 	// `extra_perms` can only widen them, so the item is fetched only to overturn a denial.
-	if (canWrite(path, {}, role.user)) return 'allowed'
+	if (canDraftItem(kind, path, {}, user, settings)) return 'allowed'
 	try {
 		const extraPerms =
 			kind === 'script'
@@ -4845,7 +4980,7 @@ async function canEditItemPath(
 				: kind === 'flow'
 					? (await FlowService.getFlowByPath({ workspace, path })).extra_perms
 					: (await AppService.getAppByPath({ workspace, path })).extra_perms
-		return canWrite(path, extraPerms ?? {}, role.user) ? 'allowed' : 'denied'
+		return canDraftItem(kind, path, extraPerms, user, settings) ? 'allowed' : 'denied'
 	} catch (e) {
 		// Nothing deployed means no sharing to widen the folder rules with.
 		return (e as { status?: number } | null | undefined)?.status === 404 ? 'denied' : 'unverified'
@@ -5035,6 +5170,9 @@ function getSessionScreenshot(sessionId: string | undefined): Promise<SessionScr
 export type DeployedInSessionHandler = (req: {
 	sessionId: string | undefined
 	kind: 'script' | 'flow' | 'raw_app'
+	/** The path the item's draft, and so its open editor, is keyed on. */
+	storagePath: string
+	/** Where the deploy landed. */
 	path: string
 }) => void
 
@@ -5299,10 +5437,12 @@ function maybeAttachPreviewCard(
 function finishAppDraftWrite(
 	result: DraftPersistResult,
 	ctx: WriteDraftCtx,
-	onSaved: () => { content: string; message: string; warning?: string }
+	onSaved: () => { content: string; message: string; warning?: string },
+	codeDiff?: ToolCodeDiff
 ): string {
 	const failure = draftWriteFailure(result, ctx)
 	if (failure) return failure
+	if (codeDiff) ctx.toolCallbacks.setToolStatus(ctx.toolId, { codeDiff })
 	ctx.toolCallbacks.onItemModified?.(result.itemKind, result.storagePath)
 	maybeAttachPreviewCard(ctx, result.itemKind, result.item.path)
 	const { content, message, warning } = onSaved()
@@ -5446,6 +5586,17 @@ function writeScriptDraft(
 	ctx: WriteDraftCtx,
 	codeDiff?: ToolCodeDiff
 ): Promise<string> {
+	// A session builds pipeline nodes into the folder's pipeline draft; a script draft
+	// written here never reaches the pipeline graph, and saving the pipeline drops it.
+	if (
+		(ctx.sessionId ?? sessionIdFromCtx(ctx)) &&
+		parsePipelineAnnotations(args.content).inPipeline
+	) {
+		const folder = args.path.match(/^f\/([^/]+)\//)?.[1] ?? '<folder>'
+		throw new Error(
+			`"${args.path}" is a data pipeline node (its source starts with the pipeline annotation). In a session, pipeline nodes are not script drafts: call open_preview(kind="pipeline", path="${folder}") if that folder's pipeline editor is not open yet, then use build_pipeline_node (new node) or edit_pipeline_node (existing node). Nothing was written.`
+		)
+	}
 	return writeDraft(SCRIPT_SPEC, 'script', args.path, args, ctx, {
 		override: args.override,
 		codeDiff:
@@ -5951,6 +6102,7 @@ async function agentStepRunForm(
 		.sort((a, b) => (position.get(a) ?? Infinity) - (position.get(b) ?? Infinity))
 
 	const evaluated: Record<string, any> = {}
+	await quickjsReady()
 	for (const key of keys) {
 		const value = evalValue(key, module, undefined, false)
 		if (value !== undefined) evaluated[key] = value
@@ -6503,16 +6655,31 @@ async function testRunFlowStepByPath(
 	)
 }
 
+/** The `data.tables` entry for a table named without its data table (`schema:table`,
+ * `schema.table` or `table`), which models write for a table of the app's own data table.
+ * A bare name is a table of the app's own schema. */
+function appTableRef(datatable: string, schema: string | undefined, ref: string): string {
+	if (ref.includes('/')) return ref
+	const sep = ref.includes(':') ? ':' : '.'
+	const at = ref.indexOf(sep)
+	return formatDataTableRef(
+		at === -1
+			? { datatable, schema, table: ref }
+			: { datatable, schema: ref.slice(0, at), table: ref.slice(at + 1) }
+	)
+}
+
 async function initApp(
 	args: {
 		path: string
 		summary?: string
 		framework: FrameworkKey
+		data?: { datatable: string; schema?: string; tables?: string[] }
 	},
 	ctx: WriteDraftCtx
 ): Promise<string> {
 	const { workspace, toolId, toolCallbacks } = ctx
-	const { path, summary, framework } = args
+	const { path, summary, framework, data } = args
 
 	if (await getGlobalDraft(workspace, 'app', path)) {
 		throw new Error(
@@ -6533,13 +6700,20 @@ async function initApp(
 	const value: AppDraftValue = {
 		summary,
 		files: { ...template },
-		runnables: structuredClone(STARTER_RUNNABLES)
+		runnables: structuredClone(STARTER_RUNNABLES),
+		...(data && {
+			data: {
+				tables: (data.tables ?? []).map((ref) => appTableRef(data.datatable, data.schema, ref)),
+				datatable: data.datatable,
+				schema: data.schema
+			}
+		})
 	}
 	await recomputeAppPolicy(value)
 	const result = await saveAppDraft(workspace, path, value)
 	return finishAppDraftWrite(result, ctx, () => ({
 		content: `Saved app "${path}" draft (${framework})`,
-		message: `Initialized a per-user draft app "${path}" from the ${framework} template (saved server-side, not a deployed workspace item). The template is a demo tour with starter runnables ${Object.keys(STARTER_RUNNABLES).join(', ')}: replace its UI and delete the runnables the app does not need (delete_app_runnable). Use write_app_file / write_app_runnable to evolve it.`
+		message: `Initialized a per-user draft app "${path}" from the ${framework} template (saved server-side, not a deployed workspace item). The template is a demo tour with starter runnables ${Object.keys(STARTER_RUNNABLES).join(', ')}: replace its UI and delete the runnables the app does not need (delete_app_runnable). Use write_app_file / write_app_runnable to evolve it.${data?.schema ? ` Its data config names schema "${data.schema}" of data table "${data.datatable}" without creating it: if it does not exist yet, create it before the tables that go in it.` : ''}`
 	}))
 }
 
@@ -6840,12 +7014,18 @@ async function writeAppFile(
 	})
 
 	const { value } = await loadAppDraftValue(args.path, workspace)
+	const before = value.files[target.filePath] ?? ''
 	value.files = { ...value.files, [target.filePath]: args.content }
 	const result = await saveAppDraft(workspace, args.path, value)
-	return finishAppDraftWrite(result, ctx, () => ({
-		content: `Updated ${target.filePath} in app "${args.path}"`,
-		message: `Updated draft app "${args.path}" with frontend file "${target.filePath}".`
-	}))
+	return finishAppDraftWrite(
+		result,
+		ctx,
+		() => ({
+			content: `Updated ${target.filePath} in app "${args.path}"`,
+			message: `Updated draft app "${args.path}" with frontend file "${target.filePath}".`
+		}),
+		{ before, after: args.content, lang: appFileEditorLang(target.filePath) }
+	)
 }
 
 async function deleteAppFile(
@@ -6869,13 +7049,18 @@ async function deleteAppFile(
 	if (!(target.filePath in value.files)) {
 		throw new Error(`Frontend file "${target.filePath}" not found in app "${args.path}".`)
 	}
-	const { [target.filePath]: _removed, ...remaining } = value.files
+	const { [target.filePath]: removed, ...remaining } = value.files
 	value.files = remaining
 	const result = await saveAppDraft(workspace, args.path, value)
-	return finishAppDraftWrite(result, ctx, () => ({
-		content: `Removed ${target.filePath} from app "${args.path}"`,
-		message: `Removed "${target.filePath}" from draft app "${args.path}".`
-	}))
+	return finishAppDraftWrite(
+		result,
+		ctx,
+		() => ({
+			content: `Removed ${target.filePath} from app "${args.path}"`,
+			message: `Removed "${target.filePath}" from draft app "${args.path}".`
+		}),
+		{ before: removed, after: '', lang: appFileEditorLang(target.filePath) }
+	)
 }
 
 async function patchAppFile(
@@ -6946,10 +7131,15 @@ async function patchAppFile(
 	}
 
 	const result = await saveAppDraft(workspace, path, value)
-	return finishAppDraftWrite(result, ctx, () => ({
-		content: `Patched ${target.filePath} in app "${path}"`,
-		message: `Patched "${target.filePath}" in draft app "${path}".`
-	}))
+	return finishAppDraftWrite(
+		result,
+		ctx,
+		() => ({
+			content: `Patched ${target.filePath} in app "${path}"`,
+			message: `Patched "${target.filePath}" in draft app "${path}".`
+		}),
+		{ before: currentContent, after: updated, lang: appFileEditorLang(target.filePath) }
+	)
 }
 
 async function recomputeAppPolicy(value: AppDraftValue): Promise<void> {
@@ -6980,15 +7170,48 @@ async function writeAppRunnable(
 	await recomputeAppPolicy(value)
 	const undeployed = await undeployedRunnableTargets(workspace, { [key]: persisted })
 	const result = await saveAppDraft(workspace, path, value)
-	return finishAppDraftWrite(result, ctx, () => ({
-		content: `Updated runnable "${key}" in app "${path}"`,
-		message: `Updated draft app "${path}" with runnable "${key}".`,
-		warning: undeployed.length
-			? `This runnable points at an item that is NOT deployed (${undeployed[0]}), so it fails at runtime — ` +
-				`a path runnable runs the deployed item, never a draft. Offer to deploy just that item with ` +
-				`deploy_workspace_item; the app itself does not need deploying, since the preview runs its draft.`
-			: undefined
-	}))
+	return finishAppDraftWrite(
+		result,
+		ctx,
+		() => ({
+			content: `Updated runnable "${key}" in app "${path}"`,
+			message: `Updated draft app "${path}" with runnable "${key}".`,
+			warning: undeployed.length
+				? `This runnable points at an item that is NOT deployed (${undeployed[0]}), so it fails at runtime — ` +
+					`a path runnable runs the deployed item, never a draft. Offer to deploy just that item with ` +
+					`deploy_workspace_item; the app itself does not need deploying, since the preview runs its draft.`
+				: undefined
+		}),
+		inlineRunnableDiff(key, existing, persisted)
+	)
+}
+
+function inlineRunnableCode(runnable: PersistedRunnable | undefined): string | undefined {
+	return runnable?.type === 'inline' || runnable?.type === 'runnableByName'
+		? (runnable.inlineScript?.content ?? '')
+		: undefined
+}
+
+// A runnable that references a workspace or hub item has no code of its own to diff.
+function inlineRunnableDiff(
+	key: string,
+	before: PersistedRunnable | undefined,
+	after: PersistedRunnable | undefined
+): ToolCodeDiff | undefined {
+	const beforeCode = inlineRunnableCode(before)
+	const afterCode = inlineRunnableCode(after)
+	if (beforeCode === undefined && afterCode === undefined) return undefined
+	if (after !== undefined && afterCode === undefined) return undefined
+	const lang = (runnable: PersistedRunnable | undefined) =>
+		appFileEditorLang(`backend/${key}/main.${getInlineScriptExtension(runnable)}`)
+	const afterLang = lang(after ?? before)
+	const beforeLang = beforeCode === undefined ? afterLang : lang(before)
+	return {
+		before: beforeCode ?? '',
+		after: afterCode ?? '',
+		lang: afterLang,
+		...(beforeLang !== afterLang ? { beforeLang } : {})
+	}
 }
 
 /**
@@ -7088,14 +7311,19 @@ async function deleteAppRunnable(
 	if (!(key in value.runnables)) {
 		throw new Error(`Backend runnable "${key}" not found in app "${path}".`)
 	}
-	const { [key]: _removed, ...remaining } = value.runnables
+	const { [key]: removed, ...remaining } = value.runnables
 	value.runnables = remaining
 	await recomputeAppPolicy(value)
 	const result = await saveAppDraft(workspace, path, value)
-	return finishAppDraftWrite(result, ctx, () => ({
-		content: `Removed runnable "${key}" from app "${path}"`,
-		message: `Removed runnable "${key}" from draft app "${path}".`
-	}))
+	return finishAppDraftWrite(
+		result,
+		ctx,
+		() => ({
+			content: `Removed runnable "${key}" from app "${path}"`,
+			message: `Removed runnable "${key}" from draft app "${path}".`
+		}),
+		inlineRunnableDiff(key, removed as PersistedRunnable, undefined)
+	)
 }
 
 const triggerLabels: Record<TriggerKind, string> = {
@@ -8591,24 +8819,29 @@ async function deployDraft(
 	// synthetic storage key never exists deployed, so the entry would otherwise
 	// stop matching anything after the draft is gone.
 	const deployedKind = itemKindFor(type, triggerKind)
+	const draftStoragePath = getGlobalDraftStoragePath(workspace, type, path, triggerKind)
 	if (deployedKind) {
-		toolCallbacks.onItemDeployed?.(
-			deployedKind,
-			getGlobalDraftStoragePath(workspace, type, path, triggerKind),
-			deployedPath
-		)
+		toolCallbacks.onItemDeployed?.(deployedKind, draftStoragePath, deployedPath)
 	}
 
-	// Reload the session preview if it's open on the deployed item. Map the
-	// deploy type to the preview kind — a raw app deploys under 'app' but the
-	// preview addresses it as 'raw_app'; non-previewable types map to undefined.
+	// Reload the session preview if it's open on the deployed item, which its editor
+	// knows by the draft's storage path. Map the deploy type to the preview kind — a
+	// raw app deploys under 'app' but the preview addresses it as 'raw_app';
+	// non-previewable types map to undefined.
 	const previewKindByType: Partial<Record<WorkspaceItemType, 'script' | 'flow' | 'raw_app'>> = {
 		script: 'script',
 		flow: 'flow',
 		app: 'raw_app'
 	}
 	const kind = previewKindByType[type]
-	if (kind) deployedInSessionHandler?.({ sessionId, kind, path })
+	if (kind) {
+		deployedInSessionHandler?.({
+			sessionId,
+			kind,
+			storagePath: draftStoragePath,
+			path: deployedPath
+		})
+	}
 
 	toolCallbacks.setToolStatus(toolId, {
 		content: `Deployed ${type} "${path}"`,
@@ -8850,7 +9083,13 @@ export function getActiveGlobalEditorContext(
 		if (!liveDraft) continue
 		const path = liveDraft.effectivePath || liveDraft.storagePath
 		if (!path) continue
-		return { type, path, storagePath: liveDraft.storagePath, isLiveDraft: true }
+		return {
+			type,
+			path,
+			storagePath: liveDraft.storagePath,
+			isLiveDraft: true,
+			isNew: liveDraft.isNew
+		}
 	}
 }
 
@@ -8874,7 +9113,12 @@ export function prepareGlobalUserMessage(
 		content += '## ACTIVE EDITOR\n'
 		content += `type: ${activeEditor.type}\n`
 		content += `path: ${activeEditor.path}\n`
-		content += `isLiveDraft: true\n\n`
+		content += `isLiveDraft: true\n`
+		if (activeEditor.isNew) {
+			content +=
+				'isNew: true — the user just started this item from the new-item builder; it holds the starter template and is the item to build. Edit it in place; do not create another one. For an app, its files are the framework it was started with and the `data` config read_workspace_item shows is the data setup it was started with: ask about neither.\n'
+		}
+		content += '\n'
 	}
 
 	if (options.activePreview) {
diff --git a/frontend/src/lib/components/copilot/chat/global/gate.ts b/frontend/src/lib/components/copilot/chat/global/gate.ts
index d1dafe29ed..506f230027 100644
--- a/frontend/src/lib/components/copilot/chat/global/gate.ts
+++ b/frontend/src/lib/components/copilot/chat/global/gate.ts
@@ -25,14 +25,35 @@ export function isGlobalAiEnabled(): boolean {
 	}
 }
 
+const OPERATOR_SESSIONS_KEY = 'wm_operator_ai_sessions'
+
+/**
+ * Operators get AI sessions only in a browser that opted in, until the operator experience
+ * has been tested; everywhere else they keep the docked chat and `/sessions` refuses them.
+ * Set with `localStorage.setItem('wm_operator_ai_sessions', '1')` and reload. To ship it,
+ * delete this and `sessionsAllowedFor`, and drop the `isOperator` argument from every caller.
+ */
+function operatorSessionsEnabled(): boolean {
+	if (typeof localStorage === 'undefined') return false
+	try {
+		return localStorage.getItem(OPERATOR_SESSIONS_KEY) === '1'
+	} catch {
+		return false
+	}
+}
+
+/** Whether this user's role may use AI sessions at all. */
+export function sessionsAllowedFor(isOperator: boolean | undefined): boolean {
+	return !isOperator || operatorSessionsEnabled()
+}
+
 /**
  * Whether an AI entry point hands off to a session instead of driving the docked
  * chat. Deliberately the same condition as the root layout's `disableAi`, so a
  * caller falling back on `false` always has a mounted pane to fall back to.
- * Operators keep that pane (`/sessions` refuses them) until the operator chat ships.
  */
 export function prefersSessionHandoff(isOperator: boolean | undefined): boolean {
-	return isGlobalAiEnabled() && !isOperator
+	return isGlobalAiEnabled() && sessionsAllowedFor(isOperator)
 }
 
 /** Clear the opt-out, then hard-reload so every gated site re-reads it. */
diff --git a/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts b/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
index feffda425e..dcb46ca148 100644
--- a/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
@@ -15,22 +15,17 @@ vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({ default:
 vi.mock('$lib/components/vscode', () => ({}))
 
 import { getSessionContextPromptSection, type SessionPromptContext } from './core'
-import { getPipelinePromptSection, type PipelineContext } from '../pipeline/core'
+import { getPipelinePromptSection } from '../pipeline/core'
 import { assembleGlobalSystemMessage, assembleGlobalTools } from './globalAssembly'
 
 const sessionContext: SessionPromptContext = { workspaceId: 'ws', parentWorkspaceId: 'parent' }
-const pipelineContext: PipelineContext = {
-	folder: 'myfolder',
-	mode: 'edit',
-	nodes: [],
-	assets: []
-}
+const pipelineFolders = ['myfolder']
 
 describe('assembleGlobalTools', () => {
 	it('includes the pipeline tools only when a pipeline editor is active', () => {
 		const names = (opts: Parameters<typeof assembleGlobalTools>[0]) =>
 			assembleGlobalTools(opts).map((t) => t.def.function.name)
-		expect(names({ pipelineContext })).toContain('get_pipeline_graph')
+		expect(names({ pipelineFolders })).toContain('get_pipeline_graph')
 		expect(names({})).not.toContain('get_pipeline_graph')
 	})
 })
@@ -41,13 +36,13 @@ describe('assembleGlobalSystemMessage', () => {
 	it('carries both optional sections when both contexts are given', () => {
 		const content = assembleGlobalSystemMessage(undefined, {
 			sessionContext,
-			pipelineContext
+			pipelineFolders
 		}).content as string
 		expect(content).toContain(getSessionContextPromptSection(sessionContext))
-		expect(content).toContain(getPipelinePromptSection(pipelineContext))
+		expect(content).toContain(getPipelinePromptSection(pipelineFolders))
 		// Order is part of the assembled output, so it is pinned too.
 		expect(content.indexOf(getSessionContextPromptSection(sessionContext))).toBeLessThan(
-			content.indexOf(getPipelinePromptSection(pipelineContext))
+			content.indexOf(getPipelinePromptSection(pipelineFolders))
 		)
 	})
 
@@ -58,6 +53,6 @@ describe('assembleGlobalSystemMessage', () => {
 		// shares, so a stray section built from any other context still trips them.
 		const heading = (s: string) => s.trim().split('\n')[0]
 		expect(content).not.toContain(heading(getSessionContextPromptSection(sessionContext)))
-		expect(content).not.toContain(heading(getPipelinePromptSection(pipelineContext)))
+		expect(content).not.toContain(heading(getPipelinePromptSection(pipelineFolders)))
 	})
 })
diff --git a/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts b/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
index a291e93ec7..d1fe80f13d 100644
--- a/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
+++ b/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
@@ -12,7 +12,7 @@ import {
 	type SessionPromptContext
 } from './core'
 import { createMcpTools } from './mcpTools'
-import { getPipelinePromptSection, pipelineTools, type PipelineContext } from '../pipeline/core'
+import { getPipelinePromptSection, pipelineTools } from '../pipeline/core'
 import { getFolderInstructionsPromptSection, type FolderInstruction } from '../folderInstructions'
 
 // Derived, not retyped: an option added to prepareGlobalSystemMessage is reachable
@@ -21,7 +21,8 @@ import { getFolderInstructionsPromptSection, type FolderInstruction } from '../f
 // directly — would get it.
 export type GlobalAssemblyOpts = NonNullable<Parameters<typeof prepareGlobalSystemMessage>[1]> & {
 	sessionContext?: SessionPromptContext
-	pipelineContext?: PipelineContext
+	/** Folders of the open pipeline editors; the pipeline tools and prompt come with any. */
+	pipelineFolders?: readonly string[]
 	folderInstructions?: readonly FolderInstruction[]
 }
 
@@ -34,8 +35,8 @@ export function assembleGlobalSystemMessage(
 	if (opts.sessionContext) {
 		systemMessage.content += getSessionContextPromptSection(opts.sessionContext, opts.access)
 	}
-	if (opts.pipelineContext) {
-		systemMessage.content += getPipelinePromptSection(opts.pipelineContext, opts.access)
+	if (opts.pipelineFolders?.length) {
+		systemMessage.content += getPipelinePromptSection(opts.pipelineFolders, opts.access)
 	}
 	return systemMessage
 }
@@ -43,7 +44,7 @@ export function assembleGlobalSystemMessage(
 export function assembleGlobalTools(opts: GlobalAssemblyOpts): SessionTool<any>[] {
 	return [
 		...globalToolsFor({ sessionPreview: opts.previewTools ?? false }),
-		...(opts.pipelineContext ? pipelineTools : []),
+		...(opts.pipelineFolders?.length ? pipelineTools : []),
 		...createMcpTools(opts.mcpServers ?? [])
 	]
 }
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts b/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts
index 82ad8162d3..2e28375cee 100644
--- a/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts
@@ -8,7 +8,7 @@ const { whoami, deployRules } = vi.hoisted(() => ({
 vi.mock('$lib/gen', () => ({ UserService: { whoami } }))
 vi.mock('$lib/utils_workspace_deploy', () => ({ checkDeployRules: deployRules }))
 
-import { resolveSessionAccess } from './sessionAccess'
+import { capabilitiesForRole, resolveSessionAccess } from './sessionAccess'
 import { clearWorkspaceRoleCache } from '$lib/user'
 
 type WhoamiOverrides = { is_admin?: boolean; is_super_admin?: boolean; operator?: boolean }
@@ -45,20 +45,30 @@ describe('resolveSessionAccess', () => {
 
 	it('gives a developer every capability but admin', async () => {
 		const caps = await capabilitiesFor({})
-		expect([...caps].sort()).toEqual(['deploy', 'manage_code', 'run_preview', 'write_draft'])
+		expect([...caps].sort()).toEqual([
+			'deploy',
+			'manage_code',
+			'manage_flows',
+			'manage_schedules',
+			'manage_triggers',
+			'run_flow_preview',
+			'run_preview',
+			'write_draft',
+			'write_flow_draft'
+		])
 	})
 
 	// The folder, resource and variable handlers run the rules but have no operator check,
 	// so withholding `deploy` from an operator would be stricter than the server.
 	it('leaves an operator the deploy-rule capability, and nothing their token refuses', async () => {
 		const caps = await capabilitiesFor({ operator: true })
-		expect([...caps]).toEqual(['deploy'])
+		expect([...caps].sort()).toEqual(['deploy', 'manage_schedules', 'manage_triggers'])
 	})
 
 	it('takes deploy from the rules alone, so a rule blocks an operator too', async () => {
 		deployRules.mockResolvedValue({ ok: false, refusedBy: 'DisableDirectDeployment' })
 		const caps = await capabilitiesFor({ operator: true })
-		expect([...caps]).toEqual([])
+		expect([...caps].sort()).toEqual(['manage_schedules', 'manage_triggers'])
 	})
 
 	// Both spellings of `authed.is_admin`, which the draft path honours and the handlers
@@ -67,7 +77,14 @@ describe('resolveSessionAccess', () => {
 		'lets an admin who is also an operator draft and deploy, but not preview or manage code (%o)',
 		async (role) => {
 			const caps = await capabilitiesFor({ ...role, operator: true })
-			expect([...caps].sort()).toEqual(['admin', 'deploy', 'write_draft'])
+			expect([...caps].sort()).toEqual([
+				'admin',
+				'deploy',
+				'manage_schedules',
+				'manage_triggers',
+				'write_draft',
+				'write_flow_draft'
+			])
 		}
 	)
 
@@ -82,6 +99,37 @@ describe('resolveSessionAccess', () => {
 		expect(caps.has('write_draft')).toBe(true)
 	})
 
+	// flows.rs, drafts.rs and run_preview_flow all let a builder through for flows, and
+	// nothing else moves: scripts, apps and their previews stay refused.
+	it("gives a builder operator the flow capabilities and nothing a script's handler refuses", () => {
+		const caps = capabilitiesForRole({
+			isAdmin: false,
+			operator: true,
+			deployRulesPass: true,
+			operatorSettings: { builder_flows: true }
+		})
+		expect([...caps].sort()).toEqual([
+			'deploy',
+			'manage_flows',
+			'manage_schedules',
+			'manage_triggers',
+			'run_flow_preview',
+			'write_flow_draft'
+		])
+	})
+
+	// A withdrawable right: only `false` withdraws it, as `gate_operator_writes` reads it.
+	it('withholds schedule and trigger writes only where the workspace set them to false', () => {
+		const caps = capabilitiesForRole({
+			isAdmin: false,
+			operator: true,
+			deployRulesPass: true,
+			operatorSettings: { manage_schedules: false }
+		})
+		expect(caps.has('manage_schedules')).toBe(false)
+		expect(caps.has('manage_triggers')).toBe(true)
+	})
+
 	it('grants everything when the role cannot be resolved', async () => {
 		whoami.mockRejectedValueOnce(new Error('network'))
 		const access = await resolveSessionAccess('ws')
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts b/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts
index 1ac13136a4..2f1e00c09b 100644
--- a/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts
+++ b/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts
@@ -1,12 +1,26 @@
+import { get } from 'svelte/store'
+import { userWorkspaces } from '$lib/stores'
+import type { OperatorSettings } from '$lib/gen'
 import { getWorkspaceRole } from '$lib/user'
+import { roleCanAuthor, roleCanDraft } from '$lib/editRights'
 import { checkDeployRules } from '$lib/utils_workspace_deploy'
 import type { SessionAccess, SessionCapability } from '../sessionCapabilities'
 
+type OperatorRights = Pick<
+	NonNullable<OperatorSettings>,
+	'builder_flows' | 'manage_schedules' | 'manage_triggers'
+>
+
 const ALL_CAPABILITIES: SessionCapability[] = [
 	'write_draft',
+	'write_flow_draft',
 	'run_preview',
+	'run_flow_preview',
 	'deploy',
 	'manage_code',
+	'manage_flows',
+	'manage_schedules',
+	'manage_triggers',
 	'admin'
 ]
 
@@ -25,19 +39,35 @@ export function capabilitiesForRole(role: {
 	isAdmin: boolean
 	operator: boolean
 	deployRulesPass: boolean
+	/** The workspace's `operator_settings`, null for a non-operator. */
+	operatorSettings?: OperatorRights | null
 }): SessionAccess {
 	const capabilities = new Set<SessionCapability>()
-	// Per-capability precedence, NOT a role ladder: drafts.rs `require_can_write_path`
-	// returns Ok on `authed.is_admin` BEFORE its operator branch, while jobs.rs
-	// `run_preview_*` and the script/flow/app handlers refuse `authed.is_operator` with no
-	// admin escape — and on the session path that flag is never cleared for an admin.
-	if (role.isAdmin || !role.operator) {
+	const user = { operator: role.operator, is_admin: role.isAdmin, is_super_admin: false }
+	const authorsCode = roleCanAuthor('script', user, role.operatorSettings)
+	const authorsFlows = roleCanAuthor('flow', user, role.operatorSettings)
+	// Drafts take the admin precedence `roleCanDraft` encodes; previews and the item handlers
+	// do not — and on the session path the operator flag is never cleared for an admin.
+	if (roleCanDraft('script', user, role.operatorSettings)) {
 		capabilities.add('write_draft')
 	}
-	if (!role.operator) {
+	if (roleCanDraft('flow', user, role.operatorSettings)) {
+		capabilities.add('write_flow_draft')
+	}
+	if (authorsCode) {
 		capabilities.add('run_preview')
 		capabilities.add('manage_code')
 	}
+	if (authorsFlows) {
+		capabilities.add('run_flow_preview')
+		capabilities.add('manage_flows')
+	}
+	if (roleCanAuthor('schedule', user, role.operatorSettings)) {
+		capabilities.add('manage_schedules')
+	}
+	if (roleCanAuthor('trigger', user, role.operatorSettings)) {
+		capabilities.add('manage_triggers')
+	}
 	// No operator term: the rules are their own gate, and the handlers that also refuse
 	// operators say so through `manage_code`. Admins bypass the rules inside the check.
 	if (role.deployRulesPass) {
@@ -63,6 +93,7 @@ export async function resolveSessionAccess(workspace: string): Promise<SessionAc
 	return capabilitiesForRole({
 		isAdmin: !!me.is_admin || !!me.is_super_admin,
 		operator: !!me.operator,
-		deployRulesPass: (await checkDeployRules(workspace, me)).ok
+		deployRulesPass: (await checkDeployRules(workspace, me)).ok,
+		operatorSettings: get(userWorkspaces).find((w) => w.id === workspace)?.operator_settings
 	})
 }
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
index 42136112c4..0c0b8d8a7d 100644
--- a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
@@ -32,7 +32,7 @@ import type { SessionAccess, SessionCapability, SessionTool } from '../sessionCa
 
 const ASSEMBLY_OPTS = {
 	previewTools: true,
-	pipelineContext: { folder: 'my_pipeline', mode: 'edit', nodes: [], assets: [] },
+	pipelineFolders: ['my_pipeline'],
 	mcpServers: [{ path: 'f/test/server' } as any]
 }
 
@@ -75,10 +75,22 @@ const REACHABLE_PROFILES = [
 		[false, true].flatMap((isAdmin) =>
 			[false, true].flatMap((operator) =>
 				// `checkDeployRules` bypasses on admin, so an admin has only the one outcome.
-				(isAdmin ? [true] : [false, true]).map((deployRulesPass) => {
-					const access = capabilitiesForRole({ isAdmin, operator, deployRulesPass })
-					return [[...access].sort().join(',') || 'none', access] as const
-				})
+				(isAdmin ? [true] : [false, true]).flatMap((deployRulesPass) =>
+					// The operator rights a workspace can set: none, the builder right, both locks.
+					[
+						undefined,
+						{ builder_flows: true },
+						{ manage_schedules: false, manage_triggers: false }
+					].map((operatorSettings) => {
+						const access = capabilitiesForRole({
+							isAdmin,
+							operator,
+							deployRulesPass,
+							operatorSettings
+						})
+						return [[...access].sort().join(',') || 'none', access] as const
+					})
+				)
 			)
 		)
 	).entries()
@@ -122,13 +134,24 @@ describe('session tool policies', () => {
 		const kindsOf = (name: string, access: SessionAccess) =>
 			(shipped(name, access).def.function.parameters as any).properties.type.enum
 
+		const developerCaps: SessionCapability[] = [
+			'write_draft',
+			'write_flow_draft',
+			'run_preview',
+			'run_flow_preview',
+			'manage_code',
+			'manage_flows',
+			'manage_schedules',
+			'manage_triggers'
+		]
+
 		// A developer a protection rule refuses keeps the two kinds no rule reaches.
-		const refused = accessWith(['write_draft', 'run_preview', 'manage_code'])
+		const refused = accessWith(developerCaps)
 		expect(kindsOf('deploy_workspace_item', refused)).toEqual(['schedule', 'trigger'])
 		expect(kindsOf('delete_workspace_item', refused)).toEqual(['schedule', 'trigger'])
 
 		// An operator where no rule applies: only the code handlers refuse them.
-		const operator = accessWith(['deploy'])
+		const operator = accessWith(['deploy', 'manage_schedules', 'manage_triggers'])
 		expect(kindsOf('deploy_workspace_item', operator)).toEqual([
 			'schedule',
 			'trigger',
@@ -136,8 +159,17 @@ describe('session tool policies', () => {
 			'variable'
 		])
 
+		// A workspace that withdrew schedule writes from operators: `gate_operator_writes`.
+		const locked = accessWith(['deploy', 'manage_triggers'])
+		expect(kindsOf('delete_workspace_item', locked)).toEqual(['trigger', 'resource', 'variable'])
+
+		// A builder operator deploys flows too, and still no script or app.
+		const builder = accessWith(['deploy', 'manage_flows', 'manage_schedules', 'manage_triggers'])
+		expect(kindsOf('deploy_workspace_item', builder)).toContain('flow')
+		expect(kindsOf('deploy_workspace_item', builder)).not.toContain('script')
+
 		// Deleting a script is admin-only, where deploying one is not.
-		const developer = accessWith(['write_draft', 'run_preview', 'manage_code', 'deploy'])
+		const developer = accessWith([...developerCaps, 'deploy'])
 		expect(kindsOf('deploy_workspace_item', developer)).toContain('script')
 		expect(kindsOf('delete_workspace_item', developer)).not.toContain('script')
 
@@ -168,7 +200,7 @@ describe('session tool policies', () => {
 						user: { username: 'alex', folders: ['shared'], folders_read: ['shared'] },
 						access,
 						sessionContext: ctx,
-						pipelineContext: { folder: 'my_pipeline', mode: 'edit', nodes: [], assets: [] }
+						pipelineFolders: ['my_pipeline']
 					})
 					// Both decoration variants: the escalation one adds its own tool mentions.
 					for (const blocks of [0, 9]) {
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index ebaa5b1c38..13143f6bce 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -18,6 +18,7 @@ import { applyReasoningToConfig } from '../reasoningRegistry'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	type LiveToolSet,
 	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks,
@@ -328,6 +329,7 @@ export async function* getOpenAIResponsesCompletionStream(
 		forceModelProvider?: AIProviderModel
 		openaiClient?: OpenAI
 		reasoningEffort?: string
+		maxTokensCap?: number
 	}
 ): AsyncGenerator<OpenAI.Chat.Completions.ChatCompletionChunk> {
 	const { provider, config } = getProviderAndCompletionConfig({
@@ -335,6 +337,7 @@ export async function* getOpenAIResponsesCompletionStream(
 		stream: true,
 		tools,
 		forceModelProvider: options?.forceModelProvider,
+		maxTokensCap: options?.maxTokensCap,
 		reasoningEffort: options?.reasoningEffort
 	})
 	const { instructions, input } = convertMessagesToResponsesInput(messages)
@@ -383,6 +386,20 @@ export async function* getOpenAIResponsesCompletionStream(
 					}
 				]
 			} as OpenAI.Chat.Completions.ChatCompletionChunk
+		} else if (event.type === 'response.completed' || event.type === 'response.incomplete') {
+			yield {
+				id: 'chatcmpl-' + Date.now(),
+				object: 'chat.completion.chunk',
+				created: Date.now(),
+				model: responsesConfig.model,
+				choices: [
+					{
+						index: 0,
+						delta: {},
+						finish_reason: event.type === 'response.completed' ? 'stop' : 'length'
+					}
+				]
+			} as OpenAI.Chat.Completions.ChatCompletionChunk
 		}
 	}
 }
@@ -397,7 +414,11 @@ export async function parseOpenAIResponsesCompletion(
 	addedMessages: ChatCompletionMessageParam[],
 	tools: Tool<any>[],
 	helpers: any,
-	options?: { workspace?: string; onTokenUsage?: (usage: ChatTokenUsage) => void }
+	options?: {
+		workspace?: string
+		onTokenUsage?: (usage: ChatTokenUsage) => void
+		live?: LiveToolSet
+	}
 ): Promise<ParsedCompletionResult> {
 	let toolCallsToProcess: ChatCompletionMessageFunctionToolCall[] = []
 	let error: OpenAIError | ResponseErrorEvent | null = null
@@ -604,7 +625,8 @@ export async function parseOpenAIResponsesCompletion(
 				helpers,
 				toolCallbacks: callbacks,
 				workspace: options?.workspace,
-				messages
+				messages,
+				live: options?.live
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
index c0d9b7ac8b..6c4539ef85 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.test.ts
@@ -39,7 +39,7 @@ const sampleContext: PipelineContext = {
 }
 
 function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
-	helpers: { pipeline: PipelineAIChatHelpers }
+	helpers: { pipelines: () => PipelineAIChatHelpers[] }
 	calls: Record<string, any[]>
 } {
 	const calls: Record<string, any[]> = {}
@@ -50,6 +50,8 @@ function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
 			return ret
 		}
 	const pipeline: PipelineAIChatHelpers = {
+		getFolder: () => sampleContext.folder,
+		hasDrafts: () => false,
 		getPipelineContext: () => sampleContext,
 		getNodeBody: async (path: string) => {
 			calls.getNodeBody = [...(calls.getNodeBody ?? []), [path]]
@@ -59,15 +61,20 @@ function makeHelpers(overrides: Partial<PipelineAIChatHelpers> = {}): {
 			calls.proposeNode = [...(calls.proposeNode ?? []), [input]]
 			return { path: input.path, detectedReads: [], detectedWrites: [] }
 		},
-		editNode: async (path, content) => {
-			calls.editNode = [...(calls.editNode ?? []), [path, content]]
-			return { detectedReads: [], detectedWrites: [] }
+		editNode: async (path, content, summary) => {
+			calls.editNode = [...(calls.editNode ?? []), [path, content, summary]]
+			return { summary: summary ?? 'Existing summary', detectedReads: [], detectedWrites: [] }
 		},
 		removeProposedNode: record('removeProposedNode'),
+		unconfiguredTriggers: async () => [],
+		setNodeTrigger: async (path, kind, config) => {
+			calls.setNodeTrigger = [...(calls.setNodeTrigger ?? []), [path, kind, config]]
+			return { path: `${path}_${kind}`, replaced: false }
+		},
 		testNode: async () => 'job-123',
 		...overrides
 	}
-	return { helpers: { pipeline }, calls }
+	return { helpers: { pipelines: () => [pipeline] }, calls }
 }
 
 describe('pipeline tools', () => {
@@ -78,6 +85,7 @@ describe('pipeline tools', () => {
 			'get_pipeline_graph',
 			'read_pipeline_node',
 			'remove_pipeline_node',
+			'set_pipeline_trigger',
 			'test_pipeline_node'
 		])
 	})
@@ -96,18 +104,25 @@ describe('pipeline tools', () => {
 
 	it('build_pipeline_node forwards to proposeNode and does not deploy', async () => {
 		const { helpers, calls } = makeHelpers()
+		const modified: string[] = []
 		const out = await toolByName('build_pipeline_node').fn({
 			args: {
 				path: 'f/analytics/clean',
 				language: 'bun',
+				summary: 'Test node',
 				content: '// pipeline\nexport async function main() {}',
 				output_kind: 'ducklake'
 			},
 			workspace: 'w',
 			helpers,
-			toolCallbacks: noopCallbacks(),
+			toolCallbacks: {
+				...noopCallbacks(),
+				onItemModified: (kind, path) => modified.push(`${kind}:${path}`)
+			},
 			toolId: 't'
 		})
+		// The session tracks the folder's draft bundle, the unit it deploys.
+		expect(modified).toEqual(['data_pipeline:f/analytics/data_pipeline'])
 		expect(calls.proposeNode?.[0]?.[0]).toMatchObject({
 			path: 'f/analytics/clean',
 			language: 'bun',
@@ -116,6 +131,99 @@ describe('pipeline tools', () => {
 		expect(out).toContain('not deployed')
 	})
 
+	it('build_pipeline_node attaches declared triggers, and flags one left unset', async () => {
+		const { helpers, calls } = makeHelpers({ unconfiguredTriggers: async () => ['kafka'] })
+		const out = await toolByName('build_pipeline_node').fn({
+			args: {
+				path: 'f/analytics/ingest',
+				language: 'python3',
+				summary: 'Test node',
+				content: '# pipeline\n# on schedule\n# on kafka\ndef main():\n    return 1',
+				triggers: [{ kind: 'schedule', config: { schedule: '0 0 6 * * *', timezone: 'UTC' } }]
+			},
+			workspace: 'w',
+			helpers,
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(calls.setNodeTrigger?.[0]).toEqual([
+			'f/analytics/ingest',
+			'schedule',
+			{ args: {}, enabled: true, schedule: '0 0 6 * * *', timezone: 'UTC' }
+		])
+		expect(out).toContain("schedule 'f/analytics/ingest_schedule'")
+		expect(out).toContain('ACTION REQUIRED')
+		expect(out).toContain('set_pipeline_trigger')
+	})
+
+	it('build_pipeline_node rejects an invalid trigger config before staging the node', async () => {
+		const { helpers, calls } = makeHelpers()
+		await expect(
+			toolByName('build_pipeline_node').fn({
+				args: {
+					path: 'f/analytics/ingest',
+					language: 'python3',
+					summary: 'Test node',
+					content: '# pipeline\n# on schedule\ndef main():\n    return 1',
+					triggers: [{ kind: 'schedule', config: { timezone: 'UTC' } }]
+				},
+				workspace: 'w',
+				helpers,
+				toolCallbacks: noopCallbacks(),
+				toolId: 't'
+			})
+		).rejects.toThrow(/schedule/)
+		expect(calls.proposeNode).toBeUndefined()
+	})
+
+	it('build_pipeline_node keeps and records the node when a trigger fails to attach', async () => {
+		const { helpers, calls } = makeHelpers({
+			setNodeTrigger: async () => {
+				throw new Error('path taken')
+			}
+		})
+		const modified: string[] = []
+		const out = await toolByName('build_pipeline_node').fn({
+			args: {
+				path: 'f/analytics/ingest',
+				language: 'python3',
+				content: '# pipeline\n# on schedule\ndef main():\n    return 1',
+				summary: 'Ingest',
+				triggers: [{ kind: 'schedule', config: { schedule: '0 0 6 * * *', timezone: 'UTC' } }]
+			},
+			workspace: 'w',
+			helpers,
+			toolCallbacks: {
+				...noopCallbacks(),
+				onItemModified: (kind, path) => modified.push(`${kind}:${path}`)
+			},
+			toolId: 't'
+		})
+		expect(calls.proposeNode).toHaveLength(1)
+		expect(modified).toEqual(['data_pipeline:f/analytics/data_pipeline'])
+		expect(out).toContain('path taken')
+	})
+
+	it('build_pipeline_node refuses a trigger the content does not declare, before staging', async () => {
+		const { helpers, calls } = makeHelpers()
+		await expect(
+			toolByName('build_pipeline_node').fn({
+				args: {
+					path: 'f/analytics/ingest',
+					language: 'python3',
+					content: '# pipeline\ndef main():\n    return 1',
+					summary: 'Ingest',
+					triggers: [{ kind: 'schedule', config: { schedule: '0 0 6 * * *', timezone: 'UTC' } }]
+				},
+				workspace: 'w',
+				helpers,
+				toolCallbacks: noopCallbacks(),
+				toolId: 't'
+			})
+		).rejects.toThrow(/on schedule/)
+		expect(calls.proposeNode).toBeUndefined()
+	})
+
 	it('build_pipeline_node reports the inferred asset lineage', async () => {
 		const { helpers } = makeHelpers({
 			proposeNode: async (input) => ({
@@ -125,7 +233,12 @@ describe('pipeline tools', () => {
 			})
 		})
 		const out = await toolByName('build_pipeline_node').fn({
-			args: { path: 'f/analytics/clean', language: 'duckdb', content: '-- pipeline' },
+			args: {
+				path: 'f/analytics/clean',
+				language: 'duckdb',
+				content: '-- pipeline',
+				summary: 'Test node'
+			},
 			workspace: 'w',
 			helpers,
 			toolCallbacks: noopCallbacks(),
@@ -140,7 +253,12 @@ describe('pipeline tools', () => {
 			proposeNode: async (input) => ({ path: input.path, detectedReads: [], detectedWrites: [] })
 		})
 		const out = await toolByName('build_pipeline_node').fn({
-			args: { path: 'f/analytics/clean', language: 'duckdb', content: '-- pipeline' },
+			args: {
+				path: 'f/analytics/clean',
+				language: 'duckdb',
+				content: '-- pipeline',
+				summary: 'Test node'
+			},
 			workspace: 'w',
 			helpers,
 			toolCallbacks: noopCallbacks(),
@@ -164,6 +282,34 @@ describe('pipeline tools', () => {
 		expect(calls.editNode?.[0]?.[1]).toContain('const x = 42')
 	})
 
+	it('edit_pipeline_node renames a node by summary alone, and asks for one when missing', async () => {
+		const body = { language: 'bun' as const, content: 'const x = 1\n' }
+		const { helpers, calls } = makeHelpers({ getNodeBody: async () => body })
+		const run = (args: Record<string, unknown>) =>
+			toolByName('edit_pipeline_node').fn({
+				args: { path: 'f/analytics/orders', ...args },
+				workspace: 'w',
+				helpers,
+				toolCallbacks: noopCallbacks(),
+				toolId: 't'
+			})
+		await run({ summary: 'Clean orders' })
+		expect(calls.editNode?.[0]).toEqual(['f/analytics/orders', body.content, 'Clean orders'])
+
+		const bare = makeHelpers({
+			getNodeBody: async () => body,
+			editNode: async () => ({ summary: '', detectedReads: [], detectedWrites: [] })
+		})
+		const out = await toolByName('edit_pipeline_node').fn({
+			args: { path: 'f/analytics/orders', old_string: 'x = 1', new_string: 'x = 2' },
+			workspace: 'w',
+			helpers: bare.helpers,
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(out).toContain('has no summary')
+	})
+
 	it('edit_pipeline_node surfaces a clear error when old_string is absent', async () => {
 		const { helpers } = makeHelpers({
 			getNodeBody: async () => ({ language: 'bun', content: 'const x = 1\n' })
@@ -182,7 +328,7 @@ describe('pipeline tools', () => {
 	it('mutation tools fail clearly when no pipeline editor is registered', async () => {
 		await expect(
 			toolByName('build_pipeline_node').fn({
-				args: { path: 'f/a/b', language: 'bun', content: 'x' },
+				args: { path: 'f/a/b', language: 'bun', content: 'x', summary: 'Test node' },
 				workspace: 'w',
 				helpers: {},
 				toolCallbacks: noopCallbacks(),
@@ -191,14 +337,114 @@ describe('pipeline tools', () => {
 		).rejects.toThrow(/No pipeline editor is open/)
 	})
 
+	it('remove_pipeline_node drops the pipeline from the changes once its last draft goes', async () => {
+		const run = async (hasDrafts: boolean) => {
+			const { helpers } = makeHelpers({ hasDrafts: () => hasDrafts })
+			const log: string[] = []
+			await toolByName('remove_pipeline_node').fn({
+				args: { path: 'f/analytics/clean' },
+				workspace: 'w',
+				helpers,
+				toolCallbacks: {
+					...noopCallbacks(),
+					onItemModified: (kind, path) => log.push(`modified ${kind}:${path}`),
+					onItemDiscarded: (kind, path) => log.push(`discarded ${kind}:${path}`)
+				},
+				toolId: 't'
+			})
+			return log
+		}
+		expect(await run(false)).toEqual(['discarded data_pipeline:f/analytics/data_pipeline'])
+		expect(await run(true)).toEqual(['modified data_pipeline:f/analytics/data_pipeline'])
+	})
+
 	it('test_pipeline_node requires confirmation', () => {
 		expect(toolByName('test_pipeline_node').requiresConfirmation).toBe(true)
 	})
 })
 
+describe('pipeline tools with several editors open', () => {
+	function editorFor(folder: string, built: string[]): PipelineAIChatHelpers {
+		return {
+			...makeHelpers().helpers.pipelines()[0],
+			getFolder: () => folder,
+			getPipelineContext: () => ({ ...sampleContext, folder }),
+			proposeNode: async (input) => {
+				built.push(`${folder}:${input.path}`)
+				return { path: input.path, detectedReads: [], detectedWrites: [] }
+			}
+		}
+	}
+	const call = (name: string, args: any, editors: PipelineAIChatHelpers[]) =>
+		toolByName(name).fn({
+			args,
+			workspace: 'w',
+			helpers: { pipelines: () => editors },
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+
+	it('remounts an opened folder whose editor another tab replaced', async () => {
+		const built: string[] = []
+		const mounted: PipelineAIChatHelpers[] = []
+		const ensured: string[] = []
+		await toolByName('build_pipeline_node').fn({
+			args: {
+				path: 'f/sales/clean',
+				language: 'bun',
+				content: '// pipeline',
+				summary: 'Test node'
+			},
+			workspace: 'w',
+			helpers: {
+				pipelines: () => mounted,
+				pipelineFolders: () => ['sales'],
+				ensurePipeline: async (folder: string) => {
+					ensured.push(folder)
+					mounted.push(editorFor(folder, built))
+					return mounted[0]
+				}
+			},
+			toolCallbacks: noopCallbacks(),
+			toolId: 't'
+		})
+		expect(ensured).toEqual(['sales'])
+		expect(built).toEqual(['sales:f/sales/clean'])
+	})
+
+	it('routes a node to the editor of its folder', async () => {
+		const built: string[] = []
+		const editors = [editorFor('crm', built), editorFor('sales', built)]
+		await call(
+			'build_pipeline_node',
+			{ path: 'f/sales/clean', language: 'bun', content: '// pipeline', summary: 'Test node' },
+			editors
+		)
+		expect(built).toEqual(['sales:f/sales/clean'])
+		await expect(
+			call(
+				'build_pipeline_node',
+				{ path: 'f/other/clean', language: 'bun', content: '// pipeline', summary: 'Test node' },
+				editors
+			)
+		).rejects.toThrow(/open_preview\(kind="pipeline", path="other"\)/)
+	})
+
+	it('get_pipeline_graph needs the folder only when it is ambiguous', async () => {
+		const editors = [editorFor('crm', []), editorFor('sales', [])]
+		await expect(call('get_pipeline_graph', {}, editors)).rejects.toThrow(/pass the folder/)
+		expect(
+			JSON.parse(await call('get_pipeline_graph', { folder: 'f/sales' }, editors))
+		).toMatchObject({ folder: 'sales' })
+		expect(JSON.parse(await call('get_pipeline_graph', {}, [editors[0]]))).toMatchObject({
+			folder: 'crm'
+		})
+	})
+})
+
 describe('getPipelinePromptSection', () => {
 	it('names the active folder and the direct-draft workflow', () => {
-		const section = getPipelinePromptSection(sampleContext)
+		const section = getPipelinePromptSection([sampleContext.folder])
 		expect(section).toContain('/pipeline/analytics')
 		expect(section).toContain('build_pipeline_node')
 		expect(section).toContain('directly as unsaved drafts')
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index a1a8f1ad6b..8d71b00279 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -1,7 +1,8 @@
 import { z } from 'zod'
 import { $ScriptLang } from '$lib/gen/schemas.gen'
 import type { ScriptLang } from '$lib/gen'
-import { createToolDef, executeTestRun, findAndReplace } from '../shared'
+import { createToolDef, executeTestRun, findAndReplace, type ToolCallbacks } from '../shared'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 import {
 	NONE,
 	RUN_PREVIEW,
@@ -10,6 +11,11 @@ import {
 	type SessionTool
 } from '../sessionCapabilities'
 import type { PipelineOutputKind } from '$lib/components/assets/AssetGraph/pipelineTemplates'
+import type { PipelineTriggerDraftKind } from '$lib/components/assets/AssetGraph/types'
+import { DRAFTABLE_TRIGGER_KINDS } from '$lib/components/assets/AssetGraph/pipelineTriggerDrafts'
+import { scheduleRequestSchema, triggerRequestSchemas } from '../workspaceToolsZod.gen'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
+import { parsePipelineAnnotations } from '$lib/components/assets/AssetGraph/parsePipelineAnnotations'
 
 // ============================================================================
 // Pipeline AI chat tools.
@@ -57,6 +63,10 @@ export type PipelineContext = {
  * small — the page owns the draft Map and canvas rendering.
  */
 export interface PipelineAIChatHelpers {
+	/** Folder name (no `f/` prefix) of the pipeline this editor shows. */
+	getFolder: () => string
+	/** Whether the folder has any script or trigger draft left. */
+	hasDrafts: () => boolean
 	getPipelineContext: () => PipelineContext
 	/** Read a node's source (the in-flight draft body if one exists, else deployed). */
 	getNodeBody: (path: string) => Promise<{ language: ScriptLang; content: string } | undefined>
@@ -68,29 +78,108 @@ export interface PipelineAIChatHelpers {
 		language: ScriptLang
 		content: string
 		outputKind?: PipelineOutputKind
+		summary?: string
 	}) => Promise<{ path: string; detectedReads: string[]; detectedWrites: string[] }>
 	/** Replace an existing node's body, applied as an unsaved draft. Returns the
 	 * re-inferred asset lineage (URIs) so the caller sees the effect of the edit. */
 	editNode: (
 		path: string,
-		content: string
-	) => Promise<{ detectedReads: string[]; detectedWrites: string[] }>
+		content: string,
+		summary?: string
+	) => Promise<{ summary: string; detectedReads: string[]; detectedWrites: string[] }>
 	/** Discard the unsaved draft at a path (undo a build_pipeline_node). */
 	removeProposedNode: (path: string) => Promise<void>
+	/** Trigger kinds the node declares (`on <kind>`) that no trigger row or draft fills. */
+	unconfiguredTriggers: (path: string) => Promise<PipelineTriggerDraftKind[]>
+	/** Attach (or replace) the node's trigger draft of that kind, deployed with the
+	 * pipeline. `config` is the kind's trigger config; path/script_path are filled in. */
+	setNodeTrigger: (
+		path: string,
+		kind: PipelineTriggerDraftKind,
+		config: Record<string, any>
+	) => Promise<{ path: string; replaced: boolean }>
 	/** Preview-run a node (draft body preferred). Returns the started job id. */
 	testNode: (path: string, args?: Record<string, any>) => Promise<string | undefined>
 }
 
-/** Helper bag the pipeline tools receive from the manager in global mode. */
-export type PipelineToolHelpers = { pipeline?: PipelineAIChatHelpers }
+/** Helper bag the pipeline tools receive from the manager in global mode: every
+ * pipeline editor currently open, one per folder. */
+export type PipelineToolHelpers = {
+	pipelines?: () => readonly PipelineAIChatHelpers[]
+	/** Folders the chat may work on, including ones whose editor is not mounted now. */
+	pipelineFolders?: () => readonly string[]
+	/** Remounts the folder's editor (a session reopens its preview tab) and resolves
+	 * to it, or `undefined` when it cannot be brought back. */
+	ensurePipeline?: (folder: string) => Promise<PipelineAIChatHelpers | undefined>
+}
 
-function requirePipeline(helpers: PipelineToolHelpers): PipelineAIChatHelpers {
-	if (!helpers?.pipeline) {
+/** The folder's editor, remounted when the chat opened it before and something else
+ * has taken its tab since. */
+async function remount(
+	helpers: PipelineToolHelpers,
+	folder: string | undefined
+): Promise<PipelineAIChatHelpers | undefined> {
+	if (!folder || !helpers?.ensurePipeline) return undefined
+	if (!(helpers.pipelineFolders?.() ?? []).includes(folder)) return undefined
+	return helpers.ensurePipeline(folder)
+}
+
+function openPipelines(helpers: PipelineToolHelpers): readonly PipelineAIChatHelpers[] {
+	const open = helpers?.pipelines?.() ?? []
+	if (open.length === 0) {
 		throw new Error(
 			'No pipeline editor is open. Pipeline tools only work on a /pipeline/<folder> page in edit mode.'
 		)
 	}
-	return helpers.pipeline
+	return open
+}
+
+function notOpenError(folder: string, open: readonly PipelineAIChatHelpers[]): Error {
+	const names = open.map((p) => `'${p.getFolder()}'`).join(', ')
+	return new Error(
+		`No pipeline editor is open for folder '${folder}' (open: ${names}). Open it with open_preview(kind="pipeline", path="${folder}") first.`
+	)
+}
+
+/** The editor of the pipeline a node path belongs to (`f/<folder>/<node>`). With a
+ * single editor open, a path outside it still goes to that editor, whose own check
+ * names the corrected path. */
+async function pipelineForPath(
+	helpers: PipelineToolHelpers,
+	path: string
+): Promise<PipelineAIChatHelpers> {
+	const folder = path.match(/^f\/([^/]+)\//)?.[1]
+	const live = folder ? helpers?.pipelines?.().find((p) => p.getFolder() === folder) : undefined
+	const match = live ?? (await remount(helpers, folder))
+	if (match) return match
+	const open = openPipelines(helpers)
+	if (open.length === 1) return open[0]
+	throw folder
+		? notOpenError(folder, open)
+		: new Error(
+				`'${path}' is not a pipeline node path — nodes live at f/<folder>/<node_name>, with <folder> one of: ${open.map((p) => `'${p.getFolder()}'`).join(', ')}.`
+			)
+}
+
+async function pipelineForFolder(
+	helpers: PipelineToolHelpers,
+	folder: string | undefined
+): Promise<PipelineAIChatHelpers> {
+	const known = helpers?.pipelineFolders?.() ?? []
+	const name = folder ? normalizePipelineFolder(folder) : known.length === 1 ? known[0] : undefined
+	const live = name ? helpers?.pipelines?.().find((p) => p.getFolder() === name) : undefined
+	const remounted = live ?? (await remount(helpers, name))
+	if (remounted) return remounted
+	const open = openPipelines(helpers)
+	if (folder) {
+		const match = open.find((p) => p.getFolder() === name)
+		if (!match) throw notOpenError(normalizePipelineFolder(folder), open)
+		return match
+	}
+	if (open.length === 1) return open[0]
+	throw new Error(
+		`Several pipeline editors are open (${open.map((p) => `'${p.getFolder()}'`).join(', ')}) — pass the folder to read.`
+	)
 }
 
 const scriptLangSchema = z.enum($ScriptLang.enum)
@@ -105,12 +194,20 @@ const outputKindSchema = z
 // Read tools
 // ----------------------------------------------------------------------------
 
-const getPipelineGraphSchema = z.object({})
+const getPipelineGraphSchema = z.object({
+	folder: z
+		.string()
+		.optional()
+		.describe(
+			'Folder of the pipeline to read (e.g. `analytics`). Required when several pipeline editors are open; may be omitted when only one is.'
+		)
+})
 
 const getPipelineGraphToolDef = createToolDef(
 	getPipelineGraphSchema,
 	'get_pipeline_graph',
-	"Read the live pipeline graph for the open /pipeline/<folder> editor: its nodes (scripts), each node's language, asset reads/writes, declared triggers, and whether it has an unsaved draft edit. Call this before building or editing nodes so you reuse existing assets/paths and understand the current DAG."
+	"Read the live pipeline graph of an open /pipeline/<folder> editor: its nodes (scripts), each node's language, asset reads/writes, declared triggers, and whether it has an unsaved draft edit. Call this before building or editing nodes so you reuse existing assets/paths and understand the current DAG.",
+	{ strict: false }
 )
 
 const readPipelineNodeSchema = z.object({
@@ -127,11 +224,75 @@ const readPipelineNodeToolDef = createToolDef(
 // Mutation tools (apply directly as unsaved drafts; never deploy)
 // ----------------------------------------------------------------------------
 
+const triggerKindEnum = z.enum(DRAFTABLE_TRIGGER_KINDS as [PipelineTriggerDraftKind, ...PipelineTriggerDraftKind[]])
+
+const nodeTriggerSchema = z.object({
+	kind: triggerKindEnum.describe('Trigger kind; the node must declare `on <kind>`.'),
+	config: z
+		.record(z.string(), z.any())
+		.describe(
+			'The trigger configuration. schedule: { schedule (6-field cron, e.g. "0 0 6 * * *"), timezone (IANA, e.g. "UTC"), args? (the node\'s inputs), summary? }. Any other kind: the fields get_trigger_schema returns for it. path, script_path and is_flow are filled in; pass path only to name the trigger yourself.'
+		)
+})
+
+const setPipelineTriggerSchema = nodeTriggerSchema.extend({
+	path: z.string().describe('Workspace path of the node the trigger runs.')
+})
+
+const setPipelineTriggerToolDef = createToolDef(
+	setPipelineTriggerSchema,
+	'set_pipeline_trigger',
+	'Attach the trigger a node declares with `on <schedule|email|kafka|mqtt|amqp|nats|postgres|sqs|gcp>` (its cron, topic, queue…) as an unsaved trigger draft, deployed together with the pipeline. Calling it again for the same node and kind replaces that draft. Webhook and data_upload need no trigger.',
+	{ strict: false }
+)
+
+/** Validates a node trigger's config against the kind's request schema, with the
+ * fields the pipeline fills in present so they are not reported missing. */
+function validateTriggerConfig(
+	kind: PipelineTriggerDraftKind,
+	config: Record<string, any>,
+	nodePath: string
+): Record<string, any> {
+	const filled = { path: `${nodePath}_${kind}`, script_path: nodePath, is_flow: false, ...config }
+	if (kind === 'schedule') {
+		const parsed = scheduleRequestSchema.safeParse({ args: {}, enabled: true, ...filled })
+		if (!parsed.success) {
+			throw new Error(
+				`Invalid schedule config: ${parsed.error.issues.map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`).join('; ')}`
+			)
+		}
+		return { args: {}, enabled: true, ...config }
+	}
+	const parsed = triggerRequestSchemas[kind].safeParse(filled)
+	if (!parsed.success) {
+		throw new Error(
+			`Invalid config for a "${kind}" trigger. Call get_trigger_schema with kind "${kind}" for its exact fields. Issues: ${parsed.error.issues.map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`).join('; ')}`
+		)
+	}
+	return config
+}
+
+/** The note every node write ends with while a declared trigger is still unset: the
+ * node would deploy with nothing to start it. */
+function unconfiguredTriggersNote(path: string, kinds: readonly string[]): string {
+	if (kinds.length === 0) return ''
+	return ` ACTION REQUIRED: '${path}' declares \`on ${kinds.join('`, `on ')}\` but has no ${kinds.join('/')} trigger yet, so nothing would start it once deployed. Call set_pipeline_trigger for it now (a schedule needs its cron and timezone; ask the user only if the cadence cannot be inferred).`
+}
+
+const summaryField = z
+	.string()
+	.trim()
+	.min(1)
+	.max(80)
+	.describe(
+		'Succinct summary of what the node does, a few words in sentence case with no trailing period (e.g. "Ingest Stripe charges", "Daily revenue by region"). It is the title the node shows in the workspace.'
+	)
+
 const buildPipelineNodeSchema = z.object({
 	path: z
 		.string()
 		.describe(
-			"Workspace path for the new node, e.g. f/<folder>/<name>. Use the open pipeline's folder. Must not collide with an existing node."
+			'Workspace path for the new node, e.g. f/<folder>/<name>, in the folder of an open pipeline editor. Must not collide with an existing node.'
 		),
 	language: scriptLangSchema.describe(
 		'Script language. SQL-shaped data work uses duckdb (DuckLake/S3) or postgresql (data tables); bun/python3 for general transforms.'
@@ -141,7 +302,14 @@ const buildPipelineNodeSchema = z.object({
 		.describe(
 			"Full script source. Start it with the `pipeline` annotation as a top-of-file comment in the LANGUAGE'S comment syntax — `-- pipeline` for SQL (duckdb/postgresql), `# pipeline` for python3/bash, `// pipeline` for bun/TS — to mark it a pipeline member; declare inputs the same way (e.g. `-- on <asset-uri|schedule|webhook|...>`), and write outputs via the wmill SDK / SQL so the lineage edges are inferred. A `// pipeline` line in a SQL node is a syntax error. Read existing node bodies first to match conventions."
 		),
-	output_kind: outputKindSchema.optional()
+	summary: summaryField,
+	output_kind: outputKindSchema.optional(),
+	triggers: z
+		.array(nodeTriggerSchema)
+		.optional()
+		.describe(
+			'Triggers for the `on <kind>` lines the content declares (schedule, email, kafka, …), attached as trigger drafts in the same step. Every such declaration needs one; webhook and data_upload need none.'
+		)
 })
 
 const buildPipelineNodeToolDef = createToolDef(
@@ -153,8 +321,17 @@ const buildPipelineNodeToolDef = createToolDef(
 
 const editPipelineNodeSchema = z.object({
 	path: z.string().describe('Workspace path of the node to edit.'),
-	old_string: z.string().min(1).describe("Exact text to find in the node's current source."),
-	new_string: z.string().describe('Replacement text.'),
+	old_string: z
+		.string()
+		.min(1)
+		.optional()
+		.describe("Exact text to find in the node's current source. Omit to change only the summary."),
+	new_string: z.string().optional().describe('Replacement text.'),
+	summary: summaryField
+		.optional()
+		.describe(
+			'New succinct summary (a few words, no trailing period). Pass it whenever the node has none or the edit changes what the node does.'
+		),
 	replace_all: z
 		.boolean()
 		.optional()
@@ -197,6 +374,12 @@ const testPipelineNodeToolDef = createToolDef(
 	{ strict: false }
 )
 
+// A pipeline's drafts are one bundle for the whole folder, so that bundle is the
+// item a node edit marks as modified — it is what the session deploys as a unit.
+function recordPipelineModified(toolCallbacks: ToolCallbacks, pipeline: PipelineAIChatHelpers) {
+	toolCallbacks.onItemModified?.(PIPELINE_DRAFT_KIND, pipelineBundlePath(pipeline.getFolder()))
+}
+
 // Summarize the asset lineage the parser inferred from a just-applied node so the
 // model gets same-turn feedback on whether its intended edges formed. An empty
 // result is the useful signal: a write/read expressed via a variable or dynamic
@@ -217,8 +400,9 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		requires: NONE,
 		def: getPipelineGraphToolDef,
 		planModeSafe: true,
-		fn: async ({ helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
+		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
+			const { folder } = getPipelineGraphSchema.parse(args ?? {})
+			const pipeline = await pipelineForFolder(helpers, folder)
 			toolCallbacks.setToolStatus(toolId, { content: 'Reading pipeline graph...' })
 			const ctx = pipeline.getPipelineContext()
 			toolCallbacks.setToolStatus(toolId, {
@@ -233,8 +417,8 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		def: readPipelineNodeToolDef,
 		planModeSafe: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
 			const { path } = readPipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
 			toolCallbacks.setToolStatus(toolId, { content: `Reading node '${path}'...` })
 			const node = await pipeline.getNodeBody(path)
 			if (!node) {
@@ -251,20 +435,51 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		showDetails: true,
 		showFade: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
-			const { path, language, content, output_kind } = buildPipelineNodeSchema.parse(args)
+			const { path, language, content, summary, output_kind, triggers } =
+				buildPipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
+			// Checked before the node is staged, so a bad trigger leaves nothing half-built.
+			const declared = new Set(parsePipelineAnnotations(content).nativeTriggers.map((n) => n.kind))
+			const configs = (triggers ?? []).map((t) => {
+				if (!declared.has(t.kind)) {
+					throw new Error(
+						`The content declares no \`on ${t.kind}\`, so a ${t.kind} trigger has nothing to bind to. Add the annotation line or drop that trigger. Nothing was built.`
+					)
+				}
+				return { kind: t.kind, config: validateTriggerConfig(t.kind, t.config, path) }
+			})
 			toolCallbacks.setToolStatus(toolId, { content: `Building node '${path}'...` })
 			const { detectedReads, detectedWrites } = await pipeline.proposeNode({
 				path,
 				language: language as ScriptLang,
 				content,
+				summary,
 				outputKind: output_kind as PipelineOutputKind | undefined
 			})
+			// Recorded as soon as it is staged: a trigger that fails below leaves the node.
+			recordPipelineModified(toolCallbacks, pipeline)
+			const attached: string[] = []
+			const failed: string[] = []
+			for (const t of configs) {
+				try {
+					const { path: triggerPath } = await pipeline.setNodeTrigger(path, t.kind, t.config)
+					attached.push(`${t.kind} '${triggerPath}'`)
+				} catch (e) {
+					failed.push(`${t.kind}: ${e instanceof Error ? e.message : String(e)}`)
+				}
+			}
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Added draft node '${path}'`,
 				result: 'Success'
 			})
-			return `Pipeline node '${path}' added as an unsaved draft on the canvas. It is not deployed — the user deploys it.${inferredLineageNote(detectedReads, detectedWrites)}`
+			const attachedNote =
+				(attached.length
+					? ` Attached trigger draft${attached.length > 1 ? 's' : ''}: ${attached.join(', ')}.`
+					: '') +
+				(failed.length
+					? ` The node was built, but these triggers were not attached — fix them with set_pipeline_trigger: ${failed.join('; ')}.`
+					: '')
+			return `Pipeline node '${path}' added as an unsaved draft on the canvas. It is not deployed — the user deploys it.${attachedNote}${inferredLineageNote(detectedReads, detectedWrites)}${unconfiguredTriggersNote(path, await pipeline.unconfiguredTriggers(path))}`
 		}
 	},
 	{
@@ -274,36 +489,74 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		showDetails: true,
 		showFade: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
-			const { path, old_string, new_string, replace_all } = editPipelineNodeSchema.parse(args)
+			const { path, old_string, new_string, replace_all, summary } =
+				editPipelineNodeSchema.parse(args)
+			if (old_string === undefined && summary === undefined) {
+				throw new Error('Pass old_string/new_string to change the source, summary to rename it, or both.')
+			}
+			const pipeline = await pipelineForPath(helpers, path)
 			const node = await pipeline.getNodeBody(path)
 			if (!node) {
 				return `No pipeline node found at '${path}'. Call get_pipeline_graph to list the available nodes.`
 			}
 			toolCallbacks.setToolStatus(toolId, { content: `Editing node '${path}'...` })
-			const updated = findAndReplace(
-				node.content,
-				old_string,
-				new_string,
-				replace_all ?? false,
-				'node source'
-			)
-			const { detectedReads, detectedWrites } = await pipeline.editNode(path, updated)
+			const updated =
+				old_string === undefined
+					? node.content
+					: findAndReplace(
+							node.content,
+							old_string,
+							new_string ?? '',
+							replace_all ?? false,
+							'node source'
+						)
+			const edited = await pipeline.editNode(path, updated, summary)
+			const { detectedReads, detectedWrites } = edited
+			const summaryNote = edited.summary.trim()
+				? ''
+				: ` '${path}' has no summary: call edit_pipeline_node with just \`summary\` (a few words saying what it does).`
+			recordPipelineModified(toolCallbacks, pipeline)
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Edited draft '${path}'`,
 				result: 'Success'
 			})
-			return `Pipeline node '${path}' updated as an unsaved draft on the canvas (not deployed).${inferredLineageNote(detectedReads, detectedWrites)}`
+			return `Pipeline node '${path}' updated as an unsaved draft on the canvas (not deployed).${inferredLineageNote(detectedReads, detectedWrites)}${summaryNote}${unconfiguredTriggersNote(path, await pipeline.unconfiguredTriggers(path))}`
+		}
+	},
+	{
+		requires: WRITE_DRAFT,
+		def: setPipelineTriggerToolDef,
+		showDetails: true,
+		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
+			const { path, kind, config } = setPipelineTriggerSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
+			toolCallbacks.setToolStatus(toolId, { content: `Setting the ${kind} trigger of '${path}'...` })
+			const valid = validateTriggerConfig(kind, config, path)
+			const { path: triggerPath, replaced } = await pipeline.setNodeTrigger(path, kind, valid)
+			recordPipelineModified(toolCallbacks, pipeline)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `${replaced ? 'Updated' : 'Attached'} ${kind} trigger '${triggerPath}'`,
+				result: 'Success'
+			})
+			return `${replaced ? 'Replaced' : 'Attached'} the ${kind} trigger draft '${triggerPath}' on '${path}'. It deploys with the pipeline.${unconfiguredTriggersNote(path, await pipeline.unconfiguredTriggers(path))}`
 		}
 	},
 	{
 		requires: WRITE_DRAFT,
 		def: removePipelineNodeToolDef,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
 			const { path } = removePipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
 			toolCallbacks.setToolStatus(toolId, { content: `Discarding draft '${path}'...` })
 			await pipeline.removeProposedNode(path)
+			// With the last draft gone there is nothing left to deploy: the pipeline
+			// is no longer this chat's change, and listing it would show it deployed.
+			if (pipeline.hasDrafts()) recordPipelineModified(toolCallbacks, pipeline)
+			else
+				toolCallbacks.onItemDiscarded?.(
+					PIPELINE_DRAFT_KIND,
+					pipelineBundlePath(pipeline.getFolder())
+				)
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Discarded draft '${path}'`,
 				result: 'Success'
@@ -319,8 +572,8 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 		showDetails: true,
 		autoCollapseDetails: false,
 		fn: async ({ args, workspace, helpers, toolId, toolCallbacks }) => {
-			const pipeline = requirePipeline(helpers)
 			const { path, args: runArgs } = testPipelineNodeSchema.parse(args)
+			const pipeline = await pipelineForPath(helpers, path)
 			return executeTestRun({
 				jobStarter: async () => {
 					const jobId = await pipeline.testNode(path, runArgs ?? undefined)
@@ -350,22 +603,35 @@ export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
  * since the tools it names are withheld from that session; the annotation model stays,
  * as it is what lets the model read and explain an existing pipeline.
  */
-export function getPipelinePromptSection(ctx: PipelineContext, access?: SessionAccess): string {
+export function getPipelinePromptSection(
+	folders: readonly string[],
+	access?: SessionAccess
+): string {
 	const canWriteDraft = !access || access.has('write_draft')
+	const [first] = folders
+	const openLine =
+		folders.length === 1
+			? `The user has the /pipeline/${first} editor open.`
+			: `The user has ${folders.length} pipeline editors open: ${folders.map((f) => `/pipeline/${f}`).join(', ')}. Each tool acts on the pipeline its node path's folder names; pass \`folder\` to get_pipeline_graph.`
+	const pathLine =
+		folders.length === 1
+			? `Every node of this pipeline lives at \`f/${first}/<node_name>\` — \`${first}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).`
+			: `Every node of a pipeline lives at \`f/<folder>/<node_name>\` (e.g. \`f/${first}/<node_name>\`) — \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`). A node can only be built in the folder of an open pipeline editor.`
 	return `
 
 Data Pipeline editor (ACTIVE):
-- The user has the /pipeline/${ctx.folder} editor open. A pipeline is a DAG of scripts (nodes) connected by storage assets (DuckLake tables, data tables, S3 objects, volumes, resources) and execution triggers.
+- ${openLine} A pipeline is a DAG of scripts (nodes) connected by storage assets (DuckLake tables, data tables, S3 objects, volumes, resources) and execution triggers.
 - Annotations are top-of-file comments in the NODE'S OWN comment syntax: \`--\` for SQL (duckdb/postgresql), \`#\` for python3/bash, \`//\` for bun/TS. The \`//\` shown below is the TS form — translate it (a \`// pipeline\` line in a SQL node is a syntax error that won't deploy).
 - A script becomes a pipeline node when its source starts with the \`// pipeline\` annotation. Declare execution-DAG inputs with \`// on <asset-uri | schedule | webhook | email | kafka | mqtt | amqp | nats | postgres | sqs | gcp | data_upload>\` (e.g. \`// on ducklake://main/orders\`). Outputs are inferred from what the body writes (wmill SDK calls / SQL CREATE TABLE / writeS3File); declare a managed output with \`// materialize <asset-uri>\`. Optional badges: \`// partitioned <daily|hourly|weekly|monthly|dynamic>\`, \`// freshness <duration>\`, \`// tag <name>\`, \`// retry <count> [delay]\`, \`// data_test <kind> ...\` (managed DuckLake targets only — deploy rejects it beside a \`dbt://\` target), \`// measure <name> = <agg> [where <pred>]\`, \`// dimension <name> = <expr>\`.
-- \`materialize\` (the managed output): a managed \`// materialize ducklake://<name>/<table>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. The \`dbt://\` target below is the opposite: the node writes its own DDL and none of the write strategies apply to it. IMPORTANT: a MANAGED \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects a \`ducklake://\` target on any other language. For a \`python3\`/\`bun\`/\`postgresql\` node writing the lake, do NOT use \`// materialize\`; write the output via the SDK instead (e.g. \`wmill.writeS3File(...)\`, a \`CREATE TABLE\` in postgresql, or \`wmill.databaseUrlFromResource\`/ducklake helpers) and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. The one target any language BUT DBT'S OWN may declare (a dbt project's writes come from its manifest, so \`// materialize\` on a dbt script is rejected at deploy) is a WAREHOUSE RELATION: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, with \`<warehouse>\` a warehouse the workspace configures under Settings → dbt. \`manual\` is its only mode — nothing generates warehouse DDL, so the node issues its own write and the annotation records the outcome. Use it on an ingestion node a dbt project reads as a \`source\`: the declared relation and the dbt model become ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when that node completes. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
+- \`materialize\` (the managed output): a managed \`// materialize ducklake://<name>/<table>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. The \`dbt://\` target below is the opposite: the node writes its own DDL and none of the write strategies apply to it. IMPORTANT: a MANAGED \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects a \`ducklake://\` target on any other language. For a \`python3\`/\`bun\`/\`postgresql\` node writing the lake, do NOT use \`// materialize\`; write the table straight into DuckLake with \`wmill.ducklake()\` (or a data table with \`wmill.datatable()\`), or a \`CREATE TABLE\` in postgresql and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. The one target any language BUT DBT'S OWN may declare (a dbt project's writes come from its manifest, so \`// materialize\` on a dbt script is rejected at deploy) is a WAREHOUSE RELATION: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, with \`<warehouse>\` a warehouse the workspace configures under Settings → dbt. \`manual\` is its only mode — nothing generates warehouse DDL, so the node issues its own write and the annotation records the outcome. Use it on an ingestion node a dbt project reads as a \`source\`: the declared relation and the dbt model become ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when that node completes. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
 - \`measure\` / \`dimension\` (declared metrics): on a node that materializes a DuckLake table, \`// measure <name> = <aggregate> [where <predicate>]\` names the canonical way to aggregate that table (e.g. \`// measure revenue = sum(amount) where not is_refund\`), and \`// dimension <name> = <expr>\` names a way to slice it (e.g. \`// dimension region = region\`, \`// dimension month = date_trunc('month', ordered_at)\`). They execute nothing: they are catalogued at deploy so the editor and other agents can reuse the definition instead of re-deriving it and silently disagreeing. Keep the predicate in the \`where\` clause rather than folding it into the aggregate: it is rendered as \`<agg> FILTER (WHERE <pred>)\`, which is what lets two measures with different predicates sit under one GROUP BY. DuckLake-only, and only meaningful next to \`// materialize\`. Declare one when a number carries a judgement call someone else would get wrong (refunds excluded, test rows dropped, which column is the amount); do NOT blanket every table with measures, an obvious \`count(*)\` earns nothing. To USE a metric another node declares, read that node with read_pipeline_node and reuse its exact expression rather than guessing it.
 - Use get_pipeline_graph to see the current nodes/assets/triggers, and read_pipeline_node before editing one.
-- Every node of this pipeline lives at \`f/${ctx.folder}/<node_name>\` — \`${ctx.folder}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).${
+- ${pathLine}${
 		canWriteDraft
 			? `
-- Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
+- Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. Give every node a succinct \`summary\` (a few words saying what it does, e.g. "Ingest Stripe charges"), and update it when an edit changes what the node does. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
 - Reuse existing asset paths from the graph when wiring a downstream node to an upstream one (read the upstream's write asset, then \`// on\` that same URI).
+- TRIGGERS: an ingestion node (one with no upstream asset to react to) must declare how it starts, e.g. \`// on schedule\`, and every \`on <schedule|email|kafka|mqtt|amqp|nats|postgres|sqs|gcp>\` line needs its trigger: pass it in build_pipeline_node's \`triggers\` (or call set_pipeline_trigger) in the same step you build the node. A schedule needs a 6-field cron and an IANA timezone — pick a sensible cadence from the request (e.g. daily at 06:00 UTC for a daily sync) rather than leaving it empty; for the other kinds call get_trigger_schema(kind) for the config fields and ask the user for any connection/resource you cannot find. Never leave a declared trigger without one: the node would deploy with nothing to start it. \`webhook\` and \`data_upload\` need no trigger.
 - Only deploy when the user explicitly asks; the user deploys drafts from the canvas.`
 			: ''
 	}`
diff --git a/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts b/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts
index fc77b3e1c4..f96e89dddc 100644
--- a/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts
+++ b/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts
@@ -12,14 +12,27 @@ export type SessionCapability =
 	/** Passes drafts.rs `require_can_write_path` — for a draft of any kind, schedules and
 	 * triggers included, though an operator may create those directly. */
 	| 'write_draft'
+	/** Passes `require_can_write_path` for a flow draft, which an operator also passes where the
+	 * workspace grants `builder_flows`. The server then refuses a draft carrying inline code. */
+	| 'write_flow_draft'
 	/** Passes the operator refusal jobs.rs `run_preview_*` makes before starting a job. */
 	| 'run_preview'
+	/** Passes `run_preview_flow`'s `check_operator_can_build_flows`: composed flows only, for an
+	 * operator with `builder_flows`. */
+	| 'run_flow_preview'
 	/** Passes `check_deploy_rules`. */
 	| 'deploy'
-	/** Passes the operator refusal the script, flow and app handlers make before creating or
+	/** Passes the operator refusal the script and app handlers make before creating or
 	 * deleting one. The same condition as `run_preview` today, but another handler family's
 	 * check, so each follows its own gate if the two ever diverge. */
 	| 'manage_code'
+	/** Passes the flow handlers' `check_operator_can_build_flows`. */
+	| 'manage_flows'
+	/** Passes `gate_operator_writes` on the schedule router: withheld only from an operator whose
+	 * workspace set `operator_settings.manage_schedules` to false. */
+	| 'manage_schedules'
+	/** The same gate on the trigger routers, read from `manage_triggers`. */
+	| 'manage_triggers'
 	/** Passes `require_admin`. */
 	| 'admin'
 
@@ -36,9 +49,22 @@ export type SessionToolPolicy = readonly SessionCapability[]
 
 export const NONE: SessionToolPolicy = []
 export const WRITE_DRAFT: SessionToolPolicy = ['write_draft']
+export const WRITE_FLOW_DRAFT: SessionToolPolicy = ['write_flow_draft']
 export const RUN_PREVIEW: SessionToolPolicy = ['run_preview']
+export const RUN_FLOW_PREVIEW: SessionToolPolicy = ['run_flow_preview']
 export const DEPLOY: SessionToolPolicy = ['deploy']
 
+/** Editors a session can open. Every editor autosaves a draft, so it needs the draft
+ * capability of its kind; a pipeline's nodes are script drafts. */
+export type EditorKind = 'script' | 'flow' | 'raw_app' | 'pipeline'
+
+/** Whether `access` can save what the `kind` editor writes. `undefined` access (not
+ * resolved yet, or not a session) answers true, as the toolset filter does. */
+export function canOpenEditor(access: SessionAccess | undefined, kind: EditorKind): boolean {
+	if (!access) return true
+	return access.has(kind === 'flow' ? 'write_flow_draft' : 'write_draft')
+}
+
 /**
  * A tool that can reach an AI session's toolset. `requires` is mandatory, and declared
  * beside the `fn` whose call is what proves it right.
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index ff7c59d6cb..5a3427006e 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -395,6 +395,30 @@ describe('processToolCall', () => {
 		expect(result.content).toBe(`Error while calling tool: ${expectedError}`)
 	})
 
+	it('resolves a tool registered earlier in the same batch from the live set', async () => {
+		const { createToolDef, processToolCall } = await import('./shared')
+		const fn = vi.fn().mockResolvedValue('built')
+		const registered = {
+			def: createToolDef(z.object({}), 'build_pipeline_node', 'Build node'),
+			fn
+		}
+		const result = await processToolCall({
+			tools: [],
+			live: () => ({ tools: [registered], helpers: { pipelines: true } }),
+			toolCall: {
+				id: 'call_live',
+				type: 'function',
+				function: { name: 'build_pipeline_node', arguments: '{}' }
+			},
+			helpers: {},
+			workspace: 'test-workspace',
+			toolCallbacks: { setToolStatus: vi.fn(), removeToolStatus: vi.fn() }
+		})
+
+		expect(result.content).toBe('built')
+		expect(fn).toHaveBeenCalledWith(expect.objectContaining({ helpers: { pipelines: true } }))
+	})
+
 	it('continues to confirmation when pre-confirmation validation passes', async () => {
 		const { createToolDef, processToolCall } = await import('./shared')
 		const fn = vi.fn().mockResolvedValue('ok')
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 0b751f150a..f346b4297d 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -1,3 +1,4 @@
+import { AI_DECISION_SCHEMA } from '../../flows/flowInfers'
 import type {
 	ChatCompletionFunctionTool,
 	ChatCompletionMessageFunctionToolCall,
@@ -622,6 +623,9 @@ export type ToolCodeDiff = {
 	after: string
 	/** Monaco language id. */
 	lang: string
+	/** Language of the before side, when the edit changed it (an inline runnable rewritten from
+	 * TypeScript to Python). */
+	beforeLang?: string
 }
 
 export type ToolDisplayMessage = {
@@ -830,6 +834,13 @@ async function callTool<T>({
 }): Promise<string> {
 	const tool = tools.find((t) => t.def.function.name === functionName)
 	if (!tool) {
+		// The pipeline tools exist only while a pipeline editor is mounted, and change_mode
+		// cannot mount one, so the generic hint would send the model probing.
+		if (/_pipeline_node$|^get_pipeline_graph$/.test(functionName)) {
+			throw new Error(
+				`${functionName} is not available yet: no pipeline editor is open for this chat. Call open_preview(kind="pipeline", path="<folder>") first and wait for its result; once it reports the editor open, the pipeline tools are callable. Do not fall back to write_script.`
+			)
+		}
 		throw new Error(
 			`Unknown tool call: ${functionName}. Probably not in the correct mode, use the change_mode tool to switch to the correct mode.`
 		)
@@ -920,22 +931,33 @@ type ToolCallStatus =
 	| 'blocked_plan_mode'
 	| 'held_for_instructions'
 
+/** Re-reads the chat loop's current tools and helpers. A call earlier in the same
+ * response can register tools (open_preview mounting the pipeline editor, change_mode),
+ * so a later call in that batch must resolve against the live set, not the snapshot the
+ * response was requested with. */
+export type LiveToolSet = () => { tools: Tool<any>[]; helpers: any }
+
 export async function processToolCall<T>({
-	tools,
+	tools: snapshotTools,
 	toolCall,
-	helpers,
+	helpers: snapshotHelpers,
 	toolCallbacks,
 	workspace,
-	messages = []
+	messages = [],
+	live
 }: {
 	tools: Tool<T>[]
 	toolCall: ChatCompletionMessageFunctionToolCall
 	helpers: T
+	live?: LiveToolSet
 	toolCallbacks: ToolCallbacks
 	workspace?: string
 	/** The conversation so far, for which folder instructions it already carries. */
 	messages?: readonly ChatCompletionMessageParam[]
 }): Promise<ChatCompletionMessageParam> {
+	const current = live?.()
+	const tools: Tool<T>[] = current?.tools ?? snapshotTools
+	const helpers: T = current ? current.helpers : snapshotHelpers
 	const tool = tools.find((t) => t.def.function.name === toolCall.function.name)
 	const workspaceId = workspace ?? get(workspaceStore) ?? ''
 
@@ -2634,12 +2656,57 @@ export async function resolveFlowStepRun({
 		}
 	}
 
+	if (moduleValue.type === 'aidecision') {
+		return {
+			module: targetModule,
+			// Run alone as a one-step flow preview, as the editor's step test does: the inputs given here
+			// override the step's own, so a state that reads an earlier step can be passed directly.
+			runnableKind: 'flow',
+			// What a run supplies: the state. The provider and questions are the step's own.
+			schema: {
+				$schema: 'https://json-schema.org/draft/2020-12/schema',
+				type: 'object',
+				properties: { state: AI_DECISION_SCHEMA.properties.state },
+				required: ['state'],
+				order: ['state']
+			},
+			startMessage: `Starting test run of AI decision step "${stepId}"...`,
+			startJob: async (args) =>
+				JobService.runFlowPreview({
+					workspace,
+					requestBody: {
+						value: {
+							modules: [
+								{
+									id: targetModule.id,
+									value: {
+										...moduleValue,
+										input_transforms: {
+											...moduleValue.input_transforms,
+											...Object.fromEntries(
+												Object.keys(args).map((key) => [
+													key,
+													{ type: 'javascript' as const, expr: `flow_input.${key}` }
+												])
+											)
+										}
+									}
+								}
+							]
+						},
+						args,
+						path: flowPath
+					}
+				})
+		}
+	}
+
 	toolCallbacks.setToolStatus(toolId, {
 		content: `Step type "${moduleValue.type}" not supported for testing`,
 		error: `Cannot test step of type "${moduleValue.type}"`
 	})
 	throw new Error(
-		`Cannot test step of type "${moduleValue.type}". Supported types: rawscript, script, flow, aiagent`
+		`Cannot test step of type "${moduleValue.type}". Supported types: rawscript, script, flow, aiagent, aidecision`
 	)
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/skills/skillResources.ts b/frontend/src/lib/components/copilot/chat/skills/skillResources.ts
index 7a80705d4e..d28a4d32e8 100644
--- a/frontend/src/lib/components/copilot/chat/skills/skillResources.ts
+++ b/frontend/src/lib/components/copilot/chat/skills/skillResources.ts
@@ -1,6 +1,7 @@
 import { ResourceService } from '$lib/gen'
-import { canWrite } from '$lib/utils'
-import type { UserExt } from '$lib/stores'
+import { canEditItem } from '$lib/editRights'
+import { userWorkspaces, type UserExt } from '$lib/stores'
+import { get } from 'svelte/store'
 
 /**
  * Skills are resources of this type: a file resource (`format_extension = 'md'`)
@@ -53,9 +54,10 @@ export type SkillListing = { skills: SkillResource[]; truncated: boolean }
  * `user` decides which rows the drawer offers to edit rather than only view; pass
  * the account the workspace is being browsed as. Ownership is mostly implicit in
  * the path (`u/<me>/…`, a folder the user owns), which is why this goes through
- * the shared `canWrite` rather than reading `extra_perms` alone. */
+ * the shared `canEditItem` rather than reading `extra_perms` alone. */
 export async function listSkillResources(workspace: string, user?: UserExt): Promise<SkillListing> {
 	if (!workspace) return { skills: [], truncated: false }
+	const operatorSettings = get(userWorkspaces).find((w) => w.id === workspace)?.operator_settings
 	const rows: SkillResource[] = []
 	for (let page = 1; page <= MAX_SKILLS_PAGES; page++) {
 		const resources = await ResourceService.listResource({
@@ -70,7 +72,7 @@ export async function listSkillResources(workspace: string, user?: UserExt): Pro
 				name: skillNameFromPath(r.path),
 				description: r.description ?? '',
 				editedAt: r.edited_at,
-				canWrite: canWrite(r.path, r.extra_perms ?? {}, user)
+				canWrite: canEditItem('resource', r.path, r.extra_perms, user, operatorSettings)
 			}))
 		)
 		if (resources.length < SKILLS_PAGE_SIZE) return { skills: rows, truncated: false }
diff --git a/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts b/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts
index dd480c5e97..75d996ebef 100644
--- a/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts
@@ -1,4 +1,4 @@
-import { BookOpen, List, Plus } from 'lucide-svelte'
+import { BookOpen, List, Loader2, Plus } from 'lucide-svelte'
 import { get } from 'svelte/store'
 import { userStore, workspaceStore } from '$lib/stores'
 import { sendUserToast } from '$lib/toast'
@@ -14,6 +14,14 @@ type Row = SkillResource & { enabled: boolean }
 // scannable, so the rest are reached through the settings modal rather than dropped.
 const MAX_MENU_SKILLS = 8
 
+// Not `disabled`: melt stamps that on a row at mount and never clears it, and the
+// unkeyed submenu reuses this row for the first skill once the load lands.
+const loadingItem: Item = {
+	displayName: 'Loading…',
+	icon: Loader2,
+	iconProps: { class: 'animate-spin shrink-0' }
+}
+
 /**
  * The chat "+" menu's Skills submenu: one row per skill, checked when it is on,
  * then the way to manage them. Everything a skill is beyond turning it on and off
@@ -25,7 +33,7 @@ export class SkillsMenu {
 	#seq = 0
 	/** Rows for the workspace named by `#rowsWorkspace`, and meaningless for any other. */
 	#rows = $state<Row[]>([])
-	#rowsWorkspace: string | undefined = undefined
+	#rowsWorkspace = $state<string | undefined>(undefined)
 
 	constructor(manager: AIChatManager, onManage: () => void) {
 		this.#manager = manager
@@ -89,19 +97,21 @@ export class SkillsMenu {
 		await this.#manager.refreshGlobalSkills(ws)
 	}
 
-	/** Loaded on open so the checks are current. */
-	async items(closeMenu?: () => void): Promise<Item[]> {
+	/** Called on open so the checks are current; never awaited, see `items`. */
+	refresh() {
+		const ws = this.#ws
+		if (ws) void this.#load(ws)
+	}
+
+	/**
+	 * Built from the live rows, so call it from a getter: the submenu then fills in
+	 * when a load lands instead of the whole "+" menu waiting on the fetch. Rows for
+	 * another workspace are not shown — same path, different skill.
+	 */
+	items(closeMenu?: () => void): Item[] {
 		const ws = this.#ws
 		if (!ws) return []
-		// The menu opens on what is already known and refreshes behind it: awaited
-		// inline it would stall the whole "+" menu, attachments included. Rows for
-		// another workspace are not "already known" — same path, different skill.
-		if (this.#rowsWorkspace !== ws) {
-			this.#rows = []
-			await this.#load(ws)
-		} else {
-			void this.#load(ws)
-		}
+		if (this.#rowsWorkspace !== ws) return [loadingItem]
 		const ambiguous = ambiguousSkillNames(this.#rows)
 		// By path. Ordering the ones that are on first would put every row in the same
 		// bucket now that skills start that way, and drop the one row it did move — a
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts
index 5077585a4f..71a25e3c2c 100644
--- a/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import hljs from 'highlight.js/lib/core'
 import {
-	argumentsCarryWholeFile,
+	diffIsWholeFile,
 	diffLineCounts,
 	hasToolCodeDiff,
 	toolCodeDiff,
@@ -113,12 +113,31 @@ describe('toolCodeDiff', () => {
 	})
 
 	it('only marks tools with a defined argument diff as diff-capable', () => {
-		expect(hasToolCodeDiff('edit_script')).toBe(true)
-		expect(hasToolCodeDiff('edit_code')).toBe(true)
-		expect(hasToolCodeDiff('write_script')).toBe(true)
-		expect(hasToolCodeDiff('__proto__')).toBe(false)
-		expect(hasToolCodeDiff('toString')).toBe(false)
-		expect(hasToolCodeDiff(undefined)).toBe(false)
+		const call = (toolName: string | undefined, parameters?: unknown) =>
+			hasToolCodeDiff(message({ toolName, parameters }))
+
+		expect(call('edit_script')).toBe(true)
+		expect(call('edit_code')).toBe(true)
+		expect(call('write_script')).toBe(true)
+		expect(call('__proto__')).toBe(false)
+		expect(call('toString')).toBe(false)
+		expect(call(undefined)).toBe(false)
+		expect(
+			hasToolCodeDiff(
+				message({ toolName: 'delete_app_file', codeDiff: { before: 'a', after: '', lang: 'css' } })
+			)
+		).toBe(true)
+	})
+
+	it('keeps a reference runnable write on the generic card', () => {
+		const call = (parameters: unknown) =>
+			hasToolCodeDiff(message({ toolName: 'write_app_runnable', parameters }))
+
+		expect(call('{"path":"f/a","key":"go","runnable":{"name":"Go","type":"in')).toBe(true)
+		expect(call('{"path":"f/a","key":"go","runnable":{"name":"Go"')).toBe(true)
+		expect(call('{"path":"f/a","key":"go","runnable":{"name":"Go","type":"flow"')).toBe(false)
+		expect(call({ path: 'f/a', key: 'go', runnable: { type: 'script', path: 'f/s' } })).toBe(false)
+		expect(call({ path: 'f/a', key: 'go', runnable: { type: 'inline' } })).toBe(true)
 	})
 
 	it('ignores tool names inherited from Object.prototype', () => {
@@ -302,14 +321,38 @@ describe('toolCodeDiff', () => {
 		})
 	})
 
+	it('highlights streamed raw app edits by file', () => {
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'patch_app_file',
+					parameters: '{"path":"f/a","file_path":"/src/App.tsx","old_string":"a","new_string":"b'
+				})
+			)
+		).toEqual({ before: 'a', after: 'b', lang: 'typescript' })
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'write_app_runnable',
+					parameters:
+						'{"path":"f/a","key":"go","runnable":{"name":"Go","type":"inline","inlineScript":{"language":"python3","content":"def main'
+				})
+			)
+		).toEqual({ before: '', after: 'def main', lang: 'python' })
+	})
+
 	it('recognizes calls whose arguments are a whole file', () => {
 		const call = (
 			toolName: string,
 			parameters: unknown,
 			codeDiff?: ToolDisplayMessage['codeDiff']
-		) => argumentsCarryWholeFile(message({ toolName, parameters, codeDiff }))
+		) => diffIsWholeFile(message({ toolName, parameters, codeDiff }))
 
 		expect(call('write_script', { path: 'f/a', content: '' })).toBe(true)
+		expect(call('delete_app_file', { path: 'f/a', file_path: '/a.css' })).toBe(true)
+		expect(call('patch_app_file', { file_path: '/a.css', old_string: 'a', new_string: 'b' })).toBe(
+			false
+		)
 		expect(call('edit_code', '{"code":"x')).toBe(true)
 		expect(
 			call('edit_code', { code: 'x' }, { before: 'old', after: 'x', lang: 'typescript' })
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts
index 2e5d8bf13c..7fc51827e4 100644
--- a/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts
@@ -1,6 +1,7 @@
 // This is Monaco's advanced diff engine; it supplies the same multi-line inner ranges.
 import { DefaultLinesDiffComputer } from '@codingame/monaco-vscode-api/vscode/vs/editor/common/diff/defaultLinesDiffComputer/defaultLinesDiffComputer'
 import type { ToolCodeDiff, ToolDisplayMessage } from './shared'
+import { appFileEditorLang } from './appFileEditorLang'
 
 // Builds a diff from a call's own arguments, for the moments the saved `codeDiff` does not
 // exist: while the arguments stream, when the call failed, and for transcripts saved before
@@ -24,17 +25,39 @@ const ARGS_DIFF_BY_TOOL: Record<string, (params: unknown) => ToolCodeDiff | unde
 			)
 		}
 		return argumentDiff(streamingEditArguments(params)) ?? fullContentArgumentDiff(params, 'code')
+	},
+	patch_app_file: (params) => {
+		const diff = argumentDiff(streamingEditArguments(params))
+		return diff && { ...diff, lang: appFileEditorLang(argumentString(params, 'file_path')) }
+	},
+	write_app_file: (params) => {
+		const diff = fullContentArgumentDiff(params, 'content')
+		return diff && { ...diff, lang: appFileEditorLang(argumentString(params, 'file_path')) }
+	},
+	write_app_runnable: (params) => {
+		const inlineScript =
+			params && typeof params === 'object'
+				? (params as { runnable?: { inlineScript?: unknown } }).runnable?.inlineScript
+				: params
+		const diff = fullContentArgumentDiff(inlineScript, 'content')
+		const language = argumentString(inlineScript, 'language')
+		return (
+			diff && { ...diff, lang: appFileEditorLang(language === 'python3' ? 'main.py' : 'main.ts') }
+		)
 	}
 }
 
+function argumentString(params: unknown, key: string): string | undefined {
+	if (params && typeof params === 'object') {
+		const value = (params as Record<string, unknown>)[key]
+		return typeof value === 'string' ? value : undefined
+	}
+	return typeof params === 'string' ? partialJsonString(params, key) : undefined
+}
+
 function fullContentArgumentDiff(params: unknown, key: string): ToolCodeDiff | undefined {
-	const content =
-		params && typeof params === 'object'
-			? (params as Record<string, unknown>)[key]
-			: typeof params === 'string'
-				? partialJsonString(params, key)
-				: undefined
-	return typeof content === 'string' ? { before: '', after: content, lang: 'plaintext' } : undefined
+	const content = argumentString(params, key)
+	return content !== undefined ? { before: '', after: content, lang: 'plaintext' } : undefined
 }
 
 function argumentDiff(
@@ -104,8 +127,22 @@ function partialJsonStrings(partialJson: string, key: string): string[] {
 	return result
 }
 
-export function hasToolCodeDiff(toolName: string | undefined): boolean {
-	return toolName !== undefined && Object.hasOwn(ARGS_DIFF_BY_TOOL, toolName)
+export function hasToolCodeDiff(message: ToolDisplayMessage): boolean {
+	if (message.codeDiff) return true
+	if (!message.toolName || !Object.hasOwn(ARGS_DIFF_BY_TOOL, message.toolName)) return false
+	// A runnable that references a workspace or hub item has no code to diff, so it keeps the
+	// generic card, whose details show the target and static inputs. Until `type` has streamed
+	// past a prefix of "inline", the call is assumed inline so an inline runnable does not
+	// switch cards mid-stream.
+	if (message.toolName === 'write_app_runnable') {
+		const params = message.parameters
+		const type =
+			params && typeof params === 'object'
+				? (params as { runnable?: { type?: unknown } }).runnable?.type
+				: argumentString(params, 'type')
+		return type === undefined || (typeof type === 'string' && 'inline'.startsWith(type))
+	}
+	return true
 }
 
 export function toolCodeDiff(message: ToolDisplayMessage): ToolCodeDiff | undefined {
@@ -116,11 +153,19 @@ export function toolCodeDiff(message: ToolDisplayMessage): ToolCodeDiff | undefi
 		: undefined
 }
 
+const WHOLE_FILE_TOOLS = new Set([
+	'write_script',
+	'write_app_file',
+	'write_app_runnable',
+	'delete_app_file',
+	'delete_app_runnable'
+])
+
 // Decided by tool and argument shape, never by the saved `codeDiff`: an overwrite's saved diff
 // has a before side, and clearing a script leaves both argument sides empty, yet both calls sent
-// a whole file.
-export function argumentsCarryWholeFile(message: ToolDisplayMessage): boolean {
-	if (message.toolName === 'write_script') return true
+// a whole file. A delete's diff is the whole removed file, saved while the call still runs.
+export function diffIsWholeFile(message: ToolDisplayMessage): boolean {
+	if (message.toolName && WHOLE_FILE_TOOLS.has(message.toolName)) return true
 	if (message.toolName !== 'edit_code') return false
 	const params = message.parameters
 	if (typeof params === 'string') return /"code"\s*:/.test(params)
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts
index ddf2464136..5f68425c1c 100644
--- a/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts
@@ -1,4 +1,13 @@
-import { csharp, go, java, json, plaintext, type LanguageType } from 'svelte-highlight/languages'
+import {
+	csharp,
+	css,
+	go,
+	java,
+	json,
+	plaintext,
+	xml,
+	type LanguageType
+} from 'svelte-highlight/languages'
 import graphql from 'svelte-highlight/languages/graphql'
 import javascript from 'svelte-highlight/languages/javascript'
 import php from 'svelte-highlight/languages/php'
@@ -32,6 +41,8 @@ const LANGUAGE_BY_MONACO: Record<string, LanguageType<string>> = {
 	r,
 	go,
 	ruby,
+	css,
+	xml,
 	text: plaintext,
 	plaintext
 }
diff --git a/frontend/src/lib/components/copilot/chat/toolGroups.test.ts b/frontend/src/lib/components/copilot/chat/toolGroups.test.ts
index f75332c87d..4dd3b376fe 100644
--- a/frontend/src/lib/components/copilot/chat/toolGroups.test.ts
+++ b/frontend/src/lib/components/copilot/chat/toolGroups.test.ts
@@ -91,6 +91,40 @@ describe('groupToolRuns', () => {
 		).toEqual([0, 1, 2, 3])
 	})
 
+	it('folds the calls queued behind another call into one waiting row', () => {
+		const sql = (extra = {}) =>
+			tool('exec_datatable_sql', { datatable_name: 'main', sql: 'select 1' }, extra)
+		const queued = { isQueued: true, content: 'Execute SQL on "main"' }
+		const batch = [
+			sql({ needsConfirmation: true, isLoading: true }),
+			sql(queued),
+			tool('search_workspace', {}, { ...queued, content: 'Search workspace' })
+		]
+		expect(shape(batch)).toEqual([0, { waiting: [1, 2] }])
+		expect(header(batch)).toBe('2 more calls waiting: Execute SQL on "main", Search workspace')
+		// The call next in line shows as itself, before anything runs and between two calls.
+		expect(shape([assistant(''), sql(queued), sql(queued)])).toEqual([0, 1, { waiting: [2] }])
+		expect(shape([sql(), sql(queued), sql(queued)])).toEqual([0, 1, { waiting: [2] }])
+		// Queued edits of one flow keep their edit group.
+		const flow = { path: 'f/a/flow' }
+		expect(
+			shape([
+				tool('search_workspace', {}, { isLoading: true }),
+				tool('patch_flow_json', flow, queued),
+				tool('patch_flow_json', flow, queued)
+			])
+		).toEqual([0, { edit: [1, 2] }])
+		// A waiting row stops before queued calls that form their own group.
+		expect(
+			shape([
+				sql({ needsConfirmation: true, isLoading: true }),
+				sql(queued),
+				tool('patch_flow_json', flow, queued),
+				tool('patch_flow_json', flow, queued)
+			])
+		).toEqual([0, { waiting: [1] }, { edit: [2, 3] }])
+	})
+
 	it('keeps an edit whose arguments are still streaming in the group it follows', () => {
 		const flow = { path: 'f/a/flow' }
 		expect(
@@ -115,7 +149,10 @@ describe('groupToolRuns', () => {
 	it('lets a call with no arguments yet join a group but not start one', () => {
 		const queued = (toolName: string) =>
 			tool(toolName, {}, { parameters: undefined, isQueued: true })
-		expect(shape([queued('delete_app_file'), queued('delete_app_runnable')])).toEqual([0, 1])
+		expect(shape([queued('delete_app_file'), queued('delete_app_runnable')])).toEqual([
+			0,
+			{ waiting: [1] }
+		])
 		expect(shape([tool('patch_app_file', { path: 'f/a/x' }), queued('delete_app_file')])).toEqual([
 			{ edit: [0, 1] }
 		])
@@ -150,6 +187,19 @@ describe('groupToolRuns', () => {
 		).toEqual([{ edit: [0, 1, 2] }, { edit: [3, 4] }])
 	})
 
+	it('folds app edits that carry a file diff, but not a script edit with one', () => {
+		const app = { path: 'f/a/x' }
+		const diff = { codeDiff: { before: 'a', after: 'b' } }
+		expect(
+			shape([
+				tool('init_app', app),
+				tool('write_app_file', { ...app, file_path: '/App.tsx' }, diff),
+				tool('delete_app_runnable', { ...app, key: 'greet' }, diff),
+				tool('write_script', { path: 'f/a/s' }, diff)
+			])
+		).toEqual([{ edit: [0, 1, 2] }, 3])
+	})
+
 	it('leaves a flow read that prepares an edit to the edit group, not the lookups before it', () => {
 		const flow = { type: 'flow', path: 'f/a/flow' }
 		expect(
diff --git a/frontend/src/lib/components/copilot/chat/toolGroups.ts b/frontend/src/lib/components/copilot/chat/toolGroups.ts
index fd4cbc28ee..f3e3ad0aa9 100644
--- a/frontend/src/lib/components/copilot/chat/toolGroups.ts
+++ b/frontend/src/lib/components/copilot/chat/toolGroups.ts
@@ -88,8 +88,9 @@ const READ_TOOLS = new Set([
 
 export type ToolGroup = {
 	kind: 'group'
-	/** 'edit': edits of one flow or app. 'explore': consecutive lookups of anything. */
-	groupKind: 'edit' | 'explore'
+	/** 'edit': edits of one flow or app. 'explore': consecutive lookups of anything.
+	 * 'waiting': calls queued behind the one running or awaiting the user. */
+	groupKind: 'edit' | 'explore' | 'waiting'
 	/** First call's id, so the group keeps its identity (and expand state) as it grows. */
 	key: string
 	/** Edit groups: the item's path, or '' for the flow open in the editor. */
@@ -115,7 +116,9 @@ function groupableCall(message: DisplayMessage): ToolDisplayMessage | undefined
 	if (message.needsConfirmation || message.blockedByPlanMode) return undefined
 	if (message.heldForFolderInstructions) return undefined
 	if (message.runForm || message.inspectedRun || message.userQuestion) return undefined
-	if (message.codeDiff || message.imageUrl || message.webSearchSources) return undefined
+	// An app edit's diff covers one file of many, so it stays a row inside the app's group.
+	if (message.codeDiff && EDIT_TOOLS[message.toolName] !== 'app') return undefined
+	if (message.imageUrl || message.webSearchSources) return undefined
 	if (!message.error && webSearchResultOf(message.result)) return undefined
 	// The user's own refusal is a decision, not a failure to fold away.
 	if (message.declinedByUser) return undefined
@@ -229,18 +232,58 @@ function editGroupAt(messages: DisplayMessage[], start: number): ToolGroup | und
 	return toolGroup(messages, start, end, 'edit', item.path)
 }
 
+function isWaitingCall(message: DisplayMessage): boolean {
+	return message.role === 'tool' && message.isQueued === true && message.error === undefined
+}
+
+function inFlight(message: DisplayMessage): boolean {
+	return (
+		message.role === 'tool' &&
+		Boolean(message.isLoading || message.isQueued || message.isStreamingArguments)
+	)
+}
+
+// Calls of one turn run one at a time, so the ones queued behind a call fold into a single
+// row: each would otherwise sit as its own row until its turn. Only behind a call still in
+// flight: between two calls the previous one has settled, and the call next in line must
+// still show as itself rather than dip into the row and back out.
+function waitingGroupAt(
+	messages: DisplayMessage[],
+	start: number,
+	previous: ChatItem | undefined
+): ToolGroup | undefined {
+	if (!isWaitingCall(messages[start]) || !previous) return undefined
+	const ahead =
+		previous.kind === 'group' ? previous.entries.map((e) => e.message) : [previous.message]
+	if (!ahead.some(inFlight)) return undefined
+	const end = runEnd(messages, start, (m, j) => isWaitingCall(m) && !kindGroupAt(messages, j))
+	return {
+		kind: 'group',
+		groupKind: 'waiting',
+		key: (messages[start] as ToolDisplayMessage).tool_call_id,
+		target: '',
+		entries: messages.slice(start, end + 1).map((message, k) => ({ message, index: start + k }))
+	}
+}
+
+// An edit group wins over an explore group: its reads belong to the edits they prepare, so an
+// explore run also stops before a read that starts one. Both win over a waiting row, which
+// stops before either: its header says less than `Edit f/a/flow · 2 changes`.
+function kindGroupAt(messages: DisplayMessage[], start: number): ToolGroup | undefined {
+	const explores = (m: DisplayMessage, j: number) => isReadCall(m) && !editGroupAt(messages, j)
+	return (
+		editGroupAt(messages, start) ??
+		(isReadCall(messages[start])
+			? toolGroup(messages, start, runEnd(messages, start, explores), 'explore', '')
+			: undefined)
+	)
+}
+
 export function groupToolRuns(messages: DisplayMessage[]): ChatItem[] {
 	const items: ChatItem[] = []
 	let i = 0
 	while (i < messages.length) {
-		// An edit group wins over an explore group: its reads belong to the edits they prepare,
-		// so an explore run also stops before a read that starts one.
-		const explores = (m: DisplayMessage, j: number) => isReadCall(m) && !editGroupAt(messages, j)
-		const group =
-			editGroupAt(messages, i) ??
-			(isReadCall(messages[i])
-				? toolGroup(messages, i, runEnd(messages, i, explores), 'explore', '')
-				: undefined)
+		const group = kindGroupAt(messages, i) ?? waitingGroupAt(messages, i, items.at(-1))
 		if (group) {
 			items.push(group)
 			i = group.entries.at(-1)!.index + 1
@@ -307,6 +350,14 @@ export function groupHeader(
 	const calls = group.entries
 		.map((e) => e.message)
 		.filter((m): m is ToolDisplayMessage => m.role === 'tool')
+	if (group.groupKind === 'waiting') {
+		// A queued row's content is its imperative label, e.g. `Execute SQL on "main"`.
+		const names = [...new Set(calls.map((m) => m.content))].join(', ')
+		return {
+			prefix: `${plural(calls.length, 'more call')} waiting:`,
+			label: names
+		}
+	}
 	if (group.groupKind === 'edit') {
 		const edits = calls.filter(
 			(m) => Object.hasOwn(EDIT_TOOLS, m.toolName ?? '') && !callFailed(m)
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index fc019ee983..0b393e6969 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -28,9 +28,9 @@ export const scheduleRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -80,9 +80,9 @@ export const httpTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -139,9 +139,9 @@ export const websocketTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -185,9 +185,9 @@ export const kafkaTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -217,9 +217,9 @@ export const natsTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -258,9 +258,9 @@ export const postgresTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -300,9 +300,9 @@ export const mqttTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -337,9 +337,9 @@ export const amqpTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -368,9 +368,9 @@ export const sqsTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -408,9 +408,9 @@ export const gcpTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -442,9 +442,9 @@ export const azureTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
@@ -470,9 +470,9 @@ export const emailTriggerRequestSchema = z.object({
 		"exponential": z.object({
 			"attempts": z.number().int().describe("Number of retry attempts").optional(),
 			"multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(),
-			"seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(),
+			"seconds": z.number().int().gte(1).describe("Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too").optional(),
 			"random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional()
-		}).describe("Retry with exponential backoff (delay doubles each time)").optional(),
+		}).describe("Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n").optional(),
 		"retry_if": z.object({
 			"expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables")
 		}).describe("Conditional retry based on error or result").optional()
diff --git a/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts b/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts
index 4bffcd80ac..52d58863c6 100644
--- a/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts
+++ b/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts
@@ -99,6 +99,7 @@ async function setupClients() {
 				textDelta('Hel'),
 				{ type: 'content_block_delta', delta: { type: 'input_json_delta', partial_json: '{' } },
 				textDelta('lo'),
+				{ type: 'message_delta', delta: { stop_reason: 'end_turn' } },
 				{ type: 'message_stop' }
 			])
 		)
@@ -175,8 +176,9 @@ describe('Anthropic Messages API routing', () => {
 		}
 
 		expect(anthropicStream).toHaveBeenCalledTimes(1)
-		// only the two text deltas surface; message_start/stop and input_json are dropped
-		expect(chunks).toBe(2)
+		// the two text deltas and the stop reason surface; message_start/stop and
+		// input_json are dropped
+		expect(chunks).toBe(3)
 		expect(text).toBe('Hello')
 	})
 
@@ -228,6 +230,87 @@ describe('Anthropic Messages API routing', () => {
 		expect(METADATA_MAX_TOKENS).toBeLessThanOrEqual(21333)
 	})
 
+	it('getStreamedCompletionText streams the capped request and falls back off the Responses API', async () => {
+		const { getStreamedCompletionText, workspaceAIClients } = await import('./lib')
+
+		h.currentModel = { provider: 'anthropic', model: 'claude-sonnet-4-6' }
+		expect(
+			await getStreamedCompletionText(messages, new AbortController(), { maxTokensCap: 8000 })
+		).toBe('Hello')
+		expect(anthropicCreate).not.toHaveBeenCalled()
+		expect(anthropicStream.mock.calls[0][0].max_tokens).toBe(8000)
+
+		h.currentModel = { provider: 'openai', model: 'gpt-4o' }
+		const completedResponses = vi
+			.fn()
+			.mockReturnValue(
+				streamOf([
+					{ type: 'response.created' },
+					{ type: 'response.output_text.delta', delta: 'responses ' },
+					{ type: 'response.output_text.delta', delta: 'text' },
+					{ type: 'response.completed' }
+				])
+			)
+		vi.spyOn(workspaceAIClients, 'getOpenaiClient').mockReturnValue({
+			chat: { completions: { create: openaiCreate } },
+			responses: { stream: completedResponses }
+		} as any)
+		expect(await getStreamedCompletionText(messages, new AbortController())).toBe('responses text')
+		expect(openaiCreate).not.toHaveBeenCalled()
+
+		// The Responses stream fails on iteration, not on creation.
+		const responsesStream = vi.fn().mockReturnValue(
+			(async function* () {
+				throw new Error('responses api not served')
+			})()
+		)
+		openaiCreate.mockResolvedValue(
+			streamOf([
+				{ choices: [{ delta: { content: 'chat ' } }] },
+				{ choices: [{ delta: { content: 'text' } }] },
+				{ choices: [{ delta: {}, finish_reason: 'stop' }] },
+				{ choices: [], usage: {} }
+			])
+		)
+		vi.spyOn(workspaceAIClients, 'getOpenaiClient').mockReturnValue({
+			chat: { completions: { create: openaiCreate } },
+			responses: { stream: responsesStream }
+		} as any)
+		vi.spyOn(console, 'error').mockImplementation(() => {})
+		h.currentModel = { provider: 'openai', model: 'gpt-4o' }
+
+		expect(
+			await getStreamedCompletionText(messages, new AbortController(), { maxTokensCap: 8000 })
+		).toBe('chat text')
+		expect(responsesStream.mock.calls[0][0].max_output_tokens).toBe(8000)
+		expect(openaiCreate.mock.calls[0][0]).toMatchObject({ stream: true, max_tokens: 8000 })
+	})
+
+	it('getStreamedCompletionText rejects when the stream is cut or stopped midway', async () => {
+		const { getStreamedCompletionText } = await import('./lib')
+		h.currentModel = { provider: 'deepseek', model: 'deepseek-chat' }
+
+		// A hop closing the response early ends the iteration cleanly, with no
+		// finish reason.
+		openaiCreate.mockResolvedValue(streamOf([{ choices: [{ delta: { content: 'partial' } }] }]))
+		await expect(getStreamedCompletionText(messages, new AbortController())).rejects.toThrow(
+			'ended before the model finished'
+		)
+
+		const abortController = new AbortController()
+		// The OpenAI SDK swallows the abort and just ends the iteration.
+		openaiCreate.mockResolvedValue(
+			(async function* () {
+				yield { choices: [{ delta: { content: 'partial' } }] }
+				abortController.abort('user_cancelled')
+			})()
+		)
+
+		await expect(getStreamedCompletionText(messages, abortController)).rejects.toBe(
+			'user_cancelled'
+		)
+	})
+
 	it('caps max_output_tokens for metadata completions on the OpenAI Responses path', async () => {
 		const { getNonStreamingCompletion, getNonStreamingMetadataCompletion, METADATA_MAX_TOKENS } =
 			await import('./lib')
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 40f1dee6a6..a9a33e9deb 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -32,6 +32,7 @@ import { formatResourceTypes } from './utils'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	type LiveToolSet,
 	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks
@@ -71,6 +72,7 @@ interface AIProviderDetails {
 // the frontier model. The gpt-5 family is deprecated (retires 2026-12-11) but
 // still served, so it stays in the list below the 5.6 models.
 const OPENAI_MODELS = [
+	'gpt-6.1-sol',
 	'gpt-6-sol',
 	'gpt-6-astra',
 	'gpt-6-luna',
@@ -85,7 +87,11 @@ const OPENAI_MODELS = [
 	'o3'
 ]
 
-export const AI_PROVIDERS: Record<AIProvider, AIProviderDetails> = {
+/** The providers that chat. Every surface picking a model to talk to (the copilot, flow chat, an
+ *  agent's text or image output, eval judges) offers exactly these. */
+export type ChatAIProvider = Exclude<AIProvider, 'typesafe' | 'cloudflare'>
+
+export const AI_PROVIDERS: Record<ChatAIProvider, AIProviderDetails> = {
 	openai: {
 		label: 'OpenAI',
 		defaultModels: OPENAI_MODELS
@@ -163,6 +169,40 @@ export const AI_PROVIDERS: Record<AIProvider, AIProviderDetails> = {
 	}
 }
 
+/** Decision models answer typed questions instead of messages, so only an AI decision offers
+ *  them: TypeSafe's Jev, Cloudflare's Jev-compatible Clef, and the model of OpenAI's Decisions
+ *  API, which an OpenAI resource serves next to its chat models. The pinned Jev version is there
+ *  for flows tuned against its probabilities. */
+export const DECISION_AI_PROVIDERS: Record<
+	Exclude<AIProvider, ChatAIProvider> | 'openai',
+	AIProviderDetails
+> = {
+	openai: {
+		label: 'OpenAI',
+		defaultModels: ['gpt-6-luna']
+	},
+	typesafe: {
+		label: 'TypeSafe',
+		defaultModels: ['jev-latest', 'jev-1.13.0']
+	},
+	cloudflare: {
+		label: 'Cloudflare',
+		defaultModels: ['clef', 'clef-flash']
+	}
+}
+
+/** Label and default models of any provider kind, chat or decision. A kind in neither list (a flow
+ *  written by hand or by a newer version) is named as it is and offers no models. */
+export function aiProviderDetails(provider: AIProvider): AIProviderDetails {
+	return (
+		(AI_PROVIDERS as Record<string, AIProviderDetails>)[provider] ??
+		(DECISION_AI_PROVIDERS as Record<string, AIProviderDetails>)[provider] ?? {
+			label: provider,
+			defaultModels: []
+		}
+	)
+}
+
 export interface ModelResponse {
 	id: string
 	object: string
@@ -193,6 +233,12 @@ export async function fetchAvailableModels(
 	/** Cap on the listing response, for callers that fetch without a user asking. */
 	maxBytes?: number
 ): Promise<string[]> {
+	// Neither decision provider has an OpenAI-shaped listing: TypeSafe's names models with `name`
+	// and serves one under aliases, and Workers AI's catalog spans every model it hosts.
+	if (provider === 'typesafe' || provider === 'cloudflare') {
+		return DECISION_AI_PROVIDERS[provider].defaultModels
+	}
+
 	// Handle AWS Bedrock separately (needs both foundation-models and inference-profiles)
 	if (provider === 'aws_bedrock') {
 		const headers = {
@@ -506,7 +552,7 @@ const DEFAULT_COMPLETION_CONFIG: ChatCompletionCreateParams = {
 	messages: []
 }
 
-export const PROVIDER_COMPLETION_CONFIG_MAP: Record<AIProvider, ChatCompletionCreateParams> = {
+export const PROVIDER_COMPLETION_CONFIG_MAP: Record<ChatAIProvider, ChatCompletionCreateParams> = {
 	openai: DEFAULT_COMPLETION_CONFIG,
 	azure_openai: DEFAULT_COMPLETION_CONFIG,
 	azure_foundry: DEFAULT_COMPLETION_CONFIG,
@@ -746,6 +792,20 @@ function getAnthropicStreamingCompletion({
 					model: params.modelProvider.model,
 					choices: [{ index: 0, delta: { content: event.delta.text }, finish_reason: null }]
 				}
+			} else if (event.type === 'message_delta' && event.delta.stop_reason) {
+				yield {
+					id: '',
+					object: 'chat.completion.chunk',
+					created: 0,
+					model: params.modelProvider.model,
+					choices: [
+						{
+							index: 0,
+							delta: {},
+							finish_reason: event.delta.stop_reason === 'max_tokens' ? 'length' : 'stop'
+						}
+					]
+				}
 			}
 		}
 	}
@@ -1158,12 +1218,18 @@ export async function getCompletion(
 		openaiClient?: OpenAI
 		reasoningEffort?: string
 		promptCaching?: boolean
+		maxTokensCap?: number
 	}
 ): Promise<Stream<ChatCompletionChunk>> {
 	const modelProvider = options?.forceModelProvider ?? getCurrentModel()
 
 	if (usesAnthropicMessagesApi(modelProvider.provider, modelProvider.model)) {
-		return getAnthropicStreamingCompletion({ messages, modelProvider, abortController })
+		return getAnthropicStreamingCompletion({
+			messages,
+			modelProvider,
+			abortController,
+			maxTokensCap: options?.maxTokensCap
+		})
 	}
 
 	const { provider, config } = getProviderAndCompletionConfig({
@@ -1171,6 +1237,7 @@ export async function getCompletion(
 		stream: true,
 		tools,
 		forceModelProvider: options?.forceModelProvider,
+		maxTokensCap: options?.maxTokensCap,
 		promptCaching: options?.promptCaching,
 		reasoningEffort: options?.reasoningEffort
 	})
@@ -1181,7 +1248,8 @@ export async function getCompletion(
 			const stream = getOpenAIResponsesCompletionStream(messages, abortController, tools, {
 				forceModelProvider: options?.forceModelProvider,
 				openaiClient: options?.openaiClient,
-				reasoningEffort: options?.reasoningEffort
+				reasoningEffort: options?.reasoningEffort,
+				maxTokensCap: options?.maxTokensCap
 			}) as any
 			return stream
 		} catch (error) {
@@ -1223,6 +1291,51 @@ export async function getCompletion(
 	return completion
 }
 
+/**
+ * Streams a completion and returns its whole text. For a generation that can run
+ * for minutes: a non-streaming request sends no byte until the model is done, so
+ * an idle timeout on any hop between the browser and the provider cuts it.
+ */
+export async function getStreamedCompletionText(
+	messages: ChatCompletionMessageParam[],
+	abortController: AbortController,
+	options?: { maxTokensCap?: number }
+): Promise<string> {
+	const drain = async (forceCompletions: boolean) => {
+		const stream = await getCompletion(messages, abortController, undefined, {
+			forceCompletions,
+			maxTokensCap: options?.maxTokensCap
+		})
+		let text = ''
+		let finished = false
+		for await (const chunk of stream) {
+			text += getResponseFromEvent(chunk)
+			finished ||= !!chunk.choices?.[0]?.finish_reason
+		}
+		// The OpenAI SDK ends an aborted stream, and one closed early by a hop in
+		// between, without throwing: partial text must not pass for the whole
+		// completion.
+		abortController.signal.throwIfAborted()
+		if (!finished) {
+			throw new Error('The completion stream ended before the model finished')
+		}
+		return text
+	}
+
+	try {
+		return await drain(false)
+	} catch (error) {
+		// The Responses API stream only fails once iterated, so the fallback to
+		// chat completions for a deployment that doesn't serve it lives here.
+		const { provider } = getCurrentModel()
+		if (abortController.signal.aborted || (provider !== 'openai' && provider !== 'azure_openai')) {
+			throw error
+		}
+		console.error('Error using Responses API:', error)
+		return drain(true)
+	}
+}
+
 function extractFirstJSON(str: string) {
 	let depth = 0,
 		i = 0
@@ -1260,6 +1373,7 @@ export async function parseOpenAICompletion(
 		workspace?: string
 		provider?: string
 		onTokenUsage?: (usage: ChatTokenUsage) => void
+		live?: LiveToolSet
 	}
 ): Promise<{ shouldContinue: boolean; tokenUsage: ChatTokenUsage }> {
 	const finalToolCalls: Record<number, ChatCompletionChunk.Choice.Delta.ToolCall> = {}
@@ -1471,7 +1585,8 @@ export async function parseOpenAICompletion(
 				helpers,
 				toolCallbacks: callbacks,
 				workspace: options?.workspace,
-				messages
+				messages,
+				live: options?.live
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
diff --git a/frontend/src/lib/components/copilot/reasoningParity.json b/frontend/src/lib/components/copilot/reasoningParity.json
index 93b8ac7eb2..1f20def9be 100644
--- a/frontend/src/lib/components/copilot/reasoningParity.json
+++ b/frontend/src/lib/components/copilot/reasoningParity.json
@@ -47,6 +47,12 @@
 		"canDisable": false,
 		"completionsToolsNeedOff": true
 	},
+	{
+		"provider": "openai",
+		"model": "gpt-6.1-sol",
+		"canDisable": false,
+		"completionsToolsNeedOff": true
+	},
 	{
 		"provider": "openai",
 		"model": "gpt-6-sol",
diff --git a/frontend/src/lib/components/copilot/reasoningRegistry.ts b/frontend/src/lib/components/copilot/reasoningRegistry.ts
index 68934c22f3..0cbf935832 100644
--- a/frontend/src/lib/components/copilot/reasoningRegistry.ts
+++ b/frontend/src/lib/components/copilot/reasoningRegistry.ts
@@ -131,9 +131,10 @@ const BEDROCK_RULES: ReasoningRule[] = [
 // Azure names gpt-3.5 `gpt-35-turbo`. `minimal` exists on gpt-5 only, `xhigh` from
 // gpt-5.5, `max` from gpt-5.6.
 const OPENAI_RULES: ReasoningRule[] = [
-	// Live-verified: astra takes low..max only, where sol and luna also take `none`.
+	// Live-verified: gpt-6-astra and gpt-6.1-sol take low..max only, where gpt-6-sol and
+	// gpt-6-luna also take `none`.
 	{
-		match: /(?:^|\/)gpt-6-astra/,
+		match: /(?:^|\/)gpt-6(?:-astra|\.1-sol)/,
 		levels: LOW_TO_MAX,
 		canDisable: false,
 		completionsToolsNeedOff: true
diff --git a/frontend/src/lib/components/custom_ui.ts b/frontend/src/lib/components/custom_ui.ts
index 2a3e6a2176..5b89d867ab 100644
--- a/frontend/src/lib/components/custom_ui.ts
+++ b/frontend/src/lib/components/custom_ui.ts
@@ -36,6 +36,8 @@ export type FlowBuilderWhitelabelCustomUi = {
 	languages?: (SupportedLanguage | 'docker' | 'bunnative')[]
 	scriptFork?: boolean
 	scriptEdit?: boolean
+	/** Set to false to hide the inline step's "Save to workspace" button. */
+	saveToWorkspace?: boolean
 	tagEdit?: boolean
 	editorBar?: EditorBarUi
 	downloadLogs?: boolean
diff --git a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
index a3a765014a..f4b7f1df60 100644
--- a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
+++ b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
@@ -1,36 +1,48 @@
 <script lang="ts">
 	import { WorkspaceService, type AclChange, type AclTarget, type DatatableAclInfo } from '$lib/gen'
 	import { resource } from 'runed'
-	import { Trash2 } from 'lucide-svelte'
+	import type { Snippet } from 'svelte'
+	import { Tooltip } from '../meltComponents'
+	import { KeyRound, Trash2 } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { Alert, Button } from '../common'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
 	import Select from '../select/Select.svelte'
+	import PgGrantBuilder from './PgGrantBuilder.svelte'
 	import DataTable from '../table/DataTable.svelte'
 	import Head from '../table/Head.svelte'
 	import Row from '../table/Row.svelte'
 	import Cell from '../table/Cell.svelte'
-	import PgGrantBuilder from './PgGrantBuilder.svelte'
+	import Badge from '../common/badge/Badge.svelte'
 	import {
 		ADMIN_ROLE,
 		blockingSources,
 		grantKey,
-		grantScopeLabel,
+		grantCoverage,
+		scopesOf,
 		groupGrants,
 		revocablePrivileges,
 		revokeScopeOf,
-		uncoveredCreators
+		uncoveredCreators,
+		type AclScope,
+		type GroupedGrant
 	} from './aclScopes'
 
 	let {
 		workspace,
 		datatable,
-		target
+		target,
+		disabledReason,
+		manageRoles
 	}: {
 		workspace: string
 		datatable: string
 		/** What owner and grants are read and written for. */
 		target: AclTarget
+		/** Shows owner and grants without letting them change, with this reason on hover. */
+		disabledReason?: string
+		/** Offered at the bottom of every role picker. `blocker` keeps the entry, disabled, with why. */
+		manageRoles?: { open: () => void; blocker?: string }
 	} = $props()
 
 	const acl = resource(
@@ -45,6 +57,11 @@
 			})
 	)
 
+	/** Re-read owner, grants and the roles they can name, e.g. after the data table's roles changed. */
+	export function refresh() {
+		acl.refetch()
+	}
+
 	// Nothing is written before its SQL has been shown, and the apply runs exactly that SQL: the
 	// server plans again and refuses if the result differs.
 	let pending = $state<
@@ -54,7 +71,32 @@
 	let applying = $state(false)
 
 	const info: DatatableAclInfo | undefined = $derived(acl.current)
+	const controlsDisabled = $derived(planning || applying || !!disabledReason)
 	const grantRows = $derived(groupGrants(info?.grants ?? []))
+	// Several tags of one kind widen the list; tags of both kinds narrow it to grants matching each.
+	let roleFilters = $state<string[]>([])
+	let privilegeFilters = $state<string[]>([])
+	// A selected tag stays offered after its last grant goes, so it can still be cleared.
+	const roleChips = $derived(
+		[...new Set([...grantRows.map((g) => g.grantee), ...roleFilters])].sort()
+	)
+	const privilegeChips = $derived(
+		[...new Set([...grantRows.flatMap((g) => g.privileges), ...privilegeFilters])].sort()
+	)
+	const shownGrantRows = $derived(
+		grantRows.filter(
+			(g) =>
+				(roleFilters.length === 0 || roleFilters.includes(g.grantee)) &&
+				(privilegeFilters.length === 0 || g.privileges.some((p) => privilegeFilters.includes(p)))
+		)
+	)
+	/** What a grant on the object itself reads as, in the scope picker's words. */
+	const targetLabel = $derived(scopesOf(target.kind)[0].label)
+	// Most grants are on the object itself, which the column would only repeat.
+	const showCoverage = $derived(grantRows.some((g) => grantCoverage(g, target) !== undefined))
+	const columns = $derived(showCoverage ? 4 : 3)
+	const toggled = (list: string[], value: string) =>
+		list.includes(value) ? list.filter((v) => v !== value) : [...list, value]
 	const ownerItems = $derived(
 		info
 			? (info.roles.includes(info.owner) ? info.roles : [info.owner, ...info.roles]).map((r) => ({
@@ -68,6 +110,28 @@
 		pending?.change.type === 'revoke' && (pending.change.objects?.length ?? 0) > 1
 	)
 
+	/** Why a row's delete button is disabled, or undefined when it can revoke. */
+	function unrevocableReason(
+		grant: GroupedGrant,
+		revokeScope: AclScope | undefined,
+		revocable: string[],
+		blocked: string[]
+	): string | undefined {
+		// What `admin` holds is what every role here connects through.
+		if (grant.grantee === ADMIN_ROLE)
+			return 'admin is the connection every role reaches this data table through, so its grants are not changed here'
+		if (!info?.roles.includes(grant.grantee))
+			return `Only grants to this data table's roles are revoked here, and ${grant.grantee} is not one`
+		if (!revokeScope) return 'Grants on types are read only here'
+		if (revocable.length === 0)
+			return grant.future
+				? 'Default privileges set database-wide are not revoked from here'
+				: "CONNECT follows the data table's roles and TEMPORARY is left as Postgres sets it, so nothing here can be revoked"
+		if (blocked.length > 0)
+			return `Only ${blocked.join(', ')} can revoke this: Postgres takes a grant back through the role that made it`
+		return undefined
+	}
+
 	function errorText(e: any): string {
 		return e?.body ?? e?.message ?? String(e)
 	}
@@ -108,6 +172,60 @@
 	}
 </script>
 
+<!-- A disabled control receives no hover, so the tooltip's trigger is a wrapper the hover falls
+     through to. -->
+{#snippet withDisabledReason(content: Snippet, widthClass: string)}
+	{#if disabledReason}
+		<Tooltip class="block {widthClass}" anchor="cursor">
+			<div class="pointer-events-none">{@render content()}</div>
+			{#snippet text()}{disabledReason}{/snippet}
+		</Tooltip>
+	{:else}
+		{@render content()}
+	{/if}
+{/snippet}
+
+<!-- The home page's filter chips, any number of them selected at once. -->
+{#snippet filterChip(label: string, selected: boolean, toggle: () => void)}
+	<Badge color="transparent" clickable {selected} onclick={toggle}>
+		{label}
+		{#if selected}&cross;{/if}
+	</Badge>
+{/snippet}
+
+<!-- Styled like the picker's tags in the row that creates a grant. -->
+{#snippet tag(text: string)}
+	<span class="inline-flex items-center min-h-6 px-2 border bg-surface rounded-full text-emphasis">
+		{text}
+	</span>
+{/snippet}
+
+{#snippet manageRolesEntry({ close }: { close: () => void })}
+	<div class="flex items-center gap-1 border-t p-1">
+		<Button
+			unifiedSize="sm"
+			variant="subtle"
+			startIcon={{ icon: KeyRound }}
+			disabled={!!manageRoles?.blocker}
+			btnClasses="w-full justify-start"
+			wrapperClasses="grow"
+			onClick={() => {
+				close()
+				manageRoles?.open()
+			}}
+		>
+			Manage roles
+		</Button>
+		{#if manageRoles?.blocker}
+			<span class="pr-2 flex">
+				<Tooltip>
+					{#snippet text()}{manageRoles?.blocker}{/snippet}
+				</Tooltip>
+			</span>
+		{/if}
+	</div>
+{/snippet}
+
 {#if acl.error}
 	<Alert type="error" title="Could not read access" size="xs">{errorText(acl.error)}</Alert>
 {:else if !info}
@@ -137,22 +255,26 @@
 					</span>
 				</div>
 				{#if info.editable}
-					<Select
-						items={ownerItems}
-						disabled={planning || applying}
-						size="sm"
-						class="w-64"
-						bind:value={
-							() => info.owner,
-							(role) => {
-								// The select shows what the database says; a pick is a request, and only the
-								// applied change moves it.
-								if (role && role !== info.owner) {
-									confirm({ type: 'set_owner', role }, `Ownership transferred to ${role}`)
+					{#snippet ownerSelect()}
+						<Select
+							items={ownerItems}
+							disabled={controlsDisabled}
+							size="sm"
+							class="w-64"
+							bind:value={
+								() => info.owner,
+								(role) => {
+									// The select shows what the database says; a pick is a request, and only the
+									// applied change moves it.
+									if (role && role !== info.owner) {
+										confirm({ type: 'set_owner', role }, `Ownership transferred to ${role}`)
+									}
 								}
 							}
-						}
-					/>
+							bottomSnippet={manageRoles ? manageRolesEntry : undefined}
+						/>
+					{/snippet}
+					{@render withDisabledReason(ownerSelect, 'w-64')}
 				{:else}
 					<span class="font-mono text-xs">{info.owner}</span>
 				{/if}
@@ -168,75 +290,76 @@
 						: 'What each role may do here, beyond what it owns.'}
 				</span>
 			</div>
-			{#if info.editable}
-				<PgGrantBuilder
-					{target}
-					roles={info.roles}
-					disabled={planning || applying}
-					supportsMaintain={info.supports_maintain}
-					dbname={info.dbname}
-					onAdd={({ role, privileges, scope }) =>
-						confirm(
-							{ type: 'grant', role, privileges, scope },
-							`Granted ${privileges.join(', ')} to ${role}`
-						)}
-				/>
+			<!-- A set filter keeps its chips, or a revoke that leaves one grant would strand it. -->
+			{#if grantRows.length > 1 || roleFilters.length > 0 || privilegeFilters.length > 0}
+				<div class="flex flex-wrap items-center gap-2">
+					{#each roleChips as role (`role:${role}`)}
+						{@render filterChip(role, roleFilters.includes(role), () => {
+							roleFilters = toggled(roleFilters, role)
+						})}
+					{/each}
+					{#each privilegeChips as privilege (`privilege:${privilege}`)}
+						{@render filterChip(privilege, privilegeFilters.includes(privilege), () => {
+							privilegeFilters = toggled(privilegeFilters, privilege)
+						})}
+					{/each}
+				</div>
 			{/if}
-			{#if grantRows.length === 0}
-				<span class="text-xs text-secondary">No grants yet.</span>
-			{:else}
-				<DataTable size="xs">
-					<Head>
-						<tr>
-							<Cell head first>Role</Cell>
-							<Cell head>Privileges</Cell>
+			<DataTable size="xs">
+				<Head>
+					<tr>
+						<Cell head first>Role</Cell>
+						<Cell head>Privileges</Cell>
+						{#if showCoverage}
 							<Cell head>On</Cell>
-							<Cell head last></Cell>
-						</tr>
-					</Head>
-					<tbody class="divide-y">
-						{#each grantRows as grant (grantKey(grant))}
-							{@const revokeScope = revokeScopeOf(grant)}
-							{@const revocable = revocablePrivileges(grant, target)}
-							{@const blocked = blockingSources(grant, revocable)}
-							{@const uncovered = uncoveredCreators(grant, info.roles)}
-							<Row>
-								<Cell first>{grant.grantee}</Cell>
-								<Cell wrap
-									><span class="font-mono text-2xs">{grant.privileges.join(', ')}</span></Cell
-								>
-								<Cell wrap>
-									{grantScopeLabel(grant)}
-									{#if blocked.length > 0}
-										<span
-											class="text-2xs text-secondary"
-											title="Only this role can take the grant back: Postgres revokes a grant through the role that made it"
-										>
-											from {blocked.join(', ')}
-										</span>
-									{/if}
-									{#if uncovered.length > 0}
-										<span
-											class="text-2xs text-secondary"
-											title="A default privilege covers only the roles it was granted for: grant it again to cover these"
-										>
-											· not for what {uncovered.join(', ')}
-											{uncovered.length === 1 ? 'creates' : 'create'}
-										</span>
-									{/if}
+						{/if}
+						<Cell head last />
+					</tr>
+				</Head>
+				<tbody class="divide-y">
+					{#each shownGrantRows as grant (grantKey(grant))}
+						{@const revokeScope = revokeScopeOf(grant)}
+						{@const revocable = revocablePrivileges(grant, target)}
+						{@const blocked = blockingSources(grant, revocable)}
+						{@const uncovered = uncoveredCreators(grant, info.roles)}
+						{@const unrevocable = unrevocableReason(grant, revokeScope, revocable, blocked)}
+						<Row>
+							<Cell first class="font-medium text-emphasis">{grant.grantee}</Cell>
+							<Cell wrap>
+								<div class="flex flex-wrap items-center gap-1">
+									{#each grant.privileges as privilege (privilege)}
+										{@render tag(privilege)}
+									{/each}
+								</div>
+								{#if blocked.length > 0 || uncovered.length > 0}
+									<div class="mt-0.5 text-2xs text-secondary">
+										{[
+											blocked.length > 0 && `granted by ${blocked.join(', ')}`,
+											uncovered.length > 0 &&
+												`not for what ${uncovered.join(', ')} ${uncovered.length === 1 ? 'creates' : 'create'}: a default privilege only covers the roles it was granted for`
+										]
+											.filter(Boolean)
+											.join(' · ')}
+									</div>
+								{/if}
+							</Cell>
+							{#if showCoverage}
+								<Cell wrap class="text-secondary">
+									{grantCoverage(grant, target) ?? targetLabel}
 								</Cell>
-								<Cell last>
-									<!-- What `admin` holds is what every role here connects through, so it is not
-									this editor's to take away. -->
-									{#if info.editable && revokeScope && revocable.length > 0 && blocked.length === 0 && info.roles.includes(grant.grantee) && grant.grantee !== ADMIN_ROLE}
+							{/if}
+							<Cell last class="w-10">
+								{#if info.editable}
+									{#snippet revokeButton()}
 										<Button
 											unifiedSize="xs"
 											variant="subtle"
 											iconOnly
 											startIcon={{ icon: Trash2 }}
-											title="Revoke {revocable.join(', ')}"
-											disabled={planning || applying}
-											onClick={() =>
+											title={unrevocable ?? `Revoke ${revocable.join(', ')}`}
+											disabled={controlsDisabled || !!unrevocable}
+											onClick={() => {
+												if (!revokeScope) return
 												confirm(
 													{
 														type: 'revoke',
@@ -246,15 +369,52 @@
 														objects: grant.objects
 													},
 													`Revoked ${revocable.join(', ')} from ${grant.grantee}`
-												)}
+												)
+											}}
 										/>
+									{/snippet}
+									{#if unrevocable && !disabledReason}
+										<Tooltip>
+											<div class="pointer-events-none">{@render revokeButton()}</div>
+											{#snippet text()}{unrevocable}{/snippet}
+										</Tooltip>
+									{:else}
+										{@render withDisabledReason(revokeButton, 'w-fit')}
 									{/if}
-								</Cell>
-							</Row>
-						{/each}
-					</tbody>
-				</DataTable>
-			{/if}
+								{/if}
+							</Cell>
+						</Row>
+					{:else}
+						<Row>
+							<Cell first last colspan={columns} class="text-secondary">
+								{grantRows.length === 0 ? 'No grants yet.' : 'No grant matches the filters.'}
+							</Cell>
+						</Row>
+					{/each}
+					{#if info.editable}
+						<!-- The grant to create: a row of the table, set apart until it exists. -->
+						<Row class="bg-surface-secondary">
+							<Cell first last colspan={columns}>
+								{#snippet grantBuilder()}
+									<PgGrantBuilder
+										{target}
+										roles={info.roles}
+										disabled={controlsDisabled}
+										manageRoles={manageRoles ? manageRolesEntry : undefined}
+										supportsMaintain={info.supports_maintain}
+										onAdd={({ role, privileges, scope }) =>
+											confirm(
+												{ type: 'grant', role, privileges, scope },
+												`Granted ${privileges.join(', ')} to ${role}`
+											)}
+									/>
+								{/snippet}
+								{@render withDisabledReason(grantBuilder, 'w-full')}
+							</Cell>
+						</Row>
+					{/if}
+				</tbody>
+			</DataTable>
 		</section>
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte b/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
index 5e5119abb6..745c1a1db5 100644
--- a/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
+++ b/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
@@ -1,17 +1,18 @@
 <script lang="ts">
 	import type { AclTarget } from '$lib/gen'
+	import type { Snippet } from 'svelte'
 	import { Plus } from 'lucide-svelte'
 	import { Button } from '../common'
 	import Select from '../select/Select.svelte'
 	import MultiSelect from '../select/MultiSelect.svelte'
-	import { privilegesOf, scopeSql, scopesOf, type AclScope } from './aclScopes'
+	import { privilegesOf, scopesOf, type AclScope } from './aclScopes'
 
 	let {
 		target,
 		roles,
 		supportsMaintain = false,
-		dbname,
 		disabled = false,
+		manageRoles,
 		onAdd
 	}: {
 		target: AclTarget
@@ -19,9 +20,9 @@
 		roles: string[]
 		/** Postgres 17+, which has one more table privilege to offer. */
 		supportsMaintain?: boolean
-		/** Names the database in the statement a database target builds. */
-		dbname?: string
 		disabled?: boolean
+		/** Rendered at the bottom of the role picker, to reach the data table's roles. */
+		manageRoles?: Snippet<[{ close: () => void }]>
 		onAdd: (grant: { role: string; privileges: string[]; scope: AclScope }) => void
 	} = $props()
 
@@ -29,26 +30,24 @@
 	let scope = $state<AclScope>('target')
 	let privileges = $state<string[]>([])
 
+	const scopes = $derived(scopesOf(target.kind))
 	const available = $derived(privilegesOf(scope, target.kind, supportsMaintain))
-	const statement = $derived(
-		privileges.length && role
-			? `GRANT ${privileges.join(', ')} ON ${scopeSql(scope, target, dbname)} TO ${role}`
-			: undefined
-	)
 </script>
 
-<div class="flex flex-col gap-2 border rounded-md p-3">
-	<div class="flex flex-wrap items-center gap-2 text-xs text-secondary">
-		<span class="font-mono text-primary">GRANT</span>
-		<MultiSelect
-			bind:value={privileges}
-			items={available.map((p) => ({ value: p, label: p }))}
-			placeholder="privileges"
-			{disabled}
-			size="sm"
-			class="min-w-48"
-		/>
-		<span class="font-mono text-primary">ON</span>
+<!-- Laid out like the grants above it, so it reads as the statement it will run. -->
+<div class="flex items-center gap-2 text-xs text-secondary">
+	<span class="font-mono shrink-0">GRANT</span>
+	<MultiSelect
+		bind:value={privileges}
+		items={available.map((p) => ({ value: p, label: p }))}
+		placeholder="privileges"
+		{disabled}
+		size="md"
+		class="min-w-0 flex-[4]"
+	/>
+	<!-- A database or a table has only itself to grant on. -->
+	{#if scopes.length > 1}
+		<span class="font-mono shrink-0">ON</span>
 		<Select
 			bind:value={
 				() => scope,
@@ -61,35 +60,34 @@
 					privileges = privileges.filter((p) => allowed.includes(p))
 				}
 			}
-			items={scopesOf(target.kind)}
+			items={scopes}
 			{disabled}
-			size="sm"
-			class="w-52"
+			size="md"
+			class="min-w-0 flex-[3]"
 		/>
-		<span class="font-mono text-primary">TO</span>
-		<Select
-			bind:value={role}
-			items={roles.map((r) => ({ value: r, label: r }))}
-			placeholder="role"
-			{disabled}
-			size="sm"
-			class="w-40"
-		/>
-		<Button
-			unifiedSize="sm"
-			variant="default"
-			startIcon={{ icon: Plus }}
-			disabled={disabled || !role || privileges.length === 0}
-			onClick={() => {
-				if (!role) return
-				onAdd({ role, privileges: [...privileges], scope })
-				privileges = []
-			}}
-		>
-			Add
-		</Button>
-	</div>
-	{#if statement}
-		<pre class="text-2xs text-tertiary overflow-x-auto">{statement}</pre>
 	{/if}
+	<span class="font-mono shrink-0">TO</span>
+	<Select
+		bind:value={role}
+		items={roles.map((r) => ({ value: r, label: r }))}
+		placeholder="role"
+		{disabled}
+		size="md"
+		class="min-w-0 flex-[2]"
+		bottomSnippet={manageRoles}
+	/>
+	<Button
+		unifiedSize="md"
+		variant="default"
+		wrapperClasses="shrink-0"
+		startIcon={{ icon: Plus }}
+		disabled={disabled || !role || privileges.length === 0}
+		onClick={() => {
+			if (!role) return
+			onAdd({ role, privileges: [...privileges], scope })
+			privileges = []
+		}}
+	>
+		Create
+	</Button>
 </div>
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
index 7c01836e89..aa385ea5af 100644
--- a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
@@ -3,10 +3,12 @@ import type { AclGrant } from '$lib/gen'
 import {
 	blockingSources,
 	grantKey,
+	grantCoverage,
 	groupGrants,
 	revocablePrivileges,
 	revokeScopeOf,
-	uncoveredCreators
+	uncoveredCreators,
+	type GroupedGrant
 } from './aclScopes'
 
 const table = (name: string) => ({ name, kind: 'TABLE' })
@@ -176,3 +178,29 @@ describe('uncoveredCreators', () => {
 		).toEqual([])
 	})
 })
+
+describe('grantCoverage', () => {
+	const schema = { kind: 'schema' as const, schema: 'sales' }
+	const row = (grant: Partial<GroupedGrant>): GroupedGrant => ({
+		grantee: 'analytics',
+		privileges: ['SELECT'],
+		objects: [],
+		sources: [],
+		...grant
+	})
+
+	it('says nothing for the object itself, and names what is created later', () => {
+		expect(grantCoverage(row({}), schema)).toBeUndefined()
+		expect(grantCoverage(row({ future: 'TABLES' }), schema)).toBe('tables created later')
+		expect(grantCoverage(row({ future: 'TABLES' }), { kind: 'database' })).toBe(
+			'tables created later, in every schema'
+		)
+	})
+
+	it('names a routine with its arguments, and summarizes past three objects', () => {
+		const routine = row({ objects: [{ name: 'refresh', kind: 'FUNCTION', args: 'integer' }] })
+		expect(grantCoverage(routine, schema)).toBe('function refresh(integer)')
+		const many = row({ objects: ['a', 'b', 'c', 'd', 'e'].map(table) })
+		expect(grantCoverage(many, schema)).toBe('tables a, b, c and 2 more')
+	})
+})
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.ts b/frontend/src/lib/components/datatableAcl/aclScopes.ts
index d5b8ad9d20..4127920c1d 100644
--- a/frontend/src/lib/components/datatableAcl/aclScopes.ts
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.ts
@@ -73,28 +73,6 @@ export function privilegesOf(
 	}
 }
 
-/** What a statement built at this scope reads as, for the builder's own preview. */
-export function scopeSql(scope: AclScope, target: AclTarget, dbname?: string): string {
-	if (target.kind === 'database') return `DATABASE ${dbname ?? ''}`.trim()
-	const schema = target.schema
-	switch (scope) {
-		case 'target':
-			return target.kind === 'schema' ? `SCHEMA ${schema}` : `TABLE ${schema}.${target.table}`
-		case 'all_tables':
-			return `ALL TABLES IN SCHEMA ${schema}`
-		case 'all_sequences':
-			return `ALL SEQUENCES IN SCHEMA ${schema}`
-		case 'all_functions':
-			return `ALL FUNCTIONS IN SCHEMA ${schema}`
-		case 'future_tables':
-			return `TABLES (default privileges in ${schema})`
-		case 'future_sequences':
-			return `SEQUENCES (default privileges in ${schema})`
-		case 'future_functions':
-			return `FUNCTIONS (default privileges in ${schema})`
-	}
-}
-
 /** One row of the grants table: the same privileges on several objects read as one line, since
  * granting them per object is what `ON ALL TABLES` does. */
 export type GroupedGrant = {
@@ -195,17 +173,21 @@ export function revocablePrivileges(grant: GroupedGrant, target: AclTarget): str
 	return grant.privileges
 }
 
-/** How a row reads back: what it covers, in one phrase. */
-export function grantScopeLabel(grant: GroupedGrant): string {
-	if (grant.future) return `${grant.future.toLowerCase()} created later`
-	if (grant.objects.length === 1) {
-		const object = grant.objects[0]
-		// A routine's arguments are part of what it is, so two of the same name would otherwise
-		// read as one row twice.
-		const args = object.args !== undefined ? `(${object.args})` : ''
-		return `${object.kind.toLowerCase()} ${object.name}${args}`
+/** How many objects a folded row names before it summarizes the rest. */
+const LISTED_OBJECTS = 3
+
+/** What a row covers, when that is not the editor's own object: the objects inside it, or what is
+ * created later. Undefined for a grant on the object itself, which needs no saying. */
+export function grantCoverage(grant: GroupedGrant, target: AclTarget): string | undefined {
+	if (grant.future) {
+		const created = `${grant.future.toLowerCase()} created later`
+		return target.kind === 'database' ? `${created}, in every schema` : created
 	}
-	if (grant.objects.length > 1)
-		return `${grant.objects.length} ${grant.objects[0].kind.toLowerCase()}s`
-	return 'itself'
+	if (grant.objects.length === 0) return undefined
+	// A routine's arguments are part of what it is: two of the same name are different objects.
+	const names = grant.objects.map((o) => (o.args !== undefined ? `${o.name}(${o.args})` : o.name))
+	const listed = names.slice(0, LISTED_OBJECTS).join(', ')
+	const rest = names.length - LISTED_OBJECTS
+	const kind = grant.objects[0].kind.toLowerCase()
+	return `${names.length > 1 ? `${kind}s` : kind} ${listed}${rest > 0 ? ` and ${rest} more` : ''}`
 }
diff --git a/frontend/src/lib/components/dbTableFilters.ts b/frontend/src/lib/components/dbTableFilters.ts
index 9d9c83e6b0..c3266b3ac7 100644
--- a/frontend/src/lib/components/dbTableFilters.ts
+++ b/frontend/src/lib/components/dbTableFilters.ts
@@ -52,7 +52,7 @@ export function buildDbTableFilterSchema(columns: ColumnDef[]): DbTableFilterSch
 	const columnOfKey: Record<string, string> = {}
 	const keyOfColumn: Record<string, string> = {}
 	for (const col of columns) {
-		if (!col.field) continue
+		if (!col.field || col.filterable === false) continue
 		let base = col.field.replace(/\W+/g, '_') || 'column'
 		if (base === FREE_TEXT_KEY) base = `${base}col`
 		let key = base
diff --git a/frontend/src/lib/components/dbTypes.ts b/frontend/src/lib/components/dbTypes.ts
index e6d3af12e8..2bb2a92e14 100644
--- a/frontend/src/lib/components/dbTypes.ts
+++ b/frontend/src/lib/components/dbTypes.ts
@@ -32,6 +32,9 @@ export const isDbType = (str?: string): str is DbType => !!str && dbTypes.includ
 
 /** The role every data table has: the one it connects as when it is not under roles. */
 export const ADMIN_DATATABLE_ROLE = 'admin'
+/** What `default_role` holds for a data table with no default role. Mirrors the backend's
+ * `NO_DEFAULT_DATATABLE_ROLE`. */
+export const NO_DEFAULT_DATATABLE_ROLE = '$none'
 
 /** What the server accepts in `-- role <name>` and `?role=<name>`. */
 export function isDatatableRoleName(name: string): boolean {
@@ -52,7 +55,13 @@ export function defaultMigrationRole(
 	permissioned: boolean | undefined,
 	defaultRole: string | undefined
 ): string | undefined {
-	return permissioned && !datatableNameTakesRole(name) ? defaultRole : undefined
+	return permissioned && !datatableNameTakesRole(name) ? namedDefaultRole(defaultRole) : undefined
+}
+
+/** A data table's default role, or `undefined` when it has none: the server reports that as
+ * `NO_DEFAULT_DATATABLE_ROLE`, which is not a role anything can connect as. */
+export function namedDefaultRole(defaultRole: string | undefined): string | undefined {
+	return defaultRole === NO_DEFAULT_DATATABLE_ROLE ? undefined : defaultRole
 }
 
 /** `datatable://<name>`, with `?role=<role>` when a role is named. Throws rather than build a
diff --git a/frontend/src/lib/components/dbt/DbtModelGraph.svelte b/frontend/src/lib/components/dbt/DbtModelGraph.svelte
index bd7f42a9e7..12b008812d 100644
--- a/frontend/src/lib/components/dbt/DbtModelGraph.svelte
+++ b/frontend/src/lib/components/dbt/DbtModelGraph.svelte
@@ -16,7 +16,6 @@
 	import { Button } from '$lib/components/common'
 	import { Loader2, RefreshCw } from 'lucide-svelte'
 	import { displayDate } from '$lib/utils'
-	import { base } from '$lib/base'
 	import AssetGraphCanvas from '$lib/components/assets/AssetGraph/AssetGraphCanvas.svelte'
 	import type { DbtPreviewBuffer } from './previewRows'
 	import type {
@@ -477,7 +476,7 @@
 			worker tag nothing serves waits here indefinitely.
 			<a
 				class="text-blue-500 hover:underline"
-				href="{base}/run/{refreshPending}?workspace={workspace}"
+				href="/run/{refreshPending}?workspace={workspace}"
 				target="_blank"
 				rel="noreferrer">Open the parse job</a
 			>
@@ -491,7 +490,7 @@
 			{#if refreshError.job}
 				<a
 					class="text-blue-500 hover:underline"
-					href="{base}/run/{refreshError.job}?workspace={workspace}"
+					href="/run/{refreshError.job}?workspace={workspace}"
 					target="_blank"
 					rel="noreferrer">Open the parse job</a
 				>
diff --git a/frontend/src/lib/components/details/DetailPageHeader.svelte b/frontend/src/lib/components/details/DetailPageHeader.svelte
index 72c39ba512..34a7fab355 100644
--- a/frontend/src/lib/components/details/DetailPageHeader.svelte
+++ b/frontend/src/lib/components/details/DetailPageHeader.svelte
@@ -3,10 +3,10 @@
 
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import ErrorHandlerToggleButton from './ErrorHandlerToggleButton.svelte'
-	import { twMerge } from 'tailwind-merge'
-	import { userStore } from '$lib/stores'
-	import { createEventDispatcher, getContext, tick } from 'svelte'
+	import { createEventDispatcher, getContext, tick, type Snippet } from 'svelte'
 	import SummaryPathDisplay from '$lib/components/SummaryPathDisplay.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 	import type { TriggerContext } from '../triggers'
 	import type { Item } from '$lib/utils'
 	import { Bell, BellOff, Calendar } from 'lucide-svelte'
@@ -37,9 +37,10 @@
 	}
 
 	// An agent's page has no triggers, and so no context for them.
-	const { triggersCount, triggersState } = $state(
-		getContext<TriggerContext | undefined>('TriggerContext') ?? ({} as Partial<TriggerContext>)
-	)
+	const triggerContext = getContext<TriggerContext | undefined>('TriggerContext')
+	const { triggersCount, triggersState } = $state(triggerContext ?? ({} as Partial<TriggerContext>))
+	// The buttons below render in the page header, away from this page's tree.
+	const headerContexts = new Map<any, any>([['TriggerContext', triggerContext]])
 
 	interface Props {
 		mainButtons?: MainButton[]
@@ -49,6 +50,9 @@
 		tag?: string | undefined
 		/** Unset for what has no workspace error handler to mute, such as an agent. */
 		errorHandlerKind?: 'flow' | 'script'
+		/** What the rename popover is renaming, when that is not the error handler's kind — an
+		 *  agent has no error handler but is still renamed from here. */
+		itemKind?: 'flow' | 'script' | 'agent'
 		scriptOrFlowPath?: string
 		errorHandlerMuted?: boolean | undefined
 		labels?: string[] | undefined
@@ -56,6 +60,10 @@
 		onSaved?: (newPath: string) => void
 		children?: import('svelte').Snippet
 		trigger_badges?: import('svelte').Snippet
+		/** True for the route's own page: its header becomes the page header. A host that renders
+		 *  this inside something else — a session's preview panel — leaves it false and gets the
+		 *  row below. */
+		ownsPageHeader?: boolean
 		/** Whether the bar is wide enough to hold every button beside the summary, decided by
 		 * the layout from its own width. Not a viewport media query: the same page also renders
 		 * inside an AI session's preview panel, where the window is wide and the pane is not. */
@@ -71,6 +79,7 @@
 		path,
 		tag,
 		errorHandlerKind,
+		itemKind,
 		scriptOrFlowPath,
 		errorHandlerMuted = $bindable(),
 		labels = $bindable(),
@@ -78,13 +87,30 @@
 		onSaved,
 		children,
 		trigger_badges,
+		ownsPageHeader = false,
 		wide = true,
 		leading_actions
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
 
-	const barButtons = $derived(wide ? mainButtons : mainButtons.filter((b) => !b.narrow))
+	// A flow and a script are renamed as what their error handler already names them; an agent has
+	// no error handler and says so itself.
+	const renameKind = $derived(itemKind ?? errorHandlerKind)
+
+	// Two reasons the row can be too tight, and either one collapses it. The host knows when its
+	// own box is narrow while the window is not — a session's preview panel — and says so through
+	// `wide`. The band knows its own width, which the host cannot see: these buttons share that row
+	// with the breadcrumb, and the trail and summary want ~580px against the set's ~530. Unmeasured
+	// (0) counts as wide, because the bar measures itself on mount and starting narrow would pop
+	// the buttons out of the menu a frame later.
+	// Measured on a flow's page: a 1192px bar leaves the last button 4px past the edge, so the row
+	// has to fold before that rather than at the ~1150 the two parts add up to on paper.
+	const COLLAPSE_BELOW = 1250
+	const roomInBar = $derived(pageHeader.barWidth === 0 || pageHeader.barWidth >= COLLAPSE_BELOW)
+	const wideRow = $derived(wide && roomInBar)
+
+	const barButtons = $derived(wideRow ? mainButtons : mainButtons.filter((b) => !b.narrow))
 
 	function dropdownHost(btn: MainButton): MainButton | undefined {
 		if (typeof btn.narrow !== 'object') return undefined
@@ -104,7 +130,7 @@
 	}
 
 	const allMenuItems: Item[] = $derived([
-		...(wide ? [] : mainButtons.filter((b) => b.narrow && !dropdownHost(b))).map((b) => ({
+		...(wideRow ? [] : mainButtons.filter((b) => b.narrow && !dropdownHost(b))).map((b) => ({
 			displayName: b.label,
 			description: b.description,
 			icon: b.buttonProps.startIcon,
@@ -113,7 +139,7 @@
 			disabled: b.buttonProps.disabled,
 			type: 'action' as const
 		})),
-		...(wide || !errorHandlerKind
+		...(wideRow || !errorHandlerKind
 			? []
 			: [
 					{
@@ -129,12 +155,12 @@
 			action: item.onclick,
 			disabled: item.disabled,
 			type: item.color === 'red' ? ('delete' as const) : ('action' as const),
-			separatorTop: i === 0 && !wide
+			separatorTop: i === 0 && !wideRow
 		}))
 	])
 
 	function dropdownItemsOf(host: MainButton) {
-		if (wide) return undefined
+		if (wideRow) return undefined
 		const items = mainButtons
 			.filter((b) => dropdownHost(b) === host)
 			.map((b) => ({
@@ -149,74 +175,138 @@
 	}
 </script>
 
-<div class="border-b">
-	<div class="mx-auto">
-		<div
-			class="flex w-full flex-wrap md:flex-nowrap justify-end gap-x-2 gap-y-4 items-center min-h-12 py-2 md:py-0"
+{#snippet summaryContent()}
+	<SummaryPathDisplay
+		{summary}
+		{path}
+		bind:labels
+		{inheritedLabels}
+		{onSaved}
+		kind={renameKind}
+		compact
+	/>
+{/snippet}
+
+<!-- The same editor as the summary's, hung off the band's path segment so it opens under the path.
+     with the cursor in the path field. `bind:` cannot be spread, so `labels` is bound twice; both
+     instances bind the same slot and only one is ever open. -->
+{#snippet pathTrigger(pathLabel: Snippet, triggerClass: string)}
+	<SummaryPathDisplay
+		label={pathLabel}
+		{triggerClass}
+		focusField="path"
+		{summary}
+		{path}
+		bind:labels
+		{inheritedLabels}
+		{onSaved}
+		kind={renameKind}
+	/>
+{/snippet}
+
+<!-- The two halves of the row, rendered side by side in the band and in the two groups of the
+     row below. One copy each: a button added to one placement belongs in both. -->
+{#snippet badges(size: 'sm' | 'md')}
+	{#if tag}
+		<Badge>tag: {tag}</Badge>
+	{/if}
+	{@render children?.()}
+	{#if triggersState?.triggers?.some((t) => t.isPrimary && !t.isDraft)}
+		{@const primarySchedule = triggersState.triggers.findIndex((t) => t.isPrimary && !t.isDraft)}
+		<Button
+			btnClasses="inline-flex"
+			startIcon={{ icon: Calendar }}
+			variant="default"
+			unifiedSize={size}
+			on:click={async () => {
+				dispatch('seeTriggers')
+				await tick()
+				triggersState.selectedTriggerIndex = primarySchedule
+			}}
 		>
-			<div class="grow px-2 inline-flex items-center gap-4 min-w-0">
-				<div class={twMerge('min-w-0', $userStore?.operator ? 'pl-10' : '')}>
-					<SummaryPathDisplay
-						{summary}
-						{path}
-						bind:labels
-						{inheritedLabels}
-						{onSaved}
-						kind={errorHandlerKind}
-					/>
+			{$triggersCount?.primary_schedule?.schedule ?? ''}
+		</Button>
+	{/if}
+	{@render trigger_badges?.()}
+{/snippet}
+
+{#snippet controls(size: 'sm' | 'md')}
+	{@render leading_actions?.()}
+	{#if allMenuItems.length > 0}
+		{#key allMenuItems}
+			<DropdownV2 items={allMenuItems} placement="bottom-end" {size} />
+		{/key}
+	{/if}
+	{#if wideRow && errorHandlerKind && scriptOrFlowPath}
+		<ErrorHandlerToggleButton
+			kind={errorHandlerKind}
+			{scriptOrFlowPath}
+			bind:errorHandlerMuted
+			unifiedSize={size}
+		/>
+	{/if}
+	{#each barButtons as btn (btn.label)}
+		{@const dropdownItems = dropdownItemsOf(btn)}
+		<Button
+			{...btn.buttonProps}
+			startIcon={{ icon: btn.buttonProps.startIcon }}
+			unifiedSize={size}
+			{dropdownItems}
+			dropdownWidth={dropdownItems?.some((i) => i.description) ? 288 : undefined}
+			btnClasses="flex items-center gap-1 whitespace-nowrap"
+		>
+			{btn.label}
+		</Button>
+	{/each}
+{/snippet}
+
+{#snippet actions()}
+	{@render badges('sm')}
+	{@render controls('sm')}
+{/snippet}
+
+{#if ownsPageHeader}
+	<!-- The summary keeps its rename-and-labels popover here rather than becoming plain text in
+	     the breadcrumb: renaming a script or flow is done from this page, not from the trail. -->
+	<PageHeaderContent
+		item={{
+			kind: errorHandlerKind,
+			path,
+			summaryContent,
+			// Only where this page can save one: without `onSaved` the editor behind it has nothing
+			// to write, and the band keeps its own segment, which copies the path.
+			pathTrigger: onSaved ? pathTrigger : undefined
+		}}
+		{actions}
+		contexts={headerContexts}
+		separator="always"
+	/>
+{:else}
+	<!-- Nested in a session's preview panel, which has a band of its own above it naming the
+	     session. A page in there draws its own row instead: registering would rename the band to
+	     whatever the panel happens to be showing. -->
+	<div class="border-b">
+		<div class="mx-auto">
+			<div
+				class="flex w-full flex-wrap md:flex-nowrap justify-end gap-x-2 gap-y-4 items-center min-h-12 py-2 md:py-0"
+			>
+				<div class="grow px-2 inline-flex items-center gap-4 min-w-0">
+					<div class="min-w-0">
+						<SummaryPathDisplay
+							{summary}
+							{path}
+							bind:labels
+							{inheritedLabels}
+							{onSaved}
+							kind={renameKind}
+						/>
+					</div>
+					{@render badges('md')}
+				</div>
+				<div class="flex gap-1 items-center pr-4">
+					{@render controls('md')}
 				</div>
-				{#if tag}
-					<Badge>tag: {tag}</Badge>
-				{/if}
-				{@render children?.()}
-				{#if triggersState?.triggers?.some((t) => t.isPrimary && !t.isDraft)}
-					{@const primarySchedule = triggersState.triggers.findIndex(
-						(t) => t.isPrimary && !t.isDraft
-					)}
-					<Button
-						btnClasses="inline-flex"
-						startIcon={{ icon: Calendar }}
-						variant="contained"
-						color="light"
-						size="xs"
-						on:click={async () => {
-							dispatch('seeTriggers')
-							await tick()
-							triggersState.selectedTriggerIndex = primarySchedule
-						}}
-					>
-						{$triggersCount?.primary_schedule?.schedule ?? ''}
-					</Button>
-				{/if}
-				{@render trigger_badges?.()}
-			</div>
-			<div class="flex gap-1 items-center pr-4">
-				{@render leading_actions?.()}
-				{#if allMenuItems.length > 0}
-					{#key allMenuItems}
-						<DropdownV2 items={allMenuItems} placement="bottom-end" size="md" />
-					{/key}
-				{/if}
-				{#if wide && errorHandlerKind && scriptOrFlowPath}
-					<ErrorHandlerToggleButton
-						kind={errorHandlerKind}
-						{scriptOrFlowPath}
-						bind:errorHandlerMuted
-					/>
-				{/if}
-				{#each barButtons as btn (btn.label)}
-					{@const dropdownItems = dropdownItemsOf(btn)}
-					<Button
-						{...btn.buttonProps}
-						startIcon={{ icon: btn.buttonProps.startIcon }}
-						{dropdownItems}
-						dropdownWidth={dropdownItems?.some((i) => i.description) ? 288 : undefined}
-						btnClasses="flex items-center gap-1 whitespace-nowrap"
-					>
-						{btn.label}
-					</Button>
-				{/each}
 			</div>
 		</div>
 	</div>
-</div>
+{/if}
diff --git a/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte b/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte
index 49622c8af2..48e833e2ff 100644
--- a/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte
+++ b/frontend/src/lib/components/details/ErrorHandlerToggleButton.svelte
@@ -13,9 +13,16 @@
 		scriptOrFlowPath: string
 		errorHandlerMuted: boolean | undefined
 		iconOnly?: boolean
+		unifiedSize?: 'xs' | 'sm' | 'md' | 'lg'
 	}
 
-	let { kind, scriptOrFlowPath, errorHandlerMuted = $bindable(), iconOnly = true }: Props = $props()
+	let {
+		kind,
+		scriptOrFlowPath,
+		errorHandlerMuted = $bindable(),
+		iconOnly = true,
+		unifiedSize = 'md'
+	}: Props = $props()
 
 	async function toggleErrorHandler(): Promise<void> {
 		const next = await toggleWorkspaceErrorHandler(
@@ -32,7 +39,7 @@
 	title={errorHandlerMuted === undefined || !errorHandlerMuted
 		? 'Disable workspace error handler for this script'
 		: 'Enable workspace error handler for this script'}
-	unifiedSize="md"
+	{unifiedSize}
 	on:click={toggleErrorHandler}
 	variant="subtle"
 	startIcon={{
diff --git a/frontend/src/lib/components/details/FlowDetail.svelte b/frontend/src/lib/components/details/FlowDetail.svelte
index 7001075e93..30de5dc7cb 100644
--- a/frontend/src/lib/components/details/FlowDetail.svelte
+++ b/frontend/src/lib/components/details/FlowDetail.svelte
@@ -23,13 +23,12 @@
 	import DetailPageLayout from '$lib/components/details/DetailPageLayout.svelte'
 	import OnBehalfOfBadge from '$lib/components/details/OnBehalfOfBadge.svelte'
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 	import { Badge as HeaderBadge, Alert } from '$lib/components/common'
 	import MoveDrawer from '$lib/components/MoveDrawer.svelte'
 	import RunForm from '$lib/components/RunForm.svelte'
 	import ShareModal from '$lib/components/ShareModal.svelte'
 	import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
-	import { useOperatorBuilderFlows } from '$lib/operatorWriteRights'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { sendUserToast } from '$lib/toast'
 	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
 	import SavedInputsV2 from '$lib/components/SavedInputsV2.svelte'
@@ -131,7 +130,7 @@
 	// A ⌘-click opens these in a new tab, which only the query names the workspace for.
 	const operatingHref = useOperatingWorkspaceHref()
 	const actingUser = $derived(operatingUser.current)
-	const operatorBuilderFlows = useOperatorBuilderFlows()
+	const editRights = useEditRights()
 
 	let flow: Flow | undefined = $state()
 	// Derived, not assigned during the load: in a fork the acting user is looked up
@@ -139,6 +138,7 @@
 	// lookup does. Assigned once, that leaves the page permanently read-only — `canWrite`
 	// refuses an unknown user — with nothing to recompute it.
 	const can_write = $derived(!!flow && canWrite(flow.path, flow.extra_perms!, actingUser))
+	const promptForAi = $derived((flow?.schema?.prompt_for_ai as string | undefined) ?? '')
 	let shareModal: ShareModal | undefined = $state()
 
 	let scheduledForStr: string | undefined = $state(undefined)
@@ -344,9 +344,7 @@
 		}
 	}
 
-	// Operators with the builder right author flows out of deployed runnables; every other
-	// operator is read-only here.
-	let canAuthorFlow = $derived(!actingUser?.operator || $operatorBuilderFlows)
+	let canAuthorFlow = $derived(editRights.roleCanAuthor('flow'))
 
 	let moveDrawer: MoveDrawer | undefined = $state()
 	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
@@ -373,7 +371,7 @@
 				description: `Start a new flow from a copy of this one`,
 				narrow: { dropdownOf: 'Edit' },
 				buttonProps: {
-					href: operatingHref(`${base}/flows/add?template=${flow.path}`),
+					href: operatingHref(`/flows/add?template=${flow.path}`),
 					onClick: interceptNav(onNavigate, `/flows/add?template=${flow.path}`),
 					variant: 'subtle',
 					unifiedSize: 'md',
@@ -410,7 +408,7 @@
 		buttons.push({
 			label: `Runs`,
 			buttonProps: {
-				href: operatingHref(`${base}/runs/${flow.path}`),
+				href: operatingHref(`/runs/${flow.path}`),
 				onClick: interceptNav(onNavigate, `/runs/${flow.path}`),
 				unifiedSize: 'md',
 				variant: 'subtle',
@@ -433,7 +431,7 @@
 			return buttons
 		}
 
-		// The builder right covers flows only; building an app is still refused to operators.
+		// Build app makes a low-code app, which no builder right covers.
 		if (!actingUser?.operator) {
 			buttons.push({
 				label: 'Build app',
@@ -456,7 +454,7 @@
 		buttons.push({
 			label: 'Edit',
 			buttonProps: {
-				href: operatingHref(`${base}/flows/edit/${path}`),
+				href: operatingHref(`/flows/edit/${path}`),
 				onClick: interceptNav(onNavigate, `/flows/edit/${path}`),
 				variant: 'accent',
 				unifiedSize: 'md',
@@ -655,6 +653,7 @@
 	{#snippet header({ wide }: { wide: boolean })}
 		<DetailPageHeader
 			{wide}
+			ownsPageHeader={!embedded}
 			on:seeTriggers={() => {
 				detailLayout?.showTriggers()
 			}}
@@ -852,15 +851,20 @@
 									</div>
 								{/if}
 
-								{#if flow.schema?.prompt_for_ai !== undefined}
-									<AIFormAssistant
-										instructions={flow.schema?.prompt_for_ai as string}
-										onEditInstructions={() => {
-											onNavigate(`/flows/edit/${flow?.path}`)
-										}}
-										runnableType="flow"
-										path={flow?.path}
-									/>
+								{#snippet aiAssistant()}
+									{#if Object.keys(flow?.schema?.properties ?? {}).length > 0}
+										<AIFormAssistant
+											instructions={promptForAi}
+											onEditInstructions={can_write && canAuthorFlow
+												? () => onNavigate(`/flows/edit/${flow?.path}`)
+												: undefined}
+											runnableType="flow"
+											path={flow?.path}
+										/>
+									{/if}
+								{/snippet}
+								{#if promptForAi}
+									{@render aiAssistant()}
 								{/if}
 
 								<RunForm
@@ -879,6 +883,7 @@
 									bind:args
 									bind:this={runForm}
 									{jsonView}
+									actions={promptForAi ? undefined : aiAssistant}
 								/>
 							</div>
 
diff --git a/frontend/src/lib/components/details/ScriptDetail.svelte b/frontend/src/lib/components/details/ScriptDetail.svelte
index 432ffbd74a..6712092c39 100644
--- a/frontend/src/lib/components/details/ScriptDetail.svelte
+++ b/frontend/src/lib/components/details/ScriptDetail.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import {
 		JobService,
 		ScriptService,
@@ -104,6 +103,7 @@
 		useOperatingUser,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import {
 		buildForkEditUrl,
 		editInForkAllowed,
@@ -166,12 +166,16 @@
 	// asynchronously, and a value read after `getScriptByHash` resolves can land before that
 	// lookup does. Assigned once, that leaves the page permanently read-only — `canWrite`
 	// refuses an unknown user — with nothing to recompute it. A hub script is never writable.
+	const promptForAi = $derived((script?.schema?.prompt_for_ai as string | undefined) ?? '')
 	const can_write = $derived(
 		!isHubScript &&
 			!!script &&
 			script.workspace_id == workspace &&
 			canWrite(script.path, script.extra_perms!, actingUser)
 	)
+	const editRights = useEditRights()
+	// The edit actions also need a role that authors scripts, which no operator has.
+	const canEdit = $derived(can_write && editRights.roleCanAuthor('script'))
 	let deploymentInProgress = $state(false)
 	let expandedModuleLocks: Record<string, boolean> = $state({})
 	let expandedModuleCode: Record<string, boolean> = $state({})
@@ -530,7 +534,7 @@
 				description: `Start a new script from a copy of this one`,
 				narrow: { dropdownOf: 'Edit' },
 				buttonProps: {
-					href: operatingHref(`${base}/scripts/add?template=${script.path}`),
+					href: operatingHref(`/scripts/add?template=${script.path}`),
 					onClick: interceptNav(onNavigate, `/scripts/add?template=${script.path}`),
 					unifiedSize: 'md',
 					variant: 'subtle',
@@ -567,7 +571,7 @@
 		buttons.push({
 			label: `Runs`,
 			buttonProps: {
-				href: operatingHref(`${base}/runs/${script.path}`),
+				href: operatingHref(`/runs/${script.path}`),
 				onClick: interceptNav(onNavigate, `/runs/${script.path}`),
 				unifiedSize: 'md',
 				variant: 'subtle',
@@ -575,7 +579,7 @@
 			}
 		})
 
-		if (!script || actingUser?.operator || !can_write) {
+		if (!script || !canEdit) {
 			return buttons
 		}
 
@@ -636,7 +640,7 @@
 				buttons.push({
 					label: 'Edit',
 					buttonProps: {
-						href: operatingHref(`${base}${editUrl}`),
+						href: operatingHref(editUrl),
 						onClick: interceptNav(onNavigate, editUrl),
 						unifiedSize: 'md',
 						startIcon: Pen,
@@ -837,6 +841,7 @@
 		{#snippet header({ wide }: { wide: boolean })}
 			<DetailPageHeader
 				{wide}
+				ownsPageHeader={!embedded}
 				{mainButtons}
 				menuItems={getMenuItems(script, deployUiSettings)}
 				bind:errorHandlerMuted={
@@ -980,7 +985,7 @@
 										<Alert type="warning" title="Not HEAD">
 											This hash is not HEAD (latest non-archived version at this path) :
 											<a
-												href="{base}/scripts/get/{topHash}?workspace={workspace}"
+												href="/scripts/get/{topHash}?workspace={workspace}"
 												onclick={interceptNav(onNavigate, `/scripts/get/${topHash}`)}
 												>Go to the HEAD of this path</a
 											>
@@ -1073,15 +1078,20 @@
 								</div>
 							{/if}
 
-							{#if script?.schema?.prompt_for_ai !== undefined}
-								<AIFormAssistant
-									instructions={script.schema?.prompt_for_ai as string}
-									onEditInstructions={() => {
-										onNavigate(`/scripts/edit/${script?.path}?metadata_open=true`)
-									}}
-									runnableType="script"
-									path={script?.path}
-								/>
+							{#snippet aiAssistant()}
+								{#if Object.keys(script?.schema?.properties ?? {}).length > 0}
+									<AIFormAssistant
+										instructions={promptForAi}
+										onEditInstructions={canEdit
+											? () => onNavigate(`/scripts/edit/${script?.path}?metadata_open=true`)
+											: undefined}
+										runnableType="script"
+										path={script?.path}
+									/>
+								{/if}
+							{/snippet}
+							{#if promptForAi}
+								{@render aiAssistant()}
 							{/if}
 
 							<RunForm
@@ -1101,6 +1111,7 @@
 								schedulable={true}
 								bind:this={runForm}
 								{jsonView}
+								actions={promptForAi ? undefined : aiAssistant}
 							/>
 						</div>
 
diff --git a/frontend/src/lib/components/flow_builder.ts b/frontend/src/lib/components/flow_builder.ts
index f763e92faa..1a4b7e5c26 100644
--- a/frontend/src/lib/components/flow_builder.ts
+++ b/frontend/src/lib/components/flow_builder.ts
@@ -75,4 +75,7 @@ export type FlowBuilderProps = {
 	// EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 	// session preview to save vertical room.
 	condensedHeader?: boolean
+	/** The editor's path/summary and actions go to the route's page header instead of a bar of
+	 *  its own. Only the full-page editor sets it; embedders keep their own bar. */
+	ownsPageHeader?: boolean
 }
diff --git a/frontend/src/lib/components/flows/CreateActionsApp.svelte b/frontend/src/lib/components/flows/CreateActionsApp.svelte
index d75d1b33d3..9ab0ea407f 100644
--- a/frontend/src/lib/components/flows/CreateActionsApp.svelte
+++ b/frontend/src/lib/components/flows/CreateActionsApp.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 
 	import { Button } from '$lib/components/common'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
@@ -39,12 +38,12 @@
 
 	function selectLowCode() {
 		appTypeModalOpen = false
-		goto(`${base}/apps/add`)
+		goto('/apps/add')
 	}
 
 	function selectFullCode() {
 		appTypeModalOpen = false
-		goto(`${base}/apps_raw/add`)
+		goto('/apps_raw/add')
 	}
 </script>
 
diff --git a/frontend/src/lib/components/flows/CreateActionsFlow.svelte b/frontend/src/lib/components/flows/CreateActionsFlow.svelte
index ae848156f5..9f78585cc0 100644
--- a/frontend/src/lib/components/flows/CreateActionsFlow.svelte
+++ b/frontend/src/lib/components/flows/CreateActionsFlow.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
 
 	import { Button } from '$lib/components/common'
@@ -35,7 +34,7 @@
 		const parsed =
 			wacImportType === 'yaml' ? YAML.parse(pendingWacRaw ?? '') : JSON.parse(pendingWacRaw ?? '')
 		$importScriptStore = parsed
-		await goto(`${base}/scripts/add?import=true`)
+		await goto('/scripts/add?import=true')
 		wacDrawer?.closeDrawer?.()
 	}
 
@@ -45,22 +44,22 @@
 
 	function selectFlowEditor() {
 		flowModalOpen = false
-		goto(`${base}/flows/add`)
+		goto('/flows/add')
 	}
 
 	function selectWacPython() {
 		flowModalOpen = false
-		goto(`${base}/scripts/add?wac=python`)
+		goto('/scripts/add?wac=python')
 	}
 
 	function selectWacTypescript() {
 		flowModalOpen = false
-		goto(`${base}/scripts/add?wac=typescript`)
+		goto('/scripts/add?wac=typescript')
 	}
 
 	function selectPipeline() {
 		flowModalOpen = false
-		goto(`${base}/pipeline`)
+		goto('/pipeline')
 	}
 </script>
 
diff --git a/frontend/src/lib/components/flows/FlowModuleIcon.svelte b/frontend/src/lib/components/flows/FlowModuleIcon.svelte
index 9da2812ec0..6a56a62b00 100644
--- a/frontend/src/lib/components/flows/FlowModuleIcon.svelte
+++ b/frontend/src/lib/components/flows/FlowModuleIcon.svelte
@@ -3,7 +3,7 @@
 	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
 	import IconedResourceType from '$lib/components/IconedResourceType.svelte'
 	import type { FlowModule } from '$lib/gen'
-	import { Building, Repeat, Square, ArrowDown, GitBranch, Bot } from 'lucide-svelte'
+	import { Building, Repeat, Square, ArrowDown, GitBranch, Bot, Scale } from 'lucide-svelte'
 	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
 
 	interface Props {
@@ -22,6 +22,8 @@
 
 {#if module?.value?.type === 'aiagent'}
 	<Bot size={16} class="text-ai" />
+{:else if module?.value?.type === 'aidecision'}
+	<Scale size={16} class="text-ai" />
 {:else if module?.value?.type === 'rawscript'}
 	<LanguageIcon lang={module.value.language} width={iconWidth} height={iconHeight} />
 {:else if module?.summary === 'Terminate flow'}
diff --git a/frontend/src/lib/components/flows/agentDraft.svelte.ts b/frontend/src/lib/components/flows/agentDraft.svelte.ts
index b76f9bb471..cb6081ef46 100644
--- a/frontend/src/lib/components/flows/agentDraft.svelte.ts
+++ b/frontend/src/lib/components/flows/agentDraft.svelte.ts
@@ -3,8 +3,8 @@ import { get } from 'svelte/store'
 import { deepEqual } from 'fast-equals'
 import { ResourceService } from '$lib/gen'
 import { sendUserToast } from '$lib/toast'
-import { canWrite } from '$lib/utils'
-import { userStore } from '$lib/stores'
+import { canEditItem, roleCanAuthor } from '$lib/editRights'
+import { userStore, userWorkspaces } from '$lib/stores'
 import { getUserExt } from '$lib/user'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 import { UserDraft } from '$lib/userDraft.svelte'
@@ -339,10 +339,12 @@ export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
 						// Same rule the generic resource editor applies. The backend refuses the write
 						// either way, but without this the editor would invite edits it cannot save and
 						// autosave a draft on every keystroke against a resource the reader cannot deploy.
-						canWriteResource = canWrite(
+						canWriteResource = canEditItem(
+							'agent',
 							r.path,
-							r.extra_perms ?? {},
-							user ?? get(userStore) ?? undefined
+							r.extra_perms,
+							user ?? get(userStore) ?? undefined,
+							get(userWorkspaces).find((w) => w.id === ws)?.operator_settings
 						)
 						// An agent that exists only as a draft has no deployed value to compare against or
 						// fall back to, and the response's is a synthetic echo of the draft. Leaving the
@@ -382,7 +384,11 @@ export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
 							if (loadedFor !== key) return
 							noDeployed = true
 							deployed = undefined
-							canWriteResource = true
+							canWriteResource = roleCanAuthor(
+								'agent',
+								get(userStore) ?? undefined,
+								get(userWorkspaces).find((w) => w.id === ws)?.operator_settings
+							)
 							state = {
 								path: name,
 								description: '',
@@ -438,6 +444,9 @@ export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
 		// The counter the step card's write-back used to report, from the surface that now owns the
 		// write: a deploy here reaches every flow linking this agent.
 		logReusableAgentUsage(noDeployed ? 'saved' : 'updated')
+		// A new agent's editor opens on its draft's storage path, so its first save always lands
+		// elsewhere: that is naming it, not a rename.
+		const firstSave = noDeployed
 		deployed = submitted
 		noDeployed = false
 		const renamed = submitted.path !== fromPath
@@ -456,7 +465,9 @@ export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
 		sync.discard(fromPath, submitted)
 		// A rename moves the row, so the next load must not reuse the old key.
 		loadedFor = `${ws}:${submitted.path}`
-		sendUserToast(renamed ? `Renamed agent to ${submitted.path}` : `Saved agent ${submitted.path}`)
+		sendUserToast(
+			renamed && !firstSave ? `Renamed agent to ${submitted.path}` : `Saved agent ${submitted.path}`
+		)
 		return submitted.path
 	}
 
diff --git a/frontend/src/lib/components/flows/agentToolTree.ts b/frontend/src/lib/components/flows/agentToolTree.ts
index c30804c21d..081eeed467 100644
--- a/frontend/src/lib/components/flows/agentToolTree.ts
+++ b/frontend/src/lib/components/flows/agentToolTree.ts
@@ -174,7 +174,7 @@ function collectFlowNodeIdsFromNode(node: FlowNodeLike): string[] {
 export function collectProviderlessAgentIds(modules: unknown): string[] {
 	const ids: string[] = []
 	forEachAiAgentModule(modules, (mod, v) => {
-		if (!v.agent && !v.input_transforms?.provider) {
+		if (v.type === 'aiagent' && !v.agent && !v.input_transforms?.provider) {
 			ids.push(mod.id)
 		}
 	})
diff --git a/frontend/src/lib/components/flows/agentToolUtils.ts b/frontend/src/lib/components/flows/agentToolUtils.ts
index 87c15bc66a..74813cd0a4 100644
--- a/frontend/src/lib/components/flows/agentToolUtils.ts
+++ b/frontend/src/lib/components/flows/agentToolUtils.ts
@@ -1,5 +1,5 @@
 import { AGENT_HISTORY_KEYS } from './agentFormFields'
-import type { AiAgent, FlowModule, FlowModuleValue, InputTransform } from '$lib/gen'
+import type { AiAgent, AiDecision, FlowModule, FlowModuleValue, InputTransform } from '$lib/gen'
 import { loadStoredConfig } from '../aiProviderStorage'
 import { AI_AGENT_SCHEMA } from './flowInfers'
 import { forbiddenIds } from './idUtils'
@@ -45,7 +45,12 @@ export function getToolNameError(
 	return undefined
 }
 
-export const SPECIAL_TOOL_KINDS = ['mcpTool', 'websearchTool', 'aiAgentTool'] as const
+export const SPECIAL_TOOL_KINDS = [
+	'mcpTool',
+	'websearchTool',
+	'aiAgentTool',
+	'aiDecisionTool'
+] as const
 export type SpecialToolKind = (typeof SPECIAL_TOOL_KINDS)[number]
 
 // Type aliases for better readability
@@ -54,6 +59,9 @@ export type FlowModuleTool = AgentTool & { value: { tool_type: 'flowmodule' } &
 export type AiAgentTool = AgentTool & {
 	value: { tool_type: 'flowmodule' } & { type: 'aiagent' } & FlowModuleValue
 }
+export type AiDecisionTool = AgentTool & {
+	value: { tool_type: 'flowmodule' } & AiDecision
+}
 export type McpTool = AgentTool & {
 	value: {
 		tool_type: 'mcp'
@@ -98,6 +106,32 @@ export function isWebsearchTool(tool: AgentTool): tool is WebsearchTool {
  *  left AI-filled here is dropped from that schema and never reaches the model. */
 export const AI_AGENT_TOOL_AI_KEYS = ['user_message']
 
+/** Likewise for a decision used as a tool: the calling agent supplies what it decides about
+ *  (`AI_DECISION_TOOL_SCHEMA` in `ai_executor.rs`). */
+export const AI_DECISION_TOOL_AI_KEYS = ['state']
+
+/** A new decision: on TypeSafe's latest Jev, with a question to show the shape. */
+export function newAiDecisionInputTransforms(): AiDecision['input_transforms'] {
+	return {
+		provider: { type: 'static', value: { kind: 'typesafe', resource: '', model: 'jev-latest' } },
+		state: { type: 'static', value: undefined },
+		questions: {
+			type: 'static',
+			value: {
+				intent: {
+					type: 'choice',
+					instructions: 'What does the message ask for?',
+					criteria: {
+						question: 'An answer to a question',
+						action: 'Something to be done',
+						other: 'Anything else'
+					}
+				}
+			}
+		}
+	}
+}
+
 /** What a tool is called wherever it is named: its own name, else what it points at. Never its id,
  *  which is internal. Undefined when it has nothing to be called yet — an MCP tool with no server
  *  picked is unnamed rather than misnamed, so each surface words that for itself. */
@@ -164,6 +198,19 @@ export function createAiAgentTool(id: string): AiAgentTool {
 	} as AiAgentTool
 }
 
+/** Create an AI decision tool: the calling agent supplies the state and gets the answers back. */
+export function createAiDecisionTool(id: string): AiDecisionTool {
+	return {
+		id,
+		summary: '',
+		value: {
+			tool_type: 'flowmodule',
+			type: 'aidecision',
+			input_transforms: { ...newAiDecisionInputTransforms(), state: { type: 'ai' } }
+		}
+	}
+}
+
 /**
  * Create an MCP tool from resource path
  */
diff --git a/frontend/src/lib/components/flows/aiAgentModules.ts b/frontend/src/lib/components/flows/aiAgentModules.ts
index b404282657..62e793215f 100644
--- a/frontend/src/lib/components/flows/aiAgentModules.ts
+++ b/frontend/src/lib/components/flows/aiAgentModules.ts
@@ -1,7 +1,8 @@
 import type { FlowModule } from '$lib/gen'
 
-/** Visit every AI agent module of a module tree, including agents nested inside agent tools.
- * Takes `unknown` so it also runs on model-produced JSON that has not been schema-checked yet.
+/** Visit every AI agent and AI decision module of a module tree, including those used as agent
+ * tools. Takes `unknown` so it also runs on model-produced JSON that has not been schema-checked
+ * yet.
  *
  * Lives in its own leaf module (types only) so validation code can traverse a flow without
  * pulling in the editor-side agent tool helpers. */
@@ -19,6 +20,8 @@ export function forEachAiAgentModule(
 				visit(v.tools)
 			} else if (v.type === 'forloopflow' || v.type === 'whileloopflow') {
 				visit(v.modules)
+			} else if (v.type === 'aidecision') {
+				cb(mod as FlowModule, v)
 			} else if (v.type === 'branchone' || v.type === 'branchall') {
 				if (v.type === 'branchone') visit(v.default)
 				// Model-produced JSON reaches this before any schema check, so a `branches` that
diff --git a/frontend/src/lib/components/flows/aiDecisionBranching.test.ts b/frontend/src/lib/components/flows/aiDecisionBranching.test.ts
new file mode 100644
index 0000000000..e7c93f2cb4
--- /dev/null
+++ b/frontend/src/lib/components/flows/aiDecisionBranching.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, it } from 'vitest'
+import type { FlowModule, OpenFlow } from '$lib/gen'
+import {
+	checkRouting,
+	choiceBranches,
+	choiceConditionExpr,
+	parseChoiceCondition
+} from './aiDecisionBranching'
+import { questionsFitRows, questionsToRows, rowsToQuestions } from './aiDecisionQuestions'
+
+const questions = {
+	intent: {
+		type: 'choice',
+		instructions: 'What does the customer want?',
+		criteria: { refund: 'Money back', bug: 'Something is broken' }
+	},
+	urgency: { type: 'score', instructions: 'How urgent?', criteria: ['Later', 'Now'] },
+	angry: { type: 'noul', instructions: 'Is the customer angry?' }
+}
+
+function flow(branches: { expr: string; modules: FlowModule[] }[]): OpenFlow {
+	return {
+		summary: '',
+		value: {
+			modules: [
+				{
+					id: 'd',
+					value: {
+						type: 'aidecision',
+						input_transforms: {
+							provider: { type: 'static', value: {} },
+							state: { type: 'static', value: 'x' },
+							questions: { type: 'static', value: questions }
+						}
+					}
+				},
+				{ id: 'route', value: { type: 'branchone', branches, default: [] } }
+			]
+		}
+	} as OpenFlow
+}
+
+function withBranches(branches: { expr: string; modules: FlowModule[] }[]): [OpenFlow, FlowModule] {
+	const f = flow(branches)
+	return [f, f.value.modules[1]]
+}
+
+describe('choice conditions', () => {
+	it('reads back the conditions it writes, even for names that are not identifiers', () => {
+		for (const c of [
+			{ decisionId: 'd', question: 'intent', kind: 'choice' as const, option: 'refund' },
+			{ decisionId: 'd', question: 'the intent', kind: 'choice' as const, option: `it's "odd"` },
+			{ decisionId: 'd', question: 'angry', kind: 'noul' as const, option: 'yes' }
+		]) {
+			expect(parseChoiceCondition(choiceConditionExpr(c))).toEqual(c)
+		}
+		expect(parseChoiceCondition('results.d.output.intent.choice !== "refund"')).toBeUndefined()
+		expect(parseChoiceCondition("results.d.output.intent.choice === 'it\\'s'")).toEqual({
+			decisionId: 'd',
+			question: 'intent',
+			kind: 'choice',
+			option: "it's"
+		})
+		// A tuned threshold still reads as the question's yes branch.
+		expect(parseChoiceCondition('results.d.output.angry.noul > 0.75')).toEqual({
+			decisionId: 'd',
+			question: 'angry',
+			kind: 'noul',
+			option: 'yes'
+		})
+	})
+
+	it('flags the options a branch is missing and the branches whose option is gone', () => {
+		const f = flow([
+			...choiceBranches('d', 'intent', 'choice', ['refund', 'cancel']),
+			{ expr: 'flow_input.x', modules: [] }
+		])
+		expect(checkRouting(f, f.value.modules[1])).toEqual([
+			{
+				decisionId: 'd',
+				question: 'intent',
+				kind: 'choice',
+				missing: ['bug'],
+				stale: [{ index: 1, option: 'cancel' }]
+			}
+		])
+	})
+})
+
+describe('a removed question', () => {
+	it('leaves every branch routing on it stale', () => {
+		const f = flow(choiceBranches('d', 'gone', 'choice', ['refund']))
+		expect(checkRouting(f, f.value.modules[1])).toEqual([
+			{
+				decisionId: 'd',
+				question: 'gone',
+				kind: 'choice',
+				missing: [],
+				stale: [{ index: 0, option: 'refund' }]
+			}
+		])
+	})
+
+	it('leaves a yes branch stale once its question is no longer a yes/no', () => {
+		expect(checkRouting(...withBranches(choiceBranches('d', 'angry', 'noul', ['yes'])))).toEqual([])
+		expect(checkRouting(...withBranches(choiceBranches('d', 'intent', 'noul', ['yes'])))).toEqual([
+			{
+				decisionId: 'd',
+				question: 'intent',
+				kind: 'choice',
+				missing: ['refund', 'bug'],
+				stale: [{ index: 0, option: 'yes' }]
+			}
+		])
+	})
+})
+
+describe('questions editor rows', () => {
+	it('round-trips every question type', () => {
+		expect(rowsToQuestions(questionsToRows(questions))).toEqual(questions)
+		expect(questionsFitRows(questions)).toBe(true)
+	})
+
+	it('leaves structured instructions to the JSON editor', () => {
+		expect(
+			questionsFitRows({ q: { type: 'noul', instructions: { ask: 'Is it urgent?', context: [] } } })
+		).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/flows/aiDecisionBranching.ts b/frontend/src/lib/components/flows/aiDecisionBranching.ts
new file mode 100644
index 0000000000..187d44b62a
--- /dev/null
+++ b/frontend/src/lib/components/flows/aiDecisionBranching.ts
@@ -0,0 +1,212 @@
+import { getContext, setContext } from 'svelte'
+import type { BranchOne, FlowModule, OpenFlow } from '$lib/gen'
+import { branchableQuestions, type BranchKind } from './aiDecisionQuestions'
+import { getAllModules } from './flowExplorer'
+
+/** A Branch to one condition on a decision's question, in the forms the branch helper writes and
+ *  reads back: one option of a choice, or the `yes` of a yes/no question above a threshold. A
+ *  condition written any other way is left alone. */
+export type ChoiceCondition = {
+	decisionId: string
+	question: string
+	kind: BranchKind
+	option: string
+}
+
+/** The one branch the helper writes for a yes/no question; the default branch is its "no". */
+export const YES = 'yes'
+const YES_THRESHOLD = 0.5
+
+const IDENT = /^[A-Za-z_$][\w$]*$/
+
+function key(k: string): string {
+	return IDENT.test(k) ? `.${k}` : `[${JSON.stringify(k)}]`
+}
+
+const KEY = String.raw`(?:\.([A-Za-z_$][\w$]*)|\[("(?:[^"\\]|\\.)*")\])`
+const CONDITION = new RegExp(
+	String.raw`^results${KEY}\.output${KEY}\.choice === ("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')$`
+)
+// Any threshold: the helper writes 0.5, and people tune it.
+const NOUL_CONDITION = new RegExp(
+	String.raw`^results${KEY}\.output${KEY}\.noul >=? (?:0|1|0?\.\d+)$`
+)
+
+/** A JS string literal as the helper writes it (double quotes) or as people and the AI chat
+ *  usually do (single quotes). */
+function stringLiteral(literal: string): string {
+	return literal.startsWith("'")
+		? literal.slice(1, -1).replace(/\\(.)/g, '$1')
+		: JSON.parse(literal)
+}
+
+export function choiceConditionExpr({
+	decisionId,
+	question,
+	kind,
+	option
+}: ChoiceCondition): string {
+	const answer = `results${key(decisionId)}.output${key(question)}`
+	return kind === 'noul'
+		? `${answer}.noul >= ${YES_THRESHOLD}`
+		: `${answer}.choice === ${JSON.stringify(option)}`
+}
+
+export function parseChoiceCondition(expr: string | undefined): ChoiceCondition | undefined {
+	const trimmed = expr?.trim()
+	try {
+		const m = trimmed?.match(CONDITION)
+		if (m) {
+			return {
+				decisionId: m[1] ?? JSON.parse(m[2]),
+				question: m[3] ?? JSON.parse(m[4]),
+				kind: 'choice',
+				option: stringLiteral(m[5])
+			}
+		}
+		const n = trimmed?.match(NOUL_CONDITION)
+		if (n) {
+			return {
+				decisionId: n[1] ?? JSON.parse(n[2]),
+				question: n[3] ?? JSON.parse(n[4]),
+				kind: 'noul',
+				option: YES
+			}
+		}
+	} catch {
+		return undefined
+	}
+	return undefined
+}
+
+/** The questions of a decision step a Branch to one can route on, when they are set statically. */
+export function decisionChoiceQuestions(
+	decision: FlowModule
+): { name: string; kind: BranchKind; options: string[] }[] {
+	if (decision.value.type !== 'aidecision') return []
+	const questions = decision.value.input_transforms?.questions
+	return questions?.type === 'static' ? branchableQuestions(questions.value) : []
+}
+
+function conditionsOf(routing: FlowModule): (ChoiceCondition | undefined)[] {
+	return routing.value.type === 'branchone'
+		? routing.value.branches.map((b) => parseChoiceCondition(b.expr))
+		: []
+}
+
+/** The Branch to one that routes on this question, if any. */
+export function findRouting(
+	flow: OpenFlow,
+	decisionId: string,
+	question: string
+): FlowModule | undefined {
+	return getAllModules(flow.value.modules, flow.value.failure_module).find((m) =>
+		conditionsOf(m).some((c) => c?.decisionId === decisionId && c.question === question)
+	)
+}
+
+/** Options of the question no branch of `routing` handles yet. */
+export function missingOptions(
+	routing: FlowModule,
+	decisionId: string,
+	question: string,
+	options: string[]
+): string[] {
+	const handled = new Set(
+		conditionsOf(routing)
+			.filter((c) => c?.decisionId === decisionId && c.question === question)
+			.map((c) => c!.option)
+	)
+	return options.filter((o) => !handled.has(o))
+}
+
+export function choiceBranches(
+	decisionId: string,
+	question: string,
+	kind: BranchKind,
+	options: string[]
+) {
+	return options.map((option) => ({
+		summary: option,
+		expr: choiceConditionExpr({ decisionId, question, kind, option }),
+		modules: [] as FlowModule[]
+	}))
+}
+
+export type RoutingCheck = {
+	decisionId: string
+	question: string
+	kind: BranchKind
+	missing: string[]
+	/** Branches, by index, whose option the question no longer offers. */
+	stale: { index: number; option: string }[]
+}
+
+/** For each decision question a Branch to one routes on, what its branches lack and what they
+ *  handle that the question no longer offers; a question removed from the decision offers nothing.
+ *  Questions set from an expression are skipped: their options are only known at run time. */
+export function checkRouting(flow: OpenFlow, routing: FlowModule): RoutingCheck[] {
+	const conditions = conditionsOf(routing)
+	const modules = getAllModules(flow.value.modules, flow.value.failure_module)
+	const pairs = new Map<string, { decisionId: string; question: string }>()
+	for (const c of conditions) {
+		if (c) pairs.set(JSON.stringify([c.decisionId, c.question]), c)
+	}
+	const checks: RoutingCheck[] = []
+	for (const { decisionId, question } of pairs.values()) {
+		const decision = modules.find((m) => m.id === decisionId)
+		if (
+			decision?.value.type !== 'aidecision' ||
+			decision.value.input_transforms?.questions?.type !== 'static'
+		) {
+			continue
+		}
+		const asked = decisionChoiceQuestions(decision).find((q) => q.name === question)
+		const options = asked?.options ?? []
+		// A branch also goes stale when its question changes kind, a choice turned yes/no or back.
+		const stale = conditions.flatMap((c, index) =>
+			c?.decisionId === decisionId &&
+			c.question === question &&
+			(c.kind !== asked?.kind || !options.includes(c.option))
+				? [{ index, option: c.option }]
+				: []
+		)
+		const missing = asked ? missingOptions(routing, decisionId, question, options) : []
+		if (missing.length || stale.length) {
+			checks.push({ decisionId, question, kind: asked?.kind ?? 'choice', missing, stale })
+		}
+	}
+	return checks
+}
+
+export function addChoiceBranches(
+	routing: FlowModule,
+	decisionId: string,
+	question: string,
+	kind: BranchKind,
+	options: string[]
+) {
+	;(routing.value as BranchOne).branches.push(
+		...choiceBranches(decisionId, question, kind, options)
+	)
+}
+
+const DECISION_STEP = Symbol('aiDecisionStep')
+
+/** The AI decision step whose questions are being edited, for the questions editor to offer
+ *  branching on them. Its `id` is undefined where branching does not apply: a decision used as
+ *  an agent tool, or a test form. */
+export type AiDecisionStepContext = { readonly id: string | undefined }
+
+export function setAiDecisionStep(step: AiDecisionStepContext): void {
+	setContext(DECISION_STEP, step)
+}
+
+export function getAiDecisionStep(): AiDecisionStepContext | undefined {
+	return getContext(DECISION_STEP)
+}
+
+/** Option names as the editor cites them in a sentence: quoted, so a name reads as a value. */
+export function quoteOptions(options: string[]): string {
+	return options.map((o) => `“${o}”`).join(', ')
+}
diff --git a/frontend/src/lib/components/flows/aiDecisionInsert.ts b/frontend/src/lib/components/flows/aiDecisionInsert.ts
new file mode 100644
index 0000000000..85adc4affd
--- /dev/null
+++ b/frontend/src/lib/components/flows/aiDecisionInsert.ts
@@ -0,0 +1,33 @@
+import type { FlowModule } from '$lib/gen'
+import { push } from '$lib/history.svelte'
+import { refreshStateStore } from '$lib/svelte5Utils.svelte'
+import type { FlowEditorContext } from './types'
+import { addChoiceBranches } from './aiDecisionBranching'
+import type { BranchKind } from './aiDecisionQuestions'
+import { getModuleArrayContainer } from './flowTree'
+import { insertNewModuleAtIndex } from './flowStateUtils.svelte'
+
+/** Insert a Branch to one right after the decision, with the question's branches (one per option
+ *  of a choice, one `yes` for a yes/no), and select it. */
+export async function branchOnQuestion(
+	{ flowStore, flowStateStore, history, selectionManager }: FlowEditorContext,
+	decisionId: string,
+	question: string,
+	kind: BranchKind,
+	options: string[]
+): Promise<void> {
+	const container = getModuleArrayContainer(flowStore.val.value, decisionId)
+	if (!container) return
+	push(history, flowStore.val)
+	const modules = (await insertNewModuleAtIndex(
+		flowStore,
+		flowStateStore,
+		container.modules,
+		container.index + 1,
+		'branchone'
+	)) as FlowModule[]
+	const inserted = modules[container.index + 1]
+	addChoiceBranches(inserted, decisionId, question, kind, options)
+	refreshStateStore(flowStore)
+	selectionManager.selectId(inserted.id)
+}
diff --git a/frontend/src/lib/components/flows/aiDecisionQuestions.ts b/frontend/src/lib/components/flows/aiDecisionQuestions.ts
new file mode 100644
index 0000000000..3b7537559a
--- /dev/null
+++ b/frontend/src/lib/components/flows/aiDecisionQuestions.ts
@@ -0,0 +1,143 @@
+/** The questions of an AI decision as Jev and Clef read them, keyed by question name. */
+export type DecisionQuestionType = 'choice' | 'score' | 'noul'
+
+/** One question as the editor holds it: every type's criteria at once, so switching type and back
+ *  keeps what was typed. Only the current type's are written out. */
+export type QuestionRow = {
+	name: string
+	type: DecisionQuestionType
+	instructions: string
+	/** choice: each option and what it means */
+	options: { name: string; description: string }[]
+	/** score: the levels, lowest first */
+	levels: string[]
+	/** noul: what yes and no mean, both optional */
+	yes: string
+	no: string
+}
+
+export function emptyQuestion(name: string): QuestionRow {
+	return {
+		name,
+		type: 'choice',
+		instructions: '',
+		options: [
+			{ name: '', description: '' },
+			{ name: '', description: '' }
+		],
+		levels: ['', ''],
+		yes: '',
+		no: ''
+	}
+}
+
+export function questionsToRows(value: unknown): QuestionRow[] {
+	if (!value || typeof value !== 'object' || Array.isArray(value)) {
+		return []
+	}
+	return Object.entries(value as Record<string, any>).map(([name, q]) => {
+		const row = emptyQuestion(name)
+		row.type = q?.type === 'score' || q?.type === 'noul' ? q.type : 'choice'
+		row.instructions = typeof q?.instructions === 'string' ? q.instructions : ''
+		const criteria = q?.criteria
+		if (
+			row.type === 'choice' &&
+			criteria &&
+			typeof criteria === 'object' &&
+			!Array.isArray(criteria)
+		) {
+			row.options = Object.entries(criteria).map(([name, description]) => ({
+				name,
+				description: typeof description === 'string' ? description : ''
+			}))
+		} else if (row.type === 'score' && Array.isArray(criteria)) {
+			row.levels = criteria.map((l) => (typeof l === 'string' ? l : ''))
+		} else if (row.type === 'noul' && criteria && typeof criteria === 'object') {
+			row.yes = typeof criteria.true === 'string' ? criteria.true : ''
+			row.no = typeof criteria.false === 'string' ? criteria.false : ''
+		}
+		return row
+	})
+}
+
+/** Rows without a name are left out, as are options without a name: neither can be keyed. */
+export function rowsToQuestions(rows: QuestionRow[]): Record<string, any> {
+	const questions: Record<string, any> = {}
+	for (const row of rows) {
+		const name = row.name.trim()
+		if (!name) continue
+		let criteria: any
+		if (row.type === 'choice') {
+			criteria = Object.fromEntries(
+				row.options.filter((o) => o.name.trim()).map((o) => [o.name.trim(), o.description])
+			)
+		} else if (row.type === 'score') {
+			criteria = row.levels
+		} else {
+			criteria = {
+				...(row.yes ? { true: row.yes } : {}),
+				...(row.no ? { false: row.no } : {})
+			}
+			if (Object.keys(criteria).length === 0) criteria = undefined
+		}
+		questions[name] = {
+			type: row.type,
+			instructions: row.instructions,
+			...(criteria !== undefined ? { criteria } : {})
+		}
+	}
+	return questions
+}
+
+/** The name the editor should flag on a row, if any: TypeSafe keys questions and options by name,
+ *  so an empty or repeated one would be dropped or overwrite another. */
+export function questionNameError(rows: QuestionRow[], index: number): string | undefined {
+	const name = rows[index].name.trim()
+	if (!name) return 'Name the question'
+	if (rows.findIndex((r) => r.name.trim() === name) !== index)
+		return 'Another question has this name'
+	return undefined
+}
+
+export function optionNameError(row: QuestionRow, index: number): string | undefined {
+	const name = row.options[index].name.trim()
+	if (name && row.options.findIndex((o) => o.name.trim() === name) !== index) {
+		return 'Another option has this name'
+	}
+	return undefined
+}
+
+function canonical(v: unknown): string {
+	return JSON.stringify(v, (_, x) =>
+		x && typeof x === 'object' && !Array.isArray(x)
+			? Object.fromEntries(Object.entries(x).sort(([a], [b]) => a.localeCompare(b)))
+			: x
+	)
+}
+
+/** Whether the question cards hold all of `value`. TypeSafe also takes structured instructions and
+ *  descriptions, which the cards would flatten to text, so those questions stay JSON. */
+export function questionsFitRows(value: unknown): boolean {
+	if (value == undefined) return true
+	return canonical(rowsToQuestions(questionsToRows(value))) === canonical(value)
+}
+
+/** How a Branch to one routes on a question: one branch per option of a choice, or one `yes`
+ *  branch for a yes/no question. Scores take a threshold the user picks, so the helper leaves them. */
+export type BranchKind = 'choice' | 'noul'
+
+/** The questions a Branch to one can route on, in order, with the branches each one gets. */
+export function branchableQuestions(
+	value: unknown
+): { name: string; kind: BranchKind; options: string[] }[] {
+	const branchable: { name: string; kind: BranchKind; options: string[] }[] = []
+	for (const r of questionsToRows(value)) {
+		if (r.type === 'choice') {
+			const options = r.options.map((o) => o.name.trim()).filter(Boolean)
+			branchable.push({ name: r.name, kind: 'choice', options })
+		} else if (r.type === 'noul') {
+			branchable.push({ name: r.name, kind: 'noul', options: ['yes'] })
+		}
+	}
+	return branchable
+}
diff --git a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
index a2fa8e08ba..e50fde2cb2 100644
--- a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
+++ b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
@@ -251,6 +251,9 @@
 					{:else if flowModuleValue.type === 'aiagent'}
 						<Badge color="indigo">AI Agent</Badge>
 						{@render summaryInput()}
+					{:else if flowModuleValue.type === 'aidecision'}
+						<Badge color="indigo">AI Decision</Badge>
+						{@render summaryInput()}
 					{/if}
 				</div>
 			</span>
diff --git a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
index 9c2a57b43f..658a7adb77 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
@@ -9,7 +9,8 @@
 		AGENT_CHAT_SCHEMA,
 		agentChatFlow,
 		agentChatGap,
-		agentChatPath
+		agentChatPath,
+		AGENT_STEP_ID
 	} from '../conversations/agentEditorChat'
 	import { runFlowPreview } from '../utils.svelte'
 	import { goto } from '$lib/navigation'
@@ -100,7 +101,7 @@
 	 *  schema per tool — the linked branch deliberately loads none. Reserved in `forbiddenIds`:
 	 *  the root shares a flow-state map with the tools, so a tool of this id would lose its
 	 *  schema to the root's. */
-	const AGENT_ID = '__wm_agent_root'
+	const AGENT_ID = AGENT_STEP_ID
 
 	const draft = useAgentDraft({
 		path: () => path,
diff --git a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
index 618c31dbaf..0280455e77 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
@@ -1,16 +1,8 @@
 <script lang="ts">
-	import {
-		ChevronRight,
-		FlaskConical,
-		Settings,
-		FormInput,
-		History,
-		MessageSquare,
-		Save
-	} from 'lucide-svelte'
+	import { FlaskConical, Settings, FormInput, History, MessageSquare, Save } from 'lucide-svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { onDestroy, untrack } from 'svelte'
+	import { onDestroy, untrack, type Snippet } from 'svelte'
 	import { resource } from 'runed'
 	import Modal, { type ModalTrailSegment } from '$lib/components/common/modal/Modal.svelte'
 	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
@@ -39,6 +31,10 @@
 	import AgentSettings from './AgentSettings.svelte'
 	import AgentEvalsModal from './AgentEvalsModal.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
+	import { emptyString } from '$lib/utils'
+	import Tooltip from '$lib/components/Tooltip.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
 
@@ -93,6 +89,9 @@
 	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
 	let versionDrawer: Drawer | undefined = $state(undefined)
 	let settingsDrawer: Drawer | undefined = $state(undefined)
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
 	let evalsModal: AgentEvalsModal | undefined = $state(undefined)
 	let saving = $state(false)
 
@@ -136,9 +135,10 @@
 	let canEvaluate = $derived(
 		draft != undefined && !draft.loading && !draftOnly && !readOnly && !refused
 	)
-	// A never-deployed agent is stored at a minted `draft_<uuid>` path, so it is named by the path
-	// its first deploy will create, as the home list names it.
-	let shownPath = $derived((draftOnly && draft?.state?.path) || target?.path)
+	// The draft's path, so a rename shows where it is typed — including a never-deployed agent,
+	// stored at a minted `draft_<uuid>` path and named by the path its first deploy will create,
+	// as the home list names it. Falls back to the target while the draft is still loading.
+	let shownPath = $derived(draft?.state?.path || target?.path)
 
 	// Where the evals pane is within itself, so its levels extend this dialog's trail rather than
 	// opening a dialog of their own. Cleared on the way in: the pane reports a level once it is on
@@ -312,34 +312,22 @@
 				{@render body()}
 			</Modal>
 		{:else}
+			<!-- On its own route the editor's header is the page header: the agent's path is the
+			     breadcrumb, the level it is on reads after that name, and its controls are the band's
+			     actions. -->
+			<PageHeaderContent
+				item={{
+					path: pathSnapshot ?? shownPath,
+					summaryContent: agentSummary,
+					// Only where the rename behind it can be saved: a reader who cannot write this agent
+					// keeps the segment that copies the path, rather than an editor with nothing to edit.
+					pathTrigger: readOnly ? undefined : agentPathTrigger
+				}}
+				afterName={agentHint}
+				actions={settings}
+				separator="always"
+			/>
 			<div class="h-full min-h-0 flex flex-col">
-				<div class="flex items-center gap-2 px-4 py-2 border-b shrink-0">
-					<div class="min-w-0 flex flex-col">
-						<div class="flex items-center gap-1 min-w-0">
-							{#each trail as segment, i (i)}
-								{#if i > 0}
-									<ChevronRight size={14} class="text-tertiary shrink-0" />
-								{/if}
-								{#if segment.onclick}
-									<Button variant="subtle" unifiedSize="sm" onClick={segment.onclick}>
-										{segment.label}
-									</Button>
-								{:else}
-									<span class="text-sm font-semibold text-emphasis truncate">{segment.label}</span>
-								{/if}
-								{#if i === 0}
-									{@render titleBadge()}
-								{/if}
-							{/each}
-							{@render levelBadge()}
-						</div>
-						{#if description}
-							<span class="text-2xs text-tertiary truncate">{description}</span>
-						{/if}
-					</div>
-					<div class="grow"></div>
-					{@render settings()}
-				</div>
 				<div class="flex-1 min-h-0 px-4 sm:px-6">
 					{@render body()}
 				</div>
@@ -347,6 +335,95 @@
 		{/if}
 	{/key}
 
+	<!-- The summary's editor again, hung off the band's path segment so it opens under the path,
+	     with the cursor in the path field. `bind:` cannot be spread, so the slots are written out
+	     twice; both instances bind the same ones and only one is ever open. -->
+	{#snippet agentPathTrigger(pathLabel: Snippet, triggerClass: string)}
+		<!-- Gated like the summary beside it: this renders from the band's tree, where `draft` is
+		     undefined for as long as the modal has not loaded one, and a getter that reads through it
+		     throws there rather than where it was written. The `{:else}` carries the whole load of
+		     that wait: the band gave up its own segment to this snippet, so without it the trail
+		     would show no path until the draft arrives. -->
+		{#if draft?.state}
+			<PathEditPopover
+				label={pathLabel}
+				{triggerClass}
+				focusField="path"
+				bind:summary={
+					() => draft.state?.description ?? '',
+					(v) => {
+						if (draft.state) draft.state.description = v
+					}
+				}
+				bind:path={
+					() => draft.state?.path ?? '',
+					(v) => {
+						if (draft.state) draft.state.path = v
+					}
+				}
+				bind:snapshotPath={pathSnapshot}
+				bind:error={() => host?.pathError(), (error) => host?.setPathError(error)}
+				savedPath={draft?.noDeployed ? undefined : target?.path}
+				kind="resource"
+				workspaceId={ws}
+				pathEditable={!readOnly}
+				summaryEditable={!readOnly}
+			/>
+		{:else}
+			<span class={triggerClass}>{@render pathLabel()}</span>
+		{/if}
+	{/snippet}
+
+	{#snippet agentSummary()}
+		<!-- What the agent is, beside what it is called, and clicking it renames both — the same
+		     shape the script, flow and app editors carry. The version rides along, as the
+		     linked-agent card in the step panel has it. The trail's levels are not here: this layout
+		     opens settings in a drawer and evals over the page, so it never stands on one. -->
+		<div class="flex items-center gap-1 min-w-0">
+			{#if draft?.state}
+				{#snippet summaryText()}
+					<span
+						class="min-w-0 truncate text-xs {emptyString(draft.state?.description)
+							? 'text-tertiary italic font-normal'
+							: 'font-medium text-emphasis'}"
+						title={draft.state?.description}
+						>{emptyString(draft.state?.description)
+							? 'Add a summary...'
+							: draft.state?.description}</span
+					>
+				{/snippet}
+				<PathEditPopover
+					label={summaryText}
+					bind:summary={
+						() => draft.state?.description ?? '',
+						(v) => {
+							if (draft.state) draft.state.description = v
+						}
+					}
+					bind:path={
+						() => draft.state?.path ?? '',
+						(v) => {
+							if (draft.state) draft.state.path = v
+						}
+					}
+					bind:snapshotPath={pathSnapshot}
+					bind:error={() => host?.pathError(), (error) => host?.setPathError(error)}
+					savedPath={draft?.noDeployed ? undefined : target?.path}
+					kind="resource"
+					workspaceId={ws}
+					pathEditable={!readOnly}
+					summaryEditable={!readOnly}
+					penVisibility={emptyString(draft.state.description) ? 'always' : 'hover'}
+				/>
+			{/if}
+			{@render titleBadge()}
+		</div>
+	{/snippet}
+	{#snippet agentHint()}
+		{#if description}
+			<Tooltip>{description}</Tooltip>
+		{/if}
+	{/snippet}
 	{#snippet titleBadge()}
 		<!-- Against the agent's own name wherever it appears, as the linked-agent card in the
 				     step panel has it. -->
diff --git a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
index dc7c0948eb..3359f20080 100644
--- a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
+++ b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
@@ -8,8 +8,8 @@
 	import ResourcePathHint from '$lib/components/ResourcePathHint.svelte'
 	import { ResourceService, type InputTransform, type Resource } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { userStore } from '$lib/stores'
-	import { canWrite } from '$lib/utils'
+	import { userStore, userWorkspaces } from '$lib/stores'
+	import { canEditItem } from '$lib/editRights'
 	import { Bot, ChevronDown, ChevronUp, Save, Unlink, Pencil } from 'lucide-svelte'
 	import {
 		AGENT_BRAIN_KEYS,
@@ -235,8 +235,13 @@
 	let unavailable = $derived(linkedInfo?.unavailable ?? false)
 	let canEditAgent = $derived(
 		!!agent &&
-			!$userStore?.operator &&
-			canWrite(agent, linkedInfo?.extraPerms ?? {}, $userStore ?? undefined)
+			canEditItem(
+				'agent',
+				agent,
+				linkedInfo?.extraPerms,
+				$userStore ?? undefined,
+				$userWorkspaces.find((w) => w.id === ws)?.operator_settings
+			)
 	)
 	// The hint flips on the first keystroke in the agent editor, so the badge does not wait for the
 	// debounced autosave and the refetch behind it; the fetched answer covers a draft written
diff --git a/frontend/src/lib/components/flows/content/AgentToolRoster.svelte b/frontend/src/lib/components/flows/content/AgentToolRoster.svelte
index 33abff2ba8..7851385465 100644
--- a/frontend/src/lib/components/flows/content/AgentToolRoster.svelte
+++ b/frontend/src/lib/components/flows/content/AgentToolRoster.svelte
@@ -20,6 +20,8 @@
 		emptyMessage?: string
 		/** Where the picker's popover belongs, when the roster is not inside the flow editor. */
 		pickerPortal?: string
+		/** The roster of an agent used as a tool, which cannot run agent or decision tools. */
+		nestedAgent?: boolean
 	}
 
 	let {
@@ -28,7 +30,8 @@
 		onAddTool = undefined,
 		onDeleteTool = undefined,
 		emptyMessage = 'No tools yet. Add one from the agent on the flow graph.',
-		pickerPortal = '#flow-editor'
+		pickerPortal = '#flow-editor',
+		nestedAgent = false
 	}: Props = $props()
 
 	let funcDesc = $state('')
@@ -37,6 +40,7 @@
 	function toolKind(tool: AgentTool): string | undefined {
 		const value = tool?.value as Record<string, any>
 		if (value?.type === 'aiagent') return 'agent'
+		if (value?.type === 'aidecision') return 'decision'
 		if (value?.tool_type === 'mcp') return 'MCP'
 		if (value?.tool_type === 'websearch') return 'web search'
 		return undefined
@@ -81,6 +85,7 @@
 			<InsertModuleInner
 				bind:funcDesc
 				toolMode
+				{nestedAgent}
 				on:close={close}
 				on:new={(e) => (onAddTool?.(e.detail), close())}
 				on:insert={(e) => (onAddTool?.(e.detail), close())}
@@ -99,6 +104,7 @@
 				on:pickMcpTool={() => (onAddTool?.({ kind: 'mcpTool' }), close())}
 				on:pickWebsearchTool={() => (onAddTool?.({ kind: 'websearchTool' }), close())}
 				on:pickAiAgentTool={() => (onAddTool?.({ kind: 'aiAgentTool' }), close())}
+				on:pickAiDecisionTool={() => (onAddTool?.({ kind: 'aiDecisionTool' }), close())}
 			/>
 		{/snippet}
 	</Popover>
diff --git a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
index 68a0d1b4e2..4e7c7692a5 100644
--- a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
+++ b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
@@ -568,6 +568,7 @@
 										{onAddTool}
 										{onDeleteTool}
 										pickerPortal={toolPickerPortal}
+										nestedAgent={isAgentTool}
 									/>
 								{:else}
 									<!-- Inert rather than merely button-less: every control below writes into
diff --git a/frontend/src/lib/components/flows/content/AiDecisionQuestionRouting.svelte b/frontend/src/lib/components/flows/content/AiDecisionQuestionRouting.svelte
new file mode 100644
index 0000000000..9d22437398
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/AiDecisionQuestionRouting.svelte
@@ -0,0 +1,157 @@
+<script lang="ts">
+	import { getContext } from 'svelte'
+	import { Split } from 'lucide-svelte'
+	import type { FlowModule } from '$lib/gen'
+	import { Alert, Button } from '$lib/components/common'
+	import { push } from '$lib/history.svelte'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
+	import type { FlowEditorContext } from '../types'
+	import {
+		addChoiceBranches,
+		checkRouting,
+		quoteOptions,
+		decisionChoiceQuestions,
+		findRouting,
+		missingOptions
+	} from '../aiDecisionBranching'
+	import { findModuleInFlow } from '../flowTree'
+	import { branchOnQuestion } from '../aiDecisionInsert'
+	import StepIdBadge from './StepIdBadge.svelte'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { dfs } from '../dfs'
+
+	interface Props {
+		decisionId: string
+		question: string
+		/** Name the question in the copy, for when it is not shown in a card of its own. */
+		named?: boolean
+	}
+
+	let { decisionId, question, named = false }: Props = $props()
+
+	const ctx = getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowStore, flowStateStore, history, selectionManager } = ctx
+
+	// Read from the stored step, so what this offers matches what the branches are checked against.
+	let asked = $derived.by(() => {
+		const decision = findModuleInFlow(flowStore.val.value, decisionId)
+		return decision && decisionChoiceQuestions(decision).find((q) => q.name === question)
+	})
+	let options = $derived(asked?.options ?? [])
+	let routing = $derived(findRouting(flowStore.val, decisionId, question))
+	let missing = $derived(routing ? missingOptions(routing, decisionId, question, options) : options)
+	let stale = $derived(
+		routing
+			? (checkRouting(flowStore.val, routing).find(
+					(c) => c.decisionId === decisionId && c.question === question
+				)?.stale ?? [])
+			: []
+	)
+
+	// Steps inside the stale branches, which removing them deletes along with them.
+	let staleSteps = $derived.by(() => {
+		if (routing?.value.type !== 'branchone') return 0
+		const branches = routing.value.branches
+		return stale.reduce((n, s) => n + dfs(branches[s.index]?.modules ?? [], (m) => m.id).length, 0)
+	})
+	let confirmingRemoval = $state(false)
+
+	// One undo entry for the whole removal, which is one click.
+	function removeStale(target: FlowModule) {
+		if (target.value.type !== 'branchone') return
+		push(history, flowStore.val)
+		const branches = target.value.branches
+		// From the last, so each index still points at its branch once the ones after it are gone.
+		for (const { index } of [...stale].sort((a, b) => b.index - a.index)) {
+			for (const id of dfs(branches[index]?.modules ?? [], (m) => m.id)) {
+				delete flowStateStore.val[id]
+			}
+			branches.splice(index, 1)
+		}
+		refreshStateStore(flowStore)
+	}
+
+	function addMissing(target: FlowModule) {
+		push(history, flowStore.val)
+		addChoiceBranches(target, decisionId, question, asked?.kind ?? 'choice', missing)
+		refreshStateStore(flowStore)
+	}
+</script>
+
+{#if !routing}
+	{#if asked && options.length > 0}
+		{@const kind = asked.kind}
+		<Button
+			unifiedSize="sm"
+			variant="default"
+			wrapperClasses="self-start"
+			startIcon={{ icon: Split }}
+			title="Add a Branch to one after this step, with one branch per option"
+			onClick={() => branchOnQuestion(ctx, decisionId, question, kind, options)}
+		>
+			Branch on {named ? question : 'this question'}
+		</Button>
+	{/if}
+{:else}
+	{@const target = routing}
+	<div class="flex items-center gap-2 text-xs text-secondary">
+		<Split size={12} />
+		<span>{named ? `${question} branched in` : 'Branched in'}</span>
+		<StepIdBadge id={target.id} />
+		<Button
+			variant="default"
+			unifiedSize="xs"
+			title="Open the Branch to one"
+			onClick={() => selectionManager.selectId(target.id)}
+		>
+			Open
+		</Button>
+	</div>
+	{#if missing.length > 0}
+		<Alert
+			type="info"
+			size="xs"
+			title="{missing.length === 1 ? 'An option has' : 'Options have'} no branch yet: {quoteOptions(
+				missing
+			)}"
+			actions={[
+				{
+					label: missing.length === 1 ? 'Add branch' : 'Add branches',
+					onClick: () => addMissing(target)
+				}
+			]}
+		/>
+	{/if}
+	{#if stale.length > 0}
+		<Alert
+			type="warning"
+			size="xs"
+			title="{stale.length === 1 ? 'A branch handles an option' : 'Branches handle options'} {named
+				? `the ${question} question`
+				: 'this question'} no longer has: {quoteOptions(stale.map((s) => s.option))}"
+			actions={[
+				{
+					label: stale.length === 1 ? 'Remove branch' : 'Remove branches',
+					onClick: () => (staleSteps > 0 ? (confirmingRemoval = true) : removeStale(target))
+				}
+			]}
+		/>
+		{@const one = stale.length === 1}
+		{@const steps = staleSteps === 1 ? '1 step' : `${staleSteps} steps`}
+		<ConfirmationModal
+			open={confirmingRemoval}
+			title="Remove the {one ? 'branch' : 'branches'} and {steps}?"
+			confirmationText="Remove"
+			onCanceled={() => (confirmingRemoval = false)}
+			onConfirmed={() => {
+				confirmingRemoval = false
+				removeStale(target)
+			}}
+		>
+			The {one ? 'branch' : 'branches'} for {quoteOptions(stale.map((s) => s.option))} in
+			<StepIdBadge id={target.id} />
+			{one ? 'contains' : 'contain'}
+			{steps}, which will be deleted too.
+		</ConfirmationModal>
+	{/if}
+{/if}
diff --git a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
index 979717dae1..9002e88adf 100644
--- a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
+++ b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
@@ -13,7 +13,6 @@
 		type ResolvedExpandedSubflowStep
 	} from '../expandedSubflowStep'
 	import { parseExpandedSubflowId } from '$lib/components/restartFromStepPath'
-	import { base } from '$app/paths'
 	import FlowPanelChrome from '../common/FlowPanelChrome.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
@@ -122,7 +121,7 @@
 					title="Open the subflow in a new tab"
 					startIcon={{ icon: ExternalLink }}
 					iconOnly
-					href={`${base}/flows/edit/${containingFlowPath}?workspace=${encodeURIComponent(
+					href={`/flows/edit/${containingFlowPath}?workspace=${encodeURIComponent(
 						opWs ?? ''
 					)}${module ? `&selected=${encodeURIComponent(leafId)}` : ''}`}
 					target="_blank"
diff --git a/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
index 753ac20166..ce785800a9 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { Badge, Tab, Tabs } from '$lib/components/common'
+	import { Alert, Badge, Tab, Tabs } from '$lib/components/common'
 	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import { GripVertical, Plus, Trash2 } from 'lucide-svelte'
 	import { getContext } from 'svelte'
@@ -22,6 +22,14 @@
 	import BranchPredicateEditor from './BranchPredicateEditor.svelte'
 	import FlowRunSettings from './FlowRunSettings.svelte'
 	import { useUiIntent } from '$lib/components/copilot/chat/flow/useUiIntent'
+	import { push } from '$lib/history.svelte'
+	import {
+		addChoiceBranches,
+		checkRouting,
+		quoteOptions,
+		type RoutingCheck
+	} from '../aiDecisionBranching'
+	import StepIdBadge from './StepIdBadge.svelte'
 
 	interface Props {
 		flowModule: FlowModule
@@ -102,6 +110,15 @@
 		refreshStateStore(flowStore)
 	}
 
+	// Kept in step with the AI decision questions its branches were generated from.
+	let routingChecks = $derived(checkRouting(flowStore.val, flowModule))
+
+	function addMissing(check: RoutingCheck) {
+		push(history, flowStore.val)
+		addChoiceBranches(flowModule, check.decisionId, check.question, check.kind, check.missing)
+		refreshStateStore(flowStore)
+	}
+
 	let runSettings: FlowRunSettings | undefined = $state(undefined)
 	let selectedTab = $state('branches')
 
@@ -140,6 +157,38 @@
 				{#if selectedTab === 'branches'}
 					<section>
 						<div class="flex flex-col gap-3">
+							{#each routingChecks as check (JSON.stringify([check.decisionId, check.question]))}
+								{#if check.missing.length > 0}
+									<Alert
+										type="info"
+										size="xs"
+										title="{check.missing.length === 1
+											? 'An option has'
+											: 'Options have'} no branch yet: {quoteOptions(check.missing)}"
+										actions={[
+											{
+												label: check.missing.length === 1 ? 'Add branch' : 'Add branches',
+												onClick: () => addMissing(check)
+											}
+										]}
+									>
+										From the {check.question} question of <StepIdBadge id={check.decisionId} />
+									</Alert>
+								{/if}
+								{#each check.stale as stale (stale.index)}
+									<Alert
+										type="warning"
+										size="xs"
+										title="Branch {stale.index + 1} handles {quoteOptions([
+											stale.option
+										])}, which is no longer an option"
+										actions={[{ label: 'Remove branch', onClick: () => removeBranch(stale.index) }]}
+									>
+										The {check.question} question of <StepIdBadge id={check.decisionId} /> no longer
+										offers it.
+									</Alert>
+								{/each}
+							{/each}
 							<section
 								class="flex flex-col gap-3"
 								use:dragHandleZone={{ items, flipDurationMs: 150, dropTargetStyle: {} }}
diff --git a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
index 6b4d73c6a0..c6c1d13b2a 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
@@ -11,7 +11,6 @@
 	import { initFlow } from '$lib/components/flows/flowStore.svelte'
 	import type { FlowState } from '$lib/components/flows/flowState'
 	import type { FlowEditorContext } from '../types'
-	import { base } from '$app/paths'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
@@ -127,7 +126,7 @@
 					// Follow the drawer's own selection, which the user may have moved since it opened.
 					const stepId = flowBuilder?.getSelectedId() ?? selectedStepId
 					const selected = stepId ? `?selected=${encodeURIComponent(stepId)}` : ''
-					window.open(`${base}/flows/edit/${flowPath}${selected}`, '_blank', 'noopener,noreferrer')
+					window.open(`/flows/edit/${flowPath}${selected}`, '_blank', 'noopener,noreferrer')
 					flowEditorDrawer?.closeDrawer()
 				}}
 				startIcon={{ icon: ExternalLink }}
diff --git a/frontend/src/lib/components/flows/content/FlowInputs.svelte b/frontend/src/lib/components/flows/content/FlowInputs.svelte
index f86d870a1a..41d860530a 100644
--- a/frontend/src/lib/components/flows/content/FlowInputs.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputs.svelte
@@ -291,6 +291,18 @@
 						})
 					}}
 				/>
+				<FlowScriptPicker
+					label="Pi"
+					lang="pisandbox"
+					on:click={() => {
+						dispatch('new', {
+							language: 'bun',
+							kind,
+							subkind: 'pisandbox',
+							summary
+						})
+					}}
+				/>
 			</div>
 		{/if}
 
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index 4e8b97f76f..ecb3187c5c 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -181,7 +181,12 @@
 		['While loop', 'whileloop'],
 		['Branch to one', 'branchone'],
 		['Branch to all', 'branchall'],
-		...(customUi?.aiAgent != false ? ([['AI Agent', 'aiagent']] as [string, string][]) : [])
+		...(customUi?.aiAgent != false
+			? ([
+					['AI Agent', 'aiagent'],
+					['AI Decision', 'aidecision']
+				] as [string, string][])
+			: [])
 	]
 
 	let topLevelNodes: [string, string][] = $state([])
@@ -262,28 +267,33 @@
 	)
 	let aiLength = $derived(showAiRows ? 2 : 0)
 
-	// Must match the heading and label rendered for the AI Sandbox section
 	const aiSandboxHeading = 'AI Sandbox'
-	const aiSandboxLabel = 'Claude Code'
-	let matchesAiSandbox = $derived.by(() => {
+	const aiSandboxes = [
+		{ label: 'Claude Code', subkind: 'claudesandbox' },
+		{ label: 'Pi', subkind: 'pisandbox' }
+	] as const
+	// A query matching the heading keeps every sandbox, otherwise only the ones it names.
+	let matchingAiSandboxes = $derived.by(() => {
 		const query = funcDesc?.trim().toLowerCase() ?? ''
-		if (query.length == 0) {
-			return true
-		}
-		return [aiSandboxHeading, aiSandboxLabel].some((term) => {
+		const matches = (term: string) => {
 			const lowered = term.toLowerCase()
 			return lowered.startsWith(query) || lowered.split(' ').some((w) => w.startsWith(query))
-		})
+		}
+		if (query.length == 0 || matches(aiSandboxHeading)) {
+			return aiSandboxes
+		}
+		return aiSandboxes.filter((s) => matches(s.label))
 	})
-	// Gates the AI Sandbox row and its slot in the index space; both must agree or arrow keys land
-	// on an index that renders nothing.
-	let showAiSandbox = $derived(
+	// Gates the AI Sandbox rows and their slots in the index space; both must agree or arrow keys
+	// land on an index that renders nothing.
+	let aiSandboxRows = $derived(
 		selectedKind === 'script' &&
 			preFilter === 'all' &&
 			!selected &&
 			customUi?.aiSandbox != false &&
-			!$operatorBuilderFlows &&
-			matchesAiSandbox
+			!$operatorBuilderFlows
+			? matchingAiSandboxes
+			: []
 	)
 
 	// Hub runnables carry code the workspace never reviewed, and the backend refuses them in a
@@ -296,7 +306,7 @@
 	let aiOffset = $derived(inlineOffset + (inlineScripts?.length ?? 0))
 	let workspaceOffset = $derived(aiOffset + aiLength)
 	let aiSandboxOffset = $derived(workspaceOffset + (filteredWorkspaceItems?.length ?? 0))
-	let hubOffset = $derived(aiSandboxOffset + (showAiSandbox ? 1 : 0))
+	let hubOffset = $derived(aiSandboxOffset + aiSandboxRows.length)
 </script>
 
 <svelte:window onkeydown={onKeyDown} />
@@ -525,27 +535,29 @@
 			{/await}
 			<div class="pb-1"></div>
 		{/if}
-		{#if showAiSandbox}
+		{#if aiSandboxRows.length > 0}
 			<div class="pb-0 text-2xs font-normal text-secondary ml-2">{aiSandboxHeading}</div>
-			<FlowScriptPickerQuick
-				eeRestricted={false}
-				selected={selectedByKeyboard === aiSandboxOffset}
-				onHover={() => hover(aiSandboxOffset)}
-				enterpriseLangs={[]}
-				label={aiSandboxLabel}
-				lang="claudesandbox"
-				on:click={() => {
-					dispatch('new', {
-						kind: selectedKind,
-						inlineScript: {
-							language: 'bun',
+			{#each aiSandboxRows as sandbox, i (sandbox.subkind)}
+				<FlowScriptPickerQuick
+					eeRestricted={false}
+					selected={selectedByKeyboard === aiSandboxOffset + i}
+					onHover={() => hover(aiSandboxOffset + i)}
+					enterpriseLangs={[]}
+					label={sandbox.label}
+					lang={sandbox.subkind}
+					on:click={() => {
+						dispatch('new', {
 							kind: selectedKind,
-							subkind: 'claudesandbox',
-							summary
-						}
-					})
-				}}
-			/>
+							inlineScript: {
+								language: 'bun',
+								kind: selectedKind,
+								subkind: sandbox.subkind,
+								summary
+							}
+						})
+					}}
+				/>
+			{/each}
 		{/if}
 		{#if showHub && selectedKind != 'preprocessor' && selectedKind != 'flow'}
 			{#if (!selected || selected?.kind === 'integrations') && (preFilter === 'hub' || preFilter === 'all')}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index 577a6275d9..1ca2ed94fc 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -34,7 +34,8 @@
 	import AgentToolBindings from './AgentToolBindings.svelte'
 	import { getLinkedAgentTools, linkedToolsScope } from '../linkedAgentToolsStore.svelte'
 	import { flowLocalAgentSchema } from '../agentResourceUtils'
-	import { AI_AGENT_TOOL_AI_KEYS } from '../agentToolUtils'
+	import { AI_AGENT_TOOL_AI_KEYS, AI_DECISION_TOOL_AI_KEYS } from '../agentToolUtils'
+	import { setAiDecisionStep } from '../aiDecisionBranching'
 	import DiffEditor from '$lib/components/DiffEditor.svelte'
 	import type { ButtonProp } from '$lib/components/diffEditorTypes'
 	import { loadSchemaFromModule } from '../flowInfers'
@@ -154,6 +155,12 @@
 		siblingToolNames = undefined
 	}: Props = $props()
 
+	setAiDecisionStep({
+		get id() {
+			return flowModule.value.type === 'aidecision' && !isAgentTool ? flowModule.id : undefined
+		}
+	})
+
 	// Key for the linked-agent tools store. Ancestry-qualified for a nested agent tool, whose id
 	// comes from a resource and is not flow-global — it could otherwise alias a top-level step and
 	// read, then overwrite, that step's tools. Flow modules keep their bare id, which is what the
@@ -318,7 +325,8 @@
 					flowModule.value.type == 'rawscript' ||
 					flowModule.value.type == 'script' ||
 					flowModule.value.type == 'flow' ||
-					flowModule.value.type == 'aiagent'
+					flowModule.value.type == 'aiagent' ||
+					flowModule.value.type == 'aidecision'
 				) {
 					if (!deepEqual(flowModule.value.input_transforms, input_transforms)) {
 						flowModule.value.input_transforms = input_transforms
@@ -867,7 +875,11 @@
 						console.log('tagChange', e.detail)
 						if (flowModule.value.type == 'script') {
 							flowModule.value.tag_override = e.detail
-						} else if (flowModule.value.type == 'rawscript' || flowModule.value.type == 'aiagent') {
+						} else if (
+							flowModule.value.type == 'rawscript' ||
+							flowModule.value.type == 'aiagent' ||
+							flowModule.value.type == 'aidecision'
+						) {
 							flowModule.value.tag = e.detail
 						}
 					}}
@@ -1144,7 +1156,7 @@
 											</Tab>
 										{/if}
 									</Tabs>
-									{#if visibleSelected === 'inputs' && (flowModule.value.type == 'rawscript' || flowModule.value.type == 'script' || flowModule.value.type == 'flow' || flowModule.value.type == 'aiagent')}
+									{#if visibleSelected === 'inputs' && (flowModule.value.type == 'rawscript' || flowModule.value.type == 'script' || flowModule.value.type == 'flow' || flowModule.value.type == 'aiagent' || flowModule.value.type == 'aidecision')}
 										<div class="flex-1 overflow-auto" id="flow-editor-step-input">
 											<!-- `sidePane` under `staticOnly`: that column only opens on a connect,
 											     and there is no connect button to open it. -->
@@ -1292,7 +1304,10 @@
 														{isAgentTool}
 														noConnect={staticOnly}
 														noJavascript={staticOnly}
-														allowedAiTransforms={undefined}
+														allowedAiTransforms={isAgentTool &&
+														flowModule.value.type === 'aidecision'
+															? AI_DECISION_TOOL_AI_KEYS
+															: undefined}
 														helperScript={retrieveDynCodeAndLang(flowModule.value)}
 														chatInputEnabled={flowStore.val.value?.chat_input_enabled ?? false}
 														workspace={opWs}
@@ -1498,7 +1513,7 @@
 						</Splitpanes>
 					{/snippet}
 
-					{#if flowModule.value.type === 'aiagent' || (noEditor && flowModule.value.type !== 'flow')}
+					{#if flowModule.value.type === 'aiagent' || flowModule.value.type === 'aidecision' || (noEditor && flowModule.value.type !== 'flow')}
 						<!-- Top pane has no content to show (aiagent has no editor; rawscript/script
 						gate their content on !noEditor). Skip the Splitpanes wrapper entirely so
 						there's no orphan splitter. type === 'flow' still renders FlowPathViewer
diff --git a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
index a1e957a045..e80408c8cf 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
@@ -20,7 +20,7 @@
 	let customUi: undefined | FlowBuilderWhitelabelCustomUi = getContext('customUi')
 </script>
 
-<div class="flex shrink-0 flex-row gap-2 whitespace-nowrap">
+<div class="flex shrink-0 flex-row items-center gap-2 whitespace-nowrap">
 	{#if module.value.type === 'script'}
 		{#if customUi?.tagEdit != false}
 			<FlowModuleWorkerTagSelect
@@ -62,7 +62,7 @@
 		/>
 	{/if}
 
-	{#if module.value.type === 'aiagent' && customUi?.tagEdit != false}
+	{#if (module.value.type === 'aiagent' || module.value.type === 'aidecision') && customUi?.tagEdit != false}
 		<FlowModuleWorkerTagSelect
 			isPreprocessor={false}
 			placeholder={customUi?.tagSelectPlaceholder}
@@ -82,13 +82,15 @@
 			tag={module.value.tag}
 			on:change={(e) => dispatch('tagChange', e.detail)}
 		/>
-		<Button
-			unifiedSize="sm"
-			variant="subtle"
-			startIcon={{ icon: Save }}
-			on:click={() => dispatch('createScriptFromInlineScript')}
-			iconOnly={true}
-			title="Save to workspace"
-		/>
+		{#if customUi?.saveToWorkspace != false && customUi?.editorBar?.saveToWorkspace != false}
+			<Button
+				unifiedSize="sm"
+				variant="subtle"
+				startIcon={{ icon: Save }}
+				on:click={() => dispatch('createScriptFromInlineScript')}
+				iconOnly={true}
+				title="Save to workspace"
+			/>
+		{/if}
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
index febbe5681c..ff3151a04b 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
@@ -210,7 +210,7 @@
 				preprocessorModule={selectedId === 'preprocessor'}
 			/>
 		{/if}
-	{:else if flowModule.value.type === 'rawscript' || flowModule.value.type === 'script' || flowModule.value.type === 'flow' || flowModule.value.type === 'aiagent'}
+	{:else if flowModule.value.type === 'rawscript' || flowModule.value.type === 'script' || flowModule.value.type === 'flow' || flowModule.value.type === 'aiagent' || flowModule.value.type === 'aidecision'}
 		<FlowModuleComponent
 			{noEditor}
 			bind:flowModule
diff --git a/frontend/src/lib/components/flows/content/FlowRunSettings.svelte b/frontend/src/lib/components/flows/content/FlowRunSettings.svelte
index a1dae0f3a4..2d91ab42a7 100644
--- a/frontend/src/lib/components/flows/content/FlowRunSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowRunSettings.svelte
@@ -28,6 +28,7 @@
 
 	import FlowModuleDebounce from './FlowModuleDebounce.svelte'
 	import FlowModuleMock from './FlowModuleMock.svelte'
+	import JobTokenScopesSetting from '$lib/components/JobTokenScopesSetting.svelte'
 	import WorkspaceScriptSettingInfo from './WorkspaceScriptSettingInfo.svelte'
 	import { slideDynamic } from '$lib/transitions'
 
@@ -346,6 +347,15 @@
 					<FlowModuleMock bind:flowModule />
 				</div>
 			{/if}
+
+			<div data-setting="job-token">
+				<JobTokenScopesSetting
+					bind:value={flowModule.job_token_scopes}
+					kind="step"
+					size="xs"
+					textClass="text-xs font-normal text-primary"
+				/>
+			</div>
 		</div></section
 	>
 
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index de3733d238..0ae94b208e 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -5,6 +5,7 @@
 	import Path from '$lib/components/Path.svelte'
 	import FlowCard from '../common/FlowCard.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
+	import JobTokenScopesSetting from '$lib/components/JobTokenScopesSetting.svelte'
 	import { Alert, Button, SecondsInput } from '$lib/components/common'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
@@ -92,8 +93,8 @@
 
 	let activeAdvancedOptions = $derived([
 		{
-			name: 'Fill flow inputs with AI',
-			active: typeof flowStore.val.schema?.prompt_for_ai == 'string'
+			name: 'AI prompt',
+			active: !!flowStore.val.schema?.prompt_for_ai
 		},
 		{
 			name: 'High Priority',
@@ -101,6 +102,7 @@
 		},
 		{ name: 'Error Handler Muted', active: Boolean(flowStore.val.ws_error_handler_muted) },
 		{ name: 'Invisible to Others', active: Boolean(flowStore.val.visible_to_runner_only) },
+		{ name: 'Restricted Job Token', active: flowStore.val.job_token_scopes != null },
 		{ name: 'Shared Directory', active: Boolean(flowStore.val.value.same_worker) },
 		{ name: 'Preserve Step Tags', active: Boolean(flowStore.val.value.preserve_step_tags) },
 		{ name: 'Cache Results', active: Boolean(flowStore.val.value.cache_ttl) },
@@ -644,11 +646,7 @@
 					{#snippet right()}
 						<input
 							type="number"
-							class={twMerge(
-								inputBaseClass,
-								inputBorderClass(),
-								'!w-16 text-xs ml-4 absolute left-52'
-							)}
+							class={twMerge(inputBaseClass, inputBorderClass(), '!w-16 text-xs ml-4')}
 							disabled={flowStore.val.value.priority === undefined}
 							bind:value={flowStore.val.value.priority}
 							onfocus={bubble('focus')}
@@ -728,6 +726,13 @@
 						type="flow"
 					/>
 				{/if}
+
+				<JobTokenScopesSetting
+					bind:value={flowStore.val.job_token_scopes}
+					kind="flow"
+					size="xs"
+					textClass="font-medium"
+				/>
 			</Section>
 		</div>
 	</FlowCard>
diff --git a/frontend/src/lib/components/flows/content/StepIdBadge.svelte b/frontend/src/lib/components/flows/content/StepIdBadge.svelte
new file mode 100644
index 0000000000..9594ac6f83
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/StepIdBadge.svelte
@@ -0,0 +1,20 @@
+<script lang="ts">
+	import { Badge } from '$lib/components/common'
+
+	interface Props {
+		id: string
+	}
+
+	let { id }: Props = $props()
+</script>
+
+<!-- Styled like the id badge on a graph node, so a step named in text reads as the same thing. -->
+<Badge
+	color="transparent"
+	class="border-none"
+	wrapperClass="rounded-md bg-component-virtual-node text-emphasis align-middle"
+	baseClass="!px-1"
+	title={id}
+>
+	<span class="text-2xs font-normal">{id}</span>
+</Badge>
diff --git a/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts b/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
index c00c1e4297..99db5b8a9f 100644
--- a/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
+++ b/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { FlowModule } from '$lib/gen'
-import { agentChatFlow, agentChatGap, agentChatPath } from './agentEditorChat'
+import { agentChatFlow, agentChatGap, agentChatPath, agentStepLabel } from './agentEditorChat'
 
 describe('agentChatPath', () => {
 	it('is a path no flow can take, so a same-path flow never shares its conversations', () => {
@@ -10,6 +10,14 @@ describe('agentChatPath', () => {
 	})
 })
 
+describe('agentStepLabel', () => {
+	it("names a run's agent step by the agent, a chat turn's included", () => {
+		expect(agentStepLabel('f/support/agent')).toBe('f/support/agent')
+		expect(agentStepLabel(agentChatPath('f/support/agent'))).toBe('f/support/agent')
+		expect(agentStepLabel(undefined)).toBe('AI Agent')
+	})
+})
+
 function agent(inputTransforms: Record<string, any>): FlowModule {
 	return {
 		id: '__wm_agent_root',
diff --git a/frontend/src/lib/components/flows/conversations/agentEditorChat.ts b/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
index b754e04bb8..0f1bc86bda 100644
--- a/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
+++ b/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
@@ -13,6 +13,15 @@ export function agentChatPath(agentPath: string): string {
 	return `${agentPath}.chat`
 }
 
+/** The id of the one step a saved agent's run is made of, as the server names it too: job-read
+ *  scoping and the run's agent detection match on it, so it is only ever relabeled for display. */
+export const AGENT_STEP_ID = '__wm_agent_root'
+
+/** What a run shows for that step: the agent it ran, read off the run's path. */
+export function agentStepLabel(runPath: string | undefined): string {
+	return runPath?.replace(/\.chat$/, '') || 'AI Agent'
+}
+
 /**
  * The inputs of the flow a saved agent is chatted with: the message, and the files the composer's
  * paperclip uploads. `user_message` is the name the server requires of a chat-mode run.
diff --git a/frontend/src/lib/components/flows/conversations/messageAttachments.ts b/frontend/src/lib/components/flows/conversations/messageAttachments.ts
index 36c7d103c3..18170a90df 100644
--- a/frontend/src/lib/components/flows/conversations/messageAttachments.ts
+++ b/frontend/src/lib/components/flows/conversations/messageAttachments.ts
@@ -1,6 +1,5 @@
 /** The files a user message carried, as the lanes its bubble renders: image thumbnails and file chips. */
 import type { ChatAttachment } from 'windmill-chat'
-import { base } from '$lib/base'
 import {
 	createAttachedFileContextElement,
 	type ContextElement
@@ -24,7 +23,7 @@ function looksLikeImage(attachment: ChatAttachment): boolean {
 function downloadUrl(workspace: string, attachment: ChatAttachment): string {
 	const params = new URLSearchParams({ file_key: attachment.s3 })
 	if (attachment.storage) params.set('storage', attachment.storage)
-	return `${base}/api/w/${workspace}/job_helpers/download_s3_file?${params.toString()}`
+	return `/api/w/${workspace}/job_helpers/download_s3_file?${params.toString()}`
 }
 
 /** Without a workspace there is no link to build, so an image falls back to a file chip. */
diff --git a/frontend/src/lib/components/flows/flowExplorer.ts b/frontend/src/lib/components/flows/flowExplorer.ts
index 3c602a7940..951c70cb78 100644
--- a/frontend/src/lib/components/flows/flowExplorer.ts
+++ b/frontend/src/lib/components/flows/flowExplorer.ts
@@ -51,7 +51,7 @@ function filterDependentComponents(modules: FlowModule[], id: string): Record<st
 				modules
 					.map((mod) => [mod.id, getModuleExprs(mod).filter((expr) => expr.includes(`flow_input`))])
 					.filter((x) => x[1].length > 0)
-		  )
+			)
 		: Object.fromEntries(
 				modules
 					.map((mod) => [
@@ -62,7 +62,7 @@ function filterDependentComponents(modules: FlowModule[], id: string): Record<st
 						})
 					])
 					.filter((x) => x[1].length > 0)
-		  )
+			)
 }
 
 function getModuleExprs(x: FlowModule): string[] {
@@ -73,7 +73,12 @@ function getModuleExprs(x: FlowModule): string[] {
 		x.value.branches.map((branch) => {
 			exprs.push(branch.expr)
 		})
-	} else if (x.value.type === 'flow' || x.value.type === 'script' || x.value.type == 'rawscript') {
+	} else if (
+		x.value.type === 'flow' ||
+		x.value.type === 'script' ||
+		x.value.type == 'rawscript' ||
+		x.value.type == 'aidecision'
+	) {
 		exprs.push(...exprsOfInputTransforms(x.value.input_transforms))
 		exprs.push(...getExpr(x.sleep))
 		if (x.stop_after_if?.expr) {
diff --git a/frontend/src/lib/components/flows/flowInfers.ts b/frontend/src/lib/components/flows/flowInfers.ts
index 5f01bfc5c2..f2beefa0de 100644
--- a/frontend/src/lib/components/flows/flowInfers.ts
+++ b/frontend/src/lib/components/flows/flowInfers.ts
@@ -212,6 +212,36 @@ export const AI_AGENT_SCHEMA: Schema = {
 	]
 }
 
+/** The inputs of an AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's
+ *  Clef, or OpenAI's Decisions API). */
+export const AI_DECISION_SCHEMA: Schema = {
+	$schema: 'https://json-schema.org/draft/2020-12/schema',
+	properties: {
+		provider: {
+			type: 'object',
+			format: 'ai-decision-provider',
+			description:
+				'The decision model to ask: TypeSafe (Jev), Cloudflare (Clef) or OpenAI (Decisions API).'
+		},
+		// Untyped, so the static editor takes any JSON: TypeSafe reads a string, an object or an
+		// array of strings.
+		state: {
+			type: undefined,
+			description:
+				'The content to evaluate: a text, or an object with named parts. Extra detail makes the answers less accurate.',
+			placeholder: 'e.g. "My order is late" or { "message": "..." }'
+		},
+		questions: {
+			type: 'object',
+			format: 'ai-decision-questions',
+			description: 'What to ask about the state'
+		}
+	},
+	required: ['provider', 'state', 'questions'],
+	type: 'object',
+	order: ['provider', 'state', 'questions']
+}
+
 /** Memory shapes the editor no longer offers for new steps. The step form offers one only to a step that still holds it,
  *  since the one-of field rewrites a value that matches none of its options. No field carries a
  *  default: the form writes one into a missing field on open, and a missing count runs as off. */
@@ -382,6 +412,15 @@ export async function loadSchemaFromModule(
 			// one step offers would otherwise become every step's.
 			schema: structuredClone(AI_AGENT_SCHEMA)
 		}
+	} else if (mod.type === 'aidecision') {
+		const input_transforms = mod.input_transforms ?? {}
+		return {
+			input_transforms: Object.keys(AI_DECISION_SCHEMA.properties ?? {}).reduce((accu, key) => {
+				accu[key] = input_transforms[key] ?? { type: 'static', value: undefined }
+				return accu
+			}, {}),
+			schema: structuredClone(AI_DECISION_SCHEMA)
+		}
 	}
 
 	return {
diff --git a/frontend/src/lib/components/flows/flowStateUtils.svelte.ts b/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
index 20bd675700..030897a63b 100644
--- a/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
+++ b/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
@@ -29,8 +29,10 @@ import type { InlineScript, InsertKind } from '$lib/components/graph/graphBuilde
 import {
 	agentToolToFlowModule,
 	createAiAgentTool,
+	createAiDecisionTool,
 	createMcpTool,
 	createWebsearchTool,
+	newAiDecisionInputTransforms,
 	newFlowModuleAgentTool,
 	SPECIAL_TOOL_KINDS,
 	type AgentTool,
@@ -49,7 +51,8 @@ export async function loadFlowModuleState(
 			flowModule.value.type == 'script' ||
 			flowModule.value.type == 'rawscript' ||
 			flowModule.value.type == 'flow' ||
-			flowModule.value.type == 'aiagent'
+			flowModule.value.type == 'aiagent' ||
+			flowModule.value.type == 'aidecision'
 		) {
 			flowModule.value.input_transforms = input_transforms
 		}
@@ -105,7 +108,7 @@ export async function pickFlow(
 export async function createInlineScriptModule(
 	language: RawScript['language'],
 	kind: Script['kind'],
-	subkind: 'pgsql' | 'flow' | 'claudesandbox' | undefined,
+	subkind: 'pgsql' | 'flow' | 'claudesandbox' | 'pisandbox' | undefined,
 	id: string,
 	summary?: string
 ): Promise<[FlowModule, FlowModuleState]> {
@@ -237,6 +240,18 @@ export async function createAiAgent(
 	return [aiAgentFlowModules, flowModuleState]
 }
 
+export async function createAiDecision(id: string): Promise<[FlowModule, FlowModuleState]> {
+	const decisionModule: FlowModule = {
+		id,
+		summary: '',
+		value: { type: 'aidecision', input_transforms: newAiDecisionInputTransforms() }
+	}
+
+	const flowModuleState = await loadFlowModuleState(decisionModule)
+
+	return [decisionModule, flowModuleState]
+}
+
 export async function createFlow(id: string): Promise<[FlowModule, FlowModuleState]> {
 	const flowFlowModules: FlowModule = {
 		id,
@@ -501,6 +516,8 @@ export async function createNewModule(
 		;[module, state] = await createBranches(module.id)
 	} else if (kind == 'branchall') {
 		;[module, state] = await createBranchAll(module.id)
+	} else if (kind == 'aidecision') {
+		;[module, state] = await createAiDecision(module.id)
 	} else if (kind == 'aiagent') {
 		;[module, state] = await createAiAgent(
 			module.id,
@@ -579,6 +596,14 @@ export async function insertNewModuleAtIndex(
 		)
 		;(modules as AgentTool[]).splice(index, 0, aiAgentTool)
 		return modules as AgentTool[]
+	} else if (toolKind === 'aiDecisionTool') {
+		const aiDecisionTool = createAiDecisionTool(module.id)
+		flowStateStore.val[module.id] = await loadFlowModuleState(
+			agentToolToFlowModule(aiDecisionTool),
+			workspace
+		)
+		;(modules as AgentTool[]).splice(index, 0, aiDecisionTool)
+		return modules as AgentTool[]
 	} else if (toolKind === 'flowmoduleTool') {
 		const agentTool = newFlowModuleAgentTool(module)
 		;(modules as AgentTool[]).splice(index, 0, agentTool)
diff --git a/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte b/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte
index 9879b2899b..cd9d7647cf 100644
--- a/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte
+++ b/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte
@@ -86,6 +86,9 @@
 			if (parsed['on_behalf_of'] !== undefined) {
 				flowStore.val.on_behalf_of = parsed['on_behalf_of']
 			}
+			if (parsed['job_token_scopes'] !== undefined) {
+				flowStore.val.job_token_scopes = parsed['job_token_scopes']
+			}
 			flowStore.val.value = parsed.value
 			flowStore.val.schema = parsed.schema
 			flowStore.val.tag = parsed.tag
diff --git a/frontend/src/lib/components/flows/linkedAgentDrafts.ts b/frontend/src/lib/components/flows/linkedAgentDrafts.ts
index 4a9aef24b1..9367b21b12 100644
--- a/frontend/src/lib/components/flows/linkedAgentDrafts.ts
+++ b/frontend/src/lib/components/flows/linkedAgentDrafts.ts
@@ -3,11 +3,12 @@ import {
 	type FlowModule,
 	type FlowValue,
 	type InputTransform,
+	type OperatorSettings,
 	type Resource
 } from '$lib/gen'
 import { UserDraft } from '$lib/userDraft.svelte'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
-import { canWrite } from '$lib/utils'
+import { canEditItem } from '$lib/editRights'
 import type { UserExt } from '$lib/stores'
 import { dfs } from './dfs'
 import { flowLocalInputs, type AIAgentConfig } from './agentResourceUtils'
@@ -122,11 +123,15 @@ export interface LinkedAgentDraft {
 	extraPerms: Record<string, boolean>
 }
 
-/** Whether `user` may write this agent's resource. Split from the load so that resolving the
- *  drafts of a whole flow costs no `whoami` — only the deploy dialog needs the answer, and it
- *  looks the user up once for every agent it lists. */
-export function agentDraftCanWrite(draft: LinkedAgentDraft, user: UserExt | undefined): boolean {
-	return canWrite(draft.path, draft.extraPerms, user)
+/** Whether `user` may write this agent's resource, in a workspace with these `operator_settings`.
+ *  Split from the load so that resolving the drafts of a whole flow costs no `whoami` — only the
+ *  deploy dialog needs the answer, and it looks the user up once for every agent it lists. */
+export function agentDraftCanWrite(
+	draft: LinkedAgentDraft,
+	user: UserExt | undefined,
+	operatorSettings: OperatorSettings | undefined
+): boolean {
+	return canEditItem('agent', draft.path, draft.extraPerms, user, operatorSettings)
 }
 
 /** A link that cannot resolve for the user rather than because something went wrong: the agent was
diff --git a/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte b/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte
index 545571fd49..a7111b1135 100644
--- a/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte
+++ b/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte
@@ -74,7 +74,11 @@
 						'text-xs rounded-md rounded-r-none px-1.5 h-[24px] w-full bg-surface flex flex-row items-center gap-2 justify-center transition-all duration-200 ',
 						'hover:bg-surface-hover text-gray-400 hover:text-primary'
 					)}
-					onclick={onOpenPreview}
+					onclick={(e) => {
+						// These buttons sit inside the Input node, whose click handler would select it.
+						e.stopPropagation()
+						onOpenPreview?.()
+					}}
 				>
 					{#if flowPreviewJob && !flowHasChanged}
 						<div
@@ -105,7 +109,10 @@
 			<button
 				class="h-[24px] px-1.5 bg-surface rounded-md rounded-l-none text-gray-400 hover:bg-red-500 hover:text-white"
 				title="Hide jobs status"
-				onclick={onHideJobStatus}
+				onclick={(e) => {
+					e.stopPropagation()
+					onHideJobStatus?.()
+				}}
 			>
 				<X size={14} />
 			</button>
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
index a0ec4759f5..c87e20139e 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
@@ -4,6 +4,7 @@
 	import type { FlowNodeColorClasses } from '$lib/components/graph'
 	import { twMerge } from 'tailwind-merge'
 	import { getContext } from 'svelte'
+	import { AGENT_STEP_ID } from '../conversations/agentEditorChat'
 
 	// Detached mode (sessions): a step's editor is hidden until asked for, so add the
 	// hint to the name tooltip. Provided by FlowEditor; absent (=> false) elsewhere.
@@ -69,7 +70,8 @@
 	</Popover>
 
 	<div class="flex items-center space-x-2 relative" bind:clientWidth={idBadgeWidth}>
-		{#if id && id !== 'preprocessor' && !id.startsWith('failure') && !id.startsWith('subflow:')}
+		<!-- A saved agent's run is that one step, already named by the run page. -->
+		{#if id && id !== 'preprocessor' && id !== AGENT_STEP_ID && !id.startsWith('failure') && !id.startsWith('subflow:')}
 			<Badge
 				color="transparent"
 				class="border-none"
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 044e52c6ba..fbf8879c53 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -771,7 +771,8 @@
 							if (
 								mod.value.type == 'rawscript' ||
 								mod.value.type == 'script' ||
-								mod.value.type == 'flow'
+								mod.value.type == 'flow' ||
+								mod.value.type == 'aidecision'
 							) {
 								mod.value.input_transforms = Object.fromEntries(
 									Object.entries(mod.value.input_transforms).map(([k, v]) => {
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index 7d1ef9487a..62ec111b6c 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -29,6 +29,9 @@
 		kind?: 'script' | 'trigger' | 'preprocessor' | 'failure'
 		allowTrigger?: boolean
 		toolMode?: boolean
+		/** Picking a tool for an agent that is itself a tool, which cannot run agent or decision
+		 *  tools: the server drops them from its roster. */
+		nestedAgent?: boolean
 		/** Narrow layout (450px instead of 650px). Defaults on for the preprocessor
 		 *  and failure pickers; set it when the container cannot fit the wide one. */
 		small?: boolean
@@ -41,6 +44,7 @@
 		kind = 'script',
 		allowTrigger = true,
 		toolMode = false,
+		nestedAgent = false,
 		small: smallProp = undefined
 	}: Props = $props()
 
@@ -113,17 +117,21 @@
 		logReusableAgentUsage('linked')
 		dispatch('new', { kind: 'aiagent', agentPath })
 	}
-	function newClaudeSandbox() {
+	function newAiSandbox(subkind: 'claudesandbox' | 'pisandbox') {
 		dispatch('close')
 		dispatch('new', {
 			kind: 'script',
 			inlineScript: {
 				language: 'bun',
 				kind: 'script',
-				subkind: 'claudesandbox'
+				subkind
 			}
 		})
 	}
+	const aiSandboxes = [
+		{ label: 'Claude Code', subkind: 'claudesandbox' },
+		{ label: 'Pi', subkind: 'pisandbox' }
+	] as const
 
 	// Rows of the AI panes in render order. FlowInputsQuick owns the keyboard index for the other
 	// panes and is unmounted while these render, so the two never fight over Enter or the arrows.
@@ -133,7 +141,7 @@
 			return [newBlankAgent, ...saved.map((a) => () => newLinkedAgent(a.path))]
 		}
 		if (selectedKind === 'aisandbox') {
-			return [newClaudeSandbox]
+			return aiSandboxes.map((s) => () => newAiSandbox(s.subkind))
 		}
 		return []
 	})
@@ -247,6 +255,16 @@
 							dispatch('close')
 						}}
 					/>
+					{#if !nestedAgent}
+						<TopLevelNode
+							label="AI Decision"
+							chevron={false}
+							onSelect={() => {
+								dispatch('pickAiDecisionTool')
+								dispatch('close')
+							}}
+						/>
+					{/if}
 				{:else}
 					{#if customUi?.triggers != false && allowTrigger}
 						<TopLevelNode
@@ -323,6 +341,13 @@
 								stepGen?.focus()
 							}}
 						/>
+						<TopLevelNode
+							label="AI Decision"
+							onSelect={() => {
+								dispatch('close')
+								dispatch('new', { kind: 'aidecision' })
+							}}
+						/>
 					{/if}
 					{#if customUi?.aiSandbox != false && !$operatorBuilderFlows}
 						<TopLevelNode
@@ -397,14 +422,16 @@
 			</div>
 		{:else if selectedKind === 'aisandbox'}
 			<div class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col">
-				<TopLevelNode
-					label="Claude Code"
-					neutral
-					returnIcon
-					selected={aiSelected === 0}
-					onSelect={newClaudeSandbox}
-					onHover={() => (selectedByKeyboard = 0)}
-				/>
+				{#each aiSandboxes as sandbox, i (sandbox.subkind)}
+					<TopLevelNode
+						label={sandbox.label}
+						neutral
+						returnIcon
+						selected={aiSelected === i}
+						onSelect={() => newAiSandbox(sandbox.subkind)}
+						onHover={() => (selectedByKeyboard = i)}
+					/>
+				{/each}
 			</div>
 		{:else}
 			<FlowInputsQuick
diff --git a/frontend/src/lib/components/flows/map/MapItem.svelte b/frontend/src/lib/components/flows/map/MapItem.svelte
index 29d10d5ca3..d68952f74e 100644
--- a/frontend/src/lib/components/flows/map/MapItem.svelte
+++ b/frontend/src/lib/components/flows/map/MapItem.svelte
@@ -279,6 +279,7 @@
 					{nodeState}
 					label={mod.summary ||
 						(mod.value.type === 'aiagent' ? (mod.value.agent ?? 'AI Agent') : undefined) ||
+						(mod.value.type === 'aidecision' ? 'AI Decision' : undefined) ||
 						(mod.id === 'preprocessor'
 							? 'Preprocessor'
 							: mod.id.startsWith('failure')
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
index 93909d13f3..0ae64f3a69 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
@@ -8,7 +8,7 @@
 	interface Props {
 		disabled?: boolean
 		label: string
-		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | undefined
+		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | 'pisandbox' | undefined
 		id?: string | undefined
 	}
 
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
index 3ac279556f..673fce2525 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
@@ -7,7 +7,7 @@
 
 	interface Props {
 		label: string
-		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | undefined
+		lang?: SupportedLanguage | 'docker' | 'javascript' | 'claudesandbox' | 'pisandbox' | undefined
 		selected?: boolean
 		eeRestricted: boolean
 		enterpriseLangs?: string[]
diff --git a/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte b/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
index 627b7c2174..a8f3e040c4 100644
--- a/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
+++ b/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
@@ -9,6 +9,7 @@
 		Globe,
 		Plug,
 		Repeat,
+		Scale,
 		Square,
 		Zap
 	} from 'lucide-svelte'
@@ -48,8 +49,10 @@
 		'Branch to one': { icon: GitBranch },
 		'Branch to all': { icon: GitBranch },
 		'AI Agent': { icon: BotIcon, showChevron: true, iconClass: 'text-ai' },
+		'AI Decision': { icon: Scale, iconClass: 'text-ai' },
 		'AI Sandbox': { icon: BotIcon, showChevron: true, iconClass: 'text-ai' },
 		'Claude Code': { icon: BotIcon, iconClass: 'text-ai' },
+		Pi: { icon: BotIcon, iconClass: 'text-ai' },
 		MCP: { icon: Plug },
 		'Web Search': { icon: Globe }
 	}
diff --git a/frontend/src/lib/components/flows/propPicker/InputPickerInner.svelte b/frontend/src/lib/components/flows/propPicker/InputPickerInner.svelte
index 1ed9be896a..b643c62f8b 100644
--- a/frontend/src/lib/components/flows/propPicker/InputPickerInner.svelte
+++ b/frontend/src/lib/components/flows/propPicker/InputPickerInner.svelte
@@ -4,6 +4,7 @@
 	import ObjectViewer from '$lib/components/propertyPicker/ObjectViewer.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import { DollarSign, Pencil, RefreshCw, SquareFunction } from 'lucide-svelte'
+	import { quickjsReady } from '$lib/utils/quickjsEval.svelte'
 
 	interface Props {
 		inputTransform: Record<string, any> | undefined
@@ -17,7 +18,9 @@
 		getContext<FlowEditorContext | undefined>('FlowEditorContext') || {}
 
 	onMount(() => {
-		stepsInputArgs?.updateStepArgs(id, flowStateStore?.val, flowStore?.val, previewArgs?.val)
+		quickjsReady().then(() =>
+			stepsInputArgs?.updateStepArgs(id, flowStateStore?.val, flowStore?.val, previewArgs?.val)
+		)
 	})
 
 	const input = $derived(stepsInputArgs?.getStepArgs(id))
diff --git a/frontend/src/lib/components/flows/propPicker/OutputBadge.svelte b/frontend/src/lib/components/flows/propPicker/OutputBadge.svelte
index 507e74ba86..ecc8e07b11 100644
--- a/frontend/src/lib/components/flows/propPicker/OutputBadge.svelte
+++ b/frontend/src/lib/components/flows/propPicker/OutputBadge.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import type { Job } from '$lib/gen'
 	import { twMerge } from 'tailwind-merge'
-	import { base } from '$lib/base'
 	import { ExternalLink } from 'lucide-svelte'
 	import { emptyString } from '$lib/utils'
 
@@ -42,7 +41,7 @@
 		{#if !emptyString(job.id)}
 			<a
 				target="_blank"
-				href="{base}/run/{job.id}?workspace={job.workspace_id}"
+				href="/run/{job.id}?workspace={job.workspace_id}"
 				class="text-right float-right text-gray-300 group-hover:text-gray-400 transition-all duration-200 dark:text-gray-500 dark:group-hover:text-gray-300"
 				title="See run detail in a new tab"
 			>
diff --git a/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte b/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
index aa9b14b762..e63db4e960 100644
--- a/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
+++ b/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
@@ -28,7 +28,6 @@
 	import { twMerge } from 'tailwind-merge'
 	import DisplayResultControlBar from '$lib/components/DisplayResultControlBar.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
-	import { base } from '$lib/base'
 	import { fade } from 'svelte/transition'
 	import type { FlowEditorContext, OutputViewerJob } from '../types'
 	import { NEVER_TESTED_THIS_FAR } from '../models'
@@ -564,7 +563,6 @@
 					<DisplayResultControlBar
 						workspaceId={selectedJob.workspace_id}
 						jobId={selectedJob.id}
-						{base}
 						result={selectedJob.result}
 						disableTooltips={false}
 						on:open-drawer={() => {
@@ -576,7 +574,6 @@
 				{:else if mock?.enabled && displayResultMock && toolbarLocationMock === 'external'}
 					<DisplayResultControlBar
 						customUi={{ disableDownload: true }}
-						{base}
 						result={mock.return_value}
 						disableTooltips={false}
 						on:open-drawer={() => {
diff --git a/frontend/src/lib/components/flows/types.ts b/frontend/src/lib/components/flows/types.ts
index 40e9ddc952..eff88e6920 100644
--- a/frontend/src/lib/components/flows/types.ts
+++ b/frontend/src/lib/components/flows/types.ts
@@ -41,6 +41,7 @@ export type ExtendedOpenFlow = OpenFlow & {
 	visible_to_runner_only?: boolean
 	on_behalf_of_email?: string
 	on_behalf_of?: string
+	job_token_scopes?: string[] | null
 }
 
 export type FlowInputEditorState = {
diff --git a/frontend/src/lib/components/flows/utils.svelte.ts b/frontend/src/lib/components/flows/utils.svelte.ts
index 2b479abceb..3efb4b30f0 100644
--- a/frontend/src/lib/components/flows/utils.svelte.ts
+++ b/frontend/src/lib/components/flows/utils.svelte.ts
@@ -12,6 +12,7 @@ import {
 import { workspaceStore } from '$lib/stores'
 import { cleanExpr, emptySchema } from '$lib/utils'
 import { unescapeTemplateBackticks } from '$lib/utils/templateLiteral'
+import { evalSandboxed } from '$lib/utils/quickjsEval.svelte'
 import { get } from 'svelte/store'
 import type { FlowModuleState } from './flowState'
 import { type PickableProperties, dfs } from './previousResults'
@@ -23,25 +24,6 @@ import type { ExtendedOpenFlow } from './types'
 import type { GraphModuleState } from '../graph'
 import type { ModulesTestStates } from '../modulesTest.svelte'
 
-function create_context_function_template(eval_string: string, context: Record<string, any>) {
-	return `
-return function (context) {
-"use strict";
-${
-	Object.keys(context).length > 0
-		? `let ${Object.keys(context).map((key) => ` ${key} = context['${key}']`)};`
-		: ``
-}
-return ${eval_string}
-}`
-}
-
-function make_context_evaluator(eval_string, context): (context) => any {
-	let template = create_context_function_template(eval_string, context)
-	let functor = Function(template)
-	return functor()
-}
-
 export function evalValue(
 	k: string,
 	mod: FlowModule,
@@ -56,11 +38,10 @@ export function evalValue(
 		v = t.value
 	} else if (t?.type == 'javascript') {
 		try {
-			let context = {
+			v = evalSandboxed(t.expr, {
 				flow_input: pickableProperties?.flow_input,
 				results: pickableProperties?.priorIds
-			}
-			v = make_context_evaluator(t.expr, context)(context)
+			})
 		} catch (e) {
 			if (showError) {
 				sendUserToast(`Error evaluating ${k}: ${e.message}`, true)
@@ -107,6 +88,9 @@ export function filteredContentForExport(flow: ExtendedOpenFlow) {
 	if (flow.tag) {
 		o['tag'] = flow.tag
 	}
+	if (flow.job_token_scopes != null) {
+		o['job_token_scopes'] = flow.job_token_scopes
+	}
 	return o
 }
 
@@ -119,6 +103,7 @@ export function cleanFlow(flow: OpenFlow | any): OpenFlow & {
 	visible_to_runner_only?: boolean
 	on_behalf_of_email?: string
 	on_behalf_of?: string
+	job_token_scopes?: string[] | null
 } {
 	const newFlow: Flow = $state.snapshot(flow)
 
diff --git a/frontend/src/lib/components/git_sync/GitPushPreview.svelte b/frontend/src/lib/components/git_sync/GitPushPreview.svelte
index bed6d741d1..25207b767c 100644
--- a/frontend/src/lib/components/git_sync/GitPushPreview.svelte
+++ b/frontend/src/lib/components/git_sync/GitPushPreview.svelte
@@ -14,6 +14,7 @@ buttons — the setup dialog puts them in its own footer, the standalone modal i
 	import hubPaths from '$lib/hubPaths.json'
 	import { jobManager } from '$lib/services/JobManager'
 	import type { SyncResponse, SettingsObject } from '$lib/git-sync'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	interface Props {
 		gitRepoResourcePath: string
@@ -39,7 +40,7 @@ buttons — the setup dialog puts them in its own footer, the standalone modal i
 	let showCliInstructions = $state(false)
 	const cliInstructions = $derived(`# Setup (only needed if local folder not initialized yet)
 npm install -g windmill-cli
-wmill workspace add ${$workspaceStore} ${$workspaceStore} ${window.location.origin}
+wmill workspace add ${$workspaceStore} ${$workspaceStore} ${apiBaseUrl()}/
 wmill init --workspace ${$workspaceStore} --repository ${gitRepoResourcePath}
 
 # Pull workspace content to git repository
diff --git a/frontend/src/lib/components/git_sync/GitSyncSection.svelte b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
index 04b23b60c3..2ec6696da5 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSection.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
@@ -12,7 +12,6 @@
 	import type { GitSyncRepository } from './GitSyncContext.svelte'
 	import GitSyncModalManager from './GitSyncModalManager.svelte'
 	import { enterpriseLicense, workspaceStore, userWorkspaces } from '$lib/stores'
-	import { base } from '$lib/base'
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { apiErrorMessage } from '$lib/utils'
@@ -106,7 +105,7 @@
 	const devPairingHref = $derived.by(() => {
 		const parent = currentWorkspace?.parent_workspace_id
 		if (!parent || !$userWorkspaces?.some((w) => w.id === parent)) return undefined
-		return `${base}/workspace_settings?workspace=${parent}&tab=dev_workspace`
+		return `/workspace_settings?workspace=${parent}&tab=dev_workspace`
 	})
 
 	const repositories = $derived(gitSyncContext?.repositories ?? [])
diff --git a/frontend/src/lib/components/graph/GroupModuleIcons.svelte b/frontend/src/lib/components/graph/GroupModuleIcons.svelte
index 09c1a6812f..bd446db21a 100644
--- a/frontend/src/lib/components/graph/GroupModuleIcons.svelte
+++ b/frontend/src/lib/components/graph/GroupModuleIcons.svelte
@@ -101,6 +101,7 @@
 		if (type === 'flow') return 'Flow'
 		if (type === 'identity') return 'Identity'
 		if (type === 'aiagent') return 'AI Agent'
+		if (type === 'aidecision') return 'AI Decision'
 		return mod.id
 	}
 
diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index 3491cd3126..98a03f8c0f 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -29,14 +29,16 @@ export type InsertKind =
 	| 'approval'
 	| 'end'
 	| 'aiagent'
+	| 'aidecision'
 	| 'mcpTool'
 	| 'websearchTool'
 	| 'aiAgentTool'
+	| 'aiDecisionTool'
 
 export type InlineScript = {
 	language: RawScript['language']
 	kind: Script['kind']
-	subkind: 'pgsql' | 'flow' | 'claudesandbox'
+	subkind: 'pgsql' | 'flow' | 'claudesandbox' | 'pisandbox'
 	summary?: string
 	instructions?: string
 }
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
index 3de9c9b839..a8880334ca 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
@@ -304,7 +304,7 @@
 		NewAiToolN,
 		NodeLayout
 	} from '../../graphBuilder.svelte'
-	import { Bot, Globe, MessageCircle, Play, Plug, Wrench, X } from 'lucide-svelte'
+	import { Bot, Globe, MessageCircle, Play, Plug, Scale, Wrench, X } from 'lucide-svelte'
 	import { twMerge } from 'tailwind-merge'
 	import type { Edge, Node } from '@xyflow/svelte'
 
@@ -407,6 +407,8 @@
 					<Plug size={16} class="ml-1 shrink-0" />
 				{:else if data.type === 'aiagent'}
 					<Bot size={16} class="ml-1 shrink-0" />
+				{:else if data.type === 'aidecision'}
+					<Scale size={16} class="ml-1 shrink-0" />
 				{:else}
 					<Wrench size={16} class="ml-1 shrink-0" />
 				{/if}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AiDecisionNodeBranch.svelte b/frontend/src/lib/components/graph/renderers/nodes/AiDecisionNodeBranch.svelte
new file mode 100644
index 0000000000..a6faaea3b3
--- /dev/null
+++ b/frontend/src/lib/components/graph/renderers/nodes/AiDecisionNodeBranch.svelte
@@ -0,0 +1,43 @@
+<script lang="ts">
+	import { getContext } from 'svelte'
+	import { GitBranchPlus } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import type { FlowEditorContext } from '$lib/components/flows/types'
+	import { decisionChoiceQuestions, findRouting } from '$lib/components/flows/aiDecisionBranching'
+	import { branchOnQuestion } from '$lib/components/flows/aiDecisionInsert'
+	import { findModuleInFlow } from '$lib/components/flows/flowTree'
+
+	interface Props {
+		moduleId: string
+	}
+
+	let { moduleId }: Props = $props()
+
+	// Absent in graphs drawn outside the flow editor, which have nothing to insert into.
+	const ctx = getContext<FlowEditorContext | undefined>('FlowEditorContext')
+
+	// The first question nothing branches on yet; the step's question cards offer the rest.
+	let question = $derived.by(() => {
+		if (!ctx) return undefined
+		const decision = findModuleInFlow(ctx.flowStore.val.value, moduleId)
+		if (!decision) return undefined
+		return decisionChoiceQuestions(decision).find(
+			(q) => q.options.length > 0 && !findRouting(ctx.flowStore.val, moduleId, q.name)
+		)
+	})
+</script>
+
+{#if ctx && question}
+	{@const q = question}
+	<div class="absolute top-1/2 -right-8 -translate-y-1/2 z-10">
+		<Button
+			variant="default"
+			unifiedSize="xs"
+			iconOnly
+			btnClasses="bg-surface text-secondary"
+			startIcon={{ icon: GitBranchPlus }}
+			title="Branch on {q.name}"
+			onClick={() => branchOnQuestion(ctx, moduleId, q.name, q.kind, q.options)}
+		/>
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
index 4ba08a57a8..53679a0de1 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
@@ -2,6 +2,7 @@
 	import MapItem from '$lib/components/flows/map/MapItem.svelte'
 	import { GitBranchPlus, Move, Copy, Trash2, StickyNote, PictureInPicture2 } from 'lucide-svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
+	import AiDecisionNodeBranch from './AiDecisionNodeBranch.svelte'
 	import type { ModuleN } from '../../graphBuilder.svelte'
 	import { jobToGraphModuleState } from '$lib/components/modulesTest.svelte'
 	import { getNoteEditorContext } from '../../noteEditor.svelte'
@@ -237,5 +238,8 @@
 				</button>
 			</div>
 		{/if}
+		{#if data.module?.value?.type === 'aidecision' && data.insertable}
+			<AiDecisionNodeBranch moduleId={data.id} />
+		{/if}
 	{/snippet}
 </NodeWrapper>
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte
index d67a0a74be..7c088c119a 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte
@@ -114,6 +114,14 @@
 					})
 					close()
 				}}
+				on:pickAiDecisionTool={(e) => {
+					data.eventHandlers.insert({
+						index: -1,
+						agentId: data.agentModuleId,
+						kind: 'aiDecisionTool'
+					})
+					close()
+				}}
 			/>
 		{/snippet}
 	</Popover>
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte b/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
index fecf82ee23..6a4d94db1f 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
@@ -3,6 +3,7 @@
 	import { Handle, Position } from '@xyflow/svelte'
 	import { twMerge } from 'tailwind-merge'
 	import ContextMenu, { type ContextMenuItem } from '../../../common/contextmenu/ContextMenu.svelte'
+	import { contextMenuItemsFromMenu } from '../../../common/contextmenu/fromMenuItems'
 	import { getGraphContext } from '../../graphContext'
 	import type { Item } from '$lib/utils'
 
@@ -28,21 +29,7 @@
 	}: Props = $props()
 
 	let resolvedContextMenuItems: ContextMenuItem[] | undefined = $derived(
-		contextMenuItems ??
-			menuItems?.flatMap((item) => [
-				...(item.separatorTop
-					? [{ id: `${item.displayName}-divider`, label: '', divider: true }]
-					: []),
-				{
-					id: item.displayName,
-					label: item.displayName,
-					icon: item.icon,
-					disabled: item.disabled,
-					type: item.type,
-					shortcut: item.shortcut,
-					onClick: item.action as (() => void) | undefined
-				}
-			])
+		contextMenuItems ?? (menuItems && contextMenuItemsFromMenu(menuItems))
 	)
 
 	// NodeWrapper is reused outside the flow graph (e.g. the app decision-tree
diff --git a/frontend/src/lib/components/handlerSlackArg.test.ts b/frontend/src/lib/components/handlerSlackArg.test.ts
new file mode 100644
index 0000000000..b087a55f26
--- /dev/null
+++ b/frontend/src/lib/components/handlerSlackArg.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import { syncSlackBotArg } from './handlerSlackArg'
+
+const AUTO = '$res:f/slack_bot/bot_token'
+
+describe('syncSlackBotArg', () => {
+	it("leaves a custom handler's slack value alone", () => {
+		const args = { slack: '$res:u/me/my_slack' }
+		syncSlackBotArg(args, false, false)
+		syncSlackBotArg(args, false, true)
+		expect(args).toEqual({ slack: '$res:u/me/my_slack' })
+	})
+
+	it('sets the bot token for the built-in and drops it when leaving', () => {
+		const args: Record<string, any> = {}
+		syncSlackBotArg(args, true, false)
+		expect(args.slack).toBe(AUTO)
+		syncSlackBotArg(args, false, true)
+		expect(args).toStrictEqual({})
+	})
+})
diff --git a/frontend/src/lib/components/handlerSlackArg.ts b/frontend/src/lib/components/handlerSlackArg.ts
new file mode 100644
index 0000000000..6b8e4d6f5c
--- /dev/null
+++ b/frontend/src/lib/components/handlerSlackArg.ts
@@ -0,0 +1,17 @@
+import { WORKSPACE_SLACK_BOT_TOKEN_PATH } from '$lib/consts'
+
+const AUTO_SLACK_ARG = '$res:' + WORKSPACE_SLACK_BOT_TOKEN_PATH
+
+// `slack` belongs to the Slack built-in only while it holds the value the picker set; any other
+// value is a custom handler's own argument and must survive handler switches and reloads.
+export function syncSlackBotArg(
+	args: Record<string, any>,
+	isSlackBuiltin: boolean,
+	wasSlackBuiltin: boolean
+) {
+	if (isSlackBuiltin) {
+		args.slack = AUTO_SLACK_ARG
+	} else if (wasSlackBuiltin && args.slack === AUTO_SLACK_ARG) {
+		delete args.slack
+	}
+}
diff --git a/frontend/src/lib/components/home/CreateActionsMenu.svelte b/frontend/src/lib/components/home/CreateActionsMenu.svelte
index 4b9e7f1e9b..2e22b0765c 100644
--- a/frontend/src/lib/components/home/CreateActionsMenu.svelte
+++ b/frontend/src/lib/components/home/CreateActionsMenu.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { goto } from '$lib/navigation'
 	import { Button } from '$lib/components/common'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
@@ -20,19 +19,20 @@
 		PanelLeftClose
 	} from 'lucide-svelte'
 	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 	import { PythonIcon, TypeScriptIcon } from '$lib/components/common/languageIcons'
 	import { HOME_SHOW_CREATE_FLOW, HOME_SHOW_CREATE_APP } from '$lib/consts'
 	import { importFlowStore } from '$lib/components/flows/flowStore.svelte'
 	import { importScriptStore } from '$lib/components/scripts/scriptStore.svelte'
 	import { importStore } from '$lib/components/apps/store'
 	import { conditionalMelt, getLocalSetting, storeLocalSetting } from '$lib/utils'
-	import { useOperatorBuilderFlows } from '$lib/operatorWriteRights'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { createDropdownMenu, melt } from '@melt-ui/svelte'
 	import YAML from 'yaml'
 	import type { Snippet } from 'svelte'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 
-	const operatorBuilderFlows = useOperatorBuilderFlows()
+	const editRights = useEditRights()
 
 	interface Props {
 		/** Replaces the default `New` button, e.g. with an inline text link. */
@@ -55,6 +55,23 @@
 		label: string
 		icon: typeof PythonIcon
 		onSelect: () => void
+		badge?: { label: string; class: string }
+		/** opened in a new tab from a link beside the variant */
+		docHref?: string
+		/** shown in the doc panel while the variant is hovered, instead of its option's */
+		doc?: Doc
+	}
+
+	/** what the doc panel shows */
+	type Doc = {
+		label: string
+		/** a lucide icon or a brand mark; rendered at 26px through both size APIs */
+		icon: any
+		accent: string
+		tagline: string
+		description: string
+		bullets: string[]
+		badge?: { label: string; class: string }
 	}
 
 	/** an importable artifact kind handled by the shared YAML/JSON import drawer */
@@ -87,6 +104,9 @@
 	const badgeAdvanced = 'bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300'
 	const badgeLegacy = 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300'
 	const badgeAlpha = 'bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300'
+	const badgeRecommended = 'bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300'
+
+	const DBT_DOCS = 'https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt'
 
 	const allOptions: Option[] = [
 		{
@@ -102,7 +122,7 @@
 				'Auto-generated UI from parameters',
 				'Instant deploy & versioning'
 			],
-			onSelect: () => goto(`${base}/scripts/add`)
+			onSelect: () => goto('/scripts/add')
 		},
 		...(HOME_SHOW_CREATE_FLOW
 			? ([
@@ -119,7 +139,7 @@
 							'Branches, loops & error handling',
 							'Suspend / approval steps'
 						],
-						onSelect: () => goto(`${base}/flows/add`),
+						onSelect: () => goto('/flows/add'),
 						extras: [{ label: 'Import flow', onSelect: () => openImport('flow') }]
 					}
 				] as Option[])
@@ -135,7 +155,7 @@
 						description:
 							'Full control over the UI with React or Svelte and a powerful AI agent. Best for complex apps that need full flexibility.',
 						bullets: ['React or Svelte', 'Full flexibility & control', 'AI-assisted authoring'],
-						onSelect: () => goto(`${base}/apps_raw/add`),
+						onSelect: () => goto('/apps_raw/add'),
 						extras: [{ label: 'Import full-code app', onSelect: () => openImport('app-fullcode') }]
 					}
 				] as Option[])
@@ -153,7 +173,7 @@
 				'Reusable as a step in any flow',
 				'Tools from scripts, flows and MCP'
 			],
-			onSelect: () => goto(`${base}/agents/add`)
+			onSelect: () => goto('/agents/add')
 		},
 		...(HOME_SHOW_CREATE_FLOW
 			? ([
@@ -170,18 +190,18 @@
 							'Full control via the SDK',
 							'Versioned as a regular script'
 						],
-						onSelect: () => goto(`${base}/scripts/add?wac=typescript`),
+						onSelect: () => goto('/scripts/add?wac=typescript'),
 						badge: { label: 'Advanced', class: badgeAdvanced },
 						variants: [
 							{
 								label: 'TypeScript',
 								icon: TypeScriptIcon,
-								onSelect: () => goto(`${base}/scripts/add?wac=typescript`)
+								onSelect: () => goto('/scripts/add?wac=typescript')
 							},
 							{
 								label: 'Python',
 								icon: PythonIcon,
-								onSelect: () => goto(`${base}/scripts/add?wac=python`)
+								onSelect: () => goto('/scripts/add?wac=python')
 							}
 						],
 						extras: [{ label: 'Import Workflow-as-Code', onSelect: () => openImport('wac') }]
@@ -199,8 +219,35 @@
 							'Partitioned & incremental',
 							'Asset-aware lineage'
 						],
-						onSelect: () => goto(`${base}/pipeline`),
-						badge: { label: 'Alpha', class: badgeAlpha }
+						onSelect: () => goto('/pipeline'),
+						badge: { label: 'Alpha', class: badgeAlpha },
+						variants: [
+							{
+								label: 'Windmill pipelines',
+								icon: Workflow,
+								badge: { label: 'Recommended', class: badgeRecommended },
+								onSelect: () => goto('/pipeline')
+							},
+							{
+								label: 'dbt',
+								icon: DbtIcon,
+								docHref: DBT_DOCS,
+								onSelect: () => goto('/scripts/add?lang=dbt'),
+								doc: {
+									label: 'dbt',
+									icon: DbtIcon,
+									accent: 'orange',
+									tagline: 'Run an existing dbt project',
+									description:
+										'A pipeline is Windmill’s own abstraction; an existing dbt project stays a dbt project, and runs here unchanged as its own kind of script, with dbt still owning its models, refs and tests. All it needs is a warehouse configured under Settings → dbt. Its models show up in the asset graph as dbt:// nodes, next to whatever pipelines you do build, so you can adopt pipelines later, or never.',
+									bullets: [
+										'Your dbt project, unchanged',
+										'Needs a warehouse under Settings → dbt',
+										'Models appear as dbt:// assets'
+									]
+								}
+							}
+						]
 					}
 				] as Option[])
 			: []),
@@ -215,7 +262,7 @@
 						description:
 							'Assemble an internal UI from 60+ components wired to your scripts and flows. Best for simple apps or apps that need minimal customization.',
 						bullets: ['60+ ready-made components', 'No code required', 'Backed by scripts & flows'],
-						onSelect: () => goto(`${base}/apps/add`),
+						onSelect: () => goto('/apps/add'),
 						badge: { label: 'Legacy', class: badgeLegacy },
 						extras: [{ label: 'Import low-code app', onSelect: () => openImport('app-lowcode') }]
 					}
@@ -266,12 +313,11 @@
 		}
 	}
 
-	// A builder composes runnables that already exist, so only flows are offered: everything else
-	// here writes code, which the backend refuses from an operator.
+	// Only the kinds this user's role authors: a builder operator gets the kinds its rights grant.
 	// Derived, not computed once: switching workspace only sets `workspaceStore`, it does not
 	// remount this component, so a snapshot would keep the previous workspace's kinds.
 	const options: Option[] = $derived(
-		$operatorBuilderFlows ? allOptions.filter((o) => o.key === 'flow') : allOptions
+		allOptions.filter((o) => editRights.roleCanAuthor(o.key === 'app-fullcode' ? 'raw_app' : o.key))
 	)
 
 	// the doc panel only shows while an option is hovered or focused, so the menu opens compact
@@ -301,18 +347,25 @@
 	// per-row fan-out submenus: open to the right when there's room. The popover hugs
 	// the right viewport edge on most screens, so the default flip (right → left) would
 	// cover the doc panel — fall back below the trigger row instead.
+	const variantSubmenu = () =>
+		builders.createSubmenu({
+			positioning: {
+				placement: 'right-start',
+				gutter: 4,
+				flip: { fallbackPlacements: ['bottom-end', 'bottom-start', 'top-end', 'top-start'] },
+				fitViewport: true,
+				overflowPadding: 8
+			}
+		})
 	const {
 		elements: { subTrigger: wacSubTrigger, subMenu: wacSubMenu },
 		states: { subOpen: wacSubOpen }
-	} = builders.createSubmenu({
-		positioning: {
-			placement: 'right-start',
-			gutter: 4,
-			flip: { fallbackPlacements: ['bottom-end', 'bottom-start', 'top-end', 'top-start'] },
-			fitViewport: true,
-			overflowPadding: 8
-		}
-	})
+	} = variantSubmenu()
+	const {
+		elements: { subTrigger: pipelineSubTrigger, subMenu: pipelineSubMenu },
+		states: { subOpen: pipelineSubOpen }
+	} = variantSubmenu()
+	let variantSubOpen = $derived($wacSubOpen || $pipelineSubOpen)
 	const {
 		elements: { subTrigger: importSubTrigger, subMenu: importSubMenu },
 		states: { subOpen: importSubOpen }
@@ -378,7 +431,10 @@
 		if (isOpen && !wasOpen) {
 			logFeatureUsage('home', 'new_menu_open', { key: source })
 		}
-		if (!isOpen) activeKey = undefined
+		if (!isOpen) {
+			activeKey = undefined
+			activeVariantDoc = undefined
+		}
 		wasOpen = isOpen
 	})
 
@@ -389,17 +445,25 @@
 		// only persist the non-default (hidden) state, so a cleared key means "shown"
 		storeLocalSetting(SHOW_DOC_SETTING, value ? undefined : 'false')
 	}
-	// The pointer crosses the gutter outside the menu on its way into the Workflow-as-Code
-	// submenu, so leaving the menu keeps the panel while that submenu is open; it clears
-	// once the submenu closes with neither pointer nor focus left on the menu.
+	// The pointer crosses the gutter outside the menu on its way into a variant submenu,
+	// so leaving the menu keeps the panel while that submenu is open; it clears once the
+	// submenu closes with neither pointer nor focus left on the menu.
 	let menuEl: HTMLDivElement | undefined = $state(undefined)
 	$effect(() => {
-		if ($wacSubOpen || !menuEl) return
+		if (variantSubOpen || !menuEl) return
 		if (!menuEl.matches(':hover') && !menuEl.contains(document.activeElement)) {
 			activeKey = undefined
 		}
 	})
-	let active = $derived(options.find((o) => o.key === activeKey))
+	// A hovered variant with its own doc (dbt under Data pipelines) takes over the panel.
+	let activeVariantDoc: Doc | undefined = $state(undefined)
+	function highlightOption(key: string | undefined) {
+		activeKey = key
+		activeVariantDoc = undefined
+	}
+	let active: Doc | undefined = $derived(
+		activeVariantDoc ?? options.find((o) => o.key === activeKey)
+	)
 	let activeAc = $derived(active ? accentClasses[active.accent] : undefined)
 
 	// shared YAML/JSON import drawer, reused by every "Import …" extra
@@ -427,17 +491,17 @@
 		const parsed = importType === 'yaml' ? YAML.parse(importRaw) : JSON.parse(importRaw)
 		if (importKind === 'flow') {
 			importFlowStore.set(parsed)
-			await goto(`${base}/flows/add`)
+			await goto('/flows/add')
 		} else if (importKind === 'wac') {
 			importScriptStore.set(parsed)
-			await goto(`${base}/scripts/add?import=true`)
+			await goto('/scripts/add?import=true')
 		} else if (importKind === 'app-fullcode') {
 			// The raw app editor reads the payload from sessionStorage on mount.
 			sessionStorage.setItem('rawAppImport', JSON.stringify(parsed))
-			await goto(`${base}/apps_raw/add`)
+			await goto('/apps_raw/add')
 		} else {
 			importStore.set(parsed)
-			await goto(`${base}/apps/add`)
+			await goto('/apps/add')
 		}
 		importDrawer?.closeDrawer?.()
 	}
@@ -476,7 +540,7 @@
 		style={showDoc ? 'width: 780px;' : ''}
 		bind:this={menuEl}
 		onpointerleave={() => {
-			if (!$wacSubOpen) activeKey = undefined
+			if (!variantSubOpen) highlightOption(undefined)
 		}}
 	>
 		<div
@@ -492,7 +556,7 @@
 						<div
 							class="w-12 h-12 rounded-xl flex items-center justify-center shrink-0 {activeAc.tile}"
 						>
-							<active.icon size={26} class={activeAc.iconText} />
+							<active.icon size={26} width={26} height={26} class={activeAc.iconText} />
 						</div>
 						<div class="min-w-0">
 							<div class="flex flex-row items-center gap-2">
@@ -551,48 +615,92 @@
 						</span>
 					{/if}
 				{/snippet}
+				{#snippet variantRow(
+					option: Option,
+					ac: (typeof accentClasses)[string],
+					rowClass: string,
+					subTrigger: any,
+					subMenu: any,
+					subOpen: boolean
+				)}
+					<button
+						use:melt={subTrigger}
+						class={rowClass}
+						onfocusin={() => highlightOption(option.key)}
+						onpointerenter={() => highlightOption(option.key)}
+					>
+						{@render rowBody(option, ac)}
+						<ChevronRight size={14} class="shrink-0 text-tertiary" />
+					</button>
+					{#if subOpen}
+						<!-- The invisible `before:` margin bridges the gutter to the trigger row: when
+						     the submenu falls below its row, that gutter lies over the next row, and
+						     crossing it highlights that item, which closes the submenu. -->
+						<div
+							use:melt={subMenu}
+							use:hugViewportRight
+							class="pointer-events-auto z-[6001] flex flex-col gap-0.5 p-1 min-w-52 w-max rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none before:absolute before:-inset-2 before:-z-10 before:content-['']"
+						>
+							{#each option.variants ?? [] as variant (variant.label)}
+								{@const VariantIcon = variant.icon}
+								<div class="flex flex-row items-center gap-1">
+									<button
+										use:melt={$item}
+										class="flex flex-row flex-1 items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
+										onclick={() => variant.onSelect()}
+										onfocusin={() => (activeVariantDoc = variant.doc)}
+										onpointerenter={() => (activeVariantDoc = variant.doc)}
+									>
+										<VariantIcon width={14} height={14} size={14} />
+										<span class="text-xs font-medium text-primary whitespace-nowrap">
+											{variant.label}
+										</span>
+										{#if variant.badge}
+											<span
+												class="shrink-0 rounded px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide {variant
+													.badge.class}"
+											>
+												{variant.badge.label}
+											</span>
+										{/if}
+									</button>
+									{#if variant.docHref}
+										<a
+											href={variant.docHref}
+											target="_blank"
+											rel="noreferrer"
+											class="px-2 text-[10px] text-tertiary hover:text-secondary hover:underline whitespace-nowrap"
+											onpointerenter={() => (activeVariantDoc = variant.doc)}
+										>
+											See documentation
+										</a>
+									{/if}
+								</div>
+							{/each}
+						</div>
+					{/if}
+				{/snippet}
 				{#each options as option (option.key)}
 					{@const ac = accentClasses[option.accent]}
 					{@const rowClass =
 						'w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover'}
-					{#if option.variants}
-						<button
-							use:melt={$wacSubTrigger}
-							class={rowClass}
-							onfocusin={() => (activeKey = option.key)}
-							onpointerenter={() => (activeKey = option.key)}
-						>
-							{@render rowBody(option, ac)}
-							<ChevronRight size={14} class="shrink-0 text-tertiary" />
-						</button>
-						{#if $wacSubOpen}
-							<!-- The invisible `before:` margin bridges the gutter to the trigger row: when
-							     the submenu falls below its row, that gutter lies over the next row, and
-							     crossing it highlights that item, which closes the submenu. -->
-							<div
-								use:melt={$wacSubMenu}
-								use:hugViewportRight
-								class="pointer-events-auto z-[6001] flex flex-col gap-0.5 p-1 w-52 rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none before:absolute before:-inset-2 before:-z-10 before:content-['']"
-							>
-								{#each option.variants ?? [] as variant (variant.label)}
-									{@const VariantIcon = variant.icon}
-									<button
-										use:melt={$item}
-										class="flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-										onclick={() => variant.onSelect()}
-									>
-										<VariantIcon width={14} height={14} />
-										<span class="text-xs font-medium text-primary">{variant.label}</span>
-									</button>
-								{/each}
-							</div>
-						{/if}
+					{#if option.variants && option.key === 'pipeline'}
+						{@render variantRow(
+							option,
+							ac,
+							rowClass,
+							$pipelineSubTrigger,
+							$pipelineSubMenu,
+							$pipelineSubOpen
+						)}
+					{:else if option.variants}
+						{@render variantRow(option, ac, rowClass, $wacSubTrigger, $wacSubMenu, $wacSubOpen)}
 					{:else}
 						<button
 							use:melt={$item}
 							class={rowClass}
-							onfocusin={() => (activeKey = option.key)}
-							onpointerenter={() => (activeKey = option.key)}
+							onfocusin={() => highlightOption(option.key)}
+							onpointerenter={() => highlightOption(option.key)}
 							onclick={() => option.onSelect()}
 						>
 							{@render rowBody(option, ac)}
@@ -605,8 +713,8 @@
 				<button
 					use:melt={$importSubTrigger}
 					class="w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-					onfocusin={() => (activeKey = undefined)}
-					onpointerenter={() => (activeKey = undefined)}
+					onfocusin={() => highlightOption(undefined)}
+					onpointerenter={() => highlightOption(undefined)}
 				>
 					<div
 						class="w-6 h-6 rounded-md flex items-center justify-center shrink-0 bg-gray-100 dark:bg-gray-700"
diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index a8e4d8b973..83e940602d 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -16,6 +16,24 @@
 			prompt: 'Generate a weekly sales report from postgres and post it to Slack every Monday'
 		}
 	]
+
+	/** An operator's session can run what is deployed, read runs and call MCP servers, but
+	 * cannot author scripts or apps. It composes flows only where the workspace grants
+	 * `operator_settings.builder_flows`, so none of these asks it to build anything. */
+	export const homeAIOperatorExamples: { label: string; prompt: string }[] = [
+		{
+			label: 'Run a flow',
+			prompt: 'Find the flow that onboards a new employee and run it for Jane Doe, starting Monday'
+		},
+		{
+			label: 'Rerun failed jobs',
+			prompt: 'List the jobs that failed today, tell me why, and rerun the ones that timed out'
+		},
+		{
+			label: 'Summarize GitHub issues',
+			prompt: "Read this week's open GitHub issues and summarize the ones that mention billing"
+		}
+	]
 </script>
 
 <script lang="ts">
@@ -37,7 +55,6 @@
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { aiUserDisabled, hubBaseUrlStore, userStore, workspaceStore } from '$lib/stores'
 	import { HOME_SHOW_HUB } from '$lib/consts'
-	import { base } from '$lib/base'
 	import { getLocalSetting, storeLocalSetting } from '$lib/utils'
 	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
 	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
@@ -46,22 +63,33 @@
 	import HomeConnectDrawer from './HomeConnectDrawer.svelte'
 	import { USER_SETTINGS_HASH } from '../sidebar/settings'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 	import { onboardingProfile } from '$lib/onboardingProfile'
 
 	const COLLAPSED_SETTING = 'home-ai-composer-collapsed'
 
+	/** Bar width from which the two side trips stand in the bar rather than folding into the menu.
+	 *  Home's trail is ~250px and the rest of its actions ~400, so this leaves room for both
+	 *  labelled buttons without the trail starting to truncate. Below it they fold back. */
+	const BAR_FITS_SIDE_TRIPS = 1024
+	const sideTripsInBar = $derived(pageHeader.barWidth >= BAR_FITS_SIDE_TRIPS)
+	const hubOffered = $derived(!$userStore?.operator && HOME_SHOW_HUB)
+
 	let value = $state('')
-	// The stock examples, unless the invite that brought this person here wrote prompts for
+	// The stock examples for the reader's role, unless the invite that brought this person here wrote prompts for
 	// them — those replace the set outright rather than joining it, since a prompt written
 	// for someone's own stack next to "Ban Discord users" reads as the generic one.
-	let examples = $state(homeAIExamples)
+	let invitePrompts: { label: string; prompt: string }[] | undefined = $state(undefined)
 	void onboardingProfile().then((p) => {
 		if (!p?.starter_prompts?.length) return
-		examples = p.starter_prompts
+		invitePrompts = p.starter_prompts
 		promptIndex = 0
-		placeholder = examples[0].prompt
 	})
-	let placeholder = $state(homeAIExamples[0].prompt)
+	let examples = $derived(
+		invitePrompts ?? ($userStore?.operator ? homeAIOperatorExamples : homeAIExamples)
+	)
 	let placeholderVisible = $state(true)
 	let homeConnectDrawer: HomeConnectDrawer | undefined = $state(undefined)
 
@@ -73,6 +101,26 @@
 		storeLocalSetting(COLLAPSED_SETTING, next ? 'true' : undefined)
 	}
 
+	// Removing puts the composer away rather than throwing it out, and the way back is one item in
+	// the band's menu — so the ellipsis flashes as it appears, in a corner nobody is watching while
+	// the hero collapses in the middle of the page.
+	//
+	// A keyframe animation, not a transition: this mounts in the same flush that collapses the
+	// hero, so the frame that would paint it at rest is the frame it is already told to leave, and
+	// one `requestAnimationFrame` is not reliably past that paint. The flash then goes straight to
+	// invisible without ever being drawn. Mounted only while pulsing, so each removal replays it.
+	const PULSE_MS = 1000
+	let pulsing = $state(false)
+	let pulseEndTimer: ReturnType<typeof setTimeout> | undefined
+
+	function removeComposer() {
+		setCollapsed(true)
+		if (reducedMotion.val) return
+		clearTimeout(pulseEndTimer)
+		pulsing = true
+		pulseEndTimer = setTimeout(() => (pulsing = false), PULSE_MS)
+	}
+
 	// In global-AI mode the layout's chat panel is disabled and never loads the copilot
 	// config, so the home chat loads it for the current workspace itself.
 	$effect(() => {
@@ -107,8 +155,9 @@
 	// unlocked, so the far commoner unlocked workspace never pops the composer in mid-load.
 	let runOnlyWorkspace = $derived(isRuleActive('DisableDirectDeployment'))
 
-	// The composer hands off to /sessions, which refuses operators — so hide it from them (the
-	// prompt would be silently dropped) while the AI-independent CLI/MCP row below stays.
+	// The composer hands off to /sessions, which refuses operators and users opted out of the
+	// sessions beta — so hide it from them (the prompt would be silently dropped) while the
+	// AI-independent CLI/MCP row below stays.
 	let showComposer = $derived(
 		prefersSessionHandoff($userStore?.operator) &&
 			!runOnlyWorkspace &&
@@ -116,7 +165,7 @@
 	)
 
 	// The hero's margins and centered column are for the full block. The lone button row left
-	// by a collapsed, operator, run-only or hidden-assistant view is a hint line and should
+	// by a collapsed, opted-out, run-only or hidden-assistant view is a hint line and should
 	// cost the page almost nothing: no top margin, and the content column's full width so it
 	// hugs the right edge instead of floating centered in empty space.
 	let hero = $derived(showComposer && !collapsed)
@@ -149,12 +198,13 @@
 	const FADE_MS = 600
 
 	// Rotate the example prompt every CYCLE_MS: fade the placeholder out, swap it, fade it back in.
-	// Only while the composer is shown — otherwise (operators) it would loop forever driving an
+	// Only while the composer is shown — otherwise it would loop forever driving an
 	// unrendered input — and not under reduced motion, where the first prompt simply stays put.
 	// The index lives outside the effect so re-showing the composer resumes the rotation from the
 	// prompt currently displayed rather than restarting it.
 	const reducedMotion = useReducedMotion()
-	let promptIndex = 0
+	let promptIndex = $state(0)
+	let placeholder = $derived(prompts[promptIndex % prompts.length])
 	$effect(() => {
 		if (!showComposer || collapsed || reducedMotion.val) return
 		let timer: ReturnType<typeof setTimeout>
@@ -163,7 +213,6 @@
 			placeholderVisible = false
 			timer = setTimeout(() => {
 				promptIndex = (promptIndex + 1) % prompts.length
-				placeholder = prompts[promptIndex]
 				placeholderVisible = true
 				timer = setTimeout(next, CYCLE_MS)
 			}, FADE_MS)
@@ -185,11 +234,13 @@
 				<!-- The one dismiss control while the composer is usable; the overlay below carries its
 				     own once it takes over, so the two never show at the same time. -->
 				<div class="absolute right-0 top-0 z-20">
-					<CloseButton small noBg title="Hide Build with AI" onClick={() => setCollapsed(true)} />
+					<CloseButton small noBg title="Remove session chat" onClick={removeComposer} />
 				</div>
 			{/if}
 			<div class="flex items-center justify-center gap-2 mb-4">
-				<p class="text-center font-regular text-3xl">Build with AI</p>
+				<p class="text-center font-regular text-3xl">
+					{$userStore?.operator ? 'Run with AI' : 'Build with AI'}
+				</p>
 				<Badge color="blue" small>Beta</Badge>
 			</div>
 			<!-- Anchors the send button / model settings to the input, not to the whole block — the row
@@ -204,7 +255,9 @@
 						underlyingInputEl="textarea"
 						inputProps={{
 							rows: 4,
-							'aria-label': 'Describe what you want to build',
+							'aria-label': $userStore?.operator
+								? 'Describe what you want to do'
+								: 'Describe what you want to build',
 							onkeydown: onKeydown
 						}}
 					/>
@@ -267,14 +320,12 @@
 									unifiedSize="sm"
 									variant="accent"
 									startIcon={{ icon: freeTierExhausted ? KeyRound : Settings }}
-									href="{base}/workspace_settings?tab=ai"
+									href="/workspace_settings?tab=ai"
 								>
 									{freeTierExhausted ? 'Add your own API key' : 'Configure AI'}
 								</Button>
 							{/if}
-							<Button unifiedSize="sm" variant="default" onClick={() => setCollapsed(true)}>
-								Hide
-							</Button>
+							<Button unifiedSize="sm" variant="default" onClick={removeComposer}>Remove</Button>
 						</div>
 					</div>
 				{/if}
@@ -295,49 +346,106 @@
 						</Button>
 					{/each}
 				</div>
-			{:else if showComposer}
-				<!-- All that is left of the composer once dismissed: sits with the CLI/MCP row so the
-				     collapsed home page is one quiet line. -->
-				<Button
-					variant="subtle"
-					unifiedSize="xs"
-					btnClasses="!text-2xs !text-hint"
-					startIcon={{ icon: WandSparkles }}
-					onClick={() => setCollapsed(false)}
-				>
-					Build with AI
-				</Button>
-			{:else}
-				<div></div>
 			{/if}
-
-			<!-- Not AI-related, so shown even to operators / when the composer is hidden. -->
-			<div class="flex flex-row items-center gap-1">
-				<Button
-					variant="subtle"
-					unifiedSize="xs"
-					btnClasses="!text-2xs !text-hint"
-					startIcon={{ icon: PlugZap }}
-					onClick={() => homeConnectDrawer?.openDrawer?.()}
-				>
-					CLI / MCP
-				</Button>
-				{#if !$userStore?.operator && HOME_SHOW_HUB}
-					<Button
-						variant="subtle"
-						unifiedSize="xs"
-						btnClasses="!text-2xs !text-hint"
-						startIcon={{ icon: Globe2 }}
-						endIcon={{ icon: ExternalLink }}
-						href={$hubBaseUrlStore}
-						target="_blank"
-					>
-						Hub
-					</Button>
-				{/if}
-			</div>
 		</div>
 	</div>
 </div>
 
 <HomeConnectDrawer bind:this={homeConnectDrawer} />
+
+<!-- Everything the hero offered beside the composer lives in the band's menu: the connect helper,
+     the hub, and the way back to the composer once it has been put away. -->
+<!-- Last in the bar whatever else the page registers: a menu of side trips belongs after the
+     buttons that act on what is on screen. -->
+<PageHeaderContent actions={homeMenu} actionsOrder={100} />
+
+{#snippet homeMenu()}
+	<!-- The band's own menu: the connect helper, the hub, and whether the composer is on this page
+	     — all of them preferences or side trips, none of them the page's work. -->
+	<span class="flex items-center gap-1">
+		<!-- Wide enough, and the two side trips are buttons of their own: a menu is where a thing
+		     goes when the bar cannot hold it, not where it belongs. They fold back below the width
+		     above. -->
+		{#if sideTripsInBar}
+			<!-- The same quiet shape the hero gave them before the bar took them: xs, hint-coloured,
+			     and the hub keeps its outbound mark. They sit beside the page's own buttons, and a
+			     side trip should not read as loudly as the thing the page is for. -->
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				btnClasses="!text-2xs !text-hint"
+				startIcon={{ icon: PlugZap }}
+				onClick={() => homeConnectDrawer?.openDrawer?.()}
+			>
+				CLI / MCP
+			</Button>
+			{#if hubOffered}
+				<Button
+					variant="subtle"
+					unifiedSize="xs"
+					btnClasses="!text-2xs !text-hint"
+					startIcon={{ icon: Globe2 }}
+					endIcon={{ icon: ExternalLink }}
+					href={$hubBaseUrlStore}
+					target="_blank"
+				>
+					Hub
+				</Button>
+			{/if}
+		{/if}
+		<!-- Nothing left to hold once the side trips stand in the bar and the composer is on the
+		     page: an ellipsis that opens an empty menu is a button that does nothing. -->
+		<!-- No menu while the hero is on the page and its side trips are in the bar: the hero's own
+		     cross removes it, so an ellipsis holding a second way to do that is a button whose only
+		     item is a duplicate. -->
+		{#if !sideTripsInBar || (showComposer && collapsed)}
+			<!-- The flash rides the ellipsis itself, not the row: with the side trips beside it the
+			     row is three controls wide, and marking all three names none of them. -->
+			<span class="relative inline-flex">
+				{#if pulsing}
+					<!-- `opacity-0` at rest: the keyframes carry no fill mode, so at the end of the
+					     animation the element returns to its own opacity. At 1 that is the flash coming
+					     back at full strength until the unmount timer catches up. -->
+					<span
+						aria-hidden="true"
+						class="pointer-events-none absolute -inset-1 rounded-lg bg-blue-500/30 opacity-0 animate-fade-out"
+					></span>
+				{/if}
+				<DropdownV2
+					placement="bottom-end"
+					size="sm"
+					items={[
+						...(showComposer && collapsed
+							? [
+									{
+										displayName: 'Pin session hero to homepage',
+										icon: WandSparkles,
+										action: () => setCollapsed(false)
+									}
+								]
+							: []),
+						...(sideTripsInBar
+							? []
+							: [
+									{
+										displayName: 'CLI / MCP',
+										icon: PlugZap,
+										action: () => homeConnectDrawer?.openDrawer?.()
+									},
+									...(hubOffered
+										? [
+												{
+													displayName: 'Hub',
+													icon: Globe2,
+													href: $hubBaseUrlStore,
+													hrefTarget: '_blank' as const
+												}
+											]
+										: [])
+								])
+					]}
+				/>
+			</span>
+		{/if}
+	</span>
+{/snippet}
diff --git a/frontend/src/lib/components/home/HomeConnectDrawer.svelte b/frontend/src/lib/components/home/HomeConnectDrawer.svelte
index e08ac2ddea..2b86025549 100644
--- a/frontend/src/lib/components/home/HomeConnectDrawer.svelte
+++ b/frontend/src/lib/components/home/HomeConnectDrawer.svelte
@@ -6,6 +6,7 @@
 	import { Bot, ExternalLink, Terminal } from 'lucide-svelte'
 	import { shell } from 'svelte-highlight/languages'
 	import { mcpTokenUrlDisabled } from '$lib/mcpAuth'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 
 	type ConnectTab = 'cli' | 'mcp'
 
@@ -14,7 +15,7 @@
 	let selectedTab: ConnectTab = $state('cli')
 	let openVersion = $state(0)
 
-	const origin = $derived(typeof window === 'undefined' ? '' : window.location.origin)
+	const origin = $derived(typeof window === 'undefined' ? '' : `${apiBaseUrl()}/`)
 	const workspaceId = $derived($workspaceStore ?? '<workspace>')
 	const cliCommands = $derived(`npm install -g windmill-cli
 wmill workspace add ${workspaceId} ${workspaceId} ${origin}
@@ -55,7 +56,8 @@ wmill sync pull`)
 												<h3 class="text-sm font-semibold text-emphasis">Local setup</h3>
 												<p class="text-xs text-secondary max-w-xl">
 													Run this in your local repo to bind the current workspace, create
-													<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+													<code
+														class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 														>wmill.yaml</code
 													>, and pull the latest files.
 												</p>
@@ -80,15 +82,18 @@ wmill sync pull`)
 										/>
 
 										<p class="text-2xs text-secondary">
-											<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+											<code
+												class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 												>wmill workspace add</code
 											>
 											will handle authentication,
-											<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+											<code
+												class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 												>wmill init</code
 											>
 											bootstraps the local config, and
-											<code class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
+											<code
+												class="rounded bg-surface-secondary px-1 py-0.5 font-mono text-2xs text-emphasis"
 												>wmill sync pull</code
 											>
 											fetches the workspace content.
diff --git a/frontend/src/lib/components/home/Item.svelte b/frontend/src/lib/components/home/Item.svelte
index a8837d555a..67dac7b3dd 100644
--- a/frontend/src/lib/components/home/Item.svelte
+++ b/frontend/src/lib/components/home/Item.svelte
@@ -45,10 +45,9 @@
 	// A raw app the listing returns is an `app` row carrying `raw_app`, and is
 	// selectable like any other app. The separate `raw_app` type is the legacy
 	// listing shape, which renders through RawAppRow — no selection control there,
-	// so it must not enter the selection either. An agent is a resource underneath,
-	// which none of the bulk actions handle.
+	// so it must not enter the selection either.
 	let bulkItem = $derived(
-		homeSelection?.available && item.type !== 'raw_app' && item.type !== 'agent'
+		homeSelection?.available && item.type !== 'raw_app'
 			? toBulkItem(item, $userStore, $workspaceStore)
 			: undefined
 	)
@@ -145,6 +144,7 @@
 		{depth}
 		bind:menuOpen
 		{keyboardSelected}
+		{rowSelection}
 	/>
 {/if}
 
diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index e44bcb08aa..ee22e1a43a 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -19,7 +19,7 @@
 	import { resource } from 'runed'
 	import { getDraftItems } from '$lib/workspaceDrafts.svelte'
 	import { disableHubStore, userStore, workspaceStore } from '$lib/stores'
-	import { useOperatorBuilderFlows } from '$lib/operatorWriteRights'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import type uFuzzy from '@leeoniya/ufuzzy'
 	import {
 		ArrowDownUp,
@@ -50,7 +50,7 @@
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import FlowIcon from './FlowIcon.svelte'
-	import { canWrite, getLocalSetting, isOwner, storeLocalSetting } from '$lib/utils'
+	import { getLocalSetting, isOwner, storeLocalSetting } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
 	import Drawer from '../common/drawer/Drawer.svelte'
 	import HighlightCode from '../HighlightCode.svelte'
@@ -60,12 +60,11 @@
 	import { effectivePath, type ItemType } from './treeViewUtils'
 	import { tick, untrack } from 'svelte'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
-	import { NetworkIcon } from 'lucide-svelte'
-	import { base } from '$lib/base'
+	import PipelineRow from '../common/table/PipelineRow.svelte'
 	import BulkActionsBar from './BulkActionsBar.svelte'
 	import { HomeSelection, setHomeSelection, toBulkItem } from './homeSelection.svelte'
 
-	const operatorBuilderFlows = useOperatorBuilderFlows()
+	const editRights = useEditRights()
 
 	interface Props {
 		subtab?: 'flow' | 'script' | 'app' | 'agent'
@@ -358,11 +357,12 @@
 		const base = {
 			...it,
 			canWrite:
-				canWrite(it.path, (it.extra_perms ?? {}) as any, $userStore) &&
-				(it.type === 'script' || it.workspace_id == $workspaceStore) &&
-				// The builder right covers flows only; a script or an app is still off limits, so
-				// the row must not offer edit or delete for those.
-				(!$userStore?.operator || (it.type === 'flow' && $operatorBuilderFlows))
+				editRights.canEditItem(
+					it.type === 'app' && it.raw_app ? 'raw_app' : it.type,
+					it.path,
+					(it.extra_perms ?? {}) as any
+				) &&
+				(it.type === 'script' || it.workspace_id == $workspaceStore)
 		}
 		// combinedItems reads a script's time from `created_at`; the endpoint's
 		// unified `edited_at` holds exactly that for scripts.
@@ -435,7 +435,7 @@
 		agents = sorted.map((r, i) => ({
 			...r,
 			summary: r.description || undefined,
-			canWrite: canWrite(r.path, (r.extra_perms ?? {}) as any, $userStore) && !$userStore?.operator,
+			canWrite: editRights.canEditItem('agent', r.path, (r.extra_perms ?? {}) as any),
 			ord: AGENT_ORD_BASE + i
 		}))
 	}
@@ -835,6 +835,8 @@
 		// keeping a dead path. `tick` lets the reloaded rows re-register first.
 		const renderedBefore = homeSelection.renderedKeys
 		void ownerCountsRes.refetch()
+		// Deleting a pipeline removes it from this list, which no item reload covers.
+		void pipelineFoldersRes.refetch()
 		await reloadItems()
 		await tick()
 		homeSelection.dropVanished(renderedBefore)
@@ -1210,7 +1212,10 @@
 	 * whose direct-deploy protection cleared `showEditButtons` — must not be shown them.
 	 * Reading archived items is not a write, so it is not gated on this.
 	 */
-	let canCreateHere = $derived((!$userStore?.operator || $operatorBuilderFlows) && showEditButtons)
+	// Every author can create a flow or a full-code app, except a builder granted only the other.
+	let canCreateHere = $derived(
+		(editRights.roleCanAuthor('flow') || editRights.roleCanAuthor('raw_app')) && showEditButtons
+	)
 
 	// The workspace itself holds nothing — no filter is narrowing the list away. It stays
 	// false until the first load resolves: a skeleton already means "loading", and the
@@ -1820,8 +1825,7 @@
 				homeSelection.active &&
 				selectedIndex >= 0 &&
 				selectedIndex < displayedItems.length &&
-				displayedItems[selectedIndex].type !== 'raw_app' &&
-				displayedItems[selectedIndex].type !== 'agent'
+				displayedItems[selectedIndex].type !== 'raw_app'
 			) {
 				e.preventDefault()
 				homeSelection.toggle(
@@ -2042,7 +2046,7 @@
 				     script and flow hub pickers observe. Nor for a builder: a hub project brings
 				     scripts and apps along. -->
 				<CreateActionsMenu
-					onImportHubProject={$disableHubStore || $operatorBuilderFlows
+					onImportHubProject={$disableHubStore || !editRights.roleCanAuthor('script')
 						? undefined
 						: () => (hubPickerOpen = true)}
 				/>
@@ -2168,13 +2172,7 @@
 			<div class="border rounded-md bg-surface-tertiary" class:wm-imported={justImported}>
 				{#if filter === ''}
 					{#each [...visiblePipelineFolders].sort() as folder (folder)}
-						<a
-							href="{base}/pipeline/{encodeURIComponent(folder)}"
-							class="w-full inline-flex items-center gap-4 px-4 py-3 border-b last:border-b-0 hover:bg-surface-hover transition-colors text-sm first-of-type:rounded-t-md"
-						>
-							<NetworkIcon size={16} class="text-emerald-600 dark:text-emerald-400" />
-							<span class="text-xs font-medium text-emphasis truncate">Pipeline · f/{folder}</span>
-						</a>
+						<PipelineRow {folder} onDeleted={reloadItemsAndCounts} />
 					{/each}
 				{/if}
 				{#each displayedItems as item, i (item.type + '/' + item.path + (item.hash ? '/' + item.hash : ''))}
diff --git a/frontend/src/lib/components/home/TreeView.svelte b/frontend/src/lib/components/home/TreeView.svelte
index 4c6f3e8ae6..806787cb76 100644
--- a/frontend/src/lib/components/home/TreeView.svelte
+++ b/frontend/src/lib/components/home/TreeView.svelte
@@ -1,14 +1,14 @@
 <script lang="ts">
 	import TreeView from './TreeView.svelte'
-	import { onDestroy, untrack, type Snippet } from 'svelte'
+	import { createEventDispatcher, onDestroy, untrack, type Snippet } from 'svelte'
 	import ResizeTransitionWrapper from '$lib/components/common/ResizeTransitionWrapper.svelte'
 
-	import { ChevronDown, ChevronUp, Folder, FolderTree, NetworkIcon, User } from 'lucide-svelte'
+	import { ChevronDown, ChevronUp, Folder, FolderTree, User } from 'lucide-svelte'
+	import PipelineRow from '../common/table/PipelineRow.svelte'
 	import Item from './Item.svelte'
 	import { countLeaves, type FolderItem, type ItemType, type UserItem } from './treeViewUtils'
 	import { twMerge } from 'tailwind-merge'
 	import { pluralize } from '$lib/utils'
-	import { base } from '$lib/base'
 	import { Button } from '$lib/components/common'
 
 	interface Props {
@@ -74,6 +74,8 @@
 
 	let visualDepth = $derived(depth + indent)
 
+	const dispatch = createEventDispatcher<{ reload: void }>()
+
 	// Bounds the request burst from "expand all": however many root owners the tree
 	// renders (its slice grows as you scroll), it fetches at most this many. Lazy owners
 	// past the cap stay collapsed and load on a single click (see the effect).
@@ -316,17 +318,12 @@
 			{#if opened || isSearching}
 				<div>
 					{#if hasPipeline && isFolder(item)}
-						<!-- py-3 matches common/table/Row.svelte so this row sits at
-					     the same height as the script/flow/app rows that follow
-					     it under the same folder; py-2 was visibly shorter. -->
-						<a
-							href="{base}/pipeline/{encodeURIComponent(item.folderName)}"
-							class="flex items-center gap-4 px-4 py-3 border-b text-sm hover:bg-surface-hover transition-colors"
-							style="padding-left: {(visualDepth + 1) * 16}px;"
-						>
-							<NetworkIcon size={16} class="text-emerald-600 dark:text-emerald-400" />
-							<span class="text-xs font-medium text-emphasis">Pipeline</span>
-						</a>
+						<PipelineRow
+							folder={item.folderName}
+							depth={visualDepth + 1}
+							label="Pipeline"
+							onDeleted={() => dispatch('reload')}
+						/>
 					{/if}
 					{#each item.items.slice(0, effectiveMax) as subItem, index ((subItem['path'] ? subItem['type'] + '__' + subItem['path'] + '__' + index : undefined) ?? 'folder__' + subItem['folderName'] + '__' + index)}
 						<TreeView
diff --git a/frontend/src/lib/components/home/WorkspaceEmptyState.svelte b/frontend/src/lib/components/home/WorkspaceEmptyState.svelte
index 1f7bebb1ce..6e828eee34 100644
--- a/frontend/src/lib/components/home/WorkspaceEmptyState.svelte
+++ b/frontend/src/lib/components/home/WorkspaceEmptyState.svelte
@@ -4,11 +4,11 @@
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import type { HubProjectPick } from '$lib/hubProject'
 	import { disableHubStore } from '$lib/stores'
-	import { useOperatorBuilderFlows } from '$lib/operatorWriteRights'
+	import { useOperatorBuilderRights } from '$lib/operatorWriteRights'
 	import CreateActionsMenu from './CreateActionsMenu.svelte'
 	import HubTemplatePicker from './HubTemplatePicker.svelte'
 
-	const operatorBuilderFlows = useOperatorBuilderFlows()
+	const operatorBuilderRights = useOperatorBuilderRights()
 
 	interface Props {
 		/** A project was chosen here. The list owns the import dialog, and opens it on this. */
@@ -39,7 +39,7 @@
 	const rowOpacities = [1, 0.7, 0.4]
 
 	// A builder gets no hub template: a hub project brings scripts and apps along.
-	const showHub = $derived(!$disableHubStore && !$operatorBuilderFlows)
+	const showHub = $derived(!$disableHubStore && !$operatorBuilderRights)
 
 	// The inline "create a new one" link is the anchor for the very same New menu the
 	// toolbar button opens, so the menu pops next to the words that promised it.
diff --git a/frontend/src/lib/components/home/bulkActions.test.ts b/frontend/src/lib/components/home/bulkActions.test.ts
index d69c3b30ff..e00d5f5da5 100644
--- a/frontend/src/lib/components/home/bulkActions.test.ts
+++ b/frontend/src/lib/components/home/bulkActions.test.ts
@@ -15,6 +15,7 @@ function item(over: Partial<BulkItem> = {}): BulkItem {
 		archived: false,
 		draftOnly: false,
 		isDraft: false,
+		legacyDraft: false,
 		rawApp: false,
 		...over
 	}
@@ -56,6 +57,15 @@ describe('blockedReason', () => {
 		expect(blockedReason('unarchive', item({ archived: false }), admin)).toBeDefined()
 	})
 
+	// AgentRow's delete is `disabled: !canWrite`; the server moves no resource draft.
+	it('gates an agent as its row does, and keeps a draft-only one in place', () => {
+		const agent = item({ kind: 'agent', owner: false })
+		expect(blockedReason('delete', agent, member)).toBeUndefined()
+		expect(blockedReason('delete', { ...agent, canWrite: false }, member)).toBeDefined()
+		expect(blockedReason('archive', agent, admin)).toBeDefined()
+		expect(blockedReason('move', item({ kind: 'agent', draftOnly: true }), admin)).toBeDefined()
+	})
+
 	it('lets a draft-only row move or discard, never archive/delete', () => {
 		const draftOnly = item({ draftOnly: true, isDraft: true })
 		expect(blockedReason('discard', draftOnly, admin)).toBeUndefined()
diff --git a/frontend/src/lib/components/home/bulkActions.ts b/frontend/src/lib/components/home/bulkActions.ts
index da88e19121..20a65ec596 100644
--- a/frontend/src/lib/components/home/bulkActions.ts
+++ b/frontend/src/lib/components/home/bulkActions.ts
@@ -8,18 +8,19 @@
  * addresses the deployed row. A draft-only item is therefore not deletable —
  * there is nothing deployed at its path.
  */
-import { AppService, DraftService, FlowService, ScriptService } from '$lib/gen'
+import { AppService, DraftService, FlowService, ResourceService, ScriptService } from '$lib/gen'
 import type { UserDraftItemKind } from '$lib/gen'
 import { updateItemPathAndSummary } from '$lib/components/moveRenameManager'
 import { discardDraft } from '$lib/utils_draft_deploy'
 import type { BulkItem } from './homeSelection.svelte'
 
-/** The draft overlay is the one place a raw app is its own kind. Narrowed to the
- * four kinds `moveDraft` accepts — a `BulkItem` is never anything else, and
- * saying so lets the compiler check that rather than trusting it. */
+/** The draft overlay is the one place a raw app is its own kind, and an agent's
+ * draft is filed as the resource it is. Narrowed so the compiler checks that a
+ * `BulkItem` never maps to anything else. */
 function draftKind(
 	item: BulkItem
-): Extract<UserDraftItemKind, 'script' | 'flow' | 'app' | 'raw_app'> {
+): Extract<UserDraftItemKind, 'script' | 'flow' | 'app' | 'raw_app' | 'resource'> {
+	if (item.kind === 'agent') return 'resource'
 	return item.kind === 'app' && item.rawApp ? 'raw_app' : item.kind
 }
 
@@ -43,6 +44,9 @@ export function blockedReason(
 	switch (action) {
 		case 'move':
 			if (item.archived) return 'archived items cannot be moved'
+			// The server moves only script, flow and app drafts.
+			if (item.kind === 'agent' && item.draftOnly)
+				return 'a draft-only agent is moved by changing its path in the editor'
 			if (!item.owner) return notOwner
 			if (!item.canWrite) return 'you do not have write permission on this path'
 			return undefined
@@ -94,9 +98,11 @@ async function moveItem(ctx: BulkContext, item: BulkItem, target: string): Promi
 	if (item.draftOnly) {
 		// Nothing is deployed at this path, so there is no deploy to re-run: the
 		// item IS its draft row, and moving it rewrites that row.
+		const kind = draftKind(item)
+		if (kind === 'resource') throw new Error('a draft-only agent cannot be moved here')
 		await DraftService.moveDraft({
 			workspace: ctx.workspace,
-			kind: draftKind(item),
+			kind,
 			path: item.path,
 			requestBody: { new_path: newPath }
 		})
@@ -138,6 +144,8 @@ async function deleteItem(ctx: BulkContext, item: BulkItem): Promise<void> {
 		await ScriptService.deleteScriptByPath({ workspace: ctx.workspace, path: item.path })
 	} else if (item.kind === 'flow') {
 		await FlowService.deleteFlowByPath({ workspace: ctx.workspace, path: item.path })
+	} else if (item.kind === 'agent') {
+		await ResourceService.deleteResource({ workspace: ctx.workspace, path: item.path })
 	} else {
 		await AppService.deleteApp({ workspace: ctx.workspace, path: item.path })
 	}
@@ -150,7 +158,7 @@ async function discardItemDraft(ctx: BulkContext, item: BulkItem): Promise<void>
 		item.path,
 		ctx.workspace,
 		item.draftOnly,
-		false,
+		item.legacyDraft,
 		false
 	)
 	if (!res.success) throw new Error(res.error ?? 'discard failed')
diff --git a/frontend/src/lib/components/home/homeSelection.dom.test.ts b/frontend/src/lib/components/home/homeSelection.dom.test.ts
index 1e325fa3bd..17ddad1be9 100644
--- a/frontend/src/lib/components/home/homeSelection.dom.test.ts
+++ b/frontend/src/lib/components/home/homeSelection.dom.test.ts
@@ -15,6 +15,7 @@ function row(key: string): BulkItem {
 		archived: false,
 		draftOnly: false,
 		isDraft: false,
+		legacyDraft: false,
 		rawApp: false
 	}
 }
diff --git a/frontend/src/lib/components/home/homeSelection.svelte.ts b/frontend/src/lib/components/home/homeSelection.svelte.ts
index 97e2acc9d7..0b4cfcba7a 100644
--- a/frontend/src/lib/components/home/homeSelection.svelte.ts
+++ b/frontend/src/lib/components/home/homeSelection.svelte.ts
@@ -13,7 +13,7 @@ import type { UserExt } from '$lib/stores'
 /** A raw app is not a kind of its own here: the listing returns it as an `app`
  * row carrying `raw_app`, which every action addresses through `BulkItem.rawApp`
  * (only the draft overlay distinguishes the two). */
-export type BulkKind = 'script' | 'flow' | 'app'
+export type BulkKind = 'script' | 'flow' | 'app' | 'agent'
 
 /** The flattened row facts every bulk action needs, snapshotted at selection
  * time so an action still knows what it is acting on after the list reloads. */
@@ -32,6 +32,9 @@ export type BulkItem = {
 	draftOnly: boolean
 	/** The authed user has a draft at this path (the listing only flags their own). */
 	isDraft: boolean
+	/** A draft-only item whose draft is a legacy (owner-less) row, which only a
+	 * `legacy` delete reaches. */
+	legacyDraft: boolean
 	rawApp: boolean
 }
 
@@ -44,6 +47,7 @@ type RawItem = {
 	draft_only?: boolean | null
 	draft_path?: string | null
 	is_draft?: boolean
+	draft_users?: { username?: string | null }[] | null
 	raw_app?: boolean
 }
 
@@ -69,6 +73,8 @@ export function toBulkItem(
 		archived: item.archived ?? false,
 		draftOnly: !!item.draft_only,
 		isDraft: !!item.is_draft,
+		legacyDraft:
+			!!item.draft_only && item.draft_users?.length === 1 && item.draft_users[0]?.username == null,
 		rawApp: !!item.raw_app
 	}
 }
diff --git a/frontend/src/lib/components/home/homeSelection.test.ts b/frontend/src/lib/components/home/homeSelection.test.ts
index 1daf18563e..25502d7eaf 100644
--- a/frontend/src/lib/components/home/homeSelection.test.ts
+++ b/frontend/src/lib/components/home/homeSelection.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { HomeSelection, type BulkItem } from './homeSelection.svelte'
+import { HomeSelection, toBulkItem, type BulkItem } from './homeSelection.svelte'
 
 function bulk(key: string, over: Partial<BulkItem> = {}): BulkItem {
 	return {
@@ -13,6 +13,7 @@ function bulk(key: string, over: Partial<BulkItem> = {}): BulkItem {
 		archived: false,
 		draftOnly: false,
 		isDraft: false,
+		legacyDraft: false,
 		rawApp: false,
 		...over
 	}
@@ -81,3 +82,13 @@ describe('HomeSelection.register', () => {
 		expect(s.items[0].archived).toBe(true)
 	})
 })
+
+describe('toBulkItem', () => {
+	it('flags a draft-only row owned by nobody as legacy, so its discard can reach it', () => {
+		const row = { type: 'script', path: 'f/a/one', draft_only: true, is_draft: true }
+		const legacy = toBulkItem({ ...row, draft_users: [{ username: null }] }, undefined, 'ws')
+		const own = toBulkItem({ ...row, draft_users: [{ username: 'me' }] }, undefined, 'ws')
+		expect(legacy.legacyDraft).toBe(true)
+		expect(own.legacyDraft).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 9701b74e30..27906dddee 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -5,6 +5,7 @@ import { instanceBannerFormError } from './instanceBanner'
 import { ACCENT_COLOR_SETTING, parseAccentColor } from '$lib/accentColor'
 import { parseMaxTokenExpirationDays } from '$lib/tokenExpiration'
 import { writable } from 'svelte/store'
+import { OidcService } from '$lib/gen'
 
 /**
  * Bumped after instance settings are successfully saved. Settings whose display
@@ -175,8 +176,7 @@ export function isValidWebhookBaseUrl(value: unknown): boolean {
 	return (
 		(url.protocol === 'http:' || url.protocol === 'https:') &&
 		url.host !== '' &&
-		// Userinfo would end up in the per-repository receiver stored in workspace
-		// settings, which workspace admins can read.
+		// Userinfo would end up in URLs that users who are not instance admins can read.
 		url.username === '' &&
 		url.password === '' &&
 		// Tested on the raw string, not `url.search`/`url.hash`: those are `''` for a
@@ -187,6 +187,8 @@ export function isValidWebhookBaseUrl(value: unknown): boolean {
 		// `new URL` silently percent-encodes a space in the path, where the server
 		// rejects it outright.
 		!/\s/.test(trimmed) &&
+		// Shell-active characters: the URL is pasted into commands users copy.
+		!/[$`'"\\;&|<>(){}*!]/.test(trimmed) &&
 		!trimmed.endsWith('/')
 	)
 }
@@ -207,7 +209,29 @@ export const settings: Record<string, Setting[]> = {
 				(value?.startsWith('http') &&
 					value.includes('://') &&
 					!value?.endsWith('/') &&
-					!value?.endsWith(' '))
+					!value?.endsWith(' ')),
+			advancedToggle: {
+				label: 'The API is served on a different url than the UI',
+				onChange(values) {
+					values['api_base_url'] = values['api_base_url'] == null ? '' : null
+					return values
+				},
+				checked: (values) => values['api_base_url'] != null
+			}
+		},
+		{
+			label: 'API base url',
+			description:
+				'Base url shown to users for the endpoints external clients call (webhooks, HTTP routes, push trigger endpoints, the CLI remote), without trailing slash. Leave empty to show the url the UI is browsed on. Set it when the API is served on a separate domain or behind an API gateway. If that url does not also serve the UI, the CLI must authenticate with a token rather than the browser login.',
+			key: 'api_base_url',
+			fieldType: 'text',
+			placeholder: 'https://api.windmill.company.com',
+			storage: 'setting',
+			ee_only: '',
+			hiddenIfNull: true,
+			error:
+				'API base url must be an http:// or https:// url with a host, no embedded username or password, no query string or fragment, no shell metacharacters, and no trailing slash',
+			isValid: isValidWebhookBaseUrl
 		},
 		{
 			label: 'Email domain',
@@ -354,6 +378,15 @@ export const settings: Record<string, Setting[]> = {
 				value === null ||
 				value === '' ||
 				parseAccentColor(value) !== undefined
+		},
+		{
+			label: 'Sync resource types from the hub daily',
+			description:
+				'Every day, the server updates the resource types of the admins workspace from the Hub, overwriting local edits to the types the Hub also defines. Superadmins can also sync them on demand with "Sync resource types with Hub".',
+			key: 'sync_hub_resource_types_daily',
+			fieldType: 'boolean',
+			storage: 'setting',
+			hideInQuickSetup: true
 		}
 	],
 	Jobs: [
@@ -798,6 +831,7 @@ export const settings: Record<string, Setting[]> = {
 		}
 	],
 	'DB Health': [],
+	'OIDC signing': [],
 	Registries: [
 		{
 			label: 'Instance Python Version',
@@ -808,7 +842,7 @@ export const settings: Record<string, Setting[]> = {
 			// 1. Change placeholder in instanceSettings.ts
 			// 2. Change LATEST_STABLE_PY in dockerfile
 			// 3. Change #[default] annotation for PyVersion in backend
-			placeholder: '3.10,3.11,3.12,3.13',
+			placeholder: '3.10,3.11,3.12,3.13,3.14,3.15',
 			select_items: [
 				{
 					label: 'Latest Stable',
@@ -826,6 +860,12 @@ export const settings: Record<string, Setting[]> = {
 				},
 				{
 					label: '3.13'
+				},
+				{
+					label: '3.14'
+				},
+				{
+					label: '3.15'
 				}
 			],
 			storage: 'setting'
@@ -1223,7 +1263,7 @@ export const settings: Record<string, Setting[]> = {
 			storage: 'setting',
 			ee_only: '',
 			error:
-				'Webhook base url must be an http:// or https:// url with a host, no embedded username or password, no query string or fragment, and no trailing slash',
+				'Webhook base url must be an http:// or https:// url with a host, no embedded username or password, no query string or fragment, no shell metacharacters, and no trailing slash',
 			isValid: isValidWebhookBaseUrl
 		}
 	],
@@ -1306,6 +1346,13 @@ export const instanceSettingsNavigationGroups = [
 				aiId: 'instance-settings-scim-saml',
 				aiDescription: 'Instance SCIM/SAML settings',
 				isEE: true
+			},
+			{
+				id: 'oidc_signing',
+				label: 'OIDC signing',
+				aiId: 'instance-settings-oidc-signing',
+				aiDescription: 'Keys that sign and verify the OIDC tokens Windmill issues',
+				isEE: true
 			}
 		]
 	},
@@ -1463,6 +1510,7 @@ export const tabToCategoryMap: Record<string, string> = {
 	github_enterprise_app: 'GitHub App',
 	websocket: 'WebSocket',
 	db_health: 'DB Health',
+	oidc_signing: 'OIDC signing',
 	lsp: 'LSP'
 }
 
@@ -1472,6 +1520,30 @@ export const tabToAuthSubTab: Record<string, 'sso' | 'oauth' | 'scim'> = {
 	scim_saml: 'scim'
 }
 
+/**
+ * "OIDC signing" is listed only on instances that sign with an external signer: its page
+ * says nothing actionable elsewhere.
+ */
+export function listedNavigationGroups<G extends { items: { id: string }[] }>(
+	groups: G[],
+	externalOidcSigner: boolean
+): G[] {
+	if (externalOidcSigner) return groups
+	return groups.map((group) => ({
+		...group,
+		items: group.items.filter((item) => item.id !== 'oidc_signing')
+	}))
+}
+
+/** The status endpoint is EE only: call it once the license is known. */
+export async function usesExternalOidcSigner(): Promise<boolean> {
+	try {
+		return (await OidcService.getOidcSigningStatus()).mode === 'external'
+	} catch {
+		return false
+	}
+}
+
 // Navigation groups for the initial setup flow (no Users tab)
 export const setupNavigationGroups = instanceSettingsNavigationGroups
 	.map((group) => ({
@@ -1500,6 +1572,7 @@ export const categoryToTabMap: Record<string, string> = {
 	'GitHub App': 'github_enterprise_app',
 	WebSocket: 'websocket',
 	'DB Health': 'db_health',
+	'OIDC signing': 'oidc_signing',
 	LSP: 'lsp'
 }
 
diff --git a/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte b/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte
index 8d7d107940..2f2145da9b 100644
--- a/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { JobService, SettingService, WorkspaceService, type AIConfig } from '$lib/gen'
+	import { SettingService, WorkspaceService, type AIConfig } from '$lib/gen'
 	import { setCopilotInfo } from '$lib/aiStore'
 	import { workspaceStore, userStore } from '$lib/stores'
 	import { getUserExt } from '$lib/user'
@@ -7,6 +7,7 @@
 	import { workspaceAIClients } from '../copilot/lib'
 	import AISettings from '../workspaceSettings/AISettings.svelte'
 	import { Alert, Button } from '../common'
+	import SettingCard from './SettingCard.svelte'
 
 	interface Props {
 		hasUnsavedChanges?: boolean
@@ -80,20 +81,15 @@
 		hubSyncStatus = 'loading'
 		hubSyncMessage = ''
 		try {
-			await JobService.runWaitResultScriptByPath({
-				workspace: 'admins',
-				path: 'u/admin/hub_sync',
-				requestBody: {}
-			})
+			const res = await fetch('/api/settings/sync_cached_resource_types', { method: 'POST' })
+			if (!res.ok) {
+				const body = await res.text()
+				throw new Error(body || res.statusText)
+			}
+			hubSyncMessage = await res.text()
 			hubSyncStatus = 'success'
-			hubSyncMessage = 'Resource types synced from hub successfully'
 		} catch (e: any) {
-			hubSyncMessage =
-				e?.body?.error?.message ||
-				e?.body?.message ||
-				(typeof e?.body === 'string' ? e.body : null) ||
-				e?.message ||
-				'Failed to sync from hub'
+			hubSyncMessage = e?.message ?? 'Failed to sync from hub'
 			hubSyncStatus = 'error'
 		}
 	}
@@ -101,37 +97,31 @@
 
 {#if loaded}
 	{#if showHubSync}
-		<div
-			class="p-3 border rounded-md bg-surface-secondary mb-4 mt-4 flex items-center justify-between gap-4"
+		<SettingCard
+			label="Resource types"
+			description="AI providers require their resource types. Sync from the Hub if they are missing."
+			class="my-4"
 		>
-			<div>
-				<p class="text-xs font-medium text-secondary">Resource types</p>
-				<p class="text-2xs text-tertiary mt-0.5">
-					AI providers require their resource types. Sync from the Hub if they are missing.
-				</p>
-			</div>
-			<Button
-				variant="default"
-				unifiedSize="sm"
-				loading={hubSyncStatus === 'loading'}
-				onClick={syncFromHub}
-			>
-				Sync from hub
-			</Button>
-		</div>
-		{#if hubSyncStatus === 'success'}
-			<div class="mb-4">
-				<Alert type="success" title="Resource types synced">
+			{#snippet headerAction()}
+				<Button
+					variant="default"
+					unifiedSize="sm"
+					loading={hubSyncStatus === 'loading'}
+					onClick={syncFromHub}
+				>
+					Sync from hub
+				</Button>
+			{/snippet}
+			{#if hubSyncStatus === 'success'}
+				<Alert type="success" title="Resource types synced" class="mt-2">
 					{hubSyncMessage}
 				</Alert>
-			</div>
-		{:else if hubSyncStatus === 'error'}
-			<div class="mb-4">
-				<Alert type="error" title="Sync failed">
+			{:else if hubSyncStatus === 'error'}
+				<Alert type="error" title="Sync failed" class="mt-2">
 					{hubSyncMessage}
 				</Alert>
-			</div>
-		{/if}
+			{/if}
+		</SettingCard>
 	{/if}
 
 	<AISettings
diff --git a/frontend/src/lib/components/instanceSettings/OidcSigningStatus.svelte b/frontend/src/lib/components/instanceSettings/OidcSigningStatus.svelte
new file mode 100644
index 0000000000..e223b7452c
--- /dev/null
+++ b/frontend/src/lib/components/instanceSettings/OidcSigningStatus.svelte
@@ -0,0 +1,100 @@
+<script lang="ts">
+	import { OidcService } from '$lib/gen'
+	import { Alert, Badge, CopyButton } from '$lib/components/common'
+	import DataTable from '$lib/components/table/DataTable.svelte'
+	import Head from '$lib/components/table/Head.svelte'
+	import Cell from '$lib/components/table/Cell.svelte'
+	import { displayDate } from '$lib/utils'
+
+	type Status = Awaited<ReturnType<typeof OidcService.getOidcSigningStatus>>
+
+	let status = $state<Status | undefined>(undefined)
+	let loadError = $state<string | undefined>(undefined)
+
+	const modeLabels: Record<Status['mode'], string> = {
+		database: 'Key stored in the database',
+		file: 'Key file (OIDC_SIGNING_KEY_FILE)',
+		external: 'External signer (OIDC_SIGNER_URL)'
+	}
+
+	$effect(() => {
+		OidcService.getOidcSigningStatus()
+			.then((s) => {
+				status = s
+				loadError = undefined
+			})
+			.catch((e) => {
+				loadError = e?.body ?? e?.message ?? String(e)
+			})
+	})
+</script>
+
+{#if loadError}
+	<Alert type="error" title="Could not load the OIDC signing status">{loadError}</Alert>
+{:else if status}
+	<div class="flex flex-col gap-4">
+		<div class="text-xs text-primary">
+			<span class="text-secondary">Tokens are signed by:</span>
+			{modeLabels[status.mode]}
+		</div>
+		{#if status.signer}
+			<div class="flex flex-wrap items-center gap-2 text-xs text-primary">
+				<span class="text-secondary">Last key listing:</span>
+				{status.signer.last_refresh_success
+					? displayDate(status.signer.last_refresh_success)
+					: 'never'}
+				{#if status.signer.breaker !== 'closed'}
+					<Badge color="red">Signer unreachable</Badge>
+				{:else if !status.signer.last_refresh_error && status.signer.last_refresh_success}
+					<Badge color="green">Signer reachable</Badge>
+				{/if}
+			</div>
+			{#if status.signer.last_refresh_error}
+				<Alert type="warning" title="The last key listing was refused">
+					{status.signer.last_refresh_error}
+				</Alert>
+			{/if}
+			{#if status.signer.keys_from_store}
+				<Alert type="warning" title="The signer has not answered since this server started">
+					The keys below are those stored by the last accepted listing. Tokens cannot be signed
+					until the signer answers.
+				</Alert>
+			{/if}
+			{#if status.signer.tls_files_error}
+				<Alert type="warning" title="The mTLS files on disk are not in use">
+					{status.signer.tls_files_error}. The previous certificate and key are kept.
+				</Alert>
+			{/if}
+		{/if}
+		<DataTable size="xs">
+			<Head>
+				<tr>
+					<Cell head first>Key ID (kid)</Cell>
+					<Cell head>Algorithm</Cell>
+					<Cell head>State</Cell>
+					<Cell head last>Source</Cell>
+				</tr>
+			</Head>
+			<tbody>
+				{#each status.keys as key, i (`${key.source}:${key.kid ?? i}`)}
+					<tr>
+						<Cell first>
+							<span class="flex items-center gap-1 font-mono text-xs">
+								{key.kid}
+								{#if key.kid}<CopyButton value={key.kid} />{/if}
+							</span>
+						</Cell>
+						<Cell>{key.alg}</Cell>
+						<Cell>
+							<Badge color={key.state === 'active' ? 'green' : 'gray'}>{key.state}</Badge>
+						</Cell>
+						<Cell last>{key.source}</Cell>
+					</tr>
+				{/each}
+			</tbody>
+		</DataTable>
+		{#if status.keys.length === 0}
+			<div class="text-xs text-secondary">The JWKS serves no key.</div>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts b/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts
index c8545b073e..175a251315 100644
--- a/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts
+++ b/frontend/src/lib/components/instanceSettingsWebhookBaseUrl.test.ts
@@ -29,7 +29,10 @@ const REJECTED = [
 	'https://hooks.example.com?',
 	'https://hooks.example.com#',
 	'https://user:password@hooks.example.com',
-	'https://user@hooks.example.com'
+	'https://user@hooks.example.com',
+	'https://hooks.example.com/$(uname)',
+	'https://hooks.example.com/`uname`',
+	'https://hooks.example.com/a;b'
 ]
 
 describe('isValidWebhookBaseUrl', () => {
@@ -41,10 +44,13 @@ describe('isValidWebhookBaseUrl', () => {
 		expect(isValidWebhookBaseUrl(value)).toBe(false)
 	})
 
-	it.each([true, 42, {}, [], null] as unknown[])('rejects the non-string %j without throwing', (value) => {
-		// `Setting.isValid` is typed `any` and YAML mode can supply any JSON shape.
-		expect(isValidWebhookBaseUrl(value as never)).toBe(value === null)
-	})
+	it.each([true, 42, {}, [], null] as unknown[])(
+		'rejects the non-string %j without throwing',
+		(value) => {
+			// `Setting.isValid` is typed `any` and YAML mode can supply any JSON shape.
+			expect(isValidWebhookBaseUrl(value as never)).toBe(value === null)
+		}
+	)
 
 	it('treats unset and blank as valid, since the setting is optional', () => {
 		expect(isValidWebhookBaseUrl(undefined)).toBe(true)
diff --git a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
index c6b86b1cc7..950700b28f 100644
--- a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
+++ b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$app/paths'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { WorkerService } from '$lib/gen'
 	import { resource } from 'runed'
@@ -43,7 +42,7 @@
 			{subject} run as Windmill jobs tagged <b>{tag}</b>, and no worker is currently listening to
 			that tag, so they stay queued until one is. If no worker group is meant to serve it, add
 			<b>{tag}</b>
-			to a group's worker tags on the <a href="{base}/workers">workers page</a>.
+			to a group's worker tags on the <a href="/workers">workers page</a>.
 		</Alert>
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/mcp/McpConnect.svelte b/frontend/src/lib/components/mcp/McpConnect.svelte
index 1fe1a2fed9..a8808aa052 100644
--- a/frontend/src/lib/components/mcp/McpConnect.svelte
+++ b/frontend/src/lib/components/mcp/McpConnect.svelte
@@ -8,7 +8,6 @@
 	import McpServerOAuthConnect from './McpServerOAuthConnect.svelte'
 	import OauthScopes from '$lib/components/OauthScopes.svelte'
 	import { sameTopDomainOrigin } from '$lib/cookies'
-	import { base } from '$lib/base'
 	import { onDestroy, untrack } from 'svelte'
 	import { ExternalLink, Pen } from 'lucide-svelte'
 	import { MCP_REGISTRY, findMcpEntry, findMcpEntryByUrl } from './registry'
@@ -449,7 +448,7 @@
 				Under <span class="font-mono">u/{$userStore?.username ?? 'you'}</span> it is yours alone; in
 				a folder, everyone in it can use the connection and its token. Saved as an
 				<a
-					href="{base}/resources?workspace={ws}"
+					href="/resources?workspace={ws}"
 					target="_blank"
 					rel="noopener noreferrer"
 					class="text-accent hover:underline inline-flex items-center gap-1"
diff --git a/frontend/src/lib/components/mcp/mcpMenu.svelte.ts b/frontend/src/lib/components/mcp/mcpMenu.svelte.ts
index a911d71c07..853d994014 100644
--- a/frontend/src/lib/components/mcp/mcpMenu.svelte.ts
+++ b/frontend/src/lib/components/mcp/mcpMenu.svelte.ts
@@ -1,4 +1,4 @@
-import { List, Plus } from 'lucide-svelte'
+import { List, Loader2, Plus } from 'lucide-svelte'
 import type { Component } from 'svelte'
 import { get } from 'svelte/store'
 import { ResourceService } from '$lib/gen'
@@ -27,6 +27,14 @@ const MAX_MENU_SERVERS = 8
 // menu nobody is reading that far down.
 const MAX_ICON_LOOKUPS = 20
 
+// Not `disabled`: melt stamps that on a row at mount and never clears it, and the
+// unkeyed submenu reuses this row for the first server once the load lands.
+const loadingItem: Item = {
+	displayName: 'Loading…',
+	icon: Loader2,
+	iconProps: { class: 'animate-spin shrink-0' }
+}
+
 /**
  * The chat "+" menu's MCP submenu: one row per connected server, checked when it
  * is on, then the way to manage them. Connecting and deleting live in the
@@ -38,7 +46,7 @@ export class McpMenu {
 	#seq = 0
 	/** Rows for the workspace named by `#rowsWorkspace`, and meaningless for any other. */
 	#rows = $state<Row[]>([])
-	#rowsWorkspace: string | undefined = undefined
+	#rowsWorkspace = $state<string | undefined>(undefined)
 
 	constructor(manager: AIChatManager, onManage: () => void) {
 		this.#manager = manager
@@ -73,6 +81,10 @@ export class McpMenu {
 					editedAt: r.edited_at,
 					enabled: isMcpEnabled(ws, r.path)
 				}))
+				// Enabled first: those are the ones a quick visit is most likely about.
+				// Sorted here, once per load, not in `items()`: the open submenu re-derives
+				// from `items()`, so a toggle would move rows under the cursor.
+				.sort((a, b) => Number(b.enabled) - Number(a.enabled) || a.path.localeCompare(b.path))
 			this.#rowsWorkspace = ws
 			void this.#loadIcons(ws, seq)
 		} catch {
@@ -143,23 +155,22 @@ export class McpMenu {
 		await this.#manager.refreshMcpServers(ws)
 	}
 
-	/** Loaded on open so the checks are current. */
-	async items(closeMenu?: () => void): Promise<Item[]> {
+	/** Called on open so the checks are current; never awaited, see `items`. */
+	refresh() {
+		const ws = this.#ws
+		if (ws) void this.#load(ws)
+	}
+
+	/**
+	 * Built from the live rows, so call it from a getter: the submenu then fills in
+	 * when a load lands instead of the whole "+" menu waiting on the fetch. Rows for
+	 * another workspace are not shown — same path, different server.
+	 */
+	items(closeMenu?: () => void): Item[] {
 		const ws = this.#ws
 		if (!ws) return []
-		// The menu opens on what is already known and refreshes behind it: awaited
-		// inline it would stall the whole "+" menu, attachments included. Rows for
-		// another workspace are not "already known" — same path, different server.
-		if (this.#rowsWorkspace !== ws) {
-			this.#rows = []
-			await this.#load(ws)
-		} else {
-			void this.#load(ws)
-		}
-		// Enabled first: those are the ones a quick visit is most likely about.
-		const ordered = [...this.#rows].sort(
-			(a, b) => Number(b.enabled) - Number(a.enabled) || a.path.localeCompare(b.path)
-		)
+		if (this.#rowsWorkspace !== ws) return [loadingItem]
+		const ordered = this.#rows
 		const shown = ordered.slice(0, MAX_MENU_SERVERS)
 		const manage = () => {
 			closeMenu?.()
diff --git a/frontend/src/lib/components/mcp/providerIcon.ts b/frontend/src/lib/components/mcp/providerIcon.ts
index ed8d059a57..a666b2b1c5 100644
--- a/frontend/src/lib/components/mcp/providerIcon.ts
+++ b/frontend/src/lib/components/mcp/providerIcon.ts
@@ -12,8 +12,11 @@ import { findMcpEntry, findMcpEntryByUrl } from './registry'
  * the chat does not otherwise reach that barrel. `import.meta.glob` gives the
  * filenames at build time and the module only when a match is actually used, so
  * a workspace with two connections downloads two icons.
+ *
+ * The pattern is relative because svelte-package rewrites `$lib` only in import
+ * specifiers: an aliased glob ships as-is and no consumer's bundler expands it.
  */
-const iconModules = import.meta.glob('$lib/components/icons/*.svelte') as Record<
+const iconModules = import.meta.glob('../icons/*.svelte') as Record<
 	string,
 	() => Promise<{ default: Component<any> }>
 >
diff --git a/frontend/src/lib/components/meltComponents/Menu.svelte b/frontend/src/lib/components/meltComponents/Menu.svelte
index ab6de64123..02ed1d90f7 100644
--- a/frontend/src/lib/components/meltComponents/Menu.svelte
+++ b/frontend/src/lib/components/meltComponents/Menu.svelte
@@ -16,6 +16,10 @@
 
 	interface Props {
 		placement?: Placement
+		/** Inline style on the panel. A margin here shifts it after floating-ui has placed it,
+		 *  which is the only way to anchor it to a box wider than the trigger: melt's menubar
+		 *  menu ignores `positioning.offset`. */
+		contentStyle?: string
 		justifyEnd?: boolean
 		lightMode?: boolean
 		maxHeight?: number
@@ -45,6 +49,7 @@
 
 	let {
 		placement = 'right-start',
+		contentStyle = '',
 		justifyEnd = false,
 		lightMode = false,
 		maxHeight = 900,
@@ -221,6 +226,7 @@
 			onmouseenter={cancelPendingClose}
 			onmouseleave={scheduleClose}
 			transition:placementFly={{ duration: 100, placement }}
+			style={contentStyle}
 			class={twMerge(
 				'z-[6000] border w-56 origin-top-right rounded-md shadow-md focus:outline-none',
 				// Default: scroll on the melt element. submenuSafe moves it to the inner
diff --git a/frontend/src/lib/components/moveRenameManager.ts b/frontend/src/lib/components/moveRenameManager.ts
index 1500f8fc69..e5844a3351 100644
--- a/frontend/src/lib/components/moveRenameManager.ts
+++ b/frontend/src/lib/components/moveRenameManager.ts
@@ -1,7 +1,8 @@
-import { AppService, FlowService, ScriptService } from '$lib/gen'
+import { AppService, FlowService, ResourceService, ScriptService } from '$lib/gen'
+import { agentEditorRefusal } from './flows/agentResourceUtils'
 import { invalidateWorkspacePaths } from './PathNameAutocomplete.svelte'
 
-type ItemKind = 'flow' | 'script' | 'app'
+type ItemKind = 'flow' | 'script' | 'app' | 'agent'
 
 /**
  * Check whether a flow uses on_behalf_of_email.
@@ -71,6 +72,24 @@ export async function updateItemPathAndSummary(opts: {
 				skip_draft_deletion: true
 			}
 		})
+	} else if (kind === 'agent') {
+		// An agent is a resource, and its summary is the resource's description. The read before
+		// the write is the same one the agent editor does: an update carries no resource type, so
+		// a path deleted and recreated as something else in the meantime would otherwise take an
+		// agent's config.
+		const current = await ResourceService.getResource({ workspace, path: initialPath })
+		const refused = agentEditorRefusal(initialPath, current.resource_type)
+		if (refused) {
+			throw new Error(refused)
+		}
+		// Only what this popover edits: the backend sets a column per field it is given, so the
+		// agent's own config, its type and `ws_specific` are left where they are rather than read
+		// here and written back over whatever changed in between.
+		await ResourceService.updateResource({
+			workspace,
+			path: initialPath,
+			requestBody: { path: newPath, description: newSummary, labels }
+		})
 	} else if (kind === 'app') {
 		await AppService.updateApp({
 			workspace,
diff --git a/frontend/src/lib/components/operatingWorkspace.svelte.ts b/frontend/src/lib/components/operatingWorkspace.svelte.ts
index 93a7f2c0de..70f1c63c1c 100644
--- a/frontend/src/lib/components/operatingWorkspace.svelte.ts
+++ b/frontend/src/lib/components/operatingWorkspace.svelte.ts
@@ -22,6 +22,14 @@ export function setOperatingWorkspace(resolve: () => string | undefined): void {
 	setContext(KEY, outer ? () => resolve() ?? outer() : resolve)
 }
 
+/** This subtree's operating workspace as an entry for a `ContextBridge` contexts map. A snippet
+ * handed to the page header's band renders outside the subtree that declared the workspace, so
+ * without this it would quietly act on the navigation workspace instead. Reads context: call
+ * during component initialisation. */
+export function operatingWorkspaceContextEntry(): [any, any] {
+	return [KEY, getContext(KEY)]
+}
+
 /** The workspace this component acts on, as a store. Reads context: call during component
  * initialisation. Falls back to the navigation workspace where no host set one, or where the
  * host's resolves to nothing. */
diff --git a/frontend/src/lib/components/otherUserDraftLoad.svelte.ts b/frontend/src/lib/components/otherUserDraftLoad.svelte.ts
index 7ba5cde6fb..e2bf7c87d8 100644
--- a/frontend/src/lib/components/otherUserDraftLoad.svelte.ts
+++ b/frontend/src/lib/components/otherUserDraftLoad.svelte.ts
@@ -1,6 +1,5 @@
 import { SvelteMap, SvelteSet } from 'svelte/reactivity'
 import { goto } from '$lib/navigation'
-import { base } from '$app/paths'
 import { UserDraft, draftValuesEqual, type UserDraftItemKind } from '$lib/userDraft.svelte'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 
@@ -55,13 +54,13 @@ const overwriteOpen = new SvelteSet<string>()
 export function editRouteFor(itemKind: UserDraftItemKind, path: string): string {
 	switch (itemKind) {
 		case 'script':
-			return `${base}/scripts/edit/${path}`
+			return `/scripts/edit/${path}`
 		case 'flow':
-			return `${base}/flows/edit/${path}`
+			return `/flows/edit/${path}`
 		case 'app':
-			return `${base}/apps/edit/${path}`
+			return `/apps/edit/${path}`
 		case 'raw_app':
-			return `${base}/apps_raw/edit/${path}`
+			return `/apps_raw/edit/${path}`
 		default:
 			throw new Error(`Cannot load drafts of kind ${itemKind}`)
 	}
diff --git a/frontend/src/lib/components/pageHeaderRegistry.svelte.ts b/frontend/src/lib/components/pageHeaderRegistry.svelte.ts
new file mode 100644
index 0000000000..bd30855e15
--- /dev/null
+++ b/frontend/src/lib/components/pageHeaderRegistry.svelte.ts
@@ -0,0 +1,188 @@
+import type { Snippet } from 'svelte'
+import type { WorkspaceItemKind } from './workspacePicker'
+
+/** An item the page is working on: the breadcrumb walks its path and ends with its summary. */
+export type PageHeaderItem = {
+	/** Absent for an item the picker does not file under a kind — an agent's detail page. The
+	 *  breadcrumb then names the item without claiming it is one of the three. */
+	kind?: WorkspaceItemKind
+	/** Shown whole. Clicking it opens whatever the page hangs off it with `pathTrigger`, and copies
+	 *  the path where there is none. */
+	path: string | undefined
+	/** Wraps the band's own path segment in whatever the page wants behind it — its rename
+	 *  popover, anchored there rather than beside the summary, so the editor opens under the half
+	 *  of the name that was clicked. The band passes the path as it renders it and the classes its
+	 *  own segment wears, so the page's control keeps the breadcrumb's look rather than inventing
+	 *  one. Without this the segment copies the path on click. */
+	pathTrigger?: Snippet<[Snippet, string]>
+	summary?: string
+	/** Rendered in place of the plain summary, for a page whose summary is itself a control —
+	 *  a detail page's rename-and-labels popover, an editor's editable title. */
+	summaryContent?: Snippet
+}
+
+/** A page with no item of its own, such as a list: the breadcrumb is the section alone. */
+export type PageHeaderSection = {
+	label: string
+	/** The page the section belongs to, when the section is one pane of it — a settings page's
+	 *  active tab. Drawn as a lead segment before `label`. */
+	parent?: string
+	/** Rendered in place of `label` when the name is itself a control, such as an editable title. */
+	content?: Snippet
+	/** Scopes the segment's picker, when the section maps to a kind of item. */
+	kind?: WorkspaceItemKind
+}
+
+export type PageHeaderContent = {
+	item?: PageHeaderItem
+	section?: PageHeaderSection
+	/** Rendered at the right end of the bar — the page's own buttons. */
+	actions?: Snippet
+	/** Orders these buttons among the other registrations', ascending; registration order breaks a
+	 *  tie. For a menu that must stay at the far end however many pages register before it. */
+	actionsOrder?: number
+	/** These actions can give width back under pressure, so the bar lets their box shrink on a
+	 *  phone. Two ways to earn it: a control that is narrower when it has to be (the Runs filter
+	 *  row, whose search field yields), or a set that scrolls inside its own box (the app and
+	 *  pipeline editors, whose rows are too wide for any bar). Without it the box holds its content
+	 *  width, because squeezing a plain row of buttons only pushes them out of the bar. */
+	actionsFlexible?: boolean
+	/** These actions are not a row of buttons at the far end but a surface of their own, running
+	 *  from the breadcrumb to the bar's right edge: a session in full screen, whose tab strip and
+	 *  controls share one shape that opens into the page below. The bar gives up its right padding
+	 *  to it, since the surface is what meets the edge. */
+	actionsFill?: boolean
+	/** Rendered right after the page's name in the breadcrumb: a mark that belongs to the name,
+	 *  like a documentation tooltip, or a control that acts on the thing named — an app's Edit,
+	 *  which at the far end of the bar would be a journey away from what it edits. */
+	afterName?: Snippet
+	/** The workspace this page acts on, when it is not the one the app is pointed at — a session
+	 *  running in a fork. The breadcrumb then names that workspace, and its fork part shows only
+	 *  when it really is a fork. */
+	actingWorkspaceId?: string
+	/** Width in px, at the right of the viewport, that this page owns from the top down — a
+	 *  session's side panel. The band stops there instead of running over it, and the band floats
+	 *  above the page rather than pushing it down, so that column starts at the top. */
+	barRightInset?: number
+	/** The bottom edge under the bar, which the bar owns so a page cannot draw a second one.
+	 *  `onScroll` (the default) shows it only while something is passing under the bar — at the top
+	 *  of a list there is nothing to divide. `always` is for a page whose content starts right
+	 *  under the bar and needs the division at rest: an editor, a detail page, a settings pane.
+	 *  `none` is for a page that genuinely draws its own first line, such as the script editor's
+	 *  toolbar or the flow editor's canvas. */
+	separator?: 'onScroll' | 'always' | 'none'
+	/** Contexts this registration's snippets look up — its actions, what it hangs after the name,
+	 *  and its summary. They all render under the header rather than under the page that wrote
+	 *  them, so anything the page's tree provides has to travel with them. */
+	contexts?: Map<any, any>
+}
+
+// The bar belongs to the root layout and is always on screen; a route page fills its breadcrumb
+// and actions by registering here.
+//
+// A registration is a getter, not a snapshot: the layout calls it while rendering, so a path or
+// summary the page edits reaches the bar through the layout's own dependency tracking, with no
+// effect keeping two copies in step.
+//
+// Registrations stack, and what the bar shows is their merge (see `content`). Pages register on
+// mount, so the first entry is the outermost one — an editor nested in a session pane or a drawer
+// is asked to register nothing.
+let entries = $state<{ id: number; get: () => PageHeaderContent }[]>([])
+let nextId = 0
+
+/**
+ * Below this bar width a page keeps one button — the thing the page is for — and folds the rest
+ * into the menu it already shows when compact. A phone in portrait is ~390px of bar and a tablet
+ * in portrait ~720; the breadcrumb with its workspace disc takes ~150 of either, which is why the
+ * line sits above the tablet rather than between the two.
+ */
+export const PHONE_BAR = 800
+
+/** The bar's height, and the padding a page owes the band when the band floats over it rather than
+ *  sitting in the flow (see `barRightInset`). They are one measurement in two forms: raise one and
+ *  the other has to follow, or the page's own content disappears under the bar. Written as literal
+ *  class names so Tailwind sees them. */
+export const BAR_HEIGHT = 'h-12'
+export const BAR_TOP_PAD = 'pt-12'
+/** The same height in px, for the places that animate to the bar's bottom edge rather than
+ *  standing under it — a transition's `css` and a measurement's fallback take a number. */
+export const BAR_HEIGHT_PX = 48
+
+// The bar's own width, written by the bar and read by the pages that fill it. A page's buttons
+// share that row with the breadcrumb, so it is the width they crowd against — not the window's,
+// which the sidebar and a page's side panel both take from.
+let barWidth = $state(0)
+
+/**
+ * One registration's content, or undefined while it cannot answer.
+ *
+ * An entry is a getter closing over another component's props, evaluated here, in a tree of its
+ * own. Nothing orders a parent clearing those props against the child's teardown: a route that
+ * drops the `{#if}` around an editor and the value it binds into it does both in one flush, and
+ * this derived re-runs on the same flush, before the editor's own cleanup releases its entry. The
+ * entry has nothing to say in that window, which is not the same as the page having no header —
+ * so it is skipped, and whatever registered before it still stands.
+ */
+function read(e: { get: () => PageHeaderContent }): PageHeaderContent | undefined {
+	try {
+		return e.get()
+	} catch {
+		return undefined
+	}
+}
+
+export const pageHeader = {
+	/**
+	 * The registrations merged, later ones winning field by field: a route sets the frame (where
+	 * the bar goes) and something nested in it — the active session, say — fills the breadcrumb
+	 * and the actions.
+	 */
+	get content(): PageHeaderContent | undefined {
+		if (entries.length === 0) return undefined
+		const merged: PageHeaderContent = {}
+		for (const e of entries) {
+			const c = read(e)
+			if (!c) continue
+			if (c.item !== undefined) merged.item = c.item
+			if (c.section !== undefined) merged.section = c.section
+			if (c.afterName !== undefined) merged.afterName = c.afterName
+			if (c.contexts !== undefined) merged.contexts = c.contexts
+			if (c.actingWorkspaceId !== undefined) merged.actingWorkspaceId = c.actingWorkspaceId
+			if (c.barRightInset !== undefined) merged.barRightInset = c.barRightInset
+			if (c.actionsFlexible !== undefined) merged.actionsFlexible = c.actionsFlexible
+			if (c.actionsFill !== undefined) merged.actionsFill = c.actionsFill
+			if (c.separator !== undefined) merged.separator = c.separator
+		}
+		return merged
+	},
+	/**
+	 * Every registration's actions, in registration order: a page and something inside it can both
+	 * put buttons in the band, and each renders with the contexts its own registration named.
+	 */
+	get actions(): { render: Snippet; contexts?: Map<any, any> }[] {
+		return entries
+			.flatMap((e, i) => {
+				const c = read(e)
+				return c?.actions
+					? [{ render: c.actions, contexts: c.contexts, order: c.actionsOrder ?? 0, i }]
+					: []
+			})
+			.sort((a, b) => a.order - b.order || a.i - b.i)
+	},
+	/** Width of the bar in px, or 0 before it has been measured. */
+	get barWidth(): number {
+		return barWidth
+	},
+	setBarWidth(w: number) {
+		barWidth = w
+	},
+	/** Registers on mount and returns the id to release on destroy. */
+	register(get: () => PageHeaderContent): number {
+		const id = nextId++
+		entries = [...entries, { id, get }]
+		return id
+	},
+	release(id: number) {
+		entries = entries.filter((e) => e.id !== id)
+	}
+}
diff --git a/frontend/src/lib/components/pageHeaderRegistry.test.ts b/frontend/src/lib/components/pageHeaderRegistry.test.ts
new file mode 100644
index 0000000000..035eabb60e
--- /dev/null
+++ b/frontend/src/lib/components/pageHeaderRegistry.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it, afterEach } from 'vitest'
+import { pageHeader, type PageHeaderContent } from './pageHeaderRegistry.svelte'
+import type { Snippet } from 'svelte'
+
+// The merge rule every registration site depends on: a page sets the frame and something nested
+// in it fills the breadcrumb, so whether a component registers at all decides whose name the band
+// shows. A viewer that registered wherever it was mounted renamed the band of the session hosting
+// it.
+const snippet = (name: string) => name as unknown as Snippet
+
+const ids: number[] = []
+function register(c: PageHeaderContent) {
+	ids.push(pageHeader.register(() => c))
+}
+afterEach(() => {
+	while (ids.length) pageHeader.release(ids.pop()!)
+})
+
+describe('pageHeader', () => {
+	it('is empty with nothing registered', () => {
+		expect(pageHeader.content).toBeUndefined()
+	})
+
+	it('lets a later registration win field by field', () => {
+		register({ section: { label: 'Sessions' }, barRightInset: 400 })
+		register({ item: { path: 'u/admin/app' } })
+		expect(pageHeader.content).toEqual({
+			section: { label: 'Sessions' },
+			item: { path: 'u/admin/app' },
+			barRightInset: 400
+		})
+	})
+
+	it('gives the fields of a released registration back', () => {
+		register({ section: { label: 'Sessions' } })
+		register({ item: { path: 'u/admin/app' } })
+		pageHeader.release(ids.pop()!)
+		expect(pageHeader.content?.item).toBeUndefined()
+		expect(pageHeader.content?.section).toEqual({ label: 'Sessions' })
+	})
+
+	it('orders actions by actionsOrder, then by registration', () => {
+		register({ actions: snippet('page'), actionsOrder: 10 })
+		register({ actions: snippet('nested') })
+		register({ actions: snippet('alsoNested') })
+		expect(pageHeader.actions.map((a) => a.render)).toEqual(['nested', 'alsoNested', 'page'])
+	})
+
+	it('carries the contexts of each registration with its actions', () => {
+		const pageContexts = new Map([['TriggerContext', 1]])
+		register({ actions: snippet('page'), contexts: pageContexts })
+		register({ actions: snippet('nested') })
+		expect(pageHeader.actions.map((a) => a.contexts)).toEqual([pageContexts, undefined])
+	})
+})
diff --git a/frontend/src/lib/components/preview/FlowPreviewStatus.svelte b/frontend/src/lib/components/preview/FlowPreviewStatus.svelte
index 68587fbf24..9d794828d8 100644
--- a/frontend/src/lib/components/preview/FlowPreviewStatus.svelte
+++ b/frontend/src/lib/components/preview/FlowPreviewStatus.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import type { CompletedJob, QueuedJob } from '$lib/gen'
-	import { base } from '$lib/base'
 
 	import JobStatus from '../JobStatus.svelte'
 	import { ExternalLinkIcon } from 'lucide-svelte'
@@ -32,7 +31,7 @@
 				<a
 					rel="noreferrer"
 					target="_blank"
-					href="{base}/run/{job?.id}?workspace={job?.workspace_id}"
+					href="/run/{job?.id}?workspace={job?.workspace_id}"
 				>
 					{truncateRev(job?.id, 8)}
 					<ExternalLinkIcon size={14} class="inline mb-1 ml-1" />
diff --git a/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte b/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte
index 6cdcd6a427..9f675664b1 100644
--- a/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppBackgroundRunner.svelte
@@ -5,6 +5,7 @@
 	import type { JobById } from '../apps/types'
 	import { JobService } from '$lib/gen'
 	import type { Runnable } from './rawAppPolicy'
+	import { RAW_APP_PREVIEW_RELAY } from './utils'
 	import { undefinedIfEmpty } from '$lib/utils'
 
 	interface Props {
@@ -19,10 +20,9 @@
 		 * Restrict waitJob/getJob/streamJob to job ids launched by this app
 		 * instance (WIN-2006): a SANDBOXED bundle must not read arbitrary
 		 * workspace jobs through the credentialed bridge. Off for unsandboxed
-		 * renders (the default, and editor preview) — there the bundle holds
-		 * the same credential as the bridge, so gating adds nothing and would
-		 * only break unsandboxed apps that poll persisted or runnable-returned
-		 * job ids.
+		 * renders — there the bundle holds the same credential as the bridge,
+		 * so gating adds nothing and would only break unsandboxed apps that
+		 * poll persisted or runnable-returned job ids.
 		 */
 		gateJobIds?: boolean
 		/**
@@ -32,7 +32,7 @@
 		 * `window.opener` (this window), so the bridge must accept its
 		 * `event.source` and reply to it. A getter so it tracks the live handle
 		 * without a reactive prop. Editor-only — the detached window runs the
-		 * same unsandboxed bundle as the inline preview.
+		 * same bundle, sandboxed or not, as the inline preview.
 		 */
 		extraSourceWindow?: () => Window | null | undefined
 	}
@@ -52,6 +52,11 @@
 	// Job ids launched by this app instance — see `gateJobIds`.
 	const launchedJobs = new Set<string>()
 
+	/** For a host that loads this component after the bundle may already have sent requests. */
+	export function handleMessage(event: MessageEvent) {
+		return listener(event)
+	}
+
 	let listener = async (event) => {
 		// Only accept messages from the bundle iframe (opaque origin) or the
 		// detached preview window we opened, so other frames/extensions can't
@@ -62,7 +67,11 @@
 		if (!iframe || !sourceWindow) return
 		if (sourceWindow !== iframe.contentWindow && sourceWindow !== detachedWindow) return
 
-		const data = event.data
+		// A sandboxed detached preview speaks through a same-origin relay, wrapped.
+		const data =
+			sourceWindow === detachedWindow && event.data?.type === RAW_APP_PREVIEW_RELAY
+				? event.data.data
+				: event.data
 
 		// Reply to whichever window sent the request (inline iframe or the
 		// detached preview), not a hardcoded target — otherwise the detached
@@ -81,7 +90,7 @@
 				result = e
 			}
 
-			if (event.data.type == 'backend' || event.data.type == 'waitJob') {
+			if (data.type == 'backend' || data.type == 'waitJob') {
 				respond({ result, error })
 			}
 			if (editor) {
@@ -101,7 +110,7 @@
 			}
 			return result
 		}
-		if (event.data.type == 'backend' || event.data.type == 'backendAsync') {
+		if (data.type == 'backend' || data.type == 'backendAsync') {
 			const runnable_id = data.runnable_id
 			let runnable = runnables[runnable_id]
 			if (runnable) {
@@ -152,7 +161,7 @@
 				)
 				launchedJobs.add(uuid)
 				let job: JobById = { component: runnable_id, created_at: Date.now(), job: uuid }
-				if (event.data.type == 'backendAsync') {
+				if (data.type == 'backendAsync') {
 					let result = uuid
 					respond({ result })
 				}
@@ -169,20 +178,20 @@
 			} else {
 				console.error('No runnable found for', runnable_id)
 			}
-		} else if (event.data.type == 'waitJob') {
+		} else if (data.type == 'waitJob') {
 			if (gateJobIds && !launchedJobs.has(data.jobId)) {
 				respond({ result: { message: 'Unknown job' }, error: true })
 				return
 			}
 			await respondWithResult(data.jobId)
-		} else if (event.data.type == 'getJob') {
+		} else if (data.type == 'getJob') {
 			if (gateJobIds && !launchedJobs.has(data.jobId)) {
 				respond({ result: { message: 'Unknown job' }, error: true })
 				return
 			}
 			const job = await JobService.getJob({ workspace, id: data.jobId })
 			respond({ result: job })
-		} else if (event.data.type == 'streamJob') {
+		} else if (data.type == 'streamJob') {
 			// Stream job results using SSE
 			const jobId = data.jobId
 			const reqId = data.reqId
diff --git a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
index 7ccf89a275..0ebb67094b 100644
--- a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
@@ -14,6 +14,7 @@
 		ADMIN_DATATABLE_ROLE,
 		datatableNameTakesRole,
 		defaultMigrationRole,
+		namedDefaultRole,
 		type DbInput
 	} from '../dbTypes'
 	import type { PendingRowAction, SelectedTable } from '../DBManager.svelte'
@@ -173,15 +174,15 @@
 			return rolesOfCurrent?.permissioned ? selectedRole : undefined
 		}
 		const entry = datatableTree.current.find((t) => t.datatable_name === datatable)
-		return entry?.permissioned ? entry.default_role : undefined
+		return entry?.permissioned ? namedDefaultRole(entry.default_role) : undefined
 	}
 
 	function defaultRoleOf(datatable: string): string | undefined {
 		if (datatable === selectedDatatable && rolesOfCurrent?.permissioned) {
-			return rolesOfCurrent.default_role
+			return namedDefaultRole(rolesOfCurrent.default_role)
 		}
 		const entry = datatableTree.current.find((t) => t.datatable_name === datatable)
-		return entry?.permissioned ? entry.default_role : undefined
+		return entry?.permissioned ? namedDefaultRole(entry.default_role) : undefined
 	}
 
 	const tableDatatable = (t: SelectedTable) => t.datatable ?? selectedDatatable
@@ -256,11 +257,14 @@
 		selectedRole = undefined
 	}
 
-	export function openDrawer() {
+	/** Opens on `at` when given, a data table and optionally one of its schemas. */
+	export function openDrawer(at?: { datatable: string; schema?: string }) {
 		resetSelection()
-		selectedSchemaKey = undefined
+		selectedSchemaKey = at?.schema
 		selectedTableKey = undefined
-		selectDatatable(datatables.current.includes('main') ? 'main' : datatables.current[0])
+		selectDatatable(
+			at?.datatable ?? (datatables.current.includes('main') ? 'main' : datatables.current[0])
+		)
 		expand = false
 		open = true
 	}
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index fd0bd23c53..ca23505ff1 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -21,12 +21,18 @@
 		genWmillTs,
 		normalizeRawAppRuntimeLogs,
 		createRawAppBuildTracker,
+		RAW_APP_BUILD_WAIT_MS,
 		type Runnable,
 		type RawAppRuntimeLogEntry,
 		type RawAppRuntimeLogRequester,
 		type RawAppRunSummary,
 		type RawAppRunsProvider,
-		type RawAppScreenshotRequester
+		type RawAppScreenshotRequester,
+		RAW_APP_SANDBOX_FLAGS,
+		RAW_APP_PREVIEW_RELAY,
+		rawAppStorageKey,
+		readRawAppStorage,
+		applyRawAppStorageOp
 	} from './utils'
 	import { runDomQueryOnHtml, type RawAppDomQuery, type RawAppDomRequester } from './rawAppDom'
 	import InlineElementPrompt from './InlineElementPrompt.svelte'
@@ -45,7 +51,14 @@
 	import { createAppSelectedContext, type AppCodeSelectionElement } from '../copilot/chat/context'
 	import { captureScale, MAX_IMAGE_EDGE } from '../copilot/chat/imageUtils'
 	import { rawAppLintStore } from './lintStore'
-	import { dbSchemas } from '$lib/stores'
+	import { dbSchemas, userStore } from '$lib/stores'
+	import RawAppSdkConsent from './RawAppSdkConsent.svelte'
+	import {
+		hasStoredSdkConsent,
+		movePreviewSdkConsent,
+		sdkConsentCovers,
+		storeSdkConsent
+	} from './sdkScopes'
 	import {
 		MousePointerSquareDashed,
 		RefreshCw,
@@ -62,7 +75,6 @@
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { setOpenInSessionHandoff } from '$lib/components/sessions/openInSessionContext'
-	import { openSourceInSession } from '$lib/components/sessions/sessionSwitch.svelte'
 	import {
 		buildDataTableWhitelist,
 		parseDataTableRef,
@@ -73,7 +85,7 @@
 		appDatatableRole
 	} from './dataTableRefUtils'
 	import { datatableReference } from '../dbTypes'
-	import { randomUUID } from '$lib/utils/uuid'
+	import { randomSecret, randomUUID } from '$lib/utils/uuid'
 	import { editorFontSize } from '$lib/editorFontSize.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
@@ -143,6 +155,8 @@
 		 *  it as `draft_path` so the home row shows the friendly name, not `draft_{uuid}`. */
 		pendingDraftPath?: string | undefined
 		// Threaded to the AutosaveIndicator's "Reset to deployed" button.
+		/** `Exit & see details`: see RawAppEditorHeader. */
+		onDetails?: (e: { path: string }) => void
 		onResetToDeployed?: () => void | Promise<void>
 		/** The app_version the draft forked from, for the deploy-time "new version
 		 *  deployed" guard: deploying is refused with a confirmation while it is not
@@ -187,6 +201,8 @@
 		// EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 		// session preview to save vertical room.
 		condensedHeader?: boolean
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader?: boolean
 	}
 
 	let {
@@ -210,6 +226,7 @@
 		autosavePath = undefined,
 		defaultSplitWithPreview = true,
 		pendingDraftPath = $bindable(undefined),
+		onDetails,
 		onResetToDeployed,
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
@@ -226,6 +243,7 @@
 		onRestore,
 		onSavedNewAppPath,
 		condensedHeader = false,
+		ownsPageHeader = false,
 		version = undefined,
 		onTakeLatest = undefined,
 		draftBaseVersion = undefined
@@ -278,17 +296,6 @@
 		return header?.openDiffDrawer()
 	}
 
-	/** Hand this app off to a fresh AI session, seeding `seedPrompt` and sending
-	 * it on arrival. Exposed for the template picker's "Start in AI session": the
-	 * route owns the prompt, but the draft persistence the preview depends on
-	 * lives here. False when there is no path to open yet, so the caller can fall
-	 * back rather than swallow the click. */
-	export async function openInSession(seedPrompt: string): Promise<boolean> {
-		if (!sessionOpen) return false
-		await openSourceInSession(sessionOpen, { seedPrompt, autoSend: true })
-		return true
-	}
-
 	// Convert to object format for child components
 	let dataTableRefsObjects = $derived(data.tables.map(parseDataTableRef))
 	let dataTableWhitelist = $derived(buildDataTableWhitelist(dataTableRefsObjects))
@@ -382,8 +389,82 @@
 
 	let iframe: HTMLIFrameElement | undefined = $state(undefined)
 	const PREVIEW_SHELL_URL = '/ui_builder/app-preview.html'
+	// The served shell is `CSP: sandbox` (opaque origin). An app without sandbox
+	// isolation runs same-origin once deployed, so its preview loads a per-mount
+	// blob: copy instead — the same split as `unsandboxedRawAppHtml`, and like it
+	// with no `<base>`, so the app resolves URLs as it will once deployed.
+	let previewBlobUrl: string | undefined = $state(undefined)
+	onMount(() => {
+		let url: string | undefined
+		let destroyed = false
+		fetch(PREVIEW_SHELL_URL)
+			.then((res) => {
+				if (!res.ok) throw new Error(`${res.status} ${res.statusText}`)
+				return res.text()
+			})
+			.then((html) => {
+				if (destroyed) return
+				url = URL.createObjectURL(new Blob([html], { type: 'text/html' }))
+				previewBlobUrl = url
+			})
+			.catch((e) => sendUserToast(`Could not load the app preview: ${e}`, true))
+		return () => {
+			destroyed = true
+			if (url) URL.revokeObjectURL(url)
+		}
+	})
+	// An app with sandbox isolation previews the way it runs once deployed: in the
+	// served, opaque-origin shell, framed with the deployed wrapper's flags. The nonce
+	// in its URL authenticates its `windmill:ready`, as in `RawAppPreview`.
+	const sandboxed = $derived(policy?.sandbox === true)
+	const previewStorageKey = $derived(rawAppStorageKey(opWorkspace ?? '', path, true))
+	const handshakeNonce = randomSecret()
+	const sandboxedShellUrl = `${PREVIEW_SHELL_URL}?wm_hs=${handshakeNonce}`
+	const previewShellUrl = $derived(sandboxed ? sandboxedShellUrl : previewBlobUrl)
+	// The pop-out of a sandboxed preview: a same-origin page framing the shell. A
+	// top-level window can't be sandboxed by its opener, and the opener can't address
+	// an opaque-origin window safely. It relays the frame's messages, and their
+	// ports, to the editor, and the editor's replies back down. Relayed messages
+	// carry our origin, so they travel wrapped: listeners that trust a same-origin
+	// message must not see the isolated app's as their own.
+	let previewControllerUrl: string | undefined = undefined
+	// Editor-to-controller only, never relayed to the app: the consent prompt lives in
+	// the editor, so the pop-out says why it is blank.
+	const PREVIEW_NOTICE = 'wm:previewNotice'
+	onDestroy(() => {
+		if (previewControllerUrl) URL.revokeObjectURL(previewControllerUrl)
+	})
+	function getPreviewControllerUrl(): string {
+		previewControllerUrl ??= URL.createObjectURL(
+			new Blob(
+				[
+					`<!DOCTYPE html><html><head><meta charset="utf-8"><title>App preview</title>
+<link rel="icon" href="${window.location.origin}/logo.svg">
+<style>html,body{margin:0;height:100%}iframe{display:block;border:0;width:100%;height:100%}
+#n{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:16px;text-align:center;font:14px system-ui,sans-serif;color-scheme:light dark;background:Canvas;color:CanvasText}#n[hidden]{display:none}</style>
+<script>
+addEventListener('message', function (e) {
+  var frame = document.querySelector('iframe').contentWindow
+  if (e.source === frame && opener) opener.postMessage({ type: '${RAW_APP_PREVIEW_RELAY}', data: e.data }, location.origin, e.ports)
+  else if (e.source === opener && e.data && e.data.type === '${PREVIEW_NOTICE}') {
+    var n = document.getElementById('n')
+    n.textContent = e.data.text || ''
+    n.hidden = !e.data.text
+  } else if (e.source === opener) frame.postMessage(e.data, '*')
+})
+<\/script></head><body><div id="n" hidden></div><iframe src="${window.location.origin}${sandboxedShellUrl}" sandbox="${RAW_APP_SANDBOX_FLAGS}" referrerpolicy="no-referrer"></iframe></body></html>`
+				],
+				{ type: 'text/html' }
+			)
+		)
+		return previewControllerUrl
+	}
 	let previewIframe: HTMLIFrameElement | undefined = $state(undefined)
 	let previewIframeLoaded = $state(false)
+	// Sandboxed only: the handshake's port, the one channel to the preview that
+	// can't reach a document app code navigated the frame to.
+	let previewPort: MessagePort | undefined = undefined
+	let externalPreviewPort: MessagePort | undefined = undefined
 	let lastBuild: { css: string; js: string } | undefined = undefined
 	// Detached preview tab/window rendering the same app-preview bundle as the
 	// inline pane. Kept live-synced: every build is replayed into it until the
@@ -408,6 +489,17 @@
 	// Latest UI Builder error; cleared on next successful build.
 	let buildError = $state<string | undefined>(undefined)
 	const buildTracker = createRawAppBuildTracker()
+	// The preview shell can be ready before the UI Builder has the files, so a fresh
+	// editor counts as building: reads made then would see an empty page.
+	buildTracker.start()
+	const BUILD_PENDING_TEXT = `The app is still building (or its build never started, e.g. no index entrypoint file): no build result arrived within ${RAW_APP_BUILD_WAIT_MS / 1000} seconds, so the preview shows an older build or nothing yet. Call get_app_runtime_logs to check the build, then retry.`
+	// A failed build never reaches the preview, which keeps the last good one, if any.
+	const buildFailedText = (error: string) =>
+		`The latest build failed, so the preview does not include the latest edits (it shows the last build that succeeded, or nothing if none has). Fix the build first. Build error:\n${error}`
+	const SDK_CONSENT_PENDING_TEXT =
+		'The preview is waiting for the user to approve the permissions the app declares in policy.frontend_sdk_scopes, so the app code is not running and the page is empty. This is not a bug in the app: do not change the code. Ask the user to approve the permissions in the preview, then retry.'
+	const SDK_STARTING_TEXT =
+		'The preview is still loading the permissions the app declares in policy.frontend_sdk_scopes, so the app code has not started yet. Retry in a moment.'
 	const PREVIEW_SETTLE_MS = 1000
 	let editorDestroyed = false
 	// Latest uncaught runtime error thrown by the rendered app; cleared on next build.
@@ -416,7 +508,7 @@
 	// entrypoint defines a component without ever mounting it. Cleared on next build.
 	let emptyRender = $state(false)
 	// The repair hint above has to match the app's framework: only React apps have
-	// an `index.tsx` and `createRoot`; Svelte and Vue mount from `index.ts`. Keyed
+	// an `index.tsx` and `createRoot`; Svelte mounts from `index.ts`. Keyed
 	// off file extensions rather than exact template filenames, which users rename.
 	let mountHint = $derived.by(() => {
 		const paths = Object.keys(files ?? {}).map((p) => p.replace(/^\//, ''))
@@ -427,9 +519,6 @@
 				call: "mount(App, { target: document.getElementById('root')! })"
 			}
 		}
-		if (paths.some((p) => p.endsWith('.vue'))) {
-			return { entrypoint: entrypoint ?? 'index.ts', call: "createApp(App).mount('#root')" }
-		}
 		return {
 			entrypoint: entrypoint ?? 'index.tsx',
 			call: "createRoot(document.getElementById('root')!).render(<App />)"
@@ -1349,6 +1438,33 @@
 			return
 		}
 
+		const relayed = e.source === externalPreviewWindow && e.data?.type === RAW_APP_PREVIEW_RELAY
+		const data = relayed ? e.data.data : e.data
+		// A sandboxed shell came up, inline or (relayed by its controller) popped out.
+		if (data?.type === 'windmill:ready') {
+			const port = e.ports?.[0]
+			if (!sandboxed || !port || data.nonce !== handshakeNonce) return
+			if (e.source === previewIframe?.contentWindow) {
+				previewPort = port
+				onPreviewShellReady()
+			} else if (relayed) {
+				externalPreviewPort = port
+				externalPreviewReady = true
+				feedExternalPreview()
+			}
+			return
+		}
+		// A sandboxed app's localStorage write, inline or popped out.
+		if (
+			data?.type === 'wm_ls_op' &&
+			sandboxed &&
+			(relayed || e.source === previewIframe?.contentWindow)
+		) {
+			applyRawAppStorageOp(previewStorageKey, data)
+			return
+		}
+		if (relayed) return
+
 		// Two children speak to us now: the UI Builder iframe (source editor)
 		// and the preview iframe (rendered user app). Gate by source so they
 		// can't be confused or spoofed.
@@ -1390,8 +1506,20 @@
 			return
 		}
 
-		if (fromPreview && e.data.type === 'runtimeLogsResponse') {
-			resolvePendingRuntimeLogRequest(e.data.requestId, normalizeRawAppRuntimeLogs(e.data.logs))
+		if (fromPreview && typeof e.data.requestId === 'string') {
+			resolvePendingPreviewRequest(e.data.requestId, e.data)
+			return
+		}
+		if (fromPreview && e.data.type === 'previewScroll') {
+			updateInlinePromptPos()
+			return
+		}
+		// Escape inside the preview exits inspect mode, and also dismisses a lingering
+		// green "selected" overlay after a pick (which auto-disables hover).
+		if (fromPreview && e.data.type === 'previewEscape') {
+			if (inspectorEnabled || inspectorElement || selectedDomSelectors.length > 0) {
+				disableInspector()
+			}
 			return
 		}
 
@@ -1513,61 +1641,78 @@
 		}
 	}
 
+	// Our own origin, or the handshake port when sandboxed — never '*': user app code
+	// can navigate the preview elsewhere, and the build can carry app source/secrets.
+	function postToPreview(msg: Record<string, unknown>) {
+		if (sandboxed) previewPort?.postMessage(msg)
+		else previewIframe?.contentWindow?.postMessage(msg, window.location.origin)
+	}
+
 	function postToExternalPreview(msg: Record<string, unknown>) {
 		if (!externalPreviewWindow || externalPreviewWindow.closed) {
 			externalPreviewWindow = null
 			externalPreviewReady = false
 			return
 		}
-		// Restrict to our own origin: the detached window loads same-origin
-		// app-preview.html, but user app code can navigate it elsewhere — don't
-		// post the build (potential app source/secrets) to a cross-origin doc.
-		externalPreviewWindow.postMessage(msg, window.location.origin)
+		if (sandboxed) externalPreviewPort?.postMessage(msg)
+		else externalPreviewWindow.postMessage(msg, window.location.origin)
 	}
 
-	// `app-preview.html` evaluates the js we post, so prefixing the env is what a
-	// bundled `windmill-client` needs — it reads `window.process.env` at module
-	// load. Gated and scoped exactly like a deployed app — sandbox off or no
-	// scopes means no env at all — so preview hits the same 403s, and the same
-	// misconfiguration, as the deployed bundle.
-
-	// Stated on every payload, tokenless included: the preview shell reuses one
-	// window across builds, so omitting it would leave an old token in place.
-	// Deleting rather than blanking matches a deployed app with no scopes.
-	const NO_SDK_ENV_JS = 'try { delete window.process } catch (_) {}\n'
-	let previewSdkEnvJs = $state(NO_SDK_ENV_JS)
-	// Identifies the request whose answer is still wanted. Toggling scopes starts a
-	// new mint while an older one is in flight, and an out-of-order answer would
-	// otherwise hand the preview the wrong scope set — or restore a token after all
-	// scopes were removed.
+	// The shell turns this into `window.process.env`, which a bundled
+	// `windmill-client` reads at module load. Gated and scoped exactly like a
+	// deployed app — sandbox off or no scopes means no env at all — so preview hits
+	// the same 403s, and the same misconfiguration, as the deployed bundle. Sent with
+	// every build, tokenless included: the shell reuses one realm across builds, so
+	// omitting it would leave an old token in place.
+	type PreviewSdk = { token: string; baseUrl: string; workspace: string }
+	let previewSdk: PreviewSdk | undefined = undefined
+	// The setup the preview last started from; an unchanged one is not redone.
 	let previewSdkKey: string | undefined = undefined
+	// Bumped on every new setup: only the newest mint's answer is used. Toggling scopes
+	// starts a new mint while an older one is in flight, and toggling back recreates the
+	// same key, so a key check alone would let an out-of-order answer hand the preview
+	// the wrong scope set, restore a removed token, or start a preview since declined.
+	let previewSdkGeneration = 0
 	// Holds the build back between dropping a credential and settling its
 	// replacement, so the app mounts once — with the final credential — instead of
 	// once tokenless and again tokenful, running mount-time side effects twice.
 	let previewSdkPending = $state(false)
+	// Holds the app back (with `previewSdkPending`) until the viewer answers.
+	let sdkPrompt = $state<{ scopes: string[]; ws: string; declined: boolean } | undefined>(undefined)
+	// What Continue granted in this editor session, kept the way a loaded deployed
+	// app keeps its token: only a scope beyond it asks again.
+	let sessionSdkConsent: { ws: string; scopes: string[] } | undefined = undefined
 
 	/** Discard the running app. The shell resets the DOM but keeps the JavaScript
 	 * realm, so only a reload drops the old bundle's timers, listeners and the
 	 * token its client captured at module load. */
 	function restartPreviewRealm() {
-		if (!lastBuild) return // nothing running yet
-		previewIframeLoaded = false
-		if (previewIframe) previewIframe.src = PREVIEW_SHELL_URL
+		if (!previewShellUrl) return
+		if (lastBuild) {
+			previewIframeLoaded = false
+			previewPort = undefined
+			if (previewIframe) previewIframe.src = previewShellUrl
+		}
+		// Even with nothing built yet: toggling isolation swaps the kind of page the
+		// detached window must hold, and only this puts the right one there.
 		if (externalPreviewWindow && !externalPreviewWindow.closed) {
 			externalPreviewReady = false
+			externalPreviewPort = undefined
 			// User app code can navigate this window elsewhere, which makes its
 			// location cross-origin and unreachable — that document holds no token.
 			try {
-				externalPreviewWindow.location.replace(PREVIEW_SHELL_URL)
+				externalPreviewWindow.location.replace(
+					sandboxed ? getPreviewControllerUrl() : previewShellUrl
+				)
 			} catch (_) {}
 		}
 	}
 
 	/** Settle the credential and let the app start: the reloaded shells replay the
-	 * build themselves (the iframe from its `load` handler, the detached window
-	 * from `appPreviewReady`), so this only covers a shell already back up. */
-	function applyPreviewSdkEnv(js: string) {
-		previewSdkEnvJs = js
+	 * build themselves (on `load` or their handshake), so this only covers a shell
+	 * already back up. */
+	function applyPreviewSdk(sdk: PreviewSdk | undefined) {
+		previewSdk = sdk
 		previewSdkPending = false
 		if (lastBuild) feedPreviewIframe(lastBuild)
 		syncExternalPreview()
@@ -1576,43 +1721,82 @@
 	$effect(() => {
 		// Frontend SDK access is sandbox-only, so isolation off gets no credential
 		// here either, however the policy's scope list reads.
-		const scopes = policy?.sandbox === true ? (policy?.frontend_sdk_scopes ?? []) : []
+		const scopes = sandboxed ? (policy?.frontend_sdk_scopes ?? []) : []
 		const ws = opWorkspace
-		const key = `${ws ?? ''}|${scopes.join(',')}`
+		// `sandboxed` too: toggling it swaps the shell, which is a new realm.
+		const key = `${sandboxed}|${ws ?? ''}|${scopes.join(',')}`
 		if (key === previewSdkKey) return
 		previewSdkKey = key
+		previewSdkGeneration++
 		// Drop the old credential before asking for its replacement, never after:
 		// a mint is asynchronous, and until it answers the running preview — and
 		// any build fed meanwhile — would keep scopes the policy just removed, or
 		// a token for the workspace we just left.
 		const willMint = scopes.length > 0 && !!ws
 		previewSdkPending = willMint
-		previewSdkEnvJs = NO_SDK_ENV_JS
+		previewSdk = undefined
+		sdkPrompt = undefined
 		restartPreviewRealm()
-		if (willMint) mintPreviewSdkToken(scopes, ws, key)
+		if (!willMint) return
+		// Ask before the app's code runs, as the deployed app does: the token acts
+		// as whoever has the editor open.
+		const granted =
+			(sessionSdkConsent?.ws === ws && sdkConsentCovers(sessionSdkConsent.scopes, scopes)) ||
+			untrack(() => hasStoredSdkConsent($userStore?.email ?? '', ws, path, scopes, true))
+		if (granted) {
+			mintPreviewSdkToken(scopes, ws)
+		} else {
+			sdkPrompt = { scopes, ws, declined: false }
+			if (externalPreviewWindow && !externalPreviewWindow.closed) {
+				untrack(() => select({ kind: 'preview' }))
+			}
+		}
 	})
 
-	async function mintPreviewSdkToken(scopes: string[], ws: string, key: string) {
+	$effect(() => {
+		sdkPrompt?.declined
+		untrack(syncExternalPreviewNotice)
+	})
+
+	function syncExternalPreviewNotice() {
+		if (!sandboxed || !externalPreviewWindow || externalPreviewWindow.closed) return
+		const text = !sdkPrompt
+			? ''
+			: sdkPrompt.declined
+				? 'The preview is blocked until you grant the permissions this app declares. You can review them in the editor window.'
+				: 'This app is waiting for you to approve its permissions in the editor window.'
+		externalPreviewWindow.postMessage({ type: PREVIEW_NOTICE, text }, window.location.origin)
+	}
+
+	async function onSdkConsentContinue(dontAskAgain: boolean) {
+		if (!sdkPrompt) return
+		const { scopes, ws } = sdkPrompt
+		sdkPrompt = undefined
+		// Recorded on the click, as the deployed app does, so a scope edit reverted while
+		// this mint is in flight is still approved and does not ask again.
+		sessionSdkConsent = { ws, scopes }
+		if (!(await mintPreviewSdkToken(scopes, ws))) return
+		const viewer = $userStore?.email
+		if (dontAskAgain && viewer) storeSdkConsent(viewer, ws, path, scopes, true)
+	}
+
+	async function mintPreviewSdkToken(scopes: string[], ws: string) {
+		const generation = previewSdkGeneration
 		try {
 			const token = await AppService.mintPreviewSdkToken({
 				workspace: ws,
 				requestBody: { path, scopes }
 			})
-			if (key !== previewSdkKey) return
-			applyPreviewSdkEnv(
-				`window.process = { env: ${JSON.stringify({
-					WM_RAW_APP: 'true',
-					WM_TOKEN: token,
-					BASE_URL: window.location.origin,
-					WM_WORKSPACE: ws
-				}).replace(/</g, '\\u003c')} };\n`
-			)
+			if (generation !== previewSdkGeneration) return false
+			applyPreviewSdk({ token, baseUrl: window.location.origin, workspace: ws })
+			return true
 		} catch (e) {
 			// Already tokenless — the effect cleared the env before calling us — so
 			// this only releases the build. The key stays set, so a failed mint is not
 			// retried until the scopes or workspace actually change.
 			console.warn('Could not mint a preview SDK token', e)
-			if (key === previewSdkKey) applyPreviewSdkEnv(NO_SDK_ENV_JS)
+			if (generation === previewSdkGeneration) applyPreviewSdk(undefined)
+			return false
 		}
 	}
 
@@ -1622,7 +1806,9 @@
 			postToExternalPreview({
 				type: 'preview',
 				css: lastBuild.css,
-				js: previewSdkEnvJs + lastBuild.js
+				js: lastBuild.js,
+				sdk: previewSdk,
+				storage: previewStorage()
 			})
 		}
 	}
@@ -1633,16 +1819,23 @@
 	function feedPreviewIframe(build: { css: string; js: string }) {
 		// Between dropping a credential and settling its replacement the shell stays
 		// blank; whichever settles last — the mint or the shell's own `load` — starts
-		// the app. Same for a shell still reloading: its `load` handler replays.
+		// the app. Same for a shell still reloading: it replays once ready.
 		if (previewSdkPending || !previewIframeLoaded) return
 		runtimeError = undefined
 		emptyRender = false
-		// Same-origin app-preview.html, and the payload now carries a token — address
-		// it to our origin rather than '*', as the detached preview already does.
-		previewIframe?.contentWindow?.postMessage(
-			{ type: 'preview', css: build.css, js: previewSdkEnvJs + build.js },
-			window.location.origin
-		)
+		postToPreview({
+			type: 'preview',
+			css: build.css,
+			js: build.js,
+			sdk: previewSdk,
+			storage: previewStorage()
+		})
+	}
+
+	// The shell seeds a fresh document's storage shim from this; unsandboxed
+	// previews use real storage and get none.
+	function previewStorage() {
+		return sandboxed ? readRawAppStorage(previewStorageKey) : undefined
 	}
 
 	// Full (re)feed of the detached window: theme first, then the build. Used
@@ -1651,16 +1844,19 @@
 	// `syncExternalPreview` alone (the theme hasn't changed).
 	function feedExternalPreview() {
 		postToExternalPreview({ type: 'setDarkMode', dark: darkMode, variant: darkVariant })
+		syncExternalPreviewNotice()
 		syncExternalPreview()
 	}
 
-	onDestroy(() => {
-		// Don't leave a detached preview behind when the editor unmounts: it
-		// would stop receiving builds and, once refreshed, has no opener to
-		// re-feed it — a permanently blank orphan.
+	// Don't leave a detached preview behind when the editor goes away, by
+	// unmounting or by its tab reloading or closing (`pagehide`, which skips
+	// `onDestroy`): it would stop receiving builds, and its document is a blob
+	// URL owned by this page, so refreshing it gives "not found".
+	function closeExternalPreview() {
 		if (externalPreviewWindow && !externalPreviewWindow.closed) externalPreviewWindow.close()
 		externalPreviewWindow = null
-	})
+	}
+	onDestroy(closeExternalPreview)
 
 	function openExternalPreview() {
 		// Reuse an already-open window instead of spawning duplicates.
@@ -1671,13 +1867,22 @@
 		}
 		// Scope the window name per app path so two open editors don't fight over
 		// (or take over / close) one shared OS-level preview window.
-		const win = window.open(PREVIEW_SHELL_URL, `windmillRawAppPreview:${encodeURIComponent(path)}`)
+		if (!previewShellUrl) {
+			sendUserToast('The app preview is not available', true)
+			return
+		}
+		const win = window.open(
+			sandboxed ? getPreviewControllerUrl() : previewShellUrl,
+			`windmillRawAppPreview:${encodeURIComponent(path)}`
+		)
 		if (!win) {
 			sendUserToast('Could not open the preview window (popup blocked?)', true)
 			return
 		}
 		externalPreviewWindow = win
 		externalPreviewReady = false
+		// The sandboxed shell announces itself through its controller's relay.
+		if (sandboxed) return
 		// Initial feed: fires once when the freshly opened tab loads. This is the
 		// only feed path against an app-preview.html that predates the
 		// `appPreviewReady` handshake, so the window isn't blank on first open
@@ -1706,75 +1911,104 @@
 		})
 	}
 
-	const RUNTIME_LOGS_TIMEOUT_MS = 2000
-	type PendingRuntimeLogRequest = {
-		resolve: (entries: RawAppRuntimeLogEntry[] | undefined) => void
+	// The preview may be an opaque-origin document, so everything the editor reads
+	// from it is a request the shell answers, correlated by requestId.
+	const PREVIEW_REQUEST_TIMEOUT_MS = 2000
+	const SCREENSHOT_TIMEOUT_MS = 30_000
+	type PendingPreviewRequest = {
+		resolve: (response: any) => void
 		timer: ReturnType<typeof setTimeout>
 	}
-	const pendingRuntimeLogReqs = new Map<string, PendingRuntimeLogRequest>()
+	const pendingPreviewReqs = new Map<string, PendingPreviewRequest>()
 
-	function resolvePendingRuntimeLogRequest(
-		requestId: string,
-		entries: RawAppRuntimeLogEntry[] | undefined
-	) {
-		const pending = pendingRuntimeLogReqs.get(requestId)
+	function resolvePendingPreviewRequest(requestId: string, response: any) {
+		const pending = pendingPreviewReqs.get(requestId)
 		if (!pending) return
 		clearTimeout(pending.timer)
-		pendingRuntimeLogReqs.delete(requestId)
-		pending.resolve(entries)
+		pendingPreviewReqs.delete(requestId)
+		pending.resolve(response)
+	}
+
+	/** Resolves with the shell's answer, or `undefined` when there is no loaded
+	 * preview to ask or it didn't answer in time. */
+	function requestFromPreview(
+		type: string,
+		payload: Record<string, unknown>,
+		timeoutMs = PREVIEW_REQUEST_TIMEOUT_MS
+	): Promise<any> {
+		if (!previewIframe || !previewIframeLoaded) return Promise.resolve(undefined)
+		const requestId = randomUUID()
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => resolvePendingPreviewRequest(requestId, undefined), timeoutMs)
+			pendingPreviewReqs.set(requestId, { resolve, timer })
+			postToPreview({ type, requestId, ...payload })
+		})
 	}
 
 	const requestRuntimeLogs: RawAppRuntimeLogRequester = async (limit) => {
 		await buildTracker.wait()
 		if (editorDestroyed) {
-			return { entries: undefined, buildError: undefined, buildPending: false, buildLogs: '' }
+			return {
+				entries: undefined,
+				buildError: undefined,
+				buildPending: false,
+				buildLogs: '',
+				sdkConsentPending: false
+			}
 		}
 		return {
 			entries: await requestPreviewConsoleLogs(limit),
 			buildError,
 			buildPending: buildTracker.pending,
-			buildLogs: logs
+			buildLogs: logs,
+			sdkConsentPending: sdkPrompt !== undefined
 		}
 	}
 
-	function requestPreviewConsoleLogs(limit: number) {
-		const win = previewIframe?.contentWindow
-		if (!win || !previewIframeLoaded) return Promise.resolve(undefined)
-		const requestId = randomUUID()
-		return new Promise<RawAppRuntimeLogEntry[] | undefined>((resolve) => {
-			const timer = setTimeout(() => {
-				resolvePendingRuntimeLogRequest(requestId, undefined)
-			}, RUNTIME_LOGS_TIMEOUT_MS)
-			pendingRuntimeLogReqs.set(requestId, { resolve, timer })
-			win.postMessage({ type: 'getRuntimeLogs', requestId, limit }, '*')
-		})
+	async function requestPreviewConsoleLogs(
+		limit: number
+	): Promise<RawAppRuntimeLogEntry[] | undefined> {
+		const res = await requestFromPreview('getRuntimeLogs', { limit })
+		return res ? normalizeRawAppRuntimeLogs(res.logs) : undefined
 	}
 
-	// Live DOM inspection for the session chat. Same-origin: the preview iframe is a
-	// same-origin document (see the load listener below that reads its contentWindow),
-	// so we read `contentDocument` directly — no postMessage, no ui_builder change. The
-	// element is re-read on every call, so the model always sees the current render.
+	/** Rebuilds the element the shell serialized, in an inert document: its scripts
+	 * don't run and its resources don't load. `<template>` keeps context-bound tags
+	 * (`<td>`, `<li>`) intact but drops `<html>`/`<body>`, which DOMParser keeps. */
+	function parsePreviewElement(outerHTML: string, tagName: string): Element | null {
+		if (tagName === 'html' || tagName === 'body' || tagName === 'head') {
+			const doc = new DOMParser().parseFromString(outerHTML, 'text/html')
+			return tagName === 'html' ? doc.documentElement : doc[tagName]
+		}
+		const template = document.createElement('template')
+		template.innerHTML = outerHTML
+		return template.content.firstElementChild
+	}
+
+	// Live DOM inspection for the session chat. The element is re-read on every call,
+	// so the model always sees the current render.
 	const requestDomQuery: RawAppDomRequester = async (query: RawAppDomQuery) => {
-		const doc = previewIframe?.contentDocument
-		if (!doc || !previewIframeLoaded) return undefined
+		await buildTracker.wait()
+		if (editorDestroyed) return undefined
+		if (buildTracker.pending) return { text: BUILD_PENDING_TEXT }
+		if (sdkPrompt) return { text: SDK_CONSENT_PENDING_TEXT }
+		if (previewSdkPending) return { text: SDK_STARTING_TEXT }
+		const res = await readPreviewDom(query)
+		return res && buildError !== undefined
+			? { text: `${buildFailedText(buildError)}\n\n${res.text}` }
+			: res
+	}
+
+	const readPreviewDom: RawAppDomRequester = async (query: RawAppDomQuery) => {
 		const selector = query.selector?.trim()
-		let el: Element | null
-		let matchCount: number
-		if (selector) {
-			let matches: NodeListOf<Element>
-			try {
-				matches = doc.querySelectorAll(selector)
-			} catch (e) {
-				return {
-					text: `Invalid CSS selector "${selector}": ${e instanceof Error ? e.message : String(e)}`
-				}
-			}
-			matchCount = matches.length
-			el = matches[0] ?? null
-		} else {
-			el = doc.body
-			matchCount = el ? 1 : 0
+		const res = await requestFromPreview('domRead', { selector })
+		if (!res) return undefined
+		if (typeof res.error === 'string') {
+			return { text: `Invalid CSS selector "${selector}": ${res.error}` }
 		}
+		const matchCount: number = res.matchCount ?? 0
+		const el =
+			typeof res.outerHTML === 'string' ? parsePreviewElement(res.outerHTML, res.tagName) : null
 		if (!el) {
 			return {
 				text: `No element matches selector "${selector}". It may not be rendered yet, or the selector is wrong. Try a broader selector or omit it to read the whole page.`
@@ -1823,7 +2057,7 @@
 	// ---- Inline "prompt this element" mini-composer (session preview only) ----
 	// Anchored over the most-recently selected element in the live preview. It's a
 	// host overlay (position: fixed in the top document) computed from the element's
-	// rect inside the same-origin preview iframe, repositioned as the preview scrolls.
+	// rect inside the preview iframe, repositioned as the preview scrolls.
 	let inlinePromptDismissed = $state(false)
 	let inlinePromptPos = $state<{ x: number; y: number } | undefined>(undefined)
 	let inlinePromptLabel = $state('')
@@ -1833,38 +2067,33 @@
 			: undefined
 	)
 
-	function shortElementLabel(el: Element): string {
+	function shortElementLabel(el: { tagName: string; id: string; className: string }): string {
 		const tag = el.tagName.toLowerCase()
 		const id = el.id ? `#${el.id}` : ''
-		const cls =
-			typeof el.className === 'string'
-				? el.className
-						.trim()
-						.split(/\s+/)
-						.filter((c) => c && !c.startsWith('inspector-'))[0]
-				: undefined
+		const cls = el.className
+			.trim()
+			.split(/\s+/)
+			.filter((c) => c && !c.startsWith('inspector-'))[0]
 		return `${tag}${id}${cls ? `.${cls}` : ''}`
 	}
 
-	function updateInlinePromptPos() {
+	// Scrolls ask faster than the shell answers; only the latest answer is applied.
+	let inlinePromptPosSeq = 0
+	async function updateInlinePromptPos() {
+		const seq = ++inlinePromptPosSeq
 		const sel = inlinePromptSelector
-		const doc = previewIframe?.contentDocument
-		if (!sel || !doc || !previewIframeLoaded || inlinePromptDismissed) {
+		if (!sel || !previewIframe || !previewIframeLoaded || inlinePromptDismissed) {
 			inlinePromptPos = undefined
 			return
 		}
-		let el: Element | null
-		try {
-			el = doc.querySelector(sel)
-		} catch (_) {
-			el = null
-		}
-		if (!el) {
+		const el = await requestFromPreview('elementRect', { selector: sel })
+		if (seq !== inlinePromptPosSeq || !previewIframe) return
+		if (!el?.rect) {
 			inlinePromptPos = undefined
 			return
 		}
-		const r = el.getBoundingClientRect()
-		const ir = previewIframe!.getBoundingClientRect()
+		const r = el.rect
+		const ir = previewIframe.getBoundingClientRect()
 		// Hide while the element is scrolled outside the preview's visible area.
 		if (r.bottom < 0 || r.top > ir.height || r.right < 0 || r.left > ir.width) {
 			inlinePromptPos = undefined
@@ -1897,20 +2126,18 @@
 
 	$effect(() => {
 		// Recompute on selection change, preview (re)load, or dismiss; and keep the
-		// overlay pinned as the preview (or the host) scrolls/resizes.
+		// overlay pinned as the host scrolls/resizes. The preview's own scrolls arrive
+		// as `previewScroll` messages.
 		inlinePromptSelector
 		selectedDomSelectors
 		previewIframeLoaded
 		inlinePromptDismissed
 		updateInlinePromptPos()
 		if (!previewIframe || !previewIframeLoaded) return
-		const win = previewIframe.contentWindow
 		const onScroll = () => updateInlinePromptPos()
-		win?.addEventListener('scroll', onScroll, true)
 		window.addEventListener('scroll', onScroll, true)
 		window.addEventListener('resize', onScroll)
 		return () => {
-			win?.removeEventListener('scroll', onScroll, true)
 			window.removeEventListener('scroll', onScroll, true)
 			window.removeEventListener('resize', onScroll)
 		}
@@ -1934,111 +2161,47 @@
 		return out.reverse()
 	}
 
-	// Only values whose non-wrapping counterpart collapses whitespace identically.
-	// `pre-line`/`break-spaces` have no such counterpart: forcing them to nowrap
-	// would eat their preserved newlines, so they are left to re-wrap.
-	const NON_WRAPPING_EQUIVALENT: Record<string, string> = {
-		normal: 'nowrap',
-		'pre-wrap': 'pre'
-	}
-
-	// getClientRects yields a rect per contained node, not per line box, so the
-	// count alone says nothing: `a <b>b</b>` is two rects on one line. Rects
-	// sharing a line overlap vertically, and `top` alone would split a line that
-	// mixes font sizes — so count vertically disjoint runs.
-	function countLines(range: Range): number {
-		const rects = Array.from(range.getClientRects()).filter((r) => r.width > 0 || r.height > 0)
-		if (rects.length === 0) return 0
-		rects.sort((a, b) => a.top - b.top)
-		let lines = 1
-		let lineBottom = rects[0].bottom
-		for (const r of rects) {
-			if (r.top >= lineBottom) {
-				lines++
-				lineBottom = r.bottom
-			} else {
-				lineBottom = Math.max(lineBottom, r.bottom)
-			}
-		}
-		return lines
-	}
-
-	// A box that shrink-wraps its text can have zero sub-pixel slack (a 208.59px box
-	// holding a 208.59px text run). The capture re-runs layout in whole pixels, so
-	// the text no longer fits, wraps, and is then clipped out of the box entirely.
-	// Pinning runs that are already single-line is a no-op on the live DOM but stops
-	// the re-layout from re-deciding where they break.
-	function pinSingleLineText(root: HTMLElement): () => void {
-		const doc = root.ownerDocument
-		const view = doc.defaultView
-		if (!view) return () => {}
-		// Measure every candidate before mutating any of them: interleaving reads and
-		// writes forces a synchronous reflow per element.
-		const pending: Array<[HTMLElement, string]> = []
-		const walker = doc.createTreeWalker(root, NodeFilter.SHOW_ELEMENT)
-		let node: Node | null
-		while ((node = walker.nextNode())) {
-			const el = node as HTMLElement
-			if (!(el instanceof view.HTMLElement)) continue
-			const hasOwnText = Array.from(el.childNodes).some(
-				(c) => c.nodeType === Node.TEXT_NODE && (c.textContent ?? '').trim() !== ''
-			)
-			if (!hasOwnText) continue
-			const replacement = NON_WRAPPING_EQUIVALENT[view.getComputedStyle(el).whiteSpace]
-			if (!replacement) continue
-			const range = doc.createRange()
-			range.selectNodeContents(el)
-			if (countLines(range) !== 1) continue // already wraps — leave its breaks alone
-			pending.push([el, replacement])
-		}
-		const restores = pending.map(([el, replacement]) => {
-			const prev = el.style.getPropertyValue('white-space')
-			const prio = el.style.getPropertyPriority('white-space')
-			el.style.setProperty('white-space', replacement, 'important')
-			return () => {
-				if (prev) el.style.setProperty('white-space', prev, prio)
-				else el.style.removeProperty('white-space')
-			}
-		})
-		return () => restores.forEach((r) => r())
-	}
-
-	// Capture the live preview as a PNG data URL. The preview iframe
-	// (/ui_builder/app-preview.html) is same-origin with no sandbox, so its rendered
-	// document is reachable and can be serialized from here. There is no native
-	// element-screenshot API; modern-screenshot reconstructs the DOM into an SVG
-	// foreignObject, so a WebGL canvas is only captured when its context was created
-	// with preserveDrawingBuffer. Lazy-imported so the library only loads on demand.
+	// Capture the live preview as a PNG data URL, taken by the shell with
+	// modern-screenshot: there is no native element-screenshot API, so it
+	// reconstructs the DOM into an SVG foreignObject, and a WebGL canvas is only
+	// captured when its context was created with preserveDrawingBuffer.
 	const captureScreenshot: RawAppScreenshotRequester = async () => {
-		const target = previewIframe?.contentDocument?.body
-		if (!previewIframe || !previewIframeLoaded || !target) {
-			throw new Error('App preview is not ready')
-		}
+		await buildTracker.wait()
+		if (editorDestroyed) throw new Error('The app preview was closed')
+		if (buildTracker.pending) throw new Error(BUILD_PENDING_TEXT)
+		if (sdkPrompt) throw new Error(SDK_CONSENT_PENDING_TEXT)
+		if (previewSdkPending) throw new Error(SDK_STARTING_TEXT)
+		if (buildError !== undefined) throw new Error(buildFailedText(buildError))
+		const body = await requestFromPreview('elementRect', { selector: 'body' })
+		if (!body?.rect) throw new Error('App preview is not ready')
+		const { width, height } = body.rect
 		// Collapsing the preview leaves the iframe mounted and populated at zero
-		// width, which passes every check above and then fails inside the rasteriser
-		// as an opaque decode error. Name the cause so the agent can act on it.
-		if (!target.clientWidth || !target.clientHeight) {
+		// width, which then fails inside the rasteriser as an opaque decode error.
+		// Name the cause so the agent can act on it.
+		if (!width || !height) {
 			throw new Error(
 				'The app preview is collapsed, so there is nothing to capture. Ask the user to expand the preview panel, then try again.'
 			)
 		}
-		const { domToPng } = await import('modern-screenshot')
 		// Above CSS resolution for small previews (a 1× capture of a ~900px preview
 		// reads blurry next to the live render), sub-1× for oversized bodies — see
 		// captureScale. maximumCanvasSize is the belt over that math: the rasterised
-		// box can exceed the body's client size, and an unbounded canvas on a tall
-		// scrolling app can freeze the tab before normalize ever bounds the pixels.
-		const scale = captureScale(Math.max(target.clientWidth, target.clientHeight))
-		const restore = pinSingleLineText(target)
-		try {
-			return await domToPng(target, {
-				backgroundColor: '#ffffff',
-				scale,
-				maximumCanvasSize: MAX_IMAGE_EDGE
-			})
-		} finally {
-			restore()
-		}
+		// box can exceed the body's size, and an unbounded canvas on a tall scrolling
+		// app can freeze the tab before normalize ever bounds the pixels.
+		const res = await requestFromPreview(
+			'screenshot',
+			{
+				options: {
+					backgroundColor: '#ffffff',
+					scale: captureScale(Math.max(width, height)),
+					maximumCanvasSize: MAX_IMAGE_EDGE
+				}
+			},
+			SCREENSHOT_TIMEOUT_MS
+		)
+		if (!res) throw new Error('The app preview did not return a screenshot')
+		if (typeof res.error === 'string') throw new Error(res.error)
+		return res.dataUrl
 	}
 
 	onMount(() => {
@@ -2051,8 +2214,8 @@
 			onRunsProvider?.(undefined)
 			onDomRequester?.(undefined)
 			onScreenshotRequester?.(undefined)
-			for (const requestId of Array.from(pendingRuntimeLogReqs.keys()))
-				resolvePendingRuntimeLogRequest(requestId, undefined)
+			for (const requestId of Array.from(pendingPreviewReqs.keys()))
+				resolvePendingPreviewRequest(requestId, undefined)
 			editorDestroyed = true
 			buildTracker.release()
 		}
@@ -2081,30 +2244,25 @@
 			iframeLoaded = true
 		})
 	})
+	function onPreviewShellReady() {
+		previewIframeLoaded = true
+		// Replay the last build so the preview repopulates without
+		// waiting for the user to trigger another bundle.
+		if (lastBuild) {
+			feedPreviewIframe(lastBuild)
+		}
+	}
 	$effect(() => {
-		previewIframe?.addEventListener('load', () => {
-			previewIframeLoaded = true
-			// Replay the last build so the preview repopulates without
-			// waiting for the user to trigger another bundle.
-			if (lastBuild) {
-				feedPreviewIframe(lastBuild)
-			}
-			// Escape inside the preview exits inspect mode — the keydown fires in
-			// the iframe's document, so the parent window listener can't see it.
-			// We also want Escape to dismiss a lingering green "selected" overlay
-			// after the user picked an element (which auto-disables hover).
-			previewIframe?.contentWindow?.addEventListener(
-				'keydown',
-				(e) => {
-					if (
-						e.key === 'Escape' &&
-						(inspectorEnabled || inspectorElement || selectedDomSelectors.length > 0)
-					) {
-						disableInspector()
-					}
-				},
-				true
-			)
+		const el = previewIframe
+		if (!el) return
+		// A new frame (sandbox isolation toggled) starts unloaded, port-less.
+		untrack(() => {
+			previewIframeLoaded = false
+			previewPort = undefined
+		})
+		// A sandboxed shell is ready on its handshake, not on `load`.
+		el.addEventListener('load', () => {
+			if (!sandboxed) onPreviewShellReady()
 		})
 	})
 	$effect(() => {
@@ -2116,11 +2274,8 @@
 				'*'
 			)
 		}
-		if (previewIframe && previewIframeLoaded) {
-			previewIframe.contentWindow?.postMessage(
-				{ type: 'setDarkMode', dark: darkMode, variant: darkVariant },
-				'*'
-			)
+		if (previewIframeLoaded) {
+			postToPreview({ type: 'setDarkMode', dark: darkMode, variant: darkVariant })
 		}
 		postToExternalPreview({ type: 'setDarkMode', dark: darkMode, variant: darkVariant })
 	})
@@ -2135,11 +2290,8 @@
 		// the harness renders one highlight per selector. Re-posts on every
 		// selection change and on preview (re)load.
 		const selectors = selectedDomSelectors
-		if (previewIframe && previewIframeLoaded) {
-			previewIframe.contentWindow?.postMessage(
-				{ type: 'inspectorSetSelection', selectors: [...selectors] },
-				'*'
-			)
+		if (previewIframeLoaded) {
+			postToPreview({ type: 'inspectorSetSelection', selectors: [...selectors] })
 		}
 	})
 	$effect(() => {
@@ -2163,7 +2315,7 @@
 	function clearInspectorSelection() {
 		inspectorElement = undefined
 		// Inspector lives in the preview iframe, so clear its overlay there.
-		previewIframe?.contentWindow?.postMessage({ type: 'inspectorClear' }, '*')
+		postToPreview({ type: 'inspectorClear' })
 	}
 
 	// Folders aren't selectable in the tree, so this only ever gets files — except
@@ -2291,8 +2443,8 @@
 		// `inspectorDisable` only stops hover/click; the green "selected"
 		// overlay from a prior pick persists until we explicitly clear it.
 		// Escape should reset both, so the iframe goes back to its idle look.
-		previewIframe?.contentWindow?.postMessage({ type: 'inspectorDisable' }, '*')
-		previewIframe?.contentWindow?.postMessage({ type: 'inspectorClear' }, '*')
+		postToPreview({ type: 'inspectorDisable' })
+		postToPreview({ type: 'inspectorClear' })
 		inspectorElement = undefined
 		// Session mode: clear the chips too. Emptying the selection hides the
 		// inline prompt (it's driven by the chips) and drops the highlights (the
@@ -2389,7 +2541,7 @@
 	}
 </script>
 
-<svelte:window onmessage={listener} onkeydown={handleKeydown} />
+<svelte:window onmessage={listener} onkeydown={handleKeydown} onpagehide={closeExternalPreview} />
 <DarkModeObserver
 	bind:darkMode
 	on:change={() => {
@@ -2405,7 +2557,7 @@
 	bind:jobsById
 	{runnables}
 	{path}
-	gateJobIds={false}
+	gateJobIds={sandboxed}
 	extraSourceWindow={() => externalPreviewWindow}
 />
 <div
@@ -2425,7 +2577,12 @@
 		{onTakeLatest}
 		{draftBaseVersion}
 		{onRestore}
-		{onSavedNewAppPath}
+		onSavedNewAppPath={(newAppPath) => {
+			if (opWorkspace && $userStore?.email) {
+				movePreviewSdkConsent($userStore.email, opWorkspace, path, newAppPath)
+			}
+			onSavedNewAppPath?.(newAppPath)
+		}}
 		{policy}
 		{diffDrawer}
 		{newApp}
@@ -2442,6 +2599,7 @@
 		{getBundle}
 		{onNavigate}
 		{onDeploy}
+		{onDetails}
 		{onResetToDeployed}
 		{loadedFromDraft}
 		{othersDraftsCount}
@@ -2454,6 +2612,7 @@
 		sidebarCollapsed={sidebarCollapsed.val}
 		onToggleSidebar={() => (sidebarCollapsed.val = !sidebarCollapsed.val)}
 		{condensedHeader}
+		{ownsPageHeader}
 	/>
 
 	<RawAppYamlEditor
@@ -2677,10 +2836,7 @@
 														disableInspector()
 													} else {
 														inspectorEnabled = true
-														previewIframe?.contentWindow?.postMessage(
-															{ type: 'inspectorEnable' },
-															'*'
-														)
+														postToPreview({ type: 'inspectorEnable' })
 													}
 												}}
 											/>
@@ -2722,13 +2878,48 @@
 										</div>
 									{/snippet}
 								</DraggableTabs>
-								<iframe
-									bind:this={previewIframe}
-									title="App preview"
-									src={PREVIEW_SHELL_URL}
-									class="w-full flex-1 block"
-								></iframe>
-								{#if buildError}
+								<!-- Not mounted before the shell is: a src-less iframe fires `load`
+								     for about:blank, which would mark the preview ready. Keyed so
+								     toggling isolation builds a new frame: a frame's sandbox flags
+								     only apply to its next navigation. -->
+								{#if previewShellUrl}
+									{#key sandboxed}
+										<iframe
+											bind:this={previewIframe}
+											title="App preview"
+											src={previewShellUrl}
+											sandbox={sandboxed ? RAW_APP_SANDBOX_FLAGS : undefined}
+											referrerpolicy={sandboxed ? 'no-referrer' : undefined}
+											class="w-full flex-1 block"
+										></iframe>
+									{/key}
+								{/if}
+								{#if sdkPrompt}
+									<!-- top-10 leaves the tab bar usable. -->
+									<div class="absolute top-10 inset-x-0 bottom-0 z-30 bg-surface overflow-auto">
+										{#if sdkPrompt.declined}
+											<div class="px-4 mt-20 max-w-xl mx-auto flex flex-col items-start gap-4">
+												<p class="text-sm text-secondary">
+													The preview is blocked until you grant the permissions this app declares.
+												</p>
+												<Button
+													variant="default"
+													unifiedSize="md"
+													onclick={() => sdkPrompt && (sdkPrompt.declined = false)}
+												>
+													Review permissions
+												</Button>
+											</div>
+										{:else}
+											<RawAppSdkConsent
+												scopes={sdkPrompt.scopes}
+												declineLabel="Decline"
+												onContinue={onSdkConsentContinue}
+												onDecline={() => sdkPrompt && (sdkPrompt.declined = true)}
+											/>
+										{/if}
+									</div>
+								{:else if buildError}
 									<!-- top-12 clears the tab bar; `before:bg-surface` backs the
 									     Alert's translucent red; `isolate` pins the pseudo's stacking context. -->
 									<div class="absolute top-12 left-2 right-2 z-20 isolate" role="alert">
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index afb8e3fa89..74f1f2ac32 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -1,9 +1,8 @@
 <script lang="ts">
 	import { Drawer, DrawerContent } from '$lib/components/common'
-	import { base } from '$lib/base'
 	import RawAppRecordSession from '$lib/components/workspaceSettings/RawAppRecordSession.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
-	import { isMac, userPathPrefix } from '$lib/utils'
+	import { isMac, userPathPrefix, emptyString } from '$lib/utils'
 	import { editPathFor } from '$lib/components/workspacePicker'
 	import { invalidateWorkspacePaths } from '$lib/components/PathNameAutocomplete.svelte'
 
@@ -28,7 +27,7 @@
 		Undo,
 		WandSparkles
 	} from 'lucide-svelte'
-	import { onDestroy, untrack } from 'svelte'
+	import { onDestroy, untrack, type Snippet } from 'svelte'
 	import { orderedJsonStringify, type Value, replaceFalseWithUndefined } from '../../utils'
 	import { random_adj } from '$lib/components/random_positive_adjetive'
 
@@ -76,9 +75,13 @@
 	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 	import {
+		operatingWorkspaceContextEntry,
 		useOperatingUser,
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader, PHONE_BAR } from '$lib/components/pageHeaderRegistry.svelte'
+	import PathEditPopover from '$lib/components/PathEditPopover.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
@@ -153,6 +156,8 @@
 		 * EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 		 * session preview to save vertical room. */
 		condensedHeader?: boolean
+		/** True for the route's own editor: its top bar becomes the page header. */
+		ownsPageHeader?: boolean
 		onNavigate?: (item: import('$lib/components/workspacePicker').WorkspaceItem) => void
 		liveEditorDraftStoragePath?: string
 		/** Indicator-only overrides for the sessions preview: the AutosaveIndicator
@@ -180,6 +185,9 @@
 		pendingDraftPath?: string | undefined
 		// Threaded to the `AutosaveIndicator` popover so its "Reset to
 		// deployed" button can do the same thing the load-time toast offers.
+		/** `Exit & see details`: leaves the editor for the app's deployed page. A session hosts that
+		 *  page itself, so it flips the tab there rather than navigating out of the session. */
+		onDetails?: (e: { path: string }) => void
 		onResetToDeployed?: () => void | Promise<void>
 		// See ScriptBuilderProps — same semantics for the raw-app editor's
 		// indicator.
@@ -198,7 +206,7 @@
 
 	let {
 		summary = $bindable(),
-		policy = $bindable(),
+		policy,
 		diffDrawer = undefined,
 		savedApp = $bindable(undefined),
 		version = $bindable(undefined),
@@ -223,12 +231,14 @@
 		sidebarCollapsed = false,
 		onToggleSidebar = undefined,
 		condensedHeader = false,
+		ownsPageHeader = false,
 		onNavigate = undefined,
 		liveEditorDraftStoragePath = undefined,
 		autosaveWorkspace = undefined,
 		autosavePath = undefined,
 		onDeploy = undefined,
 		pendingDraftPath = $bindable(undefined),
+		onDetails,
 		onResetToDeployed,
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
@@ -308,18 +318,45 @@
 
 	// Top-bar responsive collapse — container width, not viewport.
 	let topbarWidth = $state(0)
-	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+	// In the page header the buttons share the row with the breadcrumb, so they collapse sooner:
+	// the trail and the summary take ~430px of the same row, and the whole group — the menu, Diff,
+	// Jobs, Export, AI and Deploy — is ~560px.
+	const compactBelow = $derived(ownsPageHeader ? 1350 : 720)
+	const compactTopbar = $derived.by(() => {
+		const w = ownsPageHeader ? pageHeader.barWidth : topbarWidth
+		return w > 0 && w < compactBelow
+	})
+	// A phone's bar keeps the trail, the file sidebar's toggle, Diff and Deploy. AI stands down —
+	// the sidebar's own Ask AI is the way in at that width — while Jobs and the export are already
+	// in the menu, Jobs from `compactTopbar` (true at any phone width) and the export always.
+	const phoneTopbar = $derived(
+		ownsPageHeader && pageHeader.barWidth > 0 && pageHeader.barWidth < PHONE_BAR
+	)
 
 	// Top-bar button size + bar height. Condensed (session preview) uses the
 	// smallest well-supported unified size (`sm`) so the bar is thinner.
-	const headerBtnSize = $derived(condensedHeader ? 'sm' : 'md')
+	// In the page header the buttons ride a 44px band, the same size the condensed session-pane
+	// header uses.
+	const headerBtnSize = $derived(condensedHeader || ownsPageHeader ? 'sm' : 'md')
+
+	/** Held by the rename popover while it is open; the band's trail reads it so the path does not
+	 *  reflow under the pointer as the user types. */
+	let pathSnapshot = $state<string | undefined>(undefined)
+
+	// The actions render under the band, outside the subtree RawAppEditor declared the operating
+	// workspace in, so it has to travel with them: OpenInSessionButton asks who the acting user is.
+	const headerContexts = new Map<any, any>([operatingWorkspaceContextEntry()])
 
 	function closeSaveDrawer() {
 		saveDrawerOpen = false
 	}
 
-	async function computeTriggerables() {
-		policy = await updateRawAppPolicy(runnables, policy)
+	// Returns a copy: `policy` is the editor's own object, which the Deploy panel's
+	// instant toggles mutate in place. Reassigning it would detach the panel from the
+	// editor, so later toggles would never reach the preview. After a successful save,
+	// copy only `triggerables_v2` back so the editor's value matches what was deployed.
+	function policyWithTriggerables() {
+		return updateRawAppPolicy(runnables, policy)
 	}
 
 	async function createApp(path: string) {
@@ -330,9 +367,9 @@
 		if (!policy.execution_mode) {
 			policy.execution_mode = 'publisher'
 		}
-		await computeTriggerables()
 		try {
 			const { js, css } = await getBundle()
+			const deployedPolicy = await policyWithTriggerables()
 			await AppService.createAppRaw({
 				workspace: opWorkspace!,
 				formData: {
@@ -340,7 +377,7 @@
 						value: app,
 						path,
 						summary: summary,
-						policy,
+						policy: deployedPolicy,
 						deployment_message: deploymentMsg,
 						custom_path: customPath,
 						preserve_on_behalf_of: preserveOnBehalfOf || undefined,
@@ -350,6 +387,7 @@
 					css
 				}
 			})
+			policy.triggerables_v2 = deployedPolicy.triggerables_v2
 			// New path now exists server-side — drop the autocomplete cache so
 			// it shows up immediately instead of after the 60s TTL.
 			invalidateWorkspacePaths(opWorkspace!)
@@ -357,7 +395,7 @@
 				summary: summary,
 				value: structuredClone(stateSnapshot(app)),
 				path: path,
-				policy: policy,
+				policy: deployedPolicy,
 				custom_path: customPath,
 				labels: $state.snapshot(labels)
 			}
@@ -555,10 +593,10 @@
 			return
 		}
 		const { js, css } = await getBundle()
-		await computeTriggerables()
 		if (!policy.execution_mode) {
 			policy.execution_mode = 'publisher'
 		}
+		const deployedPolicy = await policyWithTriggerables()
 		const deployed = await AppService.updateAppRaw({
 			workspace: opWorkspace!,
 			path: appPath!,
@@ -566,7 +604,7 @@
 				app: {
 					value: app!,
 					summary: summary,
-					policy,
+					policy: deployedPolicy,
 					path: npath,
 					deployment_message: deploymentMsg,
 					preserve_on_behalf_of: preserveOnBehalfOf || undefined,
@@ -580,12 +618,13 @@
 				css
 			}
 		})
+		policy.triggerables_v2 = deployedPolicy.triggerables_v2
 		invalidateWorkspacePaths(opWorkspace!)
 		savedApp = {
 			summary: summary,
 			value: structuredClone(stateSnapshot(app)),
 			path: npath,
-			policy,
+			policy: deployedPolicy,
 			custom_path: customPath,
 			labels: $state.snapshot(labels)
 		}
@@ -621,12 +660,13 @@
 	}
 
 	async function setPublishState(message?: string) {
-		await computeTriggerables()
+		const nextPolicy = await policyWithTriggerables()
 		await AppService.updateApp({
 			workspace: opWorkspace!,
 			path: appPath,
-			requestBody: { policy }
+			requestBody: { policy: nextPolicy }
 		})
+		policy.triggerables_v2 = nextPolicy.triggerables_v2
 		if (message) {
 			sendUserToast(message)
 		} else if (policy.execution_mode == 'anonymous') {
@@ -869,12 +909,12 @@
 				</span>
 				<span>
 					Stop recording, then <b>Download</b> the JSON. It is self-contained: open it on
-					<a href="{base}/replay" target="_blank" rel="noreferrer" class="text-blue-500 underline">
-						{base}/replay
+					<a href="/replay" target="_blank" rel="noreferrer" class="text-blue-500 underline">
+						/replay
 					</a>
 					— a public page that needs no login and can be embedded in an iframe. Host the JSON anywhere
 					it can be fetched (S3, GitHub raw, your docs site) and link
-					<span class="font-mono">{base}/replay?src=&lt;url&gt;</span> to have it load itself. Windmill
+					<span class="font-mono">/replay?src=&lt;url&gt;</span> to have it load itself. Windmill
 					keeps no copy.
 				</span>
 			</div>
@@ -903,121 +943,212 @@
 	errorByComponent={{}}
 />
 
-<div
-	bind:clientWidth={topbarWidth}
-	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto shrink-0 {condensedHeader
-		? 'max-h-9 h-9'
-		: 'max-h-12 h-12'}"
->
-	<!-- Identity block: shrinks/truncates first so the cloud indicator and the
+{#if ownsPageHeader}
+	<!-- The editor's own top bar is the page header on this route: the app's path and summary are
+	     the breadcrumb's, and everything else the bar carried rides along as the header's actions.
+	     `separator="none"`: the splitpanes below draw their own top line, and the bar's edge would
+	     be a second one on top of it. -->
+	<PageHeaderContent
+		item={{
+			// The path being edited, not the stored one: a brand-new app is parked at a
+			// `draft_<uuid>` placeholder, and the trail would name that instead of the path Deploy
+			// will create — which is why `newEditedPath` refuses the placeholder. Frozen while the
+			// rename popover is open so the trail holds still as the user types.
+			kind: 'app',
+			path: pathSnapshot ?? (newEditedPath || appPath || newPath || undefined),
+			summaryContent: appSummary,
+			pathTrigger: rawAppPathTrigger
+		}}
+		actions={rawAppHeaderActions}
+		contexts={headerContexts}
+		separator="none"
+	/>
+{:else}
+	<div
+		bind:clientWidth={topbarWidth}
+		class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto shrink-0 {condensedHeader
+			? 'max-h-9 h-9'
+			: 'max-h-12 h-12'}"
+	>
+		<!-- Identity block: shrinks/truncates first so the cloud indicator and the
 	     action buttons stay visible. Without min-w-0 the breadcrumb + summary
 	     overflow this box on narrow widths and get overlapped by the (formerly
 	     un-pinned) action group, hiding the autosave cloud. -->
-	<div class="flex flex-row gap-2 items-center min-w-0">
-		{#if onToggleSidebar}
-			<Button
-				unifiedSize="sm"
-				variant="subtle"
-				iconOnly
-				startIcon={{ icon: sidebarCollapsed ? PanelLeft : PanelLeftClose }}
-				title={`${sidebarCollapsed ? 'Expand' : 'Collapse'} file sidebar (${isMac() ? '⌘' : 'Ctrl+'}B)`}
-				on:click={() => onToggleSidebar?.()}
-			/>
-		{/if}
-		<div class="min-w-0 overflow-hidden">
-			<EditorHeader
-				bind:summary
-				bind:path={newEditedPath}
-				savedPath={appPath || newPath || undefined}
-				kind="app"
-				raw_app
-				hidePath={condensedHeader}
-				workspaceId={autosaveWorkspace}
-				onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
-			/>
+		<div class="flex flex-row gap-2 items-center min-w-0">
+			{@render sidebarToggle()}
+			<div class="min-w-0 overflow-hidden">
+				<EditorHeader
+					bind:summary
+					bind:path={newEditedPath}
+					savedPath={appPath || newPath || undefined}
+					kind="app"
+					raw_app
+					hidePath={condensedHeader}
+					workspaceId={autosaveWorkspace}
+					onNavigate={(item) => (onNavigate ? onNavigate(item) : goto(editPathFor(item)))}
+				/>
+			</div>
+			{@render autosaveIndicator()}
 		</div>
-		{#if opWorkspace && indicatorPath !== undefined}
-			<AutosaveIndicator
-				workspace={opWorkspace}
-				itemKind="raw_app"
-				path={indicatorPath}
-				draftOnly={newApp}
-				{onResetToDeployed}
-				{loadedFromDraft}
-				{othersDraftsCount}
-				{onOpenOthersDrafts}
-			/>
-		{/if}
-	</div>
 
+		{@render awarenessMark()}
+		<div class="flex flex-row gap-2 justify-end items-center overflow-visible shrink-0">
+			{@render rawAppActions()}
+		</div>
+	</div>
+{/if}
+
+{#snippet sidebarToggle()}
+	{#if onToggleSidebar}
+		<Button
+			unifiedSize="sm"
+			variant="subtle"
+			iconOnly
+			startIcon={{ icon: sidebarCollapsed ? PanelLeft : PanelLeftClose }}
+			title={`${sidebarCollapsed ? 'Expand' : 'Collapse'} file sidebar (${isMac() ? '⌘' : 'Ctrl+'}B)`}
+			on:click={() => onToggleSidebar?.()}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet autosaveIndicator()}
+	{#if opWorkspace && indicatorPath !== undefined}
+		<AutosaveIndicator
+			workspace={opWorkspace}
+			itemKind="raw_app"
+			path={indicatorPath}
+			draftOnly={newApp}
+			{onResetToDeployed}
+			{loadedFromDraft}
+			{othersDraftsCount}
+			{onOpenOthersDrafts}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet awarenessMark()}
 	{#if $enterpriseLicense && appPath != '' && !inSessionPane}
 		<div class="shrink-0">
 			<Awareness />
 		</div>
 	{/if}
-	<div class="flex flex-row gap-2 justify-end items-center overflow-visible shrink-0">
-		<DropdownV2 items={moreItems} class="h-auto">
-			{#snippet buttonReplacement()}
-				<Button
-					nonCaptureEvent
-					unifiedSize={headerBtnSize}
-					variant="subtle"
-					startIcon={{ icon: EllipsisVertical }}
-					iconOnly
-				></Button>
-			{/snippet}
-		</DropdownV2>
+{/snippet}
 
-		<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
+<!-- The summary's editor again, hung off the band's path segment so it opens under the path, with
+     the cursor in the path field. `bind:` cannot be spread, so the slots are written out twice;
+     both instances bind the same ones and only one is ever open. -->
+{#snippet rawAppPathTrigger(pathLabel: Snippet, triggerClass: string)}
+	<PathEditPopover
+		label={pathLabel}
+		{triggerClass}
+		focusField="path"
+		bind:summary
+		bind:path={newEditedPath}
+		bind:snapshotPath={pathSnapshot}
+		savedPath={appPath || undefined}
+		kind="app"
+		workspaceId={autosaveWorkspace}
+	/>
+{/snippet}
+
+{#snippet appSummary()}
+	<!-- Not edited in place: clicking the name opens the summary and the path together, so the band
+	     reads as a name rather than a form. `title` for one it truncates. -->
+	<div class="flex items-center gap-1 min-w-0">
+		{#snippet summaryText()}
+			<span
+				class="min-w-0 truncate text-xs {emptyString(summary)
+					? 'text-tertiary italic font-normal'
+					: 'font-medium text-emphasis'}"
+				title={summary}>{emptyString(summary) ? 'Add a summary...' : summary}</span
+			>
+		{/snippet}
+		<PathEditPopover
+			label={summaryText}
+			bind:summary
+			bind:path={newEditedPath}
+			bind:snapshotPath={pathSnapshot}
+			savedPath={appPath || undefined}
+			kind="app"
+			workspaceId={autosaveWorkspace}
+		/>
+	</div>
+{/snippet}
+
+{#snippet rawAppHeaderActions()}
+	<!-- The bar's own order kept: the file sidebar, how the draft is doing, who else is here, then
+	     what to do with the app. The sidebar's toggle is the only way back once it is folded — the
+	     collapsed sidebar renders nothing of its own — so it stays on the bar at every width. -->
+	{@render sidebarToggle()}
+	{@render autosaveIndicator()}
+	{@render awarenessMark()}
+	{@render rawAppActions()}
+{/snippet}
+
+{#snippet rawAppActions()}
+	<DropdownV2 items={moreItems} class="h-auto">
+		{#snippet buttonReplacement()}
+			<Button
+				nonCaptureEvent
+				unifiedSize={headerBtnSize}
+				variant="subtle"
+				startIcon={{ icon: EllipsisVertical }}
+				iconOnly
+			></Button>
+		{/snippet}
+	</DropdownV2>
+
+	<!-- A disabled <button> fires no pointer events, so a title/tooltip on it
 		     never shows on hover. pointer-events-none on the button lets the hover
 		     reach this titled wrapper instead. -->
-		<div
+	<div
+		title={newApp || savedApp?.no_deployed === true
+			? 'Deploy this app once to compare against the deployed version'
+			: 'Diff'}
+		class={!savedApp || newApp || savedApp?.no_deployed === true
+			? 'flex cursor-not-allowed'
+			: 'flex'}
+	>
+		<Button
+			variant="default"
+			unifiedSize={headerBtnSize}
+			on:click={() => openDiffDrawer()}
+			disabled={!savedApp || newApp || savedApp?.no_deployed === true}
+			btnClasses={!savedApp || newApp || savedApp?.no_deployed === true
+				? 'pointer-events-none'
+				: undefined}
+			iconOnly={compactTopbar}
 			title={newApp || savedApp?.no_deployed === true
 				? 'Deploy this app once to compare against the deployed version'
 				: 'Diff'}
-			class={!savedApp || newApp || savedApp?.no_deployed === true
-				? 'flex cursor-not-allowed'
-				: 'flex'}
+			startIcon={{ icon: DiffIcon }}
 		>
-			<Button
-				variant="default"
-				unifiedSize={headerBtnSize}
-				on:click={() => openDiffDrawer()}
-				disabled={!savedApp || newApp || savedApp?.no_deployed === true}
-				btnClasses={!savedApp || newApp || savedApp?.no_deployed === true
-					? 'pointer-events-none'
-					: undefined}
-				iconOnly={compactTopbar}
-				title={newApp || savedApp?.no_deployed === true
-					? 'Deploy this app once to compare against the deployed version'
-					: 'Diff'}
-				startIcon={{ icon: DiffIcon }}
-			>
-				Diff
-			</Button>
-		</div>
+			Diff
+		</Button>
+	</div>
 
-		<div class="{compactTopbar ? 'hidden' : 'hidden md:inline'} relative overflow-visible">
-			<Button
-				on:click={() => {
-					jobsDrawerOpen = true
-				}}
-				color="light"
-				unifiedSize={headerBtnSize}
-				variant="default"
-				btnClasses="relative"
-			>
-				<div class="flex flex-row gap-1 items-center">
-					<Bug size={14} />
-					<div>Jobs</div>
+	<div class="{compactTopbar ? 'hidden' : 'hidden md:inline'} relative overflow-visible">
+		<Button
+			on:click={() => {
+				jobsDrawerOpen = true
+			}}
+			color="light"
+			unifiedSize={headerBtnSize}
+			variant="default"
+			btnClasses="relative"
+		>
+			<div class="flex flex-row gap-1 items-center">
+				<Bug size={14} />
+				<div>Jobs</div>
 
-					<div class="text-2xs text-primary"
-						>({jobs?.length > 99 ? '99+' : (jobs?.length ?? 0)})</div
-					>
-				</div>
-			</Button>
-		</div>
-		<AppExportButton bind:this={appExport} />
+				<div class="text-2xs text-primary">({jobs?.length > 99 ? '99+' : (jobs?.length ?? 0)})</div>
+			</div>
+		</Button>
+	</div>
+	<!-- Draws nothing in the bar: it is the export drawer, opened from the menu's Export entry
+	     through this instance. -->
+	<AppExportButton bind:this={appExport} />
+	{#if !phoneTopbar}
 		<OpenInSessionButton source={sessionOpen}>
 			{#snippet fallback()}
 				<Button
@@ -1032,34 +1163,44 @@
 				</Button>
 			{/snippet}
 		</OpenInSessionButton>
-		<Button
-			loading={loading.save}
-			startIcon={{ icon: Save }}
-			on:click={save}
-			unifiedSize={headerBtnSize}
-			variant="accent"
-			dropdownItems={appPath != ''
-				? () => [
-						{
-							label: 'Fork',
-							onClick: () => {
-								window.open(`/apps/add?template=${appPath}`)
-							}
-						},
-						...(!isCloudHosted() && editInForkAllowed(opWorkspace, $userWorkspaces)
-							? [
-									{
-										label: editInForkLabel(opWorkspace, $userWorkspaces),
-										onClick: () => {
-											openEditInFork('raw_app', appPath, opWorkspace)
-										}
+	{/if}
+	<Button
+		loading={loading.save}
+		startIcon={{ icon: Save }}
+		on:click={save}
+		unifiedSize={headerBtnSize}
+		variant="accent"
+		dropdownItems={appPath != ''
+			? () => [
+					// `appPath`, not the live edited path: a rename that has not been deployed yet
+					// would land on a details page for something that does not exist.
+					...(newApp
+						? []
+						: [
+								{
+									label: 'Exit & see details',
+									onClick: () => onDetails?.({ path: appPath })
+								}
+							]),
+					{
+						label: 'Fork',
+						onClick: () => {
+							window.open(`/apps/add?template=${appPath}`)
+						}
+					},
+					...(!isCloudHosted() && editInForkAllowed(opWorkspace, $userWorkspaces)
+						? [
+								{
+									label: editInForkLabel(opWorkspace, $userWorkspaces),
+									onClick: () => {
+										openEditInFork('raw_app', appPath, opWorkspace)
 									}
-								]
-							: [])
-					]
-				: undefined}
-		>
-			Deploy
-		</Button>
-	</div>
-</div>
+								}
+							]
+						: [])
+				]
+			: undefined}
+	>
+		Deploy
+	</Button>
+{/snippet}
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
index 200e76d85b..ddbdae5bf3 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
@@ -15,6 +15,7 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import Tabs from '../common/tabs/Tabs.svelte'
 	import { Tab } from '../common'
+	import { SQL_LANGUAGES } from '$lib/infer'
 	import RawAppInputsSpecEditor from './RawAppInputsSpecEditor.svelte'
 	import SplitPanesWrapper from '../splitPanes/SplitPanesWrapper.svelte'
 	import SchemaForm from '../SchemaForm.svelte'
@@ -80,6 +81,13 @@
 					}
 	}
 
+	// A SQL argument named after a viewer property is most often a per-viewer filter,
+	// which only a ctx field protects. `wmill app lint` warns on the same names.
+	const VIEWER_IDENTITY_ARGS = ['username', 'email', 'groups']
+	let isSql = $derived(
+		isRunnableByName(runnable) && SQL_LANGUAGES.includes(runnable.inlineScript?.language ?? '')
+	)
+
 	let selectedTab = $state('test')
 	let args = $state({})
 	let hubFlowPreview: OpenFlow | undefined = $state(undefined)
@@ -266,6 +274,7 @@
 										documentationLink={meta?.['documentationLink']}
 										allowTypeChange={meta?.['allowTypeChange']}
 										displayType
+										suggestCtx={isSql && VIEWER_IDENTITY_ARGS.includes(k)}
 									/>
 								{/each}
 							</div>
diff --git a/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
index 67ead38501..859a693ca9 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
@@ -13,6 +13,7 @@
 	import { fieldTypeToTsType } from '../apps/utils'
 	import type { InputType } from '../apps/inputType'
 	import Select from '$lib/components/select/Select.svelte'
+	import { Alert } from '$lib/components/common'
 	import { userStore } from '$lib/stores'
 	import {
 		useOperatingUser,
@@ -67,6 +68,8 @@
 		allowTypeChange?: boolean
 		loading?: boolean
 		documentationLink?: string | undefined
+		/** Warn that this input, left as a frontend input, is open to any value a viewer sends. */
+		suggestCtx?: boolean
 	}
 
 	let {
@@ -85,7 +88,8 @@
 		displayType = false,
 		allowTypeChange = true,
 		loading = false,
-		documentationLink = undefined
+		documentationLink = undefined,
+		suggestCtx = false
 	}: Props = $props()
 
 	run(() => {
@@ -193,6 +197,11 @@
 			</div>
 		{:else if componentInput?.type === 'user' || componentInput?.type == undefined}
 			<span class="text-2xs italic text-primary">Field's value is a frontend input</span>
+			{#if suggestCtx}
+				<Alert type="warning" size="xs" title="A viewer can send any value">
+					If this identifies the viewer, switch it to context so the server fills it.
+				</Alert>
+			{/if}
 		{/if}
 		{#if componentInput?.type === 'user' && ((fieldType == 'object' && format?.startsWith('resource-') && format !== 'resource-s3_object') || fieldType == 'resource')}
 			<div class="flex flex-row items-center">
diff --git a/frontend/src/lib/components/raw_apps/RawAppPreview.svelte b/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
index fce55cf132..9eced2d0e6 100644
--- a/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
@@ -1,9 +1,15 @@
 <script lang="ts">
-	import { type UserExt } from '$lib/stores'
-	import RawAppBackgroundRunner from './RawAppBackgroundRunner.svelte'
+	import type { UserExt } from '$lib/stores'
+	import type RawAppBackgroundRunner from './RawAppBackgroundRunner.svelte'
 	import type { Runnable } from './rawAppPolicy'
 	import { getContext, onMount, untrack } from 'svelte'
-	import { unsandboxedRawAppHtml } from './utils'
+	import {
+		RAW_APP_SANDBOX_FLAGS,
+		applyRawAppStorageOp,
+		rawAppStorageKey,
+		readRawAppStorage,
+		unsandboxedRawAppHtml
+	} from './utils'
 	import { randomSecret } from '$lib/utils/uuid'
 
 	// Per-mount secret proving a `windmill:ready` came from the document we loaded.
@@ -27,8 +33,7 @@
 		syncHashToUrl?: boolean
 	}
 
-	let { workspace, user, secret, path, runnables, oniframe, syncHashToUrl = true }: Props =
-		$props()
+	let { workspace, user, secret, path, runnables, oniframe, syncHashToUrl = true }: Props = $props()
 	const pageHash = () => (syncHashToUrl ? window.location.hash : '')
 
 	$effect(() => {
@@ -40,6 +45,48 @@
 	})
 
 	let iframe = $state() as HTMLIFrameElement | undefined
+	// White behind apps that set no background of their own, but only once the document
+	// has loaded: before that it would flash under a dark app.
+	let loadedSrc: string | undefined = $state(undefined)
+
+	// The job bridge reaches the generated client and the app shell's stores, which the
+	// bundle's first paint does not need, so it loads alongside the bundle. Requests the
+	// bundle sends before it mounts are queued and handed over in order.
+	const runnerModule = import('./RawAppBackgroundRunner.svelte')
+	let runner: ReturnType<typeof RawAppBackgroundRunner> | undefined = $state()
+	let queuedForRunner: MessageEvent[] = []
+	$effect(() => {
+		if (!runner) return
+		const queued = queuedForRunner
+		queuedForRunner = []
+		for (const event of queued) runner.handleMessage(event)
+	})
+
+	// If the job bridge cannot load (offline, or a chunk a redeploy removed), the bundle
+	// still paints, so its requests are answered with an error rather than left pending.
+	let runnerFailed = false
+	let requestRefused = $state(false)
+	function refuseRequest(event: MessageEvent) {
+		const data = event.data
+		if (typeof data?.type !== 'string' || data.reqId === undefined) return
+		requestRefused = true
+		;(event.source as Window | null)?.postMessage(
+			{
+				type: data.type + 'Res',
+				reqId: data.reqId,
+				error: true,
+				result: { message: 'Could not load the app runtime, reload the page to try again' }
+			},
+			'*'
+		)
+	}
+	runnerModule.catch((e) => {
+		console.error('Could not load the raw app job bridge', e)
+		runnerFailed = true
+		const queued = queuedForRunner
+		queuedForRunner = []
+		for (const event of queued) refuseRequest(event)
+	})
 
 	// Get initial hash from parent URL to pass to the iframe
 	let initialHash = ''
@@ -59,11 +106,7 @@
 	// adding no isolation). The sandboxed path keeps the restrictive attribute; the
 	// wrapper document's `CSP: sandbox` response header enforces the opaque origin
 	// regardless.
-	let sandboxAttr = $derived(
-		unsandboxed
-			? undefined
-			: 'allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation'
-	)
+	let sandboxAttr = $derived(unsandboxed ? undefined : RAW_APP_SANDBOX_FLAGS)
 
 	// WIN-2006: source of the bundle iframe.
 	// - DEFAULT (isolated): a real API URL serving a sandboxed, opaque-origin
@@ -131,7 +174,7 @@
 	// Windmill embedder and would never answer the relay (leaving the bundle without
 	// ctx). The snapshot is handed to the bundle before it evaluates so its
 	// localStorage is hydrated synchronously.
-	const SHARED_LS_KEY = `wm_apps_localstorage:${workspace}:${path}`
+	const SHARED_LS_KEY = rawAppStorageKey(workspace, path)
 	function storageAccessible(): boolean {
 		try {
 			localStorage.getItem(SHARED_LS_KEY)
@@ -149,24 +192,6 @@
 	let pendingNonce: string | undefined = undefined
 	let pendingPort: MessagePort | undefined = undefined
 
-	function readDirect(): Record<string, string> {
-		try {
-			return JSON.parse(localStorage.getItem(SHARED_LS_KEY) || '{}')
-		} catch (_) {
-			return {}
-		}
-	}
-
-	function applyDirectOp(d: any) {
-		try {
-			const s = readDirect()
-			if (d.op === 'set') s[d.key] = String(d.value)
-			else if (d.op === 'remove') delete s[d.key]
-			else if (d.op === 'clear') for (const k in s) delete s[k]
-			localStorage.setItem(SHARED_LS_KEY, JSON.stringify(s))
-		} catch (_) {}
-	}
-
 	/** The nonce authenticates the asker: it lives in our URL, which a document
 	 * navigated into the frame can't read. Replying on the port that document
 	 * transferred then keeps the answer from landing in whatever document is
@@ -179,8 +204,9 @@
 		const payload = {
 			type: 'windmill:ctx',
 			// Same shape as the unsandboxed wrapper: always the object, so
-			// `window.ctx.workspace` works for anonymous viewers too.
-			ctx: { ctx: user, workspace },
+			// `window.ctx.workspace` works for anonymous viewers too. Snapshotted: a
+			// caller's `$state` user is a proxy, which postMessage cannot clone.
+			ctx: { ctx: $state.snapshot(user), workspace },
 			initialHash,
 			storage: { local: bundleStorage ?? {}, session: {} },
 			// The wrapper turns this into `window.process.env` before it injects the
@@ -234,7 +260,7 @@
 				const nonceEcho = typeof data.nonce === 'string' ? data.nonce : undefined
 				const port = event.ports?.[0]
 				if (!framed) {
-					bundleStorage = readDirect()
+					bundleStorage = readRawAppStorage(SHARED_LS_KEY)
 					respondCtx(nonceEcho, port)
 				} else if (bundleStorage !== undefined) {
 					respondCtx(nonceEcho, port)
@@ -246,7 +272,7 @@
 			} else if (data?.type === 'wm_ls_op') {
 				// The bundle mutated localStorage — apply it to the shared store.
 				if (!framed) {
-					applyDirectOp(data)
+					applyRawAppStorageOp(SHARED_LS_KEY, data)
 				} else {
 					try {
 						window.parent.postMessage(
@@ -255,12 +281,16 @@
 						)
 					} catch (_) {}
 				}
-			} else if (data?.type === 'windmill:hashchange' && syncHashToUrl) {
+			} else if (data?.type === 'windmill:hashchange') {
 				// Keep the parent URL hash in sync for shareable URLs.
 				const newHash = data.hash || ''
-				if (window.location.hash !== newHash) {
+				if (syncHashToUrl && window.location.hash !== newHash) {
 					history.replaceState(null, '', newHash || window.location.pathname)
 				}
+			} else if (runnerFailed) {
+				refuseRequest(event)
+			} else if (!runner) {
+				queuedForRunner.push(event)
 			}
 		}
 
@@ -269,14 +299,27 @@
 	})
 </script>
 
-<RawAppBackgroundRunner
-	{workspace}
-	editor={false}
-	{iframe}
-	{runnables}
-	{path}
-	gateJobIds={!unsandboxed}
-/>
+{#await runnerModule then { default: Runner }}
+	<Runner
+		bind:this={runner}
+		{workspace}
+		editor={false}
+		{iframe}
+		{runnables}
+		{path}
+		gateJobIds={!unsandboxed}
+	/>
+{:catch}
+	{#if requestRefused}
+		<!-- Styled inline: neither app.css nor another chunk can be counted on here. -->
+		<div
+			role="alert"
+			style="position: fixed; top: 12px; left: 50%; transform: translateX(-50%); z-index: 1000; padding: 8px 12px; border: 1px solid #fca5a5; border-radius: 6px; background: #fef2f2; color: #991b1b; font: 13px/1.4 system-ui, sans-serif"
+		>
+			Could not load the app runtime. Reload the page to try again.
+		</div>
+	{/if}
+{/await}
 
 {#if iframeSrc}
 	<!-- `unsandboxed` (the default — publisher did not opt into isolation) adds
@@ -286,12 +329,15 @@
 	<!-- referrerpolicy (sandboxed only, for exact legacy parity): the hosting page
 	     URL can carry a viewer credential (the JWT path segment of share links);
 	     without this, the bundle document would see it via document.referrer. -->
+	<!-- Styled inline: on the public app routes it renders before app.css, if ever, loads. -->
 	<iframe
 		bind:this={iframe}
 		title="raw-app"
 		src={iframeSrc}
 		sandbox={sandboxAttr}
 		referrerpolicy={unsandboxed ? undefined : 'no-referrer'}
-		class="w-full h-full min-h-screen bg-white border-none"
+		onload={() => (loadedSrc = iframeSrc)}
+		style="display: block; width: 100%; height: 100%; border: none"
+		style:background={loadedSrc === iframeSrc ? 'white' : 'transparent'}
 	></iframe>
 {/if}
diff --git a/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte b/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
index 1f28cd02c0..28940eb02a 100644
--- a/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
@@ -7,16 +7,19 @@
 	let {
 		scopes,
 		onContinue,
-		onDecline
+		onDecline,
+		declineLabel = 'Open without granting'
 	}: {
 		/** Scopes the app policy declares for its frontend SDK token. */
 		scopes: string[]
 		/** Fired when the viewer accepts; `dontAskAgain` persists the consent for
 		 * this app path so the prompt is skipped until the declared scopes grow. */
 		onContinue: (dontAskAgain: boolean) => void
-		/** Fired when the viewer declines: the app still renders, its frontend code
-		 * just gets no token (SDK calls fail). */
+		/** Fired when the viewer declines; no token is minted. */
 		onDecline: () => void
+		/** Says what declining does where the prompt is shown: the deployed app
+		 * still renders tokenless, the editor preview stays blocked. */
+		declineLabel?: string
 	} = $props()
 
 	let dontAskAgain = $state(false)
@@ -34,17 +37,17 @@
 		<ul class="flex flex-col gap-2">
 			{#each scopes as scope (scope)}
 				<li class="text-sm">
-					<span class="font-medium">{sdkScopeLabel(scope)}</span>
-					{#if sdkScopeDescription(scope)}
-						<span class="text-tertiary"> — {sdkScopeDescription(scope)}</span>
-					{/if}
+					<span class="font-medium">{sdkScopeLabel(scope)}</span
+					>{#if sdkScopeDescription(scope)}<span class="text-tertiary"
+							>: {sdkScopeDescription(scope)}</span
+						>{/if}
 				</li>
 			{/each}
 		</ul>
 		<div class="flex items-center justify-between gap-4 pt-2">
 			<Toggle bind:checked={dontAskAgain} size="xs" options={{ right: 'Do not ask again' }} />
 			<div class="flex items-center gap-2">
-				<Button variant="default" onclick={onDecline}>Open without granting</Button>
+				<Button variant="default" onclick={onDecline}>{declineLabel}</Button>
 				<Button variant="accent" onclick={() => onContinue(dontAskAgain)}>Continue</Button>
 			</div>
 		</div>
diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index 0afef7744d..a052e54f97 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -1,23 +1,31 @@
 <script lang="ts">
 	import { untrack } from 'svelte'
-	import { Sparkles, Plus, List, Ban, ExternalLinkIcon, Loader2 } from 'lucide-svelte'
-	import type { Policy } from '$lib/gen'
+	import {
+		Sparkles,
+		Plus,
+		List,
+		Ban,
+		ExternalLinkIcon,
+		Code,
+		Database,
+		Loader2
+	} from 'lucide-svelte'
+	import { WorkerService, type Policy } from '$lib/gen'
+	import MissingWorkerTagAlert from '$lib/components/jobs/MissingWorkerTagAlert.svelte'
+	import { hasWorkerForTag, queuedWithoutWorkerMessage } from '$lib/components/jobs/missingWorker'
 	import { superadmin, userStore } from '$lib/stores'
-	import { base } from '$lib/base'
 	import { sendUserToast } from '$lib/toast'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Select from '$lib/components/select/Select.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { Alert } from '$lib/components/common'
-	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
-	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
+	import { Alert, Badge } from '$lib/components/common'
 	import { copilotInfo, copilotWorkspace } from '$lib/aiStore'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
-	import { react18Template, react19Template, svelte5Template } from './templates'
+	import { BUILDER_FRAMEWORK_TEMPLATES, FRAMEWORK_TEMPLATES } from './templates'
+	import { conformBuilderAppPolicy } from './builderAppPolicy'
 	import type { Runnable } from './rawAppPolicy'
 	import {
 		type DataTableRef,
@@ -38,44 +46,48 @@
 	import RawAppDataTableDrawer from './RawAppDataTableDrawer.svelte'
 	import FileEditorIcon from './FileEditorIcon.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { useOperatorBuilderApps } from '$lib/operatorWriteRights'
+	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
 
 	export type RawAppTemplatePickerResult = {
 		files: Record<string, string>
 		runnables: Record<string, Runnable>
 		data: RawAppData
-		summary: string
 		policy: Policy
-		prompt?: string
 	}
 
+	/** Where the set-up app opens: `ai` hands it to the AI, `code` opens it in the editor. */
+	export type RawAppBuildMode = 'ai' | 'code'
+
 	let {
 		open = $bindable(),
 		onStart
 	}: {
 		open: boolean
-		onStart: (result: RawAppTemplatePickerResult, withPrompt: boolean) => void
+		onStart: (result: RawAppTemplatePickerResult, mode: RawAppBuildMode) => void
 	} = $props()
 
-	const templates = [
-		{ name: 'React 19', icon: 'tsx', files: react19Template },
-		{ name: 'React 18', icon: 'tsx', files: react18Template },
-		{ name: 'Svelte 5', icon: 'svelte', files: svelte5Template }
-	]
+	const templates = $derived.by(() => {
+		const files = $operatorBuilderApps ? BUILDER_FRAMEWORK_TEMPLATES : FRAMEWORK_TEMPLATES
+		return [
+			{ name: 'React 19', icon: 'tsx', files: files.react19, recommended: true },
+			{ name: 'React 18', icon: 'tsx', files: files.react18 },
+			{ name: 'Svelte 5', icon: 'svelte', files: files.svelte5 }
+		]
+	})
 
 	let selectedTemplateIndex = $state(0)
-	let tableCreationEnabled = $state(true)
 	let selectedDatatable = $state<string | undefined>(undefined)
 	let schemaMode = $state<'none' | 'new' | 'existing'>('new')
 	let selectedSchema = $state<string | undefined>(undefined)
 	let newSchemaName = $state('')
-	let appSummary = $state('')
-	let initialPrompt = $state('')
 	let preWhitelistedTables = $state<DataTableRef[]>([])
 	/** The role each pre-whitelisted table's data table was browsed as. */
 	let preWhitelistedRoles = $state<Record<string, string>>({})
 	let dataTableDrawer: RawAppDataTableDrawer | undefined = $state()
 
 	const operatingWorkspace = useOperatingWorkspace()
+	const operatorBuilderApps = useOperatorBuilderApps()
 	let opWs = $derived($operatingWorkspace)
 
 	const datatables = createDatatablesResource(() => opWs)
@@ -92,9 +104,7 @@
 		roles.current.workspace === opWs && roles.current.datatable === selectedDatatable
 	)
 	const loadedRoles = $derived(
-		rolesAnswered &&
-			selectedDatatable !== undefined &&
-			datatableNameTakesRole(selectedDatatable)
+		rolesAnswered && selectedDatatable !== undefined && datatableNameTakesRole(selectedDatatable)
 			? roles.current.roles
 			: []
 	)
@@ -183,11 +193,10 @@
 	const availableSchemas = $derived(accessSettled ? access.current.schemas : [])
 	const canCreateSchema = $derived(accessSettled && access.current.canCreateSchema)
 
-	// Only an app that keeps the data table is held back by it: with table creation off nothing
-	// saves it.
-	const blockedByRole = $derived(
-		(noUsableRole || rolesUnknown || accessUnknown) && tableCreationEnabled
-	)
+	const blockedByRole = $derived(noUsableRole || rolesUnknown || accessUnknown)
+	// A data table the caller cannot use is left out rather than blocking the app: it would be
+	// saved with queries the server refuses, and the app may need no data table at all.
+	const usableDatatable = $derived(blockedByRole ? undefined : selectedDatatable)
 
 	// A role that cannot create schemas has nothing to name, so the mode goes back to the one
 	// every role has, once that is an answer.
@@ -264,9 +273,6 @@
 	// would announce AI as unconfigured while it is merely unknown. Gate on the
 	// config describing opWs, and load it here so the claim owns its own evidence.
 	const aiConfigLoaded = $derived(!!opWs && $copilotWorkspace === opWs)
-	// Say where the button leads: the route hands this prompt to a fresh AI
-	// session for everyone who has one, and drives the docked chat for the rest.
-	const handsOffToSession = $derived(prefersSessionHandoff($userStore?.operator))
 	const isAiEnabled = $derived(aiConfigLoaded && $copilotInfo.enabled)
 
 	$effect(() => {
@@ -275,55 +281,18 @@
 		}
 	})
 
-	async function start(withPrompt: boolean) {
-		const template = templates[selectedTemplateIndex]
+	// With AI turned off for the workspace there is nothing to choose between. A builder is
+	// offered AI only through a session: the docked app mode writes inline code they cannot save.
+	const aiOffered = $derived(
+		!$copilotInfo.workspaceDisabled &&
+			(!$operatorBuilderApps || prefersSessionHandoff($userStore?.operator))
+	)
 
-		if (
-			tableCreationEnabled &&
-			schemaMode === 'new' &&
-			newSchemaName &&
-			selectedDatatable &&
-			opWs
-		) {
-			try {
-				const { dbSchemaOpsWithPreviewScripts } = await import('$lib/components/dbOps')
-				const dbOps = dbSchemaOpsWithPreviewScripts({
-					workspace: opWs,
-					input: {
-						type: 'database',
-						resourceType: 'postgresql',
-						resourcePath: `datatable://${selectedDatatable}`,
-						role: effectiveRole,
-						migrationRole: defaultMigrationRole(
-							selectedDatatable,
-							roles.current.permissioned,
-							roles.current.defaultRole
-						)
-					}
-				})
-				await dbOps.onCreateSchema({ schema: newSchemaName })
-			} catch (e) {
-				console.error('Failed to create schema:', e)
-				sendUserToast(`Failed to create schema: ${e}`, true)
-			}
-		}
-
-		const formattedTables = preWhitelistedTables.map(formatDataTableRef)
-		const keepsDatatable = tableCreationEnabled && selectedDatatable !== undefined
-		// The roles shown, for the data tables the app ends up using.
-		const usedDatatables = new Set(preWhitelistedTables.map((t) => t.datatable))
-		if (keepsDatatable) usedDatatables.add(selectedDatatable!)
-		const shownRoles = Object.entries(pickerRoles ?? {}).filter(([dt]) => usedDatatables.has(dt))
-		const appRoles = shownRoles.length > 0 ? Object.fromEntries(shownRoles) : undefined
-		const data: RawAppData = keepsDatatable
-			? {
-					tables: formattedTables,
-					datatable: selectedDatatable,
-					schema: effectiveSchema,
-					roles: appRoles
-				}
-			: { tables: formattedTables, datatable: undefined, schema: undefined, roles: appRoles }
+	const canStart = $derived(
+		!!templates[selectedTemplateIndex] && !newSchemaAlreadyExists && rolesSettled && accessSettled
+	)
 
+	function appPolicy(): Policy {
 		const policy: Policy = {
 			on_behalf_of: $userStore?.username.includes('@')
 				? $userStore?.username
@@ -331,6 +300,118 @@
 			on_behalf_of_email: $userStore?.email,
 			execution_mode: 'publisher'
 		}
+		if ($operatorBuilderApps) conformBuilderAppPolicy(policy, $userStore)
+		return policy
+	}
+
+	const startCardClasses =
+		'relative h-full flex-col items-start justify-start gap-1.5 rounded-lg p-3 text-left whitespace-normal'
+
+	async function createSchema(input: {
+		workspace: string
+		datatable: string
+		schema: string
+		role: string | undefined
+		migrationRole: string | undefined
+	}) {
+		try {
+			const { dbSchemaOpsWithPreviewScripts } = await import('$lib/components/dbOps')
+			const dbOps = dbSchemaOpsWithPreviewScripts({
+				workspace: input.workspace,
+				input: {
+					type: 'database',
+					resourceType: 'postgresql',
+					resourcePath: `datatable://${input.datatable}`,
+					role: input.role,
+					migrationRole: input.migrationRole
+				}
+			})
+			await dbOps.onCreateSchema({ schema: input.schema })
+		} catch (e) {
+			console.error('Failed to create schema:', e)
+			sendUserToast(`Failed to create schema ${input.schema}: ${e}`, true)
+		}
+	}
+
+	// The start that is in flight, and the schema it is waiting on: creating one is a job,
+	// which can sit in the queue long enough for a silent modal to look dead.
+	let starting = $state<{ mode: RawAppBuildMode; schema?: string } | undefined>(undefined)
+
+	const SCHEMA_JOB_TAG = 'postgresql'
+
+	/** Whether a worker can pick up the job that creates a schema. Only a definite "no"
+	 * counts: with per-workspace default tags the job runs on a variant of the tag, and a
+	 * failed lookup establishes nothing. */
+	async function schemaJobsServed(workspace: string): Promise<boolean> {
+		try {
+			if (await WorkerService.isDefaultTagsPerWorkspace()) return true
+			return await hasWorkerForTag(workspace, SCHEMA_JOB_TAG)
+		} catch {
+			return true
+		}
+	}
+
+	// Existing tables go with an existing schema: under the other modes the list is not shown,
+	// and what is not shown is not saved.
+	const tablesToUse = $derived(schemaMode === 'existing' ? preWhitelistedTables : [])
+
+	function exploreDatatable() {
+		dataTableDrawer?.openDrawer(
+			selectedDatatable
+				? {
+						datatable: selectedDatatable,
+						schema: schemaMode === 'existing' ? selectedSchema : undefined
+					}
+				: undefined
+		)
+	}
+
+	async function start(mode: RawAppBuildMode) {
+		if (starting) return
+		const template = templates[selectedTemplateIndex]
+
+		if (schemaMode === 'new' && newSchemaName && usableDatatable && opWs) {
+			starting = { mode, schema: newSchemaName }
+			const creation = createSchema({
+				workspace: opWs,
+				datatable: usableDatatable,
+				schema: newSchemaName,
+				role: effectiveRole,
+				migrationRole: defaultMigrationRole(
+					usableDatatable,
+					roles.current.permissioned,
+					roles.current.defaultRole
+				)
+			})
+			if (await schemaJobsServed(opWs)) {
+				await creation
+			} else {
+				// The job stays queued for as long as no worker serves its tag: waiting on it
+				// would hold the app back for nothing, so say why the schema is missing instead.
+				sendUserToast(
+					`Schema "${newSchemaName}" is not created yet. ${queuedWithoutWorkerMessage(SCHEMA_JOB_TAG)}`,
+					true
+				)
+			}
+		}
+
+		starting = undefined
+
+		const formattedTables = tablesToUse.map(formatDataTableRef)
+		const keepsDatatable = usableDatatable !== undefined
+		// The roles shown, for the data tables the app ends up using.
+		const usedDatatables = new Set(tablesToUse.map((t) => t.datatable))
+		if (keepsDatatable) usedDatatables.add(usableDatatable!)
+		const shownRoles = Object.entries(pickerRoles ?? {}).filter(([dt]) => usedDatatables.has(dt))
+		const appRoles = shownRoles.length > 0 ? Object.fromEntries(shownRoles) : undefined
+		const data: RawAppData = keepsDatatable
+			? {
+					tables: formattedTables,
+					datatable: usableDatatable,
+					schema: effectiveSchema,
+					roles: appRoles
+				}
+			: { tables: formattedTables, datatable: undefined, schema: undefined, roles: appRoles }
 
 		open = false
 		onStart(
@@ -338,11 +419,9 @@
 				files: template.files,
 				runnables: {},
 				data,
-				summary: appSummary.trim(),
-				policy,
-				prompt: withPrompt ? initialPrompt.trim() : undefined
+				policy: appPolicy()
 			},
-			withPrompt
+			mode
 		)
 	}
 </script>
@@ -353,32 +432,28 @@
 	     Modal closes its own UI but the picker's `open` prop stays true,
 	     so the route's `templatePicker → false` watcher never fires and
 	     autosave stays suspended after the dismissal. -->
-	<Modal kind="X" bind:open title="New App setup">
+	<Modal kind="X" bind:open title="New app">
 		<div class="flex flex-col gap-6 min-w-sm">
 			<div>
-				<h2 class="text-xs font-semibold text-emphasis mb-1">Summary</h2>
-				<TextInput
-					bind:value={appSummary}
-					inputProps={{
-						placeholder: "Brief description of the app (e.g., 'Todo list with authentication')"
-					}}
-				/>
-			</div>
-
-			<div class="pt-6">
-				<h2 class="text-xs font-semibold text-emphasis mb-1">Framework</h2>
+				<h2 class="text-xs font-semibold text-emphasis mb-3">Framework</h2>
 				<div class="flex flex-wrap gap-3">
 					{#each templates as t, i}
 						<button
 							onclick={() => (selectedTemplateIndex = i)}
-							class="w-24 h-24 flex justify-between py-5 flex-col {selectedTemplateIndex === i
+							class="relative w-20 h-[4.5rem] flex justify-between py-3 flex-col {selectedTemplateIndex ===
+							i
 								? 'bg-surface-accent-selected border border-accent'
 								: ''} hover:bg-surface-hover border rounded-lg transition-all"
 						>
 							<div class="w-full flex items-center justify-center">
-								<FileEditorIcon file={'.' + t.icon} size={32} />
+								<FileEditorIcon file={'.' + t.icon} size={22} />
 							</div>
-							<div class="center-center w-full text-sm text-secondary">{t.name}</div>
+							<div class="center-center w-full text-xs text-secondary">{t.name}</div>
+							{#if t.recommended}
+								<div class="absolute -top-3 left-1/2 -translate-x-1/2">
+									<Badge color="blue" small>Recommended</Badge>
+								</div>
+							{/if}
 						</button>
 					{/each}
 				</div>
@@ -407,6 +482,10 @@
 					</Alert>
 				{:else}
 					<div class="flex flex-col gap-4">
+						<MissingWorkerTagAlert
+							tag={SCHEMA_JOB_TAG}
+							subject="Data table queries and schema changes"
+						/>
 						<div class="flex flex-col gap-1">
 							<span class="text-xs text-secondary mb-1 block">Default settings for new tables</span>
 							<div class="flex flex-col gap-4 rounded-md p-4 border">
@@ -448,7 +527,8 @@
 														? 'could not read its roles'
 														: noUsableRole
 															? 'no role you can use'
-															: 'could not reach it'}
+															: 'could not reach it'}; the app is created without a default data
+													table
 												</span>
 											{/if}
 										</div>
@@ -485,6 +565,14 @@
 													{/snippet}
 												</ToggleButtonGroup>
 											</div>
+											<Button
+												variant="default"
+												unifiedSize="sm"
+												iconOnly
+												startIcon={{ icon: Database }}
+												title="Explore {selectedDatatable ?? 'the data table'}"
+												onclick={exploreDatatable}
+											/>
 											{#if schemaMode === 'new'}
 												<TextInput
 													bind:value={newSchemaName}
@@ -518,130 +606,130 @@
 							</div>
 						</div>
 
-						<div class="flex items-center">
-							<Toggle
-								size="sm"
-								bind:checked={tableCreationEnabled}
-								options={{ right: 'Allow AI to create new tables' }}
-							/>
-						</div>
-
-						<div class="pt-6">
-							<RawAppDataTableList
-								dataTableRefs={preWhitelistedTables}
-								defaultDatatable={selectedDatatable}
-								defaultSchema={effectiveSchema}
-								roles={pickerRoles}
-								standalone
-								hideDefaultSelector
-								onAdd={() => dataTableDrawer?.openDrawer()}
-								onRemove={(index) => {
-									preWhitelistedTables = preWhitelistedTables.filter((_, i) => i !== index)
-								}}
-							/>
-						</div>
+						{#if schemaMode === 'existing'}
+							<div class="pt-6">
+								<RawAppDataTableList
+									dataTableRefs={preWhitelistedTables}
+									defaultDatatable={selectedDatatable}
+									defaultSchema={effectiveSchema}
+									roles={pickerRoles}
+									standalone
+									hideDefaultSelector
+									onAdd={exploreDatatable}
+									onRemove={(index) => {
+										preWhitelistedTables = preWhitelistedTables.filter((_, i) => i !== index)
+									}}
+								/>
+							</div>
+						{/if}
 					</div>
 				{/if}
 			</div>
 
-			{#if !$copilotInfo.workspaceDisabled}
-				<div class="pt-6">
-					<h2 class="text-xs font-semibold text-emphasis mb-1 flex items-center gap-2">
-						<Sparkles size={16} class="text-ai" />
-						Start with AI
-						<span class="text-xs font-normal text-tertiary">(optional)</span>
-					</h2>
-
-					{#if !aiConfigLoaded}
-						<div class="flex items-center gap-2 text-xs text-tertiary">
-							<Loader2 size={14} class="animate-spin" />
-							Loading AI settings...
-						</div>
-					{:else if !isAiEnabled}
-						<Alert type="info" title="AI is not configured.">
-							You can still create an app manually but using AI is highly recommended.
-							<br />
-							{#if $userStore?.is_admin}
-								Configure AI in
-								<a
-									href="{base}/workspace_settings?tab=ai"
-									target="_blank"
-									class="inline-flex items-center gap-1 font-semibold"
-									>workspace settings <ExternalLinkIcon size={16} />
-								</a>
-								{#if $superadmin}
-									or
-									<a
-										href="{base}/?workspace=admins#superadmin-settings"
-										target="_blank"
-										class="inline-flex items-center gap-1 font-semibold"
-										>instance settings <ExternalLinkIcon size={16} />
-									</a>
-								{/if} to enable this feature.
-							{:else if $superadmin}
-								Configure AI in
-								<a
-									href="{base}/?workspace=admins#superadmin-settings"
-									target="_blank"
-									class="inline-flex items-center gap-1 font-semibold"
-									>instance settings <ExternalLinkIcon size={16} />
-								</a> to enable this feature.
-							{:else}
-								Ask your workspace admin to configure AI in workspace settings to enable this
-								feature.
-							{/if}
-						</Alert>
+			{#if aiOffered && aiConfigLoaded && !isAiEnabled}
+				<Alert type="info" title="AI is not configured.">
+					You can still create an app manually but using AI is highly recommended.
+					<br />
+					{#if $userStore?.is_admin}
+						Configure AI in
+						<a
+							href="/workspace_settings?tab=ai"
+							target="_blank"
+							class="inline-flex items-center gap-1 font-semibold"
+							>workspace settings <ExternalLinkIcon size={16} />
+						</a>
+						{#if $superadmin}
+							or
+							<a
+								href="/?workspace=admins#superadmin-settings"
+								target="_blank"
+								class="inline-flex items-center gap-1 font-semibold"
+								>instance settings <ExternalLinkIcon size={16} />
+							</a>
+						{/if} to enable this feature.
+					{:else if $superadmin}
+						Configure AI in
+						<a
+							href="/?workspace=admins#superadmin-settings"
+							target="_blank"
+							class="inline-flex items-center gap-1 font-semibold"
+							>instance settings <ExternalLinkIcon size={16} />
+						</a> to enable this feature.
 					{:else}
-						<div class="flex flex-col gap-2">
-							<TextInput
-								underlyingInputEl="textarea"
-								bind:value={initialPrompt}
-								inputProps={{
-									rows: 3,
-									placeholder:
-										"Describe what you want to build... (e.g., 'Create a todo list app with user authentication')"
-								}}
-							/>
-							<p class="text-xs text-tertiary">
-								{handsOffToSession
-									? 'Leave empty to start with a blank template, or describe your app to open an AI session that builds it.'
-									: 'Leave empty to start with a blank template, or describe your app to get AI assistance right away.'}
-							</p>
-						</div>
+						Ask your workspace admin to configure AI in workspace settings to enable this feature.
 					{/if}
-				</div>
+				</Alert>
 			{/if}
 
-			<div class="pt-6 flex justify-end gap-3">
-				<Button
-					variant="default"
-					size="sm"
-					on:click={() => start(false)}
-					disabled={!templates[selectedTemplateIndex] ||
-						newSchemaAlreadyExists ||
-						!rolesSettled ||
-						!accessSettled ||
-						blockedByRole}
-				>
-					{$copilotInfo.workspaceDisabled ? 'Start' : 'Start without AI'}
-				</Button>
-				{#if isAiEnabled}
+			{#if aiOffered}
+				<div class="pt-6 flex flex-col gap-2">
+					<div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+						<Button
+							variant="default"
+							onClick={() => start('ai')}
+							disabled={!canStart || !isAiEnabled || starting !== undefined}
+							btnClasses="{startCardClasses} border-ai/40 bg-ai/5 hover:bg-ai/10 disabled:opacity-50 disabled:cursor-not-allowed"
+						>
+							<span class="flex w-full items-center gap-2">
+								{#if !aiConfigLoaded || starting?.mode === 'ai'}
+									<Loader2 size={18} class="text-ai animate-spin" />
+								{:else}
+									<Sparkles size={18} class="text-ai" />
+								{/if}
+								<span class="text-sm font-semibold text-emphasis whitespace-nowrap"
+									>Start with AI</span
+								>
+							</span>
+							<span class="text-xs font-normal text-secondary">
+								Describe your app and let the AI build it.
+							</span>
+							<span class="absolute -top-3 right-3">
+								<Badge color="blue" small>Recommended</Badge>
+							</span>
+						</Button>
+						<Button
+							variant="default"
+							onClick={() => start('code')}
+							disabled={!canStart || starting !== undefined}
+							btnClasses="{startCardClasses} disabled:opacity-50 disabled:cursor-not-allowed"
+						>
+							<span class="flex w-full items-center gap-2">
+								{#if starting?.mode === 'code'}
+									<Loader2 size={18} class="text-primary animate-spin" />
+								{:else}
+									<Code size={18} class="text-primary" />
+								{/if}
+								<span class="text-sm font-semibold text-emphasis whitespace-nowrap">
+									Start with code editor
+								</span>
+							</span>
+							<span class="text-xs font-normal text-secondary">
+								Write the app yourself in the editor.
+							</span>
+						</Button>
+					</div>
+					<p class="text-xs text-center {starting?.schema ? 'text-secondary' : 'text-hint'}">
+						{starting?.schema
+							? `Creating schema ${starting.schema}…`
+							: 'You can always switch later.'}
+					</p>
+				</div>
+			{:else}
+				<div class="pt-6 flex items-center justify-end gap-3">
+					{#if starting?.schema}
+						<p class="mr-auto text-xs text-secondary">Creating schema {starting.schema}…</p>
+					{/if}
 					<Button
 						variant="accent"
-						on:click={() => start(true)}
-						disabled={!rolesSettled ||
-							!accessSettled ||
-							blockedByRole ||
-							!templates[selectedTemplateIndex] ||
-							!initialPrompt.trim() ||
-							newSchemaAlreadyExists}
-						startIcon={{ icon: Sparkles }}
-						btnClasses={AIBtnClasses('accent')}
+						unifiedSize="md"
+						onclick={() => start('code')}
+						loading={starting?.mode === 'code'}
+						disabled={!canStart || starting !== undefined}
 					>
-						{handsOffToSession ? 'Start in AI session' : 'Start with AI'}
+						Create app
 					</Button>
-				{/if}
-			</div>
+				</div>
+			{/if}
 		</div>
 	</Modal>
 {/if}
@@ -657,6 +745,8 @@
 			...refs
 		]
 		preWhitelistedRoles = { ...preWhitelistedRoles, ...browsedRoles }
+		// Tables picked while exploring are existing ones to use: show them.
+		if (refs.length > 0) schemaMode = 'existing'
 		if (selectedDatatable !== undefined && browsedRoles[selectedDatatable] !== undefined) {
 			selectedRole = browsedRoles[selectedDatatable]
 		}
diff --git a/frontend/src/lib/components/raw_apps/builderAppPolicy.test.ts b/frontend/src/lib/components/raw_apps/builderAppPolicy.test.ts
new file mode 100644
index 0000000000..b24f319240
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/builderAppPolicy.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest'
+import { conformBuilderAppPolicy } from './builderAppPolicy'
+
+const builder = { username: 'op', email: 'op@x.dev' }
+
+describe('conformBuilderAppPolicy', () => {
+	it('conforms a policy loaded from an app someone else deployed', () => {
+		const policy: Record<string, any> = {
+			sandbox: false,
+			execution_mode: 'viewer',
+			on_behalf_of: 'u/admin',
+			on_behalf_of_email: 'admin@x.dev'
+		}
+		conformBuilderAppPolicy(policy, builder)
+		expect(policy).toEqual({ sandbox: true, execution_mode: 'publisher' })
+	})
+
+	it("keeps the builder's own identity", () => {
+		const policy: Record<string, any> = {
+			sandbox: true,
+			on_behalf_of: 'u/op',
+			on_behalf_of_email: 'op@x.dev'
+		}
+		conformBuilderAppPolicy(policy, builder)
+		expect(policy).toEqual({ sandbox: true, on_behalf_of: 'u/op', on_behalf_of_email: 'op@x.dev' })
+	})
+})
diff --git a/frontend/src/lib/components/raw_apps/builderAppPolicy.ts b/frontend/src/lib/components/raw_apps/builderAppPolicy.ts
new file mode 100644
index 0000000000..967b56f971
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/builderAppPolicy.ts
@@ -0,0 +1,23 @@
+/**
+ * Brings a raw-app policy in line with what the backend requires of a draft from an operator with
+ * builder rights (see `docs/operator-builder-rights.md`): sandboxed, never in Viewer mode, and
+ * running as nobody but its builder. A policy loaded from an app someone else deployed carries
+ * their identity and may carry either of the other two, so every builder draft writer goes
+ * through this before saving. Writes only what differs, so it is safe inside an `$effect`.
+ */
+export function conformBuilderAppPolicy(
+	policy: Record<string, any>,
+	user: { username?: string; email?: string } | undefined
+): void {
+	if (policy.sandbox !== true) policy.sandbox = true
+	if (policy.execution_mode === 'viewer') policy.execution_mode = 'publisher'
+	const username = user?.username
+	const self = username?.includes('@') ? username : `u/${username}`
+	if (
+		(policy.on_behalf_of != undefined && policy.on_behalf_of !== self) ||
+		(policy.on_behalf_of_email != undefined && policy.on_behalf_of_email !== user?.email)
+	) {
+		delete policy.on_behalf_of
+		delete policy.on_behalf_of_email
+	}
+}
diff --git a/frontend/src/lib/components/raw_apps/sdkScopes.test.ts b/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
index 68aba9c545..f72918e311 100644
--- a/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
+++ b/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it } from 'vitest'
 
-import { hasStoredSdkConsent, storeSdkConsent } from './sdkScopes'
+import { hasStoredSdkConsent, movePreviewSdkConsent, storeSdkConsent } from './sdkScopes'
 
 describe('stored frontend SDK consent', () => {
 	beforeEach(() => localStorage.clear())
@@ -20,6 +20,17 @@ describe('stored frontend SDK consent', () => {
 		expect(hasStoredSdkConsent('a@w.dev', 'other', 'u/a/app', ['users:read'])).toBe(false)
 	})
 
+	it('keeps the editor preview and the deployed app apart, and moves preview consent', () => {
+		storeSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'], true)).toBe(false)
+		storeSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', ['users:read'], true)
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', ['users:read'])).toBe(false)
+
+		movePreviewSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', 'u/a/real')
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/real', ['users:read'], true)).toBe(true)
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/draft_1', ['users:read'], true)).toBe(false)
+	})
+
 	it('treats unreadable storage as no consent', () => {
 		localStorage.setItem('wm_sdk_consent:a@w.dev:ws:u/a/app', 'not json')
 		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])).toBe(false)
diff --git a/frontend/src/lib/components/raw_apps/sdkScopes.ts b/frontend/src/lib/components/raw_apps/sdkScopes.ts
index b0177bb660..238f1b7278 100644
--- a/frontend/src/lib/components/raw_apps/sdkScopes.ts
+++ b/frontend/src/lib/components/raw_apps/sdkScopes.ts
@@ -52,8 +52,17 @@ export function sdkScopeDescription(scope: string): string | undefined {
 // Keyed by viewer as well as app: this localStorage lives on the shared embedder
 // origin, so without the viewer one person's "do not ask again" would silently
 // suppress the prompt for the next person to use the same browser profile.
-function sdkConsentKey(viewer: string, workspace: string, path: string): string {
-	return `wm_sdk_consent:${viewer}:${workspace}:${path}`
+// `preview` keeps the editor's consent apart from the deployed app's: the editor
+// runs a draft nobody may have reviewed, so trust given to one is not trust given
+// to the other.
+function sdkConsentKey(viewer: string, workspace: string, path: string, preview: boolean): string {
+	return `wm_sdk_consent:${preview ? 'p:' : ''}${viewer}:${workspace}:${path}`
+}
+
+/** True when `approved` (a consent the viewer gave) covers every scope the app now
+ * declares. Fewer scopes need no new consent; one more does. */
+export function sdkConsentCovers(approved: unknown, scopes: string[]): boolean {
+	return Array.isArray(approved) && scopes.every((s) => approved.includes(s))
 }
 
 /** True when a previously stored "do not ask again" consent covers every
@@ -62,13 +71,14 @@ export function hasStoredSdkConsent(
 	viewer: string,
 	workspace: string,
 	path: string,
-	scopes: string[]
+	scopes: string[],
+	preview = false
 ): boolean {
 	try {
 		const stored = JSON.parse(
-			localStorage.getItem(sdkConsentKey(viewer, workspace, path)) ?? 'null'
+			localStorage.getItem(sdkConsentKey(viewer, workspace, path, preview)) ?? 'null'
 		)
-		return Array.isArray(stored) && scopes.every((s) => stored.includes(s))
+		return sdkConsentCovers(stored, scopes)
 	} catch (_) {
 		return false
 	}
@@ -78,9 +88,29 @@ export function storeSdkConsent(
 	viewer: string,
 	workspace: string,
 	path: string,
-	scopes: string[]
+	scopes: string[],
+	preview = false
 ): void {
 	try {
-		localStorage.setItem(sdkConsentKey(viewer, workspace, path), JSON.stringify(scopes))
+		localStorage.setItem(sdkConsentKey(viewer, workspace, path, preview), JSON.stringify(scopes))
+	} catch (_) {}
+}
+
+/** Follows the editor's app to its new path (first deploy of a draft, or a rename),
+ * so a stored "do not ask again" consent neither is asked again nor stays behind
+ * under the old path. A plain Continue is not stored and does not carry over. */
+export function movePreviewSdkConsent(
+	viewer: string,
+	workspace: string,
+	from: string,
+	to: string
+): void {
+	if (from === to) return
+	try {
+		const fromKey = sdkConsentKey(viewer, workspace, from, true)
+		const stored = localStorage.getItem(fromKey)
+		if (stored === null) return
+		localStorage.setItem(sdkConsentKey(viewer, workspace, to, true), stored)
+		localStorage.removeItem(fromKey)
 	} catch (_) {}
 }
diff --git a/frontend/src/lib/components/raw_apps/templates.ts b/frontend/src/lib/components/raw_apps/templates.ts
index d6df109262..00d7594386 100644
--- a/frontend/src/lib/components/raw_apps/templates.ts
+++ b/frontend/src/lib/components/raw_apps/templates.ts
@@ -1,5 +1,5 @@
 // The starter app is a tour of what a raw app can do: each card calls one of the
-// STARTER_RUNNABLES below through a different `./wmill` export. The three framework
+// STARTER_RUNNABLES below through a different `./wmill` export. The framework
 // variants share `indexCss` and must stay in step with each other and with the runnables.
 
 const reactIndex = `
@@ -13,7 +13,7 @@ root.render(<App/>);
 `
 
 const STATS_SAMPLE_TEXT =
-	'Windmill turns scripts into apps. Write the frontend in React, Svelte or Vue, and the backend in TypeScript, Python or any other supported language. Scripts run on workers, and the app calls them like functions.'
+	'Windmill turns scripts into apps. Write the frontend in React or Svelte, and the backend in TypeScript, Python or any other supported language. Scripts run on workers, and the app calls them like functions.'
 
 const appTsx = `import React, { useState } from 'react'
 import { backend, backendAsync, getJob, streamJob } from './wmill'
@@ -516,230 +516,6 @@ const app = mount(App, { target: document.getElementById("root")! });
 export default app;
 `
 
-const appVue = `<template>
-  <main class="app">
-    <header class="hero">
-      <span class="eyebrow">Windmill app{{ ctx.workspace ? ' · ' + ctx.workspace : '' }}</span>
-      <h1>{{ firstName ? 'Welcome, ' + firstName : 'Welcome' }}</h1>
-      <p class="muted">
-        A Vue frontend wired to backend runnables. Each card shows one thing an app can do.
-        Edit App.vue and the runnables to make it yours, or ask the AI to build on it.
-      </p>
-    </header>
-
-    <div class="grid">
-      <section class="card">
-        <div class="card-header">
-          <span class="card-step">1</span>
-          <div>
-            <h2>Call a backend runnable</h2>
-            <p class="muted">Runnables are scripts that run on Windmill workers. Call them like async functions; context fields add who is calling.</p>
-          </div>
-        </div>
-        <div class="card-body">
-          <form class="row" @submit.prevent="greet">
-            <input v-model="name" placeholder="Your name" />
-            <button type="submit" :disabled="greetLoading">{{ greetLoading ? 'Running...' : 'Run' }}</button>
-          </form>
-          <div class="output">
-            <span v-if="greetError" class="error">{{ greetError }}</span>
-            <template v-else-if="greeting">
-              <strong>{{ greeting.message }}</strong>
-              <span class="muted"> Ran at {{ new Date(greeting.ran_at).toLocaleTimeString() }}</span>
-            </template>
-            <span v-else class="muted">The result shows up here.</span>
-          </div>
-        </div>
-        <pre class="snippet"><code>const res = await backend.greet({ name })</code></pre>
-      </section>
-
-      <section class="card">
-        <div class="card-header">
-          <span class="card-step">2</span>
-          <div>
-            <h2>Use any language</h2>
-            <p class="muted">Each runnable picks its own language. This one is Python, called the same way.</p>
-          </div>
-        </div>
-        <div class="card-body">
-          <textarea rows="4" v-model="text"></textarea>
-          <div class="row">
-            <button @click="analyze" :disabled="statsLoading">
-              {{ statsLoading ? 'Analyzing...' : 'Analyze with Python' }}
-            </button>
-          </div>
-          <div v-if="statsError" class="output error">{{ statsError }}</div>
-          <div v-if="stats" class="stats">
-            <div><strong>{{ stats.words }}</strong><span class="muted">words</span></div>
-            <div><strong>{{ stats.sentences }}</strong><span class="muted">sentences</span></div>
-            <div><strong>{{ stats.characters }}</strong><span class="muted">characters</span></div>
-            <div class="tags">
-              <span v-for="word in stats.top_words" :key="word" class="tag">{{ word }}</span>
-            </div>
-          </div>
-        </div>
-        <pre class="snippet"><code>const stats = await backend.word_stats({ text })</code></pre>
-      </section>
-
-      <section class="card">
-        <div class="card-header">
-          <span class="card-step">3</span>
-          <div>
-            <h2>Run jobs in the background</h2>
-            <p class="muted">Start long jobs without blocking the UI, then poll their status. Start several at once.</p>
-          </div>
-        </div>
-        <div class="card-body">
-          <div class="row">
-            <button @click="startJob">Start a job</button>
-          </div>
-          <div v-if="jobsError" class="output error">{{ jobsError }}</div>
-          <ul class="jobs">
-            <li v-if="jobs.length === 0" class="muted">No jobs yet.</li>
-            <li v-for="job in jobs" :key="job.id">
-              <span :class="['pill', job.status]">{{ job.status }}</span>
-              <code :title="job.id">{{ job.id.slice(-8) }}</code>
-              <span class="muted">{{ job.seconds }}s</span>
-              <div class="bar">
-                <div :class="['bar-fill', job.status]" :style="{ animationDuration: job.seconds + 's' }"></div>
-              </div>
-            </li>
-          </ul>
-        </div>
-        <pre class="snippet"><code>const id = await backendAsync.slow_task({ seconds })
-const job = await getJob(id)</code></pre>
-      </section>
-
-      <section class="card">
-        <div class="card-header">
-          <span class="card-step">4</span>
-          <div>
-            <h2>Stream results</h2>
-            <p class="muted">A runnable can yield its output bit by bit. Render it as it arrives, like an LLM answer.</p>
-          </div>
-        </div>
-        <div class="card-body">
-          <div class="row">
-            <button @click="stream" :disabled="streaming">{{ streaming ? 'Streaming...' : 'Start streaming' }}</button>
-          </div>
-          <div class="output stream">
-            <span v-if="streamError" class="error">{{ streamError }}</span>
-            <template v-else-if="streamed || streaming">
-              {{ streamed }}<span v-if="streaming" class="caret"></span>
-            </template>
-            <span v-else class="muted">Streamed text shows up here.</span>
-          </div>
-        </div>
-        <pre class="snippet"><code>await streamJob(id, (u) => append(u.new_result_stream))</code></pre>
-      </section>
-    </div>
-  </main>
-</template>
-
-<script setup>
-import { ref } from 'vue'
-import { backend, backendAsync, getJob, streamJob } from './wmill'
-
-// Windmill injects the viewer (absent for anonymous visitors) and the workspace.
-const ctx = window.ctx ?? {}
-const firstName = (ctx.ctx?.name || ctx.ctx?.username || '').split(' ')[0]
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
-
-function errorMessage(e) {
-  return e?.message ?? (typeof e === 'string' ? e : JSON.stringify(e))
-}
-
-// 1. Call a backend runnable
-const name = ref(firstName || 'world')
-const greeting = ref()
-const greetError = ref()
-const greetLoading = ref(false)
-
-async function greet() {
-  greetLoading.value = true
-  greetError.value = undefined
-  try {
-    greeting.value = await backend.greet({ name: name.value })
-  } catch (e) {
-    greetError.value = errorMessage(e)
-  }
-  greetLoading.value = false
-}
-
-// 2. Use any language
-const text = ref(${JSON.stringify(STATS_SAMPLE_TEXT)})
-const stats = ref()
-const statsError = ref()
-const statsLoading = ref(false)
-
-async function analyze() {
-  statsLoading.value = true
-  statsError.value = undefined
-  try {
-    stats.value = await backend.word_stats({ text: text.value })
-  } catch (e) {
-    statsError.value = errorMessage(e)
-  }
-  statsLoading.value = false
-}
-
-// 3. Run jobs in the background
-const jobs = ref([])
-const jobsError = ref()
-
-function setStatus(id, status) {
-  const row = jobs.value.find((r) => r.id === id)
-  if (row) row.status = status
-}
-
-async function startJob() {
-  jobsError.value = undefined
-  try {
-    const seconds = 2 + Math.floor(Math.random() * 4)
-    const id = await backendAsync.slow_task({ seconds })
-    jobs.value = [{ id, seconds, status: 'queued' }, ...jobs.value].slice(0, 4)
-    while (true) {
-      await sleep(500)
-      const job = await getJob(id)
-      if (job.type === 'CompletedJob') {
-        setStatus(id, job.success ? 'success' : 'failure')
-        return
-      }
-      setStatus(id, job.started_at ? 'running' : 'queued')
-    }
-  } catch (e) {
-    jobsError.value = errorMessage(e)
-  }
-}
-
-// 4. Stream results
-const streamed = ref('')
-const streamError = ref()
-const streaming = ref(false)
-
-async function stream() {
-  streamed.value = ''
-  streamError.value = undefined
-  streaming.value = true
-  try {
-    const id = await backendAsync.stream_text({})
-    await streamJob(id, (update) => {
-      if (update.new_result_stream) streamed.value += update.new_result_stream
-    })
-  } catch (e) {
-    streamError.value = errorMessage(e)
-  }
-  streaming.value = false
-}
-</script>`
-
-const indexVue = `import { createApp } from 'vue'
-import App from './App.vue'
-import "./index.css";
-
-createApp(App).mount('#root')`
-
 const indexCss = `/* The app renders inside an iframe whose host page has its own theme the
    iframe cannot read, so paint an opaque surface here: without one the host's
    background shows through and dark text lands on it unreadable. */
@@ -1158,27 +934,279 @@ export const svelte5Template = {
 }`
 }
 
-export const vueTemplate = {
-	'/index.ts': indexVue,
-	'/App.vue': appVue,
-	'/index.css': indexCss,
-	'/package.json': `{
-    "dependencies": {
-        "core-js": "3.26.1",
-        "vue": "3.5.13"
-    }
-}`
-}
-
 export const FRAMEWORK_TEMPLATES = {
 	react19: react19Template,
 	react18: react18Template,
-	svelte5: svelte5Template,
-	vue: vueTemplate
+	svelte5: svelte5Template
 }
 
 export type FrameworkKey = keyof typeof FRAMEWORK_TEMPLATES
 
+// An operator with builder rights gets no STARTER_RUNNABLES (they are inline code), so their
+// starter calls nothing and explains how to wire runnables already deployed in the workspace.
+const BUILDER_USES = [
+	{
+		title: 'Forms for your scripts',
+		text: 'Give a script a simple form, so anyone can run it without learning Windmill.'
+	},
+	{
+		title: 'Dashboards',
+		text: 'Show what a script or flow returns as a table or a chart, fresh every time the app opens.'
+	},
+	{
+		title: 'Self-service tools',
+		text: 'Share the app with your team or by link. It runs its scripts as you, so viewers need no access to them.'
+	}
+]
+
+const BUILDER_SAFETY =
+	'Your app can only run scripts and flows already deployed in this workspace, and it runs isolated from each viewer’s session.'
+
+const BUILDER_STEPS = [
+	{
+		title: 'Pick what it runs',
+		description: 'Choose a script or flow already deployed in this workspace.',
+		path: ['Backend panel', '+', 'Select a script or flow'],
+		note: 'You only see the ones you can read. Each one gets an id, such as a.'
+	},
+	{
+		title: 'Show it on the page',
+		description: 'Each runnable becomes a function the page can call by its id.',
+		note: 'Working with an AI assistant? Tell it the id and what to show. This is the line it writes.',
+		code: "import { backend } from './wmill'\n\nconst res = await backend.a({ name: 'world' })"
+	},
+	{
+		title: 'Run long jobs in the background',
+		description: 'backendAsync starts a job without making the page wait.',
+		note: 'Check on it with getJob, or follow its output as it runs with streamJob.',
+		code: "import { backendAsync, getJob } from './wmill'\n\nconst id = await backendAsync.a({ name: 'world' })\nconst job = await getJob(id)"
+	}
+]
+
+const BUILDER_CONTEXT_CODE = 'const ctx = (window as any).ctx\n\nctx.workspace, ctx.ctx?.username'
+
+const builderAppTsx = `import React from 'react'
+import './index.css'
+
+// Windmill injects the viewer (absent for anonymous visitors) and the workspace.
+const ctx = (window as any).ctx ?? {}
+const viewer: { name?: string; username?: string } | undefined = ctx.ctx
+const firstName = (viewer?.name || viewer?.username || '').split(' ')[0]
+
+type Step = { title: string; description: string; note: string; path?: string[]; code?: string }
+
+const uses: { title: string; text: string }[] = ${JSON.stringify(BUILDER_USES, null, 2)}
+
+const steps: Step[] = ${JSON.stringify(BUILDER_STEPS, null, 2)}
+
+const sectionTitle: React.CSSProperties = {
+  margin: '32px 0 12px',
+  fontSize: 12,
+  fontWeight: 600,
+  letterSpacing: '0.06em',
+  textTransform: 'uppercase',
+  color: 'var(--muted)'
+}
+
+function Card(props: { step: number; title: string; description: string; code?: string; children: React.ReactNode }) {
+  return (
+    <section className="card">
+      <div className="card-header">
+        <span className="card-step">{props.step}</span>
+        <div>
+          <h2>{props.title}</h2>
+          <p className="muted">{props.description}</p>
+        </div>
+      </div>
+      <div className="card-body">{props.children}</div>
+      {props.code && (
+        <pre className="snippet">
+          <code>{props.code}</code>
+        </pre>
+      )}
+    </section>
+  )
+}
+
+const App = () => {
+  return (
+    <main className="app">
+      <header className="hero">
+        <span className="eyebrow">Windmill app{ctx.workspace ? ' · ' + ctx.workspace : ''}</span>
+        <h1>{firstName ? 'Welcome, ' + firstName : 'Welcome'}</h1>
+        <p className="muted">
+          Turn the scripts and flows deployed in this workspace into a tool anyone can use. Edit
+          App.tsx to make it yours.
+        </p>
+      </header>
+      <h2 style={sectionTitle}>What you can build</h2>
+      <div className="grid" style={{ gridTemplateColumns: 'repeat(auto-fit, minmax(min(100%, 240px), 1fr))' }}>
+        {uses.map((use) => (
+          <section className="card" key={use.title} style={{ padding: 18, gap: 4 }}>
+            <h2 style={{ fontSize: 15 }}>{use.title}</h2>
+            <p className="muted" style={{ margin: 0 }}>{use.text}</p>
+          </section>
+        ))}
+      </div>
+      <p style={{ margin: '12px 0 0', padding: '10px 14px', borderRadius: 8, background: 'var(--accent-soft)', color: 'var(--fg-strong)' }}>
+        {${JSON.stringify(BUILDER_SAFETY)}}
+      </p>
+      <h2 style={sectionTitle}>How it works</h2>
+      <div className="grid">
+        {steps.map((step, i) => (
+          <Card key={step.title} step={i + 1} title={step.title} description={step.description} code={step.code}>
+            {step.path && (
+              <div className="row" style={{ alignItems: 'center', flexWrap: 'wrap' }}>
+                {step.path.map((label, j) => (
+                  <React.Fragment key={label}>
+                    {j > 0 && <span className="muted">→</span>}
+                    <span className="eyebrow">{label}</span>
+                  </React.Fragment>
+                ))}
+              </div>
+            )}
+            <span className="muted">{step.note}</span>
+          </Card>
+        ))}
+        <Card
+          step={steps.length + 1}
+          title="Know who is viewing"
+          description="Windmill passes the workspace and the viewer to the app."
+          code={${JSON.stringify(BUILDER_CONTEXT_CODE)}}
+        >
+          {ctx.workspace ? (
+            <>
+              <div>
+                <span className="muted">Workspace </span>
+                <strong>{ctx.workspace}</strong>
+              </div>
+              <div>
+                <span className="muted">Viewer </span>
+                <strong>{viewer ? viewer.name || viewer.username : 'Anonymous visitor'}</strong>
+              </div>
+            </>
+          ) : (
+            <span className="muted">The editor preview has no viewer. Deploy the app to see yours here.</span>
+          )}
+        </Card>
+      </div>
+    </main>
+  )
+}
+
+export default App
+`
+
+const builderAppSvelte = `<script lang="ts">
+  // Windmill injects the viewer (absent for anonymous visitors) and the workspace.
+  const ctx = (window as any).ctx ?? {}
+  const viewer: { name?: string; username?: string } | undefined = ctx.ctx
+  const firstName = (viewer?.name || viewer?.username || '').split(' ')[0]
+
+  type Step = { title: string; description: string; note: string; path?: string[]; code?: string }
+
+  const uses: { title: string; text: string }[] = ${JSON.stringify(BUILDER_USES, null, 2)}
+  const steps: Step[] = ${JSON.stringify(BUILDER_STEPS, null, 2)}
+  const contextCode = ${JSON.stringify(BUILDER_CONTEXT_CODE)}
+</script>
+
+{#snippet header(step: number, title: string, description: string)}
+  <div class="card-header">
+    <span class="card-step">{step}</span>
+    <div>
+      <h2>{title}</h2>
+      <p class="muted">{description}</p>
+    </div>
+  </div>
+{/snippet}
+
+<main class="app">
+  <header class="hero">
+    <span class="eyebrow">Windmill app{ctx.workspace ? ' · ' + ctx.workspace : ''}</span>
+    <h1>{firstName ? 'Welcome, ' + firstName : 'Welcome'}</h1>
+    <p class="muted">
+      Turn the scripts and flows deployed in this workspace into a tool anyone can use. Edit
+      App.svelte to make it yours.
+    </p>
+  </header>
+
+  <h2 class="section-title">What you can build</h2>
+  <div class="grid" style="grid-template-columns: repeat(auto-fit, minmax(min(100%, 240px), 1fr))">
+    {#each uses as use (use.title)}
+      <section class="card" style="padding: 18px; gap: 4px">
+        <h2 style="font-size: 15px">{use.title}</h2>
+        <p class="muted" style="margin: 0">{use.text}</p>
+      </section>
+    {/each}
+  </div>
+  <p class="safety">{${JSON.stringify(BUILDER_SAFETY)}}</p>
+
+  <h2 class="section-title">How it works</h2>
+  <div class="grid">
+    {#each steps as step, i (step.title)}
+      <section class="card">
+        {@render header(i + 1, step.title, step.description)}
+        <div class="card-body">
+          {#if step.path}
+            <div class="row" style="align-items: center; flex-wrap: wrap">
+              {#each step.path as label, j (label)}
+                {#if j > 0}<span class="muted">→</span>{/if}
+                <span class="eyebrow">{label}</span>
+              {/each}
+            </div>
+          {/if}
+          <span class="muted">{step.note}</span>
+        </div>
+        {#if step.code}
+          <pre class="snippet"><code>{step.code}</code></pre>
+        {/if}
+      </section>
+    {/each}
+
+    <section class="card">
+      {@render header(steps.length + 1, 'Know who is viewing', 'Windmill passes the workspace and the viewer to the app.')}
+      <div class="card-body">
+        {#if ctx.workspace}
+          <div><span class="muted">Workspace </span><strong>{ctx.workspace}</strong></div>
+          <div>
+            <span class="muted">Viewer </span>
+            <strong>{viewer ? viewer.name || viewer.username : 'Anonymous visitor'}</strong>
+          </div>
+        {:else}
+          <span class="muted">The editor preview has no viewer. Deploy the app to see yours here.</span>
+        {/if}
+      </div>
+      <pre class="snippet"><code>{contextCode}</code></pre>
+    </section>
+  </div>
+</main>
+
+<style>
+  .section-title {
+    margin: 32px 0 12px;
+    font-size: 12px;
+    font-weight: 600;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    color: var(--muted);
+  }
+
+  .safety {
+    margin: 12px 0 0;
+    padding: 10px 14px;
+    border-radius: 8px;
+    background: var(--accent-soft);
+    color: var(--fg-strong);
+  }
+</style>
+`
+
+export const BUILDER_FRAMEWORK_TEMPLATES = {
+	react19: { ...react19Template, '/App.tsx': builderAppTsx },
+	react18: { ...react18Template, '/App.tsx': builderAppTsx },
+	svelte5: { ...svelte5Template, '/App.svelte': builderAppSvelte }
+}
+
 type StarterArg = { type: 'string' | 'number' }
 
 function inlineRunnable(
@@ -1286,171 +1314,6 @@ export async function main() {
 	}
 }
 
-export const appVueRouter = `
-<template>
-  <div class="container">
-    <!-- Navigation tabs -->
-    <nav class="tabs">
-      <button 
-        v-for="tab in tabs" 
-        :key="tab.id"
-        :class="{ active: currentTab === tab.id }"
-        @click="changeTab(tab.id)"
-      >
-        {{ tab.name }}
-      </button>
-    </nav>
-
-    <!-- Content sections -->
-    <div class="content">
-      <div v-if="currentTab === 'home'" class="tab-content">
-        <h2>Home</h2>
-        <p>Welcome to the home tab!</p>
-        <!-- Nested navigation example -->
-        <div class="sub-nav">
-          <button 
-            v-for="subItem in ['latest', 'popular']" 
-            :key="subItem"
-            :class="{ active: currentSort === subItem }"
-            @click="changeSort(subItem)"
-          >
-            {{ subItem }}
-          </button>
-        </div>
-      </div>
-
-      <div v-else-if="currentTab === 'about'" class="tab-content">
-        <h2>About</h2>
-        <p>This is the about section</p>
-      </div>
-
-      <div v-else-if="currentTab === 'contact'" class="tab-content">
-        <h2>Contact</h2>
-        <p>Contact information here</p>
-      </div>
-    </div>
-
-    <!-- Debug info -->
-    <div class="debug">
-      <p>Current Tab: {{ currentTab }}</p>
-      <p>Current Sort: {{ currentSort }}</p>
-      <p>Current Hash: {{ currentHash }}</p>
-    </div>
-  </div>
-</template>
-
-<script setup>
-import { ref, onMounted, onUnmounted } from 'vue';
-
-// Available tabs
-const tabs = [
-  { id: 'home', name: 'Home' },
-  { id: 'about', name: 'About' },
-  { id: 'contact', name: 'Contact' }
-];
-
-const currentTab = ref('home');
-const currentSort = ref('latest');
-const currentHash = ref('');
-
-// Navigation functions
-function changeTab(tabId) {
-  currentTab.value = tabId;
-  updateHash();
-}
-
-function changeSort(sort) {
-  currentSort.value = sort;
-  updateHash();
-}
-
-function updateHash() {
-  const params = new URLSearchParams();
-  params.set('tab', currentTab.value);
-  if (currentSort.value !== 'latest') {
-    params.set('sort', currentSort.value);
-  }
-  window.location.hash = params.toString();
-  currentHash.value = window.location.hash;
-}
-
-function parseHash() {
-  const params = new URLSearchParams(window.location.hash.slice(1));
-  currentTab.value = params.get('tab') || 'home';
-  currentSort.value = params.get('sort') || 'latest';
-  currentHash.value = window.location.hash;
-}
-
-// Hash change handler
-function handleHashChange() {
-  parseHash();
-}
-
-onMounted(() => {
-  if (window.location.hash) {
-    parseHash();
-  } else {
-    updateHash();
-  }
-  window.addEventListener('hashchange', handleHashChange);
-});
-
-onUnmounted(() => {
-  window.removeEventListener('hashchange', handleHashChange);
-});
-</script>
-
-<style scoped>
-.container {
-  max-width: 800px;
-  margin: 0 auto;
-  padding: 20px;
-}
-
-.tabs {
-  display: flex;
-  gap: 10px;
-  margin-bottom: 20px;
-}
-
-button {
-  padding: 8px 16px;
-  border: 1px solid #ddd;
-  background: #fff;
-  border-radius: 4px;
-  cursor: pointer;
-}
-
-button.active {
-  background: #4CAF50;
-  color: white;
-  border-color: #4CAF50;
-}
-
-.content {
-  padding: 20px;
-  border: 1px solid #ddd;
-  border-radius: 4px;
-}
-
-.tab-content {
-  margin-bottom: 20px;
-}
-
-.sub-nav {
-  margin-top: 10px;
-}
-
-.debug {
-  margin-top: 20px;
-  padding: 10px;
-  background: #f5f5f5;
-  border-radius: 4px;
-  font-size: 0.9em;
-  color: #666;
-}
-</style>`
-
 export const appSvelteRouter = `
 <script>
 import { onMount, onDestroy } from 'svelte';
diff --git a/frontend/src/lib/components/raw_apps/utils.ts b/frontend/src/lib/components/raw_apps/utils.ts
index 6b34fe7973..3070572785 100644
--- a/frontend/src/lib/components/raw_apps/utils.ts
+++ b/frontend/src/lib/components/raw_apps/utils.ts
@@ -92,6 +92,8 @@ export type RawAppPreviewLogs = {
 	/** Files were sent to the UI Builder and its build has not reported back in time. */
 	buildPending: boolean
 	buildLogs: string
+	/** The app is held back until the user answers its SDK permission prompt, so it is not running. */
+	sdkConsentPending: boolean
 }
 export type RawAppRuntimeLogRequester = (limit: number) => Promise<RawAppPreviewLogs>
 
@@ -236,6 +238,38 @@ export function formatAppRunsForChat(runs: RawAppRunSummary[]): string {
 	return JSON.stringify(runs, null, 2)
 }
 
+/** `sandbox` attribute of a sandbox-isolated app's frame, deployed or in the editor preview. */
+export const RAW_APP_SANDBOX_FLAGS =
+	'allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation'
+
+/** Envelope type for a sandboxed pop-out's relayed messages. */
+export const RAW_APP_PREVIEW_RELAY = 'wm:previewRelay'
+
+/** Where a sandboxed app's (shimmed) localStorage persists, per app. The editor
+ * preview has its own store, so testing in it never touches the deployed app's data. */
+export function rawAppStorageKey(workspace: string, path: string, preview = false): string {
+	return `wm_apps_localstorage:${preview ? 'p:' : ''}${workspace}:${path}`
+}
+
+export function readRawAppStorage(storeKey: string): Record<string, string> {
+	try {
+		return JSON.parse(localStorage.getItem(storeKey) || '{}')
+	} catch (_) {
+		return {}
+	}
+}
+
+/** Applies one `wm_ls_op` relayed by a sandboxed app's storage shim. */
+export function applyRawAppStorageOp(storeKey: string, d: any) {
+	try {
+		const s = readRawAppStorage(storeKey)
+		if (d.op === 'set') s[d.key] = String(d.value)
+		else if (d.op === 'remove') delete s[d.key]
+		else if (d.op === 'clear') for (const k in s) delete s[k]
+		localStorage.setItem(storeKey, JSON.stringify(s))
+	} catch (_) {}
+}
+
 // The sandboxed (isolated) raw-app wrapper is generated server-side and served as
 // a sandboxed, opaque-origin document (see `get_raw_app_data` in the backend
 // `apps.rs`, WIN-2006) — a blob: URL cannot carry the `CSP: sandbox` response
@@ -260,6 +294,9 @@ export function unsandboxedRawAppHtml(
 <head>
 	<meta charset="UTF-8" />
 	<title>App</title>
+	<!-- Before the app's own stylesheet, so a bundle that wants a margin can still set one: the
+	     browser default of 8px would otherwise frame every app with a gap it never asked for. -->
+	<style>html, body { margin: 0; }</style>
 	<link rel="stylesheet" href="${baseUrl}/api/w/${workspace}/apps_u/get_data/v/${secret}.css" />
 	<script>
 		window.ctx = ${ctx ? JSON.stringify(ctx).replace(/</g, '\\u003c') : 'undefined'};
diff --git a/frontend/src/lib/components/resources/ResourcesList.svelte b/frontend/src/lib/components/resources/ResourcesList.svelte
index 687682fd4f..2b0cc5eb1e 100644
--- a/frontend/src/lib/components/resources/ResourcesList.svelte
+++ b/frontend/src/lib/components/resources/ResourcesList.svelte
@@ -44,8 +44,8 @@
 	import { OauthService, ResourceService, WorkspaceService, type ListableResource } from '$lib/gen'
 	import { enterpriseLicense, userWorkspaces } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import {
-		canWrite,
 		classNames,
 		debounce,
 		emptySchema,
@@ -96,6 +96,7 @@
 
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
+	const editRights = useEditRights()
 	const hosted = useHostedPage()
 
 	type ResourceW = ListableResource & { canWrite: boolean; marked?: string }
@@ -334,7 +335,7 @@
 		const result = (await ResourceService.listResource(apiParams)).map((x) => {
 			return {
 				canWrite:
-					canWrite(x.path, x.extra_perms!, operatingUser.current) &&
+					editRights.canEditItem('resource', x.path, x.extra_perms) &&
 					$operatingWorkspace! == x.workspace_id,
 				...x
 			}
diff --git a/frontend/src/lib/components/runs/DispatchEventsTable.svelte b/frontend/src/lib/components/runs/DispatchEventsTable.svelte
index 828437fee6..144a2d52e1 100644
--- a/frontend/src/lib/components/runs/DispatchEventsTable.svelte
+++ b/frontend/src/lib/components/runs/DispatchEventsTable.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import type { ListDispatchEventsResponse } from '$lib/gen'
 	import { ExternalLink, Check, Hourglass, MinusCircle } from 'lucide-svelte'
 
@@ -66,7 +65,7 @@
 					{#if ev.outcome === 'dispatched' && ev.child_job_id}
 						<a
 							class="inline-flex items-center gap-1"
-							href={`${base}/run/${ev.child_job_id}?workspace=${workspace}`}
+							href={`/run/${ev.child_job_id}?workspace=${workspace}`}
 							target="_blank"
 							rel="noopener noreferrer"
 						>
diff --git a/frontend/src/lib/components/runs/JobDetailHeader.svelte b/frontend/src/lib/components/runs/JobDetailHeader.svelte
index fb7a8890fc..9a1aed6145 100644
--- a/frontend/src/lib/components/runs/JobDetailHeader.svelte
+++ b/frontend/src/lib/components/runs/JobDetailHeader.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { JobService, type Job } from '$lib/gen'
-	import { base } from '$lib/base'
 	import {
 		displayDate,
 		truncateRev,
@@ -260,14 +259,14 @@
 				<Tooltip>
 					{#snippet text()}
 						This job was run on worker:
-						<a href={`${base}/runs/?job_kinds=all&worker=${job?.worker}`}>
+						<a href={`/runs/?job_kinds=all&worker=${job?.worker}`}>
 							{job?.worker}
 						</a>
 						<br />
 						<WorkerHostname worker={job.worker!} minTs={job?.['created_at']} />
 					{/snippet}
 					<a
-						href={`${base}/runs/?job_kinds=all&worker=${job?.worker}`}
+						href={`/runs/?job_kinds=all&worker=${job?.worker}`}
 						target="_blank"
 						rel="noopener noreferrer"
 						class="flex items-center gap-1 text-primary"
@@ -304,7 +303,7 @@
 				Triggered by
 			{/if}
 			<a
-				href={`${base}/run/${job.parent_job}?workspace=${$operatingWorkspace}`}
+				href={`/run/${job.parent_job}?workspace=${$operatingWorkspace}`}
 				target="_blank"
 				rel="noopener noreferrer"
 				class="flex items-center gap-1"
@@ -324,7 +323,7 @@
 						icon: Link,
 						action: () =>
 							navigator.clipboard.writeText(
-								`${window.location.origin}${base}/run/${job.id}?workspace=${job.workspace_id}`
+								`${window.location.origin}/run/${job.id}?workspace=${job.workspace_id}`
 							)
 					},
 					{
@@ -385,7 +384,7 @@
 						<span class="text-secondary flex-shrink-0">Job ID</span>
 						<span class="text-primary">
 							<a
-								href={`${base}/run/${job.id}?workspace=${job.workspace_id}`}
+								href={`/run/${job.id}?workspace=${job.workspace_id}`}
 								target="_blank"
 								rel="noopener noreferrer"
 								class="flex items-center gap-1 min-w-0"
@@ -476,7 +475,7 @@
 								{@const stem = job.job_kind === 'script' ? 'scripts' : 'flows'}
 								{@const isScript = job.job_kind === 'script'}
 								{@const viewHref = isScript
-									? `${base}/${stem}/get/${job?.script_hash}`
+									? `/${stem}/get/${job?.script_hash}`
 									: flowPathToHref(job?.script_path ?? '')}
 								<a
 									href={viewHref}
@@ -632,7 +631,7 @@
 								<span class="text-secondary flex-shrink-0">Job ID</span>
 								<span class="text-primary">
 									<a
-										href={`${base}/run/${job.id}?workspace=${job.workspace_id}`}
+										href={`/run/${job.id}?workspace=${job.workspace_id}`}
 										target="_blank"
 										rel="noopener noreferrer"
 										class="flex items-center gap-1 min-w-0"
diff --git a/frontend/src/lib/components/runs/RunBadges.svelte b/frontend/src/lib/components/runs/RunBadges.svelte
index 668521b429..3568eb5c14 100644
--- a/frontend/src/lib/components/runs/RunBadges.svelte
+++ b/frontend/src/lib/components/runs/RunBadges.svelte
@@ -2,7 +2,6 @@
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
 	import PreprocessedArgsDisplay from '$lib/components/runs/PreprocessedArgsDisplay.svelte'
 	import { getJobKindDisplayLabel, truncateHash } from '$lib/utils'
-	import { base } from '$lib/base'
 	import { truncateRev } from '$lib/utils'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -35,7 +34,7 @@
 
 {#if job.script_hash && showScriptHash && job.job_kind !== 'aiagent'}
 	{#if job.job_kind == 'script'}
-		<a href="{base}/scripts/get/{job.script_hash}?workspace={$operatingWorkspace}"
+		<a href="/scripts/get/{job.script_hash}?workspace={$operatingWorkspace}"
 			><Badge color="gray" title={`Script hash: ${job.script_hash}`} {large}
 				>{truncateHash(job.script_hash)}
 			</Badge></a
@@ -109,7 +108,7 @@
 					</Button>
 				{:else}
 					<a
-						href={`${base}/runs/?job_kinds=all&graph=ConcurrencyChart&concurrency_key=${concurrencyKey}`}
+						href={`/runs/?job_kinds=all&graph=ConcurrencyChart&concurrency_key=${concurrencyKey}`}
 					>
 						{concurrencyKey}
 					</a>
@@ -121,7 +120,7 @@
 				</button>
 			{:else}
 				<a
-					href={`${base}/runs/?job_kinds=all&graph=ConcurrencyChart&concurrency_key=${concurrencyKey}`}
+					href={`/runs/?job_kinds=all&graph=ConcurrencyChart&concurrency_key=${concurrencyKey}`}
 				>
 					<Badge {large}>Concurrency: {truncateRev(concurrencyKey, 20)}</Badge>
 				</a>
diff --git a/frontend/src/lib/components/runs/RunRow.svelte b/frontend/src/lib/components/runs/RunRow.svelte
index 959ee2fd06..34eed8e3c6 100644
--- a/frontend/src/lib/components/runs/RunRow.svelte
+++ b/frontend/src/lib/components/runs/RunRow.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { goto } from '$lib/navigation'
 	import type { Job } from '$lib/gen'
 	import {
@@ -166,12 +165,12 @@
 							{/if}
 							{#if job && job.is_flow_step && job.parent_job}
 								<br /> Step of flow
-								<a href={`${base}/run/${job.parent_job}?workspace=${job.workspace_id}`}>
+								<a href={`/run/${job.parent_job}?workspace=${job.workspace_id}`}>
 									{truncateRev(job.parent_job, 10)}
 								</a>
 							{:else if job && job.parent_job}
 								<br /> Parent
-								<a href={`${base}/run/${job.parent_job}?workspace=${job.workspace_id}`}>
+								<a href={`/run/${job.parent_job}?workspace=${job.workspace_id}`}>
 									{truncateRev(job.parent_job, 10)}
 								</a>
 							{/if}
@@ -322,7 +321,7 @@
 		<div class="flex justify-end pr-2">
 			<a
 				target="_blank"
-				href="{base}/run/{job.id}?workspace={job.workspace_id}"
+				href="/run/{job.id}?workspace={job.workspace_id}"
 				class={twMerge(
 					'text-right float-right  px-2',
 					selected ? 'text-accent' : 'text-secondary hover:text-accent'
diff --git a/frontend/src/lib/components/runs/RunsQueue.svelte b/frontend/src/lib/components/runs/RunsQueue.svelte
index 2cd2914878..4fbfe8842d 100644
--- a/frontend/src/lib/components/runs/RunsQueue.svelte
+++ b/frontend/src/lib/components/runs/RunsQueue.svelte
@@ -28,7 +28,9 @@
 	{#if small}
 		<Popover contentClasses="p-4" openOnHover debounceDelay={100}>
 			{#snippet trigger()}
-				<div class="relative">
+				<!-- mr-2: the count badge hangs half outside this box, so the margin — not the row's
+				     gap — is what keeps it off whatever sits to the right. -->
+				<div class="relative mr-2">
 					<ServerCog size={16} />
 					{#if queue_count && ($queue_count ?? 0) > 0}
 						<div
@@ -49,14 +51,11 @@
 	{/if}
 
 	{#if small}
-		<Popover
-			contentClasses="p-4"
-			openOnHover
-			debounceDelay={100}
-			disablePopup={!suspended_count || ($suspended_count ?? 0) <= 0}
-		>
+		<!-- The icon is on the bar whatever the count, so it answers a hover whatever the count —
+		     a disabled trigger takes no pointer events and reads as a dead icon. -->
+		<Popover contentClasses="p-4" openOnHover debounceDelay={100}>
 			{#snippet trigger()}
-				<div class="relative">
+				<div class="relative mr-2">
 					<Hourglass size={16} />
 					<div
 						class="absolute top-0 right-0 translate-x-1/2 -translate-y-1/2 bg-surface-secondary-inverse rounded-full text-primary-inverse text-2xs h-4 min-w-4 px-1"
@@ -69,7 +68,7 @@
 				{@render suspendedContent()}
 			{/snippet}
 		</Popover>
-	{:else}
+	{:else if suspended_count && ($suspended_count ?? 0) > 0}
 		{@render suspendedContent()}
 	{/if}
 </div>
@@ -103,28 +102,28 @@
 {/snippet}
 
 {#snippet suspendedContent()}
-	{#if suspended_count && ($suspended_count ?? 0) > 0}
-		<RunOption label="Suspended">
-			{#snippet tooltip()}
-				Jobs waiting for an event or approval before being resumed
-			{/snippet}
-			<div
-				class={suspended_count && ($suspended_count ?? 0) > 0
-					? 'bg-surface-secondary-inverse text-primary-inverse rounded-full min-w-6 h-6 flex center-center'
-					: ''}>{suspended_count ? ($suspended_count ?? 0).toFixed(0) : '...'}</div
-			>
-			<div class="truncate text-2xs !text-secondary">
-				<Button unifiedSize="md" variant="subtle" on:click={() => onJobsSuspended?.()}>
-					{#if success == 'suspended'}
-						<div class="flex flex-row items-center gap-1">
-							Reset filter
-							<X size={12} />
-						</div>
-					{:else}
-						<ListFilterPlus size={14} />
-					{/if}
-				</Button>
-			</div>
-		</RunOption>
-	{/if}
+	<RunOption label="Suspended">
+		{#snippet tooltip()}
+			Jobs waiting for an event or approval before being resumed
+		{/snippet}
+		<div
+			class={suspended_count && ($suspended_count ?? 0) > 0
+				? 'bg-surface-secondary-inverse text-primary-inverse rounded-full min-w-6 h-6 flex center-center'
+				: ''}
+		>
+			{suspended_count ? ($suspended_count ?? 0).toFixed(0) : '...'}
+		</div>
+		<div class="truncate text-2xs !text-secondary">
+			<Button unifiedSize="md" variant="subtle" on:click={() => onJobsSuspended?.()}>
+				{#if success == 'suspended'}
+					<div class="flex flex-row items-center gap-1">
+						Reset filter
+						<X size={12} />
+					</div>
+				{:else}
+					<ListFilterPlus size={14} />
+				{/if}
+			</Button>
+		</div>
+	</RunOption>
 {/snippet}
diff --git a/frontend/src/lib/components/runs/RunsTable.svelte b/frontend/src/lib/components/runs/RunsTable.svelte
index cb76daeeb3..479c785943 100644
--- a/frontend/src/lib/components/runs/RunsTable.svelte
+++ b/frontend/src/lib/components/runs/RunsTable.svelte
@@ -81,6 +81,7 @@
 				if (nextJob?.type === 'date') nextJob = flatJobs?.[idx + (key === 'ArrowDown' ? 2 : -2)]
 				if (nextJob?.type !== 'job') return
 				selectedIds = [nextJob.job.id]
+				dispatch('select')
 				e.preventDefault()
 			}
 		}
diff --git a/frontend/src/lib/components/runs/TimeframeSelect.svelte b/frontend/src/lib/components/runs/TimeframeSelect.svelte
index f8d2b0df71..7daa75f5fa 100644
--- a/frontend/src/lib/components/runs/TimeframeSelect.svelte
+++ b/frontend/src/lib/components/runs/TimeframeSelect.svelte
@@ -3,7 +3,8 @@
 		type Timeframe,
 		buildManualTimeframe,
 		serviceLogsTimeframes,
-		runsTimeframes
+		runsTimeframes,
+		auditTimeframes
 	} from './timeframes'
 	import { type Timeframe, buildManualTimeframe } from './timeframes'
 
@@ -77,7 +78,7 @@
 
 <script lang="ts">
 	import { CalendarIcon, RefreshCw } from 'lucide-svelte'
-	import { Button } from '../common'
+	import { Button, type ButtonType } from '../common'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import Popover from '../meltComponents/Popover.svelte'
@@ -94,9 +95,18 @@
 		value: Timeframe
 		wrapperClasses?: string
 		onClick?: () => void
+		/** Sizes the three buttons of the control itself; the presets inside the popover keep md. */
+		unifiedSize?: ButtonType.UnifiedSize
 	}
 
-	let { loading = false, onClick, items, value = $bindable(), wrapperClasses }: Props = $props()
+	let {
+		loading = false,
+		onClick,
+		items,
+		value = $bindable(),
+		wrapperClasses,
+		unifiedSize = 'md'
+	}: Props = $props()
 
 	let isOpen = $state(false)
 
@@ -141,7 +151,7 @@
 
 <div class="relative flex {wrapperClasses}">
 	<Button
-		unifiedSize="md"
+		{unifiedSize}
 		wrapperClasses="flex-1"
 		btnClasses="!rounded-r-none whitespace-nowrap"
 		onClick={() => onClick?.()}
@@ -154,7 +164,7 @@
 	{#if value.type === 'manual'}
 		<Button
 			btnClasses="!rounded-none border-l-0"
-			unifiedSize="md"
+			{unifiedSize}
 			onClick={() => (value = { ...items[0] })}
 		>
 			Reset
@@ -168,7 +178,7 @@
 	>
 		{#snippet trigger()}
 			<Button
-				unifiedSize="md"
+				{unifiedSize}
 				iconOnly
 				btnClasses="!rounded-l-none border-l-0"
 				endIcon={{ icon: CalendarIcon }}
diff --git a/frontend/src/lib/components/runs/jobsWindowScan.test.ts b/frontend/src/lib/components/runs/jobsWindowScan.test.ts
new file mode 100644
index 0000000000..4d56756028
--- /dev/null
+++ b/frontend/src/lib/components/runs/jobsWindowScan.test.ts
@@ -0,0 +1,140 @@
+import { describe, it, expect } from 'vitest'
+import { CancelablePromise, type Job } from '$lib/gen'
+import { scanJobWindows, type JobWindow } from './jobsWindowScan'
+
+const HOUR = 60 * 60 * 1000
+const NOW = Date.parse('2026-01-10T00:00:00.000Z')
+
+function job(at: number): Job {
+	return { type: 'CompletedJob', id: `j${at}`, created_at: new Date(at).toISOString() } as Job
+}
+
+// A history the scan can only read through its windows: `at` are the creation times of the
+// matching jobs, and a window wider than `slowOver` never answers.
+function history(at: number[], slowOver = Infinity) {
+	const windows: JobWindow[] = []
+	const fetchWindow = (w: JobWindow) => {
+		windows.push(w)
+		const lo = Date.parse(w.after)
+		const hi = w.before ? Date.parse(w.before) : Infinity
+		if (hi - lo > slowOver) return new CancelablePromise<Job[]>(() => {})
+		const rows = at
+			.filter((t) => t >= lo && t <= hi)
+			.sort((a, b) => b - a)
+			.slice(0, w.limit)
+			.map(job)
+		return new CancelablePromise<Job[]>((resolve) => resolve(rows))
+	}
+	return { windows, fetchWindow }
+}
+
+describe('scanJobWindows', () => {
+	it('lists every match down to the oldest job, in order, without a gap between windows', async () => {
+		const at = [NOW - 2 * HOUR, NOW - 30 * HOUR, NOW - 200 * HOUR]
+		const { windows, fetchWindow } = history(at)
+		const seen: Job[] = []
+		const wentToEnd = await scanJobWindows({
+			before: new Date(NOW).toISOString(),
+			after: null,
+			pageSize: 10,
+			oldest: async () => new Date(NOW - 240 * HOUR).toISOString(),
+			fetchWindow,
+			onWindow: (jobs) => seen.push(...jobs)
+		})
+		expect(wentToEnd).toBe(true)
+		expect(seen.map((j) => j.id)).toEqual(at.map((t) => `j${t}`))
+		expect(windows.at(-1)!.after).toBe(new Date(NOW - 240 * HOUR).toISOString())
+	})
+
+	it('counts a job created exactly on a window bound once', async () => {
+		// The first window is an hour wide, so its lower bound is the first job's creation time.
+		const at = [NOW - HOUR, NOW - 2 * HOUR, NOW - 100 * HOUR]
+		const { fetchWindow } = history(at)
+		const seen: Job[] = []
+		const wentToEnd = await scanJobWindows({
+			before: new Date(NOW).toISOString(),
+			after: new Date(NOW - 240 * HOUR).toISOString(),
+			pageSize: 2,
+			oldest: async () => undefined,
+			fetchWindow,
+			onWindow: (jobs) => seen.push(...jobs)
+		})
+		expect(wentToEnd).toBe(false)
+		expect(seen.map((j) => j.id)).toEqual([`j${NOW - HOUR}`, `j${NOW - 2 * HOUR}`])
+	})
+
+	it('still lists the window of a cursor that sits on the oldest job', async () => {
+		const oldest = NOW - 240 * HOUR
+		const { windows, fetchWindow } = history([oldest])
+		const seen: Job[] = []
+		const before = new Date(oldest).toISOString().replace('Z', '500Z')
+		const wentToEnd = await scanJobWindows({
+			before,
+			after: null,
+			pageSize: 10,
+			oldest: async () => new Date(oldest).toISOString(),
+			fetchWindow,
+			onWindow: (jobs) => seen.push(...jobs)
+		})
+		expect(wentToEnd).toBe(true)
+		expect(windows).toEqual([{ before, after: new Date(oldest).toISOString(), limit: 10 }])
+		expect(seen.map((j) => j.id)).toEqual([`j${oldest}`])
+	})
+
+	it('stops as soon as the page is full, asking each window only for what is missing', async () => {
+		const at = [NOW - 0.5 * HOUR, NOW - 2 * HOUR, NOW - 3 * HOUR, NOW - 100 * HOUR]
+		const { windows, fetchWindow } = history(at)
+		const seen: Job[] = []
+		const wentToEnd = await scanJobWindows({
+			before: new Date(NOW).toISOString(),
+			after: new Date(NOW - 240 * HOUR).toISOString(),
+			pageSize: 3,
+			oldest: async () => undefined,
+			fetchWindow,
+			onWindow: (jobs) => seen.push(...jobs)
+		})
+		expect(wentToEnd).toBe(false)
+		expect(seen).toHaveLength(3)
+		expect(windows.map((w) => w.limit)).toEqual([3, 2])
+	})
+
+	it('gives up when narrower windows are no faster', async () => {
+		// Every window costs the same whatever its width, as with an index that ignores the bounds.
+		const windows: JobWindow[] = []
+		const fetchWindow = (w: JobWindow) => {
+			windows.push(w)
+			return new CancelablePromise<Job[]>((resolve) => setTimeout(() => resolve([]), 30))
+		}
+		await expect(
+			scanJobWindows({
+				before: new Date(NOW).toISOString(),
+				after: new Date(NOW - 240 * HOUR).toISOString(),
+				pageSize: 10,
+				oldest: async () => undefined,
+				fetchWindow,
+				onWindow: () => {},
+				targetMs: 10,
+				patienceMs: 1000
+			})
+		).rejects.toThrow('too slow')
+		expect(windows.length).toBeLessThan(10)
+	})
+
+	it('retries a window that does not answer in time with a narrower one', async () => {
+		const at = [NOW - 0.2 * HOUR, NOW - 0.9 * HOUR]
+		const { windows, fetchWindow } = history(at, 0.5 * HOUR)
+		const seen: Job[] = []
+		const wentToEnd = await scanJobWindows({
+			before: new Date(NOW).toISOString(),
+			after: new Date(NOW - HOUR).toISOString(),
+			pageSize: 10,
+			oldest: async () => undefined,
+			fetchWindow,
+			onWindow: (jobs) => seen.push(...jobs),
+			patienceMs: 5
+		})
+		expect(wentToEnd).toBe(true)
+		expect(seen.map((j) => j.id)).toEqual(at.map((t) => `j${t}`))
+		expect(windows.length).toBeGreaterThan(2)
+	})
+})
diff --git a/frontend/src/lib/components/runs/jobsWindowScan.ts b/frontend/src/lib/components/runs/jobsWindowScan.ts
new file mode 100644
index 0000000000..c273edbceb
--- /dev/null
+++ b/frontend/src/lib/components/runs/jobsWindowScan.ts
@@ -0,0 +1,139 @@
+import { CancelablePromise, type Job } from '$lib/gen'
+
+// A window is sized so that listing it takes about this long: short enough that the scan keeps
+// reporting progress, long enough that a sparse history is not crossed one round trip at a time.
+const TARGET_MS = 2000
+// Past this the window is dropped and retried narrower. The server keeps running a dropped
+// query until its own statement timeout, so it has to be rare: a window grows by at most
+// MAX_STEP per round, which keeps a well-sized one under PATIENCE_MS = MAX_STEP * TARGET_MS.
+const MAX_STEP = 4
+const PATIENCE_MS = MAX_STEP * TARGET_MS
+const INITIAL_WIDTH_MS = 60 * 60 * 1000
+const MIN_WIDTH_MS = 60 * 1000
+
+function nextWindowWidth(widthMs: number, elapsedMs: number, targetMs: number): number {
+	const step = Math.min(MAX_STEP, Math.max(1 / MAX_STEP, targetMs / Math.max(elapsedMs, 1)))
+	return Math.max(MIN_WIDTH_MS, widthMs * step)
+}
+
+// A window's cost is expected to follow its width. It does not when the database answers it
+// from an index that ignores the time bounds (another filter's own index, or no index leading
+// with the sort column): every window then costs a pass over the whole history, and scanning
+// would multiply the load it exists to bound.
+function tooSlow(): Error {
+	return new Error(
+		`Listing the jobs of a single ${MIN_WIDTH_MS / 1000}s window is too slow. Narrow the filters.`
+	)
+}
+
+export interface JobWindow {
+	/** Upper bound, absent on a window that starts at the newest job. */
+	before?: string
+	after: string
+	limit: number
+}
+
+export interface JobWindowScan {
+	/** Upper bound of the scan, sent as is on the first window. null starts at the newest job. */
+	before: string | null
+	/** Lower bound of the scan. null ends it at the oldest job, as given by `oldest`. */
+	after: string | null
+	pageSize: number
+	oldest: () => Promise<string | undefined>
+	fetchWindow: (w: JobWindow) => CancelablePromise<Job[]>
+	/** `fraction` is the share of the scan's time range listed so far. */
+	onWindow: (jobs: Job[], scannedTo: string, fraction: number) => void
+	targetMs?: number
+	patienceMs?: number
+}
+
+const SLOW = Symbol('slow')
+
+// Both bounds of a window are inclusive on the server, whose timestamps have microsecond
+// precision. A window therefore ends one microsecond before the previous one started: sharing
+// the bound would list a job created exactly on it twice, and count it twice toward the page.
+function justBefore(ms: number): string {
+	return new Date(ms - 1).toISOString().replace('Z', '999Z')
+}
+
+/**
+ * Lists the completed jobs of a time range newest first, one bounded window after the other,
+ * which is the same page a single request over the whole range returns, except that no request
+ * has to scan more history than the server allows one to. Resolves to whether the range was
+ * scanned to its end, false meaning the page filled up first.
+ */
+export function scanJobWindows(scan: JobWindowScan): CancelablePromise<boolean> {
+	const targetMs = scan.targetMs ?? TARGET_MS
+	const patienceMs = scan.patienceMs ?? PATIENCE_MS
+	return new CancelablePromise<boolean>((resolve, reject, onCancel) => {
+		let current: CancelablePromise<Job[]> | undefined
+		onCancel(() => current?.cancel())
+
+		async function fetchWithPatience(w: JobWindow): Promise<Job[] | typeof SLOW> {
+			const request = scan.fetchWindow(w)
+			current = request
+			let timer: ReturnType<typeof setTimeout> | undefined
+			const slow = new Promise<typeof SLOW>((r) => (timer = setTimeout(() => r(SLOW), patienceMs)))
+			try {
+				const res = await Promise.race([request, slow])
+				if (res === SLOW) {
+					request.catch(() => {})
+					request.cancel()
+				}
+				return res
+			} finally {
+				clearTimeout(timer)
+			}
+		}
+
+		async function run(): Promise<boolean> {
+			const floorTs = scan.after ?? (await scan.oldest())
+			if (!floorTs) return true
+			const floor = new Date(floorTs).getTime()
+			let upper = scan.before ? new Date(scan.before).getTime() : Date.now()
+			const start = upper
+			let first = true
+			let width = INITIAL_WIDTH_MS
+			let listed = 0
+			// The first window is listed even when the scan starts at its floor: the bounds are
+			// inclusive, and jobs sharing the cursor's timestamp may still be missing from the page.
+			while (first || upper > floor) {
+				if (onCancel.isCancelled) return false
+				const lower = Math.min(upper, Math.max(floor, upper - width))
+				const w: JobWindow = {
+					before: first ? (scan.before ?? undefined) : justBefore(upper),
+					after: new Date(lower).toISOString(),
+					limit: scan.pageSize - listed
+				}
+				const startedAt = Date.now()
+				let res: Job[] | typeof SLOW
+				try {
+					res = await fetchWithPatience(w)
+				} catch (e) {
+					// A window the server refused to finish is retried narrower like a slow one.
+					if (onCancel.isCancelled || width <= MIN_WIDTH_MS) throw e
+					res = SLOW
+				}
+				if (res === SLOW) {
+					if (width <= MIN_WIDTH_MS) throw tooSlow()
+					// Well below what the elapsed time suggests: each dropped window is one more
+					// statement left running on the server, so the retry has to land.
+					width = Math.max(MIN_WIDTH_MS, width / (MAX_STEP * MAX_STEP))
+					continue
+				}
+				const completed = res.filter((j) => j.type === 'CompletedJob').length
+				scan.onWindow(res, w.after, start > floor ? (start - lower) / (start - floor) : 1)
+				if (completed >= w.limit) return false
+				listed += completed
+				upper = lower
+				first = false
+				const elapsed = Date.now() - startedAt
+				if (width <= MIN_WIDTH_MS && elapsed > targetMs && upper > floor) throw tooSlow()
+				width = nextWindowWidth(width, elapsed, targetMs)
+			}
+			return true
+		}
+
+		run().then(resolve, reject)
+	})
+}
diff --git a/frontend/src/lib/components/runs/timeframes.ts b/frontend/src/lib/components/runs/timeframes.ts
index 9e46dd1bd8..dbc624d323 100644
--- a/frontend/src/lib/components/runs/timeframes.ts
+++ b/frontend/src/lib/components/runs/timeframes.ts
@@ -39,6 +39,15 @@ export const serviceLogsTimeframes: Timeframe[] = [
 	{ label: 'Within last month', computeMinMax: () => computeMinMaxInc(30 * 24 * 60 * 60 * 1000) }
 ].map((item) => ({ ...item, type: 'dynamic' }))
 
+export const auditTimeframes: Timeframe[] = [
+	{ label: 'All time', computeMinMax: () => ({ minTs: null, maxTs: null }) },
+	{ label: 'Within last 30 minutes', computeMinMax: () => computeMinMaxInc(30 * 60 * 1000) },
+	{ label: 'Within last 24 hours', computeMinMax: () => computeMinMaxInc(24 * 60 * 60 * 1000) },
+	{ label: 'Within last 7 days', computeMinMax: () => computeMinMaxInc(7 * 24 * 60 * 60 * 1000) },
+	{ label: 'Within last month', computeMinMax: () => computeMinMaxInc(30 * 24 * 60 * 60 * 1000) },
+	{ label: 'Within last year', computeMinMax: () => computeMinMaxInc(365 * 24 * 60 * 60 * 1000) }
+].map((item) => ({ ...item, type: 'dynamic' }))
+
 export const runsTimeframes: Timeframe[] = [
 	{ label: 'Latest runs', computeMinMax: () => ({ minTs: null, maxTs: null }) },
 	{ label: 'Within 30 seconds', computeMinMax: () => computeMinMaxInc(30 * 1000) },
diff --git a/frontend/src/lib/components/runs/useJobsLoader.svelte.ts b/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
index 828f060972..8055278c77 100644
--- a/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
+++ b/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
@@ -17,10 +17,27 @@ import { subtractDaysFromDateString } from '$lib/utils'
 import { CancelablePromiseUtils } from '$lib/cancelable-promise-utils'
 import type { Timeframe } from './timeframes'
 import { allowWildcards as _allowWildcards, type RunsFilterInstance } from './runsFilter'
+import { scanJobWindows } from './jobsWindowScan'
 
 // windmill_common::utils::MAX_PER_PAGE: the server silently caps per_page at this value
 const MAX_PER_PAGE = 10000
 
+// How long a listing may run before a scan by time windows starts alongside it. A filter
+// matching fewer jobs than the page holds walks the whole history to find that out, which the
+// server stops after its statement timeout, with nothing to show for it.
+const WINDOW_SCAN_AFTER_MS = 4000
+
+const EPOCH = new Date(0).toISOString()
+
+interface JobsQuery {
+	completedBefore?: string | null
+	completedAfter?: string | null
+	createdBefore?: string
+	createdAfter?: string
+	createdAfterQueue?: string
+	perPage?: number
+}
+
 export function computeJobKinds(jobKindsCat: string | null): string {
 	if (jobKindsCat == 'all') {
 		return ''
@@ -103,6 +120,13 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 	let loadingExtra = $state(false)
 	let lastFetchWentToEnd = $state(true)
 	let batchProgress = $state<{ loaded: number; total: number } | null>(null)
+	let scanProgress = $state<{ scannedTo: string; fraction: number } | null>(null)
+	let activeScan: CancelablePromise<boolean> | undefined
+	// The page being listed, single request or scan. Only the filter-change load is otherwise
+	// tracked for cancellation, and a page left running writes into whatever listing replaces its own.
+	let activePage: CancelablePromise<boolean> | undefined
+	// Queue-only views list no completed job, and concurrency-key views go through another endpoint.
+	let canScanWindows = $derived(!isQueueOnly && (concurrencyKey == null || concurrencyKey === ''))
 
 	let completedJobs: CompletedJob[] | undefined = $state()
 	let externalJobs: Job[] | undefined = $state()
@@ -119,6 +143,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 	function onParamChanges() {
 		resetJobs()
 		slowStreamIntervalId = setInterval(() => {
+			if (scanProgress) return
 			sendUserToast(
 				'Loading is taking a long time...',
 				'warning',
@@ -128,7 +153,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 			)
 		}, 15000)
 		let promise = loadJobsIntern(true)
-		if (perPage > 25) {
+		if (perPage > 25 && !canScanWindows) {
 			promise = CancelablePromiseUtils.onTimeout(promise, 4000, () => {
 				const noStartDate = timeframe?.computeMinMax().minTs == null
 				sendUserToast(
@@ -159,6 +184,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 		paramChangePromise?.cancel()
 		resetJobs()
 		slowStreamIntervalId = setInterval(() => {
+			if (scanProgress) return
 			sendUserToast(
 				'Loading is taking a long time...',
 				'warning',
@@ -196,8 +222,13 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 		loading = true
 		loadingExtra = true
 		const batchSize = Math.min(perPage, 1000)
-		await loadExtraJobsBatch(batchSize)
-		loadingExtra = false
+		try {
+			await loadExtraJobsBatch(batchSize)
+		} catch (e) {
+			if (!(e instanceof CancelError)) throw e
+		} finally {
+			loadingExtra = false
+		}
 	}
 
 	// Mirrors when list_completed_jobs_query sorts by completed_at. A created_at cursor does not
@@ -231,37 +262,201 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 		const cursor = stepOver ? new Date(new Date(cursorTs).getTime() - 1).toISOString() : cursorTs
 		const pageSize = stepOver ? batchSize : Math.min(batchSize + tied, MAX_PER_PAGE)
 		return CancelablePromiseUtils.map(
-			byCompletedAt
-				? fetchJobs(cursor, minTs, undefined, undefined, pageSize)
-				: fetchJobs(null, minTs, undefined, cursor, pageSize),
-			(olderJobs) => {
-				jobs = updateWithNewJobs(olderJobs ?? [], jobs ?? [])
-				if (extendedJobs) {
-					extendedJobs.jobs = jobs ?? []
-					extendedJobs = extendedJobs
+			fetchPage(
+				{
+					byCompletedAt,
+					before: cursor,
+					after: minTs,
+					pageSize,
+					query: byCompletedAt
+						? { completedBefore: cursor, completedAfter: minTs, perPage: pageSize }
+						: { completedAfter: minTs, createdBefore: cursor, perPage: pageSize }
+				},
+				(olderJobs) => {
+					jobs = updateWithNewJobs(olderJobs, jobs ?? [])
+					if (extendedJobs) {
+						extendedJobs.jobs = jobs ?? []
+						extendedJobs = extendedJobs
+					}
+					computeCompletedJobs()
 				}
-				computeCompletedJobs()
-				lastFetchWentToEnd = (olderJobs?.length ?? 0) < pageSize
+			),
+			(wentToEnd) => {
+				lastFetchWentToEnd = wentToEnd
 				loading = false
 			}
 		)
 	}
 
-	function fetchJobs(
-		completedBefore: string | null,
-		completedAfter: string | null,
-		createdAfterQueue: string | undefined,
-		createdBefore?: string,
-		perPageOverride?: number
-	): CancelablePromise<Job[]> {
+	// Lists one page of jobs older than `before`, handing them to `onJobs` as they arrive, and
+	// resolves to whether the listing reached the end of the range. `query` is the whole page in
+	// one request. When that is slow, the page is also listed by time windows, and whichever
+	// completes it first wins: the server runs an abandoned request to its timeout regardless, so
+	// dropping it for the scan would only throw away an answer already being paid for.
+	function fetchPage(
+		page: {
+			byCompletedAt: boolean
+			before: string | null
+			after: string | null
+			pageSize: number
+			withQueue?: boolean
+			query: JobsQuery
+		},
+		onJobs: (jobs: Job[]) => void
+	): CancelablePromise<boolean> {
+		if (!canScanWindows || _args.skip) {
+			return CancelablePromiseUtils.map(fetchJobs(page.query), (res) => {
+				onJobs(res)
+				return res.length < page.pageSize
+			})
+		}
+		const fetched = new CancelablePromise<boolean>((resolve, reject, onCancel) => {
+			const single = listJobs(page.query)
+			let scan: CancelablePromise<boolean> | undefined
+			onCancel(() => {
+				clearTimeout(timer)
+				single.cancel()
+				scan?.cancel()
+			})
+			// Either side failing leaves the page to the other: it is lost only once both have.
+			let scanError: any
+			let singleError: any
+			const giveUp = (e: any, wentToEnd: boolean) => {
+				sendUserToast(`Could not load jobs: ${e.body ?? e.message}`, true)
+				console.error(e)
+				onJobs([])
+				resolve(wentToEnd)
+			}
+			const timer = setTimeout(() => {
+				scan = scanWindows(page, onJobs)
+				scan.then(
+					(wentToEnd) => {
+						resolve(wentToEnd)
+						single.cancel()
+					},
+					(e) => {
+						if (e instanceof CancelError) return reject(e)
+						scanError = e
+						if (singleError) giveUp(scanError, false)
+					}
+				)
+			}, WINDOW_SCAN_AFTER_MS)
+			single.then(
+				(res) => {
+					clearTimeout(timer)
+					onJobs(res)
+					resolve(res.length < page.pageSize)
+					scan?.cancel()
+				},
+				(e: any) => {
+					if (e instanceof CancelError) return
+					if (!scan) {
+						clearTimeout(timer)
+						giveUp(e, true)
+						return
+					}
+					// Once the scan runs, the single request failing is the expected server timeout.
+					singleError = e
+					if (scanError) giveUp(scanError, false)
+				}
+			)
+		})
+		activePage?.cancel()
+		activePage = fetched
+		const done = () => {
+			if (activePage === fetched) activePage = undefined
+		}
+		fetched.then(done, done)
+		return fetched
+	}
+
+	function scanWindows(
+		page: {
+			byCompletedAt: boolean
+			before: string | null
+			after: string | null
+			pageSize: number
+			withQueue?: boolean
+		},
+		onJobs: (jobs: Job[]) => void
+	): CancelablePromise<boolean> {
+		const workspace = currentWorkspace
+		const scan = scanJobWindows({
+			before: page.before,
+			after: page.after,
+			pageSize: page.pageSize,
+			oldest: async () =>
+				(await JobService.getOldestJob({ workspace, allWorkspaces: allWorkspaces || undefined }))
+					.created_at,
+			fetchWindow: (w) => {
+				// Only the first window of a listing that started at the newest job carries the queue.
+				// A created_before excludes it from the others, and bounds no completed job out of a
+				// completed_at window since a job is created before it completes.
+				const withQueue = page.withQueue && w.before == page.before
+				return listJobs(
+					page.byCompletedAt
+						? {
+								completedBefore: w.before,
+								completedAfter: w.after,
+								createdBefore: withQueue ? undefined : w.before,
+								createdAfterQueue: page.after ?? undefined,
+								perPage: w.limit
+							}
+						: {
+								createdBefore: w.before,
+								createdAfter: w.after,
+								// created_after would bound the queue too, hiding older jobs still in it
+								createdAfterQueue: withQueue ? EPOCH : undefined,
+								perPage: w.limit
+							}
+				)
+			},
+			onWindow: (res, scannedTo, fraction) => {
+				if (activeScan !== scan) return
+				scanProgress = { scannedTo, fraction }
+				onJobs(res)
+			}
+		})
+		activeScan?.cancel()
+		activeScan = scan
+		scanProgress = { scannedTo: page.before ?? new Date().toISOString(), fraction: 0 }
+		onJobs([])
+		const done = () => {
+			if (activeScan === scan) {
+				activeScan = undefined
+				scanProgress = null
+			}
+		}
+		scan.then(done, done)
+		return scan
+	}
+
+	function fetchJobs(q: JobsQuery): CancelablePromise<Job[]> {
 		if (_args.skip) return CancelablePromiseUtils.pure<Job[]>([])
+		return CancelablePromiseUtils.catchErr(listJobs(q), (e) => {
+			if (e instanceof CancelError) return CancelablePromiseUtils.err(e)
+			sendUserToast(`Could not load jobs: ${e.body ?? e.message}`, true)
+			console.error(e)
+			return CancelablePromiseUtils.pure<Job[]>([])
+		})
+	}
+
+	function listJobs({
+		completedBefore,
+		completedAfter,
+		createdBefore,
+		createdAfter,
+		createdAfterQueue,
+		perPage: perPageOverride
+	}: JobsQuery): CancelablePromise<Job[]> {
 		loadingFetch = true
 		let scriptPathStart = folder == null || folder === '' ? undefined : `f/${folder}/`
 		let scriptPathExact = path == null || path === '' ? undefined : path
 		let isCompletedOnly = success == 'success' || success == 'failure' || success == 'canceled'
 		let promise = JobService.listJobs({
 			workspace: currentWorkspace,
-			createdBefore: createdBefore ?? undefined,
+			createdBefore,
+			createdAfter,
 			completedBefore: isQueueOnly ? undefined : (completedBefore ?? undefined),
 			completedAfter: isQueueOnly ? undefined : (completedAfter ?? undefined),
 			createdBeforeQueue: isQueueOnly ? (completedBefore ?? undefined) : undefined,
@@ -314,15 +509,10 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 			broadFilter,
 			excludesEntrypointOverride: excludesEntrypointOverride ? true : undefined
 		})
-		promise = CancelablePromiseUtils.catchErr(promise, (e) => {
-			if (e instanceof CancelError) return CancelablePromiseUtils.err(e)
-			sendUserToast(`Could not load jobs: ${e.body ?? e.message}`, true)
-			console.error(e)
-			return CancelablePromiseUtils.pure<Job[]>([])
-		})
-		CancelablePromiseUtils.pipe(promise, () => {
+		const settled = () => {
 			loadingFetch = false
-		})
+		}
+		promise.then(settled, settled)
 		return promise
 	}
 
@@ -387,11 +577,16 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 
 	async function loadJobs(reset: boolean, shouldGetCount?: boolean): Promise<void> {
 		if (reset) resetJobs()
-		await loadJobsIntern(shouldGetCount)
+		try {
+			await loadJobsIntern(shouldGetCount)
+		} catch (e) {
+			if (!(e instanceof CancelError)) throw e
+		}
 	}
 
 	function stopBatchLoading(): void {
 		paramChangePromise?.cancel()
+		activePage?.cancel()
 		if (slowStreamIntervalId) {
 			clearInterval(slowStreamIntervalId)
 			slowStreamIntervalId = undefined
@@ -402,6 +597,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 	}
 
 	function resetJobs() {
+		activePage?.cancel()
 		jobs = undefined
 		completedJobs = undefined
 		externalJobs = undefined
@@ -438,15 +634,35 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 				batchProgress = { loaded: 0, total: perPage }
 			}
 			currentBatchSize = batchSize
-			let slowBatchToastShown = false
-			let firstFetchPromise = fetchJobs(
-				maxTs,
-				extendedMinTs ?? null,
-				extendedMinTs,
-				undefined,
-				batchSize
+			// The windowed scan streams a slow listing by itself, whatever the batch size.
+			let slowBatchToastShown = canScanWindows
+			let firstJobs: Job[] = []
+			let firstFetchPromise = fetchPage(
+				{
+					byCompletedAt: sortsByCompletedAt(minTs, maxTs),
+					before: maxTs,
+					after: extendedMinTs ?? null,
+					pageSize: batchSize,
+					withQueue: true,
+					query: {
+						completedBefore: maxTs,
+						completedAfter: extendedMinTs ?? null,
+						createdAfterQueue: extendedMinTs,
+						perPage: batchSize
+					}
+				},
+				(newJobs) => {
+					firstJobs = updateWithNewJobs(newJobs, firstJobs)
+					extendedJobs = { jobs: firstJobs, obscured_jobs: [] } as ExtendedJobs
+
+					// Filter on minTs here and not in the backend
+					// to get enough data for the concurrency graph
+					jobs = sortMinDate(minTs, firstJobs)
+					externalJobs = []
+					computeCompletedJobs()
+				}
 			)
-			if (isBatched && batchSize > 1) {
+			if (isBatched && batchSize > 1 && !slowBatchToastShown) {
 				firstFetchPromise = CancelablePromiseUtils.onTimeout(firstFetchPromise, 4000, () => {
 					if (!slowBatchToastShown) {
 						slowBatchToastShown = true
@@ -458,15 +674,8 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 					}
 				})
 			}
-			let p = CancelablePromiseUtils.map(firstFetchPromise, (newJobs) => {
-				extendedJobs = { jobs: newJobs, obscured_jobs: [] } as ExtendedJobs
-
-				// Filter on minTs here and not in the backend
-				// to get enough data for the concurrency graph
-				jobs = sortMinDate(minTs, newJobs)
-				externalJobs = []
-				computeCompletedJobs()
-				lastFetchWentToEnd = newJobs.length < batchSize
+			let p = CancelablePromiseUtils.map(firstFetchPromise, (wentToEnd) => {
+				lastFetchWentToEnd = wentToEnd
 				loading = false
 				if (isBatched) {
 					batchProgress = { loaded: jobs?.length ?? 0, total: perPage }
@@ -608,11 +817,11 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 						// unbounded scan of completed jobs, possibly the one that just timed out. Not for
 						// queue-only views: fetchJobs turns this into the queue's created_at bound, hiding
 						// older jobs that suspend or come due. The margin absorbs browser/database skew.
-						newJobs = await fetchJobs(
-							maxTs,
-							minTs ?? completedTs ?? (isQueueOnly ? null : listLoadedAt),
-							queueTs
-						)
+						newJobs = await fetchJobs({
+							completedBefore: maxTs,
+							completedAfter: minTs ?? completedTs ?? (isQueueOnly ? null : listLoadedAt),
+							createdAfterQueue: queueTs
+						})
 					} else {
 						// Obscured jobs have no ids, so we have to do the full request
 						extendedJobs = await fetchExtendedJobs(concurrencyKey, maxTs, minTs ?? completedTs)
@@ -721,6 +930,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 			slowStreamIntervalId = undefined
 		}
 		paramChangePromise?.cancel()
+		activePage?.cancel()
 	})
 	$effect(() => {
 		Object.keys(filters ?? {}).map((k) => filters?.[k as keyof RunsFilterInstance])
@@ -772,6 +982,9 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 		get currentBatchSize() {
 			return currentBatchSize
 		},
+		get scanProgress() {
+			return scanProgress
+		},
 		get queue_count() {
 			return queue_count
 		},
diff --git a/frontend/src/lib/components/s3TableOps.test.ts b/frontend/src/lib/components/s3TableOps.test.ts
new file mode 100644
index 0000000000..f32ce47c56
--- /dev/null
+++ b/frontend/src/lib/components/s3TableOps.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest'
+import { datatypeOf, jsonTableRows, serverTableFormat } from './s3TableOps'
+import { dbColumnKind } from './dbTableFilters'
+
+describe('serverTableFormat', () => {
+	it('pages delimited text and newline-delimited JSON through the csv reader', () => {
+		expect(serverTableFormat('a/b.parquet')).toBe('parquet')
+		for (const key of ['a.csv', 'a.TSV', 'a.jsonl', 'a.ndjson']) {
+			expect(serverTableFormat(key)).toBe('csv')
+		}
+	})
+
+	it('leaves plain JSON to the browser', () => {
+		expect(serverTableFormat('a.json')).toBeUndefined()
+		expect(serverTableFormat('a.txt')).toBeUndefined()
+	})
+})
+
+describe('datatypeOf', () => {
+	it('maps Arrow types to the kinds the grid filters by', () => {
+		expect(dbColumnKind(datatypeOf('Int64'))).toBe('number')
+		expect(dbColumnKind(datatypeOf('UInt8'))).toBe('number')
+		expect(dbColumnKind(datatypeOf('Float64'))).toBe('number')
+		expect(dbColumnKind(datatypeOf('Decimal128(21, 1)'))).toBe('number')
+		expect(dbColumnKind(datatypeOf('Boolean'))).toBe('boolean')
+		expect(dbColumnKind(datatypeOf('Utf8View'))).toBe('text')
+	})
+
+	it('names a nested type without its field list', () => {
+		expect(datatypeOf('List(Field { name: "item", data_type: Utf8 })')).toBe('list')
+		expect(datatypeOf('Timestamp(Microsecond, None)')).toBe('timestamp')
+	})
+})
+
+describe('jsonTableRows', () => {
+	it('keeps objects and wraps other elements in a value column', () => {
+		expect(jsonTableRows([{ a: 1 }, 2, null])).toEqual([{ a: 1 }, { value: 2 }, { value: null }])
+	})
+
+	it('has no table for an empty array or a non-array', () => {
+		expect(jsonTableRows([])).toBeUndefined()
+		expect(jsonTableRows({ a: 1 })).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/s3TableOps.ts b/frontend/src/lib/components/s3TableOps.ts
new file mode 100644
index 0000000000..f5d7bd758b
--- /dev/null
+++ b/frontend/src/lib/components/s3TableOps.ts
@@ -0,0 +1,170 @@
+import { HelpersService, OpenAPI } from '$lib/gen'
+import { getHeaders } from '$lib/gen/core/request'
+import { ColumnIdentity, type ColumnDef } from './apps/components/display/dbtable/utils'
+import type { IDbTableOps } from './dbOps'
+
+/** Files the server can page through as a table, without reading them whole. */
+export function serverTableFormat(fileKey: string): 'parquet' | 'csv' | undefined {
+	const key = fileKey.toLowerCase()
+	if (key.endsWith('.parquet')) return 'parquet'
+	if (/\.(csv|tsv|jsonl|ndjson)$/.test(key)) return 'csv'
+	return undefined
+}
+
+export type S3TableSource = {
+	workspace: string
+	fileKey: string
+	storage?: string
+	s3ResourcePath?: string
+	csvSeparator?: string
+	csvHasHeader?: boolean
+}
+
+type Chunk = {
+	columns: string[]
+	column_types?: string[]
+	rows: Record<string, unknown>[]
+	csv_separator?: string
+}
+
+/** An Arrow type as the SQL type name the grid filters and formats by. */
+export function datatypeOf(arrowType: string | undefined): string {
+	const t = arrowType ?? ''
+	if (/^U?Int\d+$/.test(t)) return 'bigint'
+	if (/^Float\d+$/.test(t)) return 'double'
+	if (/^Decimal/.test(t)) return 'decimal'
+	if (t === 'Boolean') return 'boolean'
+	if (/^(Large)?Utf8/.test(t)) return 'text'
+	// A nested type spells out its fields, e.g. `List(Field { name: "item", … })`.
+	return t.split('(')[0].toLowerCase() || 'text'
+}
+
+/** Read-only table ops over an object storage file, paged, searched, filtered and sorted
+ * by the server, with the CSV separator it read the file with (guessed when none is given).
+ */
+export async function s3TableOps(
+	source: S3TableSource
+): Promise<{ ops: IDbTableOps; csvSeparator?: string }> {
+	const format = serverTableFormat(source.fileKey)
+	if (!format) throw new Error(`${source.fileKey} cannot be read as a table`)
+	const common = {
+		workspace: source.workspace,
+		path: source.fileKey,
+		storage: source.storage,
+		s3ResourcePath: source.s3ResourcePath
+	}
+	const csvOptions: { csvSeparator?: string; csvHasHeader?: boolean } =
+		format === 'csv' ? { csvSeparator: source.csvSeparator, csvHasHeader: source.csvHasHeader } : {}
+	const filtersParam = (columnFilters: Record<string, unknown> | undefined) =>
+		columnFilters && Object.keys(columnFilters).length ? JSON.stringify(columnFilters) : undefined
+	const searchParam = (quicksearch: string) => quicksearch.trim() || undefined
+
+	async function loadChunk(params: {
+		offset: number
+		limit: number
+		quicksearch?: string
+		columnFilters?: Record<string, unknown>
+		orderBy?: string
+		isDesc?: boolean
+	}): Promise<Chunk> {
+		const data = {
+			...common,
+			...csvOptions,
+			offset: params.offset,
+			limit: params.limit,
+			searchTerm: searchParam(params.quicksearch ?? ''),
+			filters: filtersParam(params.columnFilters),
+			sortCol: params.orderBy,
+			sortDesc: params.isDesc
+		}
+		return (await (format === 'parquet'
+			? HelpersService.loadParquetPreview(data)
+			: HelpersService.loadCsvPreview(data))) as Chunk
+	}
+
+	const head = await loadChunk({ offset: 0, limit: 0 })
+	// Later reads reuse the separator the server guessed, rather than each guessing again.
+	if (format === 'csv') csvOptions.csvSeparator ??= head.csv_separator
+	const colDefs: ColumnDef[] = head.columns.map((field, i) => ({
+		field,
+		datatype: datatypeOf(head.column_types?.[i]),
+		// The server cannot read a struct, map or union as text to filter it.
+		filterable: !/^(Struct|Map|Union)/.test(head.column_types?.[i] ?? ""),
+		defaultvalue: '',
+		isprimarykey: false,
+		isidentity: ColumnIdentity.No,
+		isnullable: 'YES',
+		isenum: false
+	}))
+
+	const ops: IDbTableOps = {
+		dbType: 'duckdb',
+		tableKey: source.fileKey.split('/').pop() ?? source.fileKey,
+		colDefs,
+		getCount: async ({ quicksearch, columnFilters }) => {
+			const res = await HelpersService.loadTableRowCount({
+				...common,
+				...csvOptions,
+				searchTerm: searchParam(quicksearch),
+				filters: filtersParam(columnFilters)
+			})
+			return res.count ?? 0
+		},
+		getRows: async ({
+			offset,
+			limit,
+			quicksearch,
+			columnFilters,
+			order_by,
+			is_desc,
+			explicitSort
+		}) =>
+			(
+				await loadChunk({
+					offset,
+					limit,
+					quicksearch,
+					columnFilters,
+					// Unsorted, a file keeps its own row order.
+					orderBy: explicitSort ? order_by : undefined,
+					isDesc: is_desc
+				})
+			).rows
+	}
+	return { ops, csvSeparator: head.csv_separator }
+}
+
+/** Plain JSON cannot be paged by the server, so only a file this small is read whole into
+ * the browser to be shown as a table. */
+export const JSON_TABLE_MAX_BYTES = 10 * 1024 * 1024
+
+export function isJsonFile(fileKey: string): boolean {
+	return fileKey.toLowerCase().endsWith('.json')
+}
+
+/** Rows of a JSON array, an element that is not an object becoming a one-column row;
+ * undefined for anything else. */
+export function jsonTableRows(value: unknown): Record<string, unknown>[] | undefined {
+	if (!Array.isArray(value) || value.length === 0) return undefined
+	return value.map((v) =>
+		v !== null && typeof v === 'object' && !Array.isArray(v)
+			? (v as Record<string, unknown>)
+			: { value: v }
+	)
+}
+
+export async function fetchJsonTableRows(
+	source: S3TableSource
+): Promise<Record<string, unknown>[] | undefined> {
+	const query = new URLSearchParams({ file_key: source.fileKey })
+	if (source.storage) query.set('storage', source.storage)
+	if (source.s3ResourcePath) query.set('s3_resource_path', source.s3ResourcePath)
+	const apiPath = `/w/${source.workspace}/job_helpers/download_s3_file?${query}`
+	const headers = await getHeaders(OpenAPI, { method: 'GET', url: apiPath })
+	const response = await fetch(`${OpenAPI.BASE}${apiPath}`, {
+		headers,
+		credentials: OpenAPI.CREDENTIALS
+	})
+	if (!response.ok) throw new Error(`${response.status} ${response.statusText}`)
+	return jsonTableRows(await response.json())
+}
diff --git a/frontend/src/lib/components/schedules/ScheduleUpcomingEvents.svelte b/frontend/src/lib/components/schedules/ScheduleUpcomingEvents.svelte
new file mode 100644
index 0000000000..b239d1c310
--- /dev/null
+++ b/frontend/src/lib/components/schedules/ScheduleUpcomingEvents.svelte
@@ -0,0 +1,65 @@
+<script lang="ts">
+	import { ScheduleService } from '$lib/gen'
+	import { Loader2 } from 'lucide-svelte'
+	import { resource } from 'runed'
+
+	interface Props {
+		workspace: string
+		path: string
+		schedule: string
+		timezone: string
+		draftOnly?: boolean
+	}
+
+	let { workspace, path, schedule, timezone, draftOnly = false }: Props = $props()
+
+	// The list endpoint omits cron_version, and the preview parses with the legacy v1 parser when it
+	// is absent, so read it from the schedule. A deployed NULL is v1, as the executor parses it; a
+	// draft-only row reads its draft, where an absent version is v2, the default for new schedules.
+	// Mounted only while the tooltip is open, so each hover fetches fresh dates.
+	const preview = resource(
+		() => ({ workspace, path, schedule, timezone, draftOnly }),
+		async ({ workspace, path, schedule, timezone, draftOnly }) => {
+			const saved = await ScheduleService.getSchedule({ workspace, path, getDraft: draftOnly })
+			const cronVersion = saved.cron_version ?? (draftOnly ? 'v2' : undefined)
+			return ScheduleService.previewSchedule({
+				requestBody: { schedule, timezone, cron_version: cronVersion }
+			})
+		}
+	)
+
+	function formatter(timeZone: string) {
+		const options: Intl.DateTimeFormatOptions = {
+			weekday: 'short',
+			day: '2-digit',
+			month: 'short',
+			year: 'numeric',
+			hour: 'numeric',
+			minute: 'numeric',
+			second: 'numeric',
+			timeZoneName: 'short'
+		}
+		try {
+			return new Intl.DateTimeFormat('en-GB', { ...options, timeZone }).format
+		} catch {
+			return new Intl.DateTimeFormat('en-GB', { ...options, timeZone: 'UTC' }).format
+		}
+	}
+
+	const format = $derived(formatter(timezone))
+</script>
+
+<div class="flex flex-col gap-1">
+	<div class="font-semibold text-emphasis">Estimated upcoming events ({timezone})</div>
+	{#if preview.error}
+		<span class="text-secondary">Could not compute upcoming events</span>
+	{:else if preview.current === undefined}
+		<Loader2 size={14} class="animate-spin" />
+	{:else}
+		{#each preview.current as date (date)}
+			<span>{format(new Date(date))}</span>
+		{:else}
+			<span class="text-secondary">No upcoming events</span>
+		{/each}
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/schedules/SchedulesList.svelte b/frontend/src/lib/components/schedules/SchedulesList.svelte
index 7935cd6725..3d8732e088 100644
--- a/frontend/src/lib/components/schedules/SchedulesList.svelte
+++ b/frontend/src/lib/components/schedules/SchedulesList.svelte
@@ -7,14 +7,15 @@
 		WorkspaceService
 	} from '$lib/gen'
 	import { canWrite, displayDate, getLocalSetting, pluralize, storeLocalSetting } from '$lib/utils'
-	import { useScheduleLock } from '$lib/operatorWriteRights'
+	import { useEditRights, useScheduleLock } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
 	import { Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import PageHeader from '$lib/components/PageHeader.svelte'
 	import Popover from '$lib/components/Popover.svelte'
+	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
+	import ScheduleUpcomingEvents from '$lib/components/schedules/ScheduleUpcomingEvents.svelte'
 	import SharedBadge from '$lib/components/SharedBadge.svelte'
 	import DraftBadge from '$lib/components/DraftBadge.svelte'
 	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
@@ -54,7 +55,7 @@
 	import JobPreview from '$lib/components/jobs/JobPreview.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { untrack } from 'svelte'
+	import { onDestroy, untrack } from 'svelte'
 	import { page } from '$app/stores'
 	import { useHostedPage } from '$lib/components/hostedPage'
 	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
@@ -66,6 +67,7 @@
 		useOperatingUser
 	} from '$lib/components/operatingWorkspace.svelte'
 	const scheduleLock = useScheduleLock()
+	const editRights = useEditRights()
 
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
@@ -96,7 +98,15 @@
 		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
 	}
 	getDeployUiSettings()
+	// Bumped by every load and on destroy: a load that resumes from an await under an older
+	// value was superseded or outlived the page, and must not fetch or write anything more.
+	let loadGeneration = 0
+	onDestroy(() => {
+		loadGeneration++
+	})
+
 	async function loadSchedules(): Promise<void> {
+		const generation = ++loadGeneration
 		const currentFilters = filters.val
 
 		// Build API parameters from filters.
@@ -137,6 +147,7 @@
 		const result = (await ScheduleService.listSchedules(apiParams)).map((x) => {
 			return { canWrite: canWrite(x.path, x.extra_perms!, operatingUser.current), ...x }
 		})
+		if (generation !== loadGeneration) return
 
 		// Extract unique values for autocomplete
 		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
@@ -150,23 +161,27 @@
 		// after the schedule core data has been loaded, load all the job stats
 		// TODO: we could potentially not reload the job stats on every call to loadSchedules, but for now it's
 		// simpler to always call it. Update if performance becomes an issue.
-		loadSchedulesWithJobStats()
+		loadSchedulesWithJobStats(generation)
 	}
 
-	// Reload schedules when filters change
+	// One effect for every reason to reload (filters, workspace, user), so that mounting
+	// issues a single load rather than one per reason. Waits for the user lookup to settle,
+	// not for a user: a failed lookup still lists, read-only.
 	$effect(() => {
 		filters.val
-		if ($operatingWorkspace) {
+		operatingUser.current
+		if ($operatingWorkspace && operatingUser.resolved($operatingWorkspace)) {
 			untrack(() => loadSchedules())
 		}
 	})
 
-	async function loadSchedulesWithJobStats(): Promise<void> {
+	async function loadSchedulesWithJobStats(generation: number): Promise<void> {
 		loadingSchedulesWithJobStats = true
 		let schedulesWithJobsByPath = new Map<string, ScheduleW>()
 		let schedulesWithJobsList = await ScheduleService.listSchedulesWithJobs({
 			workspace: $operatingWorkspace!
 		})
+		if (generation !== loadGeneration) return
 		schedulesWithJobsList.map((x) => {
 			schedulesWithJobsByPath[x.path] = x
 		})
@@ -220,13 +235,6 @@
 		}
 	}
 
-	$effect(() => {
-		if ($operatingWorkspace && operatingUser.current) {
-			untrack(() => {
-				loadSchedules()
-			})
-		}
-	})
 	let scheduleEditor: ScheduleEditor | undefined = $state()
 
 	// Deep link: #<path> opens that schedule's edit drawer. Tracks the last
@@ -408,7 +416,7 @@
 		is_draft
 	} = s}
 	{@const hasDraft = getLocalDraftHint($operatingWorkspace, 'trigger_schedule', path) ?? is_draft}
-	{@const canEdit = canWrite && !$scheduleLock}
+	{@const canEdit = editRights.canEditItem('schedule', path, extra_perms)}
 	{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
 	{@const avg_s = jobs ? jobs.reduce((acc, x) => acc + x.duration_ms, 0) / jobs.length : undefined}
 
@@ -469,7 +477,18 @@
 			{/if}
 
 			<div class="gap-2 items-center hidden md:flex">
-				<Badge large color="blue">{schedule}</Badge>
+				<Tooltip placement="bottom">
+					<Badge large color="blue">{schedule}</Badge>
+					{#snippet text()}
+						<ScheduleUpcomingEvents
+							workspace={$operatingWorkspace!}
+							{path}
+							{schedule}
+							{timezone}
+							draftOnly={draft_only}
+						/>
+					{/snippet}
+				</Tooltip>
 				<Badge small color="gray">{timezone}</Badge>
 			</div>
 
@@ -532,7 +551,7 @@
 						}}
 						checked={!draft_only && enabled}
 						on:change={(e) => {
-							if (canWrite) {
+							if (canEdit) {
 								setScheduleEnabled(path, e.detail)
 							} else {
 								sendUserToast('not enough permission', true)
@@ -549,7 +568,7 @@
 			</div>
 			<div class="flex gap-2 items-center justify-end">
 				<Button
-					href={`${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`}
+					href={`/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`}
 					disabled={draft_only}
 					unifiedSize="md"
 					startIcon={{ icon: List }}
@@ -572,7 +591,7 @@
 							displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
 							icon: Eye,
 							action: () => {
-								if (hosted) hosted.openLink(`${base}${href}`)
+								if (hosted) hosted.openLink(href)
 								else goto(href)
 							}
 						},
@@ -624,12 +643,12 @@
 						{
 							displayName: 'View runs',
 							icon: List,
-							href: `${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`
+							href: `/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`
 						},
 						{
 							displayName: 'Audit logs',
 							icon: Eye,
-							href: `${base}/audit_logs?resource=${path}`
+							href: `/audit_logs?resource=${path}`
 						},
 						{
 							displayName: 'Run now',
@@ -662,7 +681,7 @@
 					{/if}
 					{#each jobs ?? [] as job}
 						{@const h = (avg_s ? job.duration_ms / avg_s : 1) * 7 + 3}
-						<a href="{base}/run/{job.id}?workspace={$operatingWorkspace}">
+						<a href="/run/{job.id}?workspace={$operatingWorkspace}">
 							<JobPreview id={job.id} class="p-4">
 								<div>
 									<div
diff --git a/frontend/src/lib/components/schema/JobSchemaPicker.svelte b/frontend/src/lib/components/schema/JobSchemaPicker.svelte
index fe132d546c..b8c2641164 100644
--- a/frontend/src/lib/components/schema/JobSchemaPicker.svelte
+++ b/frontend/src/lib/components/schema/JobSchemaPicker.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import SchemaPickerRow from './SchemaPickerRow.svelte'
 	import { ExternalLink } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
@@ -62,7 +61,7 @@
 			<div class="center-center">
 				<a
 					target="_blank"
-					href="{base}/run/{job.id}?workspace={$operatingWorkspace}"
+					href="/run/{job.id}?workspace={$operatingWorkspace}"
 					class="text-right float-right text-secondary px-2"
 					title="See run detail in a new tab"
 				>
diff --git a/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte b/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
index 2714cc92c3..1ae81ca63c 100644
--- a/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
+++ b/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
@@ -4,7 +4,6 @@
 	import { JobService } from '$lib/gen/index.js'
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { ExternalLink } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import { Cell, Row } from '$lib/components/table'
 	import { twMerge } from 'tailwind-merge'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
@@ -74,7 +73,7 @@
 				<div class="center-center {hovering ? '' : '!hidden'}">
 					<a
 						target="_blank"
-						href="{base}/run/{job.id}?workspace={$operatingWorkspace}"
+						href="/run/{job.id}?workspace={$operatingWorkspace}"
 						class="text-right float-right text-secondary"
 						title="See run detail in a new tab"
 					>
diff --git a/frontend/src/lib/components/scriptEditor/LogPanel.svelte b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
index fe2bc6c73c..6101417f90 100644
--- a/frontend/src/lib/components/scriptEditor/LogPanel.svelte
+++ b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
@@ -9,7 +9,6 @@
 		type Preview,
 		type WorkflowStatus
 	} from '$lib/gen'
-	import { base } from '$lib/base'
 	import { displayDate } from '$lib/utils'
 	import Tabs from '../common/tabs/Tabs.svelte'
 	import Tab from '../common/tabs/Tab.svelte'
@@ -270,7 +269,7 @@
 										<Cell first>
 											<a
 												class="pr-3"
-												href="{base}/run/{id}?workspace={workspace ?? $operatingWorkspace}"
+												href="/run/{id}?workspace={workspace ?? $operatingWorkspace}"
 												target="_blank">{id.substring(30)}</a
 											>
 										</Cell>
diff --git a/frontend/src/lib/components/script_builder.ts b/frontend/src/lib/components/script_builder.ts
index c28aad82cc..4249441d20 100644
--- a/frontend/src/lib/components/script_builder.ts
+++ b/frontend/src/lib/components/script_builder.ts
@@ -57,6 +57,7 @@ export interface ScriptBuilderProps {
 		| 'docker'
 		| 'bunnative'
 		| 'claudesandbox'
+		| 'pisandbox'
 		| 'wac_python'
 		| 'wac_typescript'
 		| 'ci_test_bun'
@@ -113,4 +114,6 @@ export interface ScriptBuilderProps {
 	// EditorHeader's path/breadcrumb row dropped (summary only). Used by the
 	// session preview to save vertical room.
 	condensedHeader?: boolean
+	/** True for the route's own editor: its top bar becomes the page header. */
+	ownsPageHeader?: boolean
 }
diff --git a/frontend/src/lib/components/scripts/CreateActionsScript.svelte b/frontend/src/lib/components/scripts/CreateActionsScript.svelte
index 48480918e0..d3e59033e0 100644
--- a/frontend/src/lib/components/scripts/CreateActionsScript.svelte
+++ b/frontend/src/lib/components/scripts/CreateActionsScript.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { Code2, Plus } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 
@@ -14,7 +13,7 @@
 		unifiedSize="lg"
 		variant="accent"
 		startIcon={{ icon: Plus }}
-		href="{base}/scripts/add"
+		href="/scripts/add"
 		endIcon={{ icon: Code2 }}
 	>
 		Script
diff --git a/frontend/src/lib/components/scripts/WacExportDrawer.svelte b/frontend/src/lib/components/scripts/WacExportDrawer.svelte
index 59f1dca1b0..ee2c402216 100644
--- a/frontend/src/lib/components/scripts/WacExportDrawer.svelte
+++ b/frontend/src/lib/components/scripts/WacExportDrawer.svelte
@@ -46,6 +46,7 @@
 		if (script.visible_to_runner_only) exportData.visible_to_runner_only = script.visible_to_runner_only
 		if (script.auto_kind) exportData.auto_kind = script.auto_kind
 		if (script.has_preprocessor) exportData.has_preprocessor = script.has_preprocessor
+		if (script.job_token_scopes != null) exportData.job_token_scopes = script.job_token_scopes
 		if (script.modules && Object.keys(script.modules).length > 0) exportData.modules = script.modules
 
 		scriptData = exportData
diff --git a/frontend/src/lib/components/select/MultiSelect.svelte b/frontend/src/lib/components/select/MultiSelect.svelte
index 0ebb824865..1413d9a90f 100644
--- a/frontend/src/lib/components/select/MultiSelect.svelte
+++ b/frontend/src/lib/components/select/MultiSelect.svelte
@@ -159,7 +159,7 @@
 		>
 			<DraggableTags
 				items={valueEntry}
-				{allowClear}
+				allowClear={allowClear && !disabled}
 				onRemove={onRemoveValue}
 				onReorder={reorderable
 					? (oldIdx, newIdx) => (value = reorder(currentValue, oldIdx, newIdx))
@@ -167,7 +167,7 @@
 			/>
 		</ul>
 	{/if}
-	{#if allowClear && !hideMainClearBtn && !!value?.length}
+	{#if allowClear && !disabled && !hideMainClearBtn && !!value?.length}
 		<CloseButton
 			noBg
 			class="ml-2 remove-all bg-transparent text-hint"
diff --git a/frontend/src/lib/components/sessions/ItemViewerView.svelte b/frontend/src/lib/components/sessions/ItemViewerView.svelte
index b805f1b91a..ca5fc2a0e5 100644
--- a/frontend/src/lib/components/sessions/ItemViewerView.svelte
+++ b/frontend/src/lib/components/sessions/ItemViewerView.svelte
@@ -7,8 +7,7 @@
 	 * is caught here and turned into a move inside the preview panel, so nothing takes
 	 * the browser out of the session.
 	 */
-	import { untrack } from 'svelte'
-	import { base } from '$lib/base'
+	import { setContext, untrack } from 'svelte'
 	import ScriptDetail from '$lib/components/details/ScriptDetail.svelte'
 	import FlowDetail from '$lib/components/details/FlowDetail.svelte'
 	import InWorkspaceAppViewer from '$lib/components/apps/editor/InWorkspaceAppViewer.svelte'
@@ -20,8 +19,9 @@
 		parseHistoricalScriptEdit,
 		parsePreviewItemRoute,
 		previewLocationLabel,
-		stripBase
+		barePath
 	} from './previewRouter'
+	import { useSessionPermissions } from './sessionPermissions.svelte'
 
 	let {
 		runtime,
@@ -48,6 +48,16 @@
 		active?: boolean
 	} = $props()
 
+	// Mounted in the preview panel, outside the chat's own subtree, as PageItemEditorView is:
+	// the detail pages' AI entry points would otherwise offer a session from inside one.
+	setContext(
+		'aiChatManager',
+		untrack(() => runtime.manager)
+	)
+
+	const permissions = useSessionPermissions(() => workspaceId)
+	const canEdit = $derived(permissions.canOpenEditor(kind))
+
 	// This reads the deployed version over the API rather than from the editor cell the
 	// chat mutates, so it is the one preview kind that does not self-sync (the invariant
 	// `previewReload.ts` states for editors). A deploy from the editor topbar beside it
@@ -102,7 +112,7 @@
 	// opens as its own tab, another side or version of an item re-points this tab, and
 	// any other page opens as a page tab. Nothing reaches the top-level router.
 	function onNavigate(url: string): void {
-		const clean = stripBase(url)
+		const clean = barePath(url)
 		const query = new URL(url, 'http://x').searchParams
 		const run = clean.match(/^\/run\/([^/?#]+)$/)
 		if (run) {
@@ -144,7 +154,7 @@
 		}
 		runtime.previewTabs.open({
 			type: 'page',
-			href: `${base}${clean}${query.size ? `?${query}` : ''}`,
+			href: `${clean}${query.size ? `?${query}` : ''}`,
 			label: previewLocationLabel(clean)
 		})
 	}
@@ -179,50 +189,53 @@
 
 <!-- Remount to refetch: both detail components load on mount, so a deploy lands here
      rather than as a refresh path of their own. -->
-	{#key loadKey}
-		{@const mountedKey = loadKey}
-		{@const setLoadState = (state: 'loaded' | 'not_found') => onLoadState(mountedKey, state)}
-		{#if notDeployed}
-			<!-- This side shows the DEPLOYED item, and there isn't one. Without this the detail
+{#key loadKey}
+	{@const mountedKey = loadKey}
+	{@const setLoadState = (state: 'loaded' | 'not_found') => onLoadState(mountedKey, state)}
+	{#if notDeployed}
+		<!-- This side shows the DEPLOYED item, and there isn't one. Without this the detail
 		     page renders nothing and the panel is simply blank, which reads as a failure
 		     rather than as the ordinary state of a draft nobody has deployed yet. -->
-			<div class="flex-1 flex flex-col items-center justify-center gap-3 p-8 text-center">
-				<div class="text-sm text-primary">Not deployed yet</div>
-				<div class="text-xs text-tertiary max-w-sm">
-					Nothing is deployed at <span class="font-mono">{path}</span>, so there is no deployed
-					version to view. Deploy it from the editor to see it here.
-				</div>
+		<div class="flex-1 flex flex-col items-center justify-center gap-3 p-8 text-center">
+			<div class="text-sm text-primary">Not deployed yet</div>
+			<div class="text-xs text-tertiary max-w-sm">
+				Nothing is deployed at <span class="font-mono">{path}</span>, so there is no deployed
+				version to view.{#if canEdit}
+					Deploy it from the editor to see it here.{/if}
+			</div>
+			{#if canEdit}
 				<Button unifiedSize="sm" variant="default" startIcon={{ icon: Pen }} on:click={toEditSide}>
 					Back to editor
 				</Button>
-			</div>
-		{:else if kind === 'script'}
-			<ScriptDetail
-				hash={path}
-				workspace={workspaceId}
-				{searchParams}
-				{onNavigate}
-				{active}
-				embedded
-				onLoadState={setLoadState}
-			/>
-		{:else if kind === 'flow'}
-			<FlowDetail
-				{path}
-				workspace={workspaceId}
-				{searchParams}
-				{onNavigate}
-				{active}
-				embedded
-				onLoadState={setLoadState}
-			/>
-		{:else}
-			<InWorkspaceAppViewer
-				workspace={workspaceId}
-				{path}
-				onEdit={() => onNavigate(`/apps_raw/edit/${path}`)}
-				onLoadState={setLoadState}
-				syncHashToUrl={false}
-			/>
-		{/if}
-	{/key}
+			{/if}
+		</div>
+	{:else if kind === 'script'}
+		<ScriptDetail
+			hash={path}
+			workspace={workspaceId}
+			{searchParams}
+			{onNavigate}
+			{active}
+			embedded
+			onLoadState={setLoadState}
+		/>
+	{:else if kind === 'flow'}
+		<FlowDetail
+			{path}
+			workspace={workspaceId}
+			{searchParams}
+			{onNavigate}
+			{active}
+			embedded
+			onLoadState={setLoadState}
+		/>
+	{:else}
+		<InWorkspaceAppViewer
+			workspace={workspaceId}
+			{path}
+			onEdit={() => onNavigate(`/apps_raw/edit/${path}`)}
+			onLoadState={setLoadState}
+			syncHashToUrl={false}
+		/>
+	{/if}
+{/key}
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 4e453c09a3..00b784138f 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -69,7 +69,7 @@
 		 * says that clicking it leaves for a session. */
 		tooltip?: string
 		/** Rendered instead when the caller keeps a docked chat to drive — an
-		 * opted-out user or an operator (typically the editor's inline-chat
+		 * opted-out user (typically the editor's inline-chat
 		 * toggle). Never rendered inside the session panel. */
 		fallback?: Snippet
 	} = $props()
diff --git a/frontend/src/lib/components/sessions/PageListView.svelte b/frontend/src/lib/components/sessions/PageListView.svelte
index 0bc27cd9f0..b9235f3e27 100644
--- a/frontend/src/lib/components/sessions/PageListView.svelte
+++ b/frontend/src/lib/components/sessions/PageListView.svelte
@@ -19,7 +19,7 @@
 	}: {
 		runtime: SessionRuntime
 		tab: SessionPreviewTab
-		/** The list page, base-stripped. */
+		/** The list page path. */
 		path: string
 		workspaceId: string
 		/** The tab's element, which also holds the list's portalled drawers and menus. */
diff --git a/frontend/src/lib/components/sessions/PipelineEditorView.svelte b/frontend/src/lib/components/sessions/PipelineEditorView.svelte
index b1e461eb32..d6e9f28935 100644
--- a/frontend/src/lib/components/sessions/PipelineEditorView.svelte
+++ b/frontend/src/lib/components/sessions/PipelineEditorView.svelte
@@ -1,9 +1,10 @@
 <script lang="ts">
 	import { resource } from 'runed'
-	import { tick, untrack } from 'svelte'
-	import { Loader2, Workflow } from 'lucide-svelte'
+	import { onDestroy, tick, untrack } from 'svelte'
+	import { Loader2, Save, Workflow } from 'lucide-svelte'
 	import PipelineGraphEditor from '$lib/components/assets/AssetGraph/PipelineGraphEditor.svelte'
 	import PipelineTriggerEditors from '$lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte'
+	import { usePipelineDataUploads } from '$lib/components/assets/AssetGraph/pipelineDataUploads.svelte'
 	import { resolveGraph } from '$lib/components/assets/AssetGraph/resolveGraph'
 	import { useActiveRunnableIds } from '$lib/components/assets/AssetGraph/activeRunnables.svelte'
 	import type {
@@ -11,10 +12,26 @@
 		AssetGraphSelection,
 		NativeTriggerKind
 	} from '$lib/components/assets/AssetGraph/types'
-	import { AssetService, JobService, type AssetKind } from '$lib/gen'
+	import { AssetService, JobService, type ScriptLang } from '$lib/gen'
+	import { DATA_ASSET_KINDS } from '$lib/components/assets/AssetGraph/cascadeRun'
+	import { usePipelineAssetPrefetch } from '$lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte'
 	import { sendUserToast } from '$lib/utils'
 	import { createPipelineAiHelpers } from '$lib/components/assets/AssetGraph/pipelineAiHelpers'
+	import { deployPipelineDrafts } from '$lib/components/assets/AssetGraph/pipelineDeploy.svelte'
+	import {
+		diffDeployedGraph,
+		extractCascadeFacts,
+		formatDrift
+	} from '$lib/components/assets/AssetGraph/deployGraphDiff'
+	import PipelineDeployErrors from '$lib/components/assets/AssetGraph/PipelineDeployErrors.svelte'
+	import PipelineDeployTriggersModal from '$lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte'
+	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
+	import { Button } from '$lib/components/common'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
+	import type { DeployResult } from '$lib/utils_workspace_deploy'
 	import type { SessionRuntime } from './sessionRuntime.svelte'
+	import { maskKey } from './modifiedItemsMask'
 
 	let {
 		runtime,
@@ -29,7 +46,7 @@
 		/** Folder name the pipeline graph is scoped to (not a workspace item path). */
 		path: string
 		workspaceId: string
-		/** Only the visible session registers the pipeline tools on its manager. */
+		/** Only the visible session polls the live run badges. */
 		isActiveSession?: boolean
 		/** Whether this is the foreground preview tab. */
 		active?: boolean
@@ -43,50 +60,36 @@
 	// wrong chat — leaving this session's chat unable to build canvas nodes.
 	const aiChatManager = runtime.manager
 
-	// Only the foreground tab of the foreground session owns the chat's pipeline
-	// tools and runs the live-badge poll — a background tab (another preview tab is
-	// showing, or another session is active) must not shadow that context or poll.
+	// Only the foreground tab of the foreground session runs the live-badge poll.
 	const engaged = $derived(isActiveSession && active)
 
-	// Externalized editor state — lives on the runtime so the drafts persist across
-	// hide/show of the preview pane (the pane unmounts on hide).
-	const pe = runtime.pipelineEditorState
-
-	// The reused `pe` is scoped to a folder. A same-folder remount (hide→show)
-	// keeps the drafts; a retarget to a different folder resets so stale drafts
-	// don't bleed across folders. untrack the writes so this can't self-loop.
-	$effect(() => {
-		const folder = path
-		untrack(() => {
-			if (pe.folder !== folder) {
-				if (pe.folder !== undefined) {
-					pe.reset()
-					// A retarget without remount re-scopes the poll, so the release
-					// effect could never match the old folder's job — drop the hint.
-					activeRunnable = undefined
-					activeRunnableJobId = undefined
-					// Re-scope the Global pipeline prompt to the new folder (the helper
-					// methods already read the reactive path, but the system message
-					// string was built for the old one). Only when this tab is engaged —
-					// its helpers are the registered set; a background tab reconfigures
-					// when it next becomes the foreground one.
-					if (engaged) aiChatManager.rebuildGlobalSystemMessage()
-				}
-				pe.folder = folder
-			}
-		})
-	})
+	// This folder's editor state lives on the runtime, so its drafts survive a
+	// remount. The host remounts this view when the tab moves to another folder, so
+	// `path` is fixed for its lifetime.
+	const pe = untrack(() => runtime.pipelineEditor(path))
 
 	const EMPTY_GRAPH: AssetGraphResponse = { assets: [], runnables: [], edges: [], triggers: [] }
-	const EMPTY_PATH_MAP = new Map<string, Array<{ kind: AssetKind; path: string }>>()
-	const EMPTY_NATIVE_MAP = new Map<string, Set<any>>()
 
+	// Data assets only, as on the pipeline page: variables and resources are
+	// config most scripts reference, and would swamp the layout as hub nodes.
 	const graphRes = resource(
 		() => ({ workspace: workspaceId, folder: path }),
 		async ({ workspace, folder }) =>
-			workspace && folder ? await AssetService.getAssetsGraph({ workspace, folder }) : EMPTY_GRAPH
+			workspace && folder
+				? await AssetService.getAssetsGraph({
+						workspace,
+						folder,
+						assetKinds: DATA_ASSET_KINDS.join(',')
+					})
+				: EMPTY_GRAPH
 	)
 
+	const assetPrefetch = usePipelineAssetPrefetch({
+		getWorkspace: () => workspaceId,
+		getGraph: () => graphRes.current as AssetGraphResponse | undefined,
+		editor: pe
+	})
+
 	// Folder whose graph is actually rendered — `graphRes.current` is stale-
 	// while-revalidate on a folder retarget, so the canvas's one-shot initial
 	// fit is keyed on the folder captured when a graph lands, not on `path`
@@ -97,9 +100,7 @@
 	})
 
 	// Deployed graph + the in-flight draft overlay (AI-built nodes render as plain
-	// dashed unsaved drafts, same as manual drafts). The session
-	// skips the route page's folder-wide asset prefetch (empty inferred maps); the
-	// open script's live overlays still feed the graph. (resolveGraph's base is the
+	// dashed unsaved drafts, same as manual drafts). (resolveGraph's base is the
 	// pipeline runnables subset; the 'job' usage_kind of the wire type never appears.)
 	let resolvedGraph = $derived.by<AssetGraphResponse>(() =>
 		resolveGraph({
@@ -107,9 +108,10 @@
 			drafts: pe.drafts,
 			liveBodyAssets: pe.liveBodyAssets,
 			liveAnnotations: pe.liveAnnotations,
-			inferredWritesByPath: EMPTY_PATH_MAP,
-			inferredReadsByPath: EMPTY_PATH_MAP,
-			annotatedNativeKindsByPath: EMPTY_NATIVE_MAP
+			inferredWritesByPath: assetPrefetch.inferredWritesByPath,
+			inferredReadsByPath: assetPrefetch.inferredReadsByPath,
+			annotatedNativeKindsByPath: assetPrefetch.annotatedNativeKindsByPath,
+			triggerDrafts: pe.triggerDrafts.values()
 		})
 	)
 
@@ -120,7 +122,13 @@
 		getDrafts: () => pe.drafts,
 		setDrafts: (next) => (pe.drafts = next),
 		newDraftLocalId: pe.newDraftLocalId,
-		onForgetPath: pe.forgetPath,
+		hasTriggerDrafts: () => pe.triggerDrafts.size > 0,
+		getTriggerDrafts: () => pe.triggerDrafts,
+		setTriggerDraft: pe.setTriggerDraft,
+		onForgetPath: (p) => {
+			pe.forgetPath(p)
+			pe.discardTriggerDraftsFor(p)
+		},
 		// Open the staged node in the details pane so its code is visible.
 		onProposeNode: (p) => {
 			pe.activeDraftPath = p
@@ -135,6 +143,7 @@
 	})
 
 	function handleCanvasSelect(s: AssetGraphSelection | undefined) {
+		uploadInputsPath = undefined
 		if (s && s.kind === 'runnable' && s.runnable_kind === 'script' && pe.drafts.has(s.path)) {
 			pe.activeDraftPath = s.path
 			pe.selection = undefined
@@ -145,6 +154,7 @@
 	}
 
 	async function afterSaved(savedPath: string) {
+		assetPrefetch.forget(savedPath)
 		const next = new Map(pe.drafts)
 		next.delete(savedPath)
 		pe.drafts = next
@@ -194,7 +204,11 @@
 
 	// Data upload has no trigger row — open the target in the details pane and pulse
 	// the signal so its auto-generated run form focuses the S3 input.
+	// A data-upload click opens the node on its inputs alone; any other selection
+	// (or "Open script") goes back to the editor.
+	let uploadInputsPath = $state<string | undefined>(undefined)
 	function openDataUploadRun(scriptPath: string) {
+		uploadInputsPath = scriptPath
 		if (pe.drafts.has(scriptPath)) {
 			pe.activeDraftPath = scriptPath
 			pe.selection = undefined
@@ -236,29 +250,40 @@
 		}
 	})
 
+	const dataUploads = usePipelineDataUploads(() => resolvedGraph)
+
 	function runProducer(producer: { kind: 'script' | 'flow'; path: string; cascade?: boolean }) {
 		// Pipeline nodes are scripts; a flow producer can't be preview/by-path run.
 		if (producer.kind !== 'script') return Promise.resolve(undefined)
-		return runNode(producer.path, {}, producer.cascade ?? false)
+		// A data-upload entry runs on the file staged in its run form.
+		return runNode(producer.path, dataUploads.argsFor(producer.path) ?? {}, producer.cascade ?? false)
 	}
 
+	// Tell the open node's runs list a job started, so it shows it right away.
+	let runsRefreshKey = $state(0)
+	let runsPendingJobId = $state<string | undefined>(undefined)
+
+	// `live` is an open editor's body, newer than what is stored: it is previewed,
+	// a deployed node included.
 	async function runNode(
 		nodePath: string,
 		args: Record<string, any> = {},
-		cascade = false
+		cascade = false,
+		live?: { content: string; language: ScriptLang }
 	): Promise<string | undefined> {
 		const draft = pe.drafts.get(nodePath)
+		const body = live ?? (draft && { content: draft.script.content, language: draft.script.language })
 		activeRunnables.arm(`script:${nodePath}`)
 		try {
 			let jobId: string
-			if (draft) {
-				// Preview-run the draft content; a preview never dispatches downstream.
+			if (body) {
+				// Preview-run the unsaved body; a preview never dispatches downstream.
 				jobId = await JobService.runScriptPreview({
 					workspace: workspaceId,
 					requestBody: {
 						path: nodePath,
-						content: draft.script.content,
-						language: draft.script.language,
+						content: body.content,
+						language: body.language,
 						args
 					}
 				})
@@ -275,6 +300,8 @@
 			}
 			activeRunnable = { kind: 'script', path: nodePath }
 			activeRunnableJobId = jobId
+			runsPendingJobId = jobId
+			runsRefreshKey++
 			return jobId
 		} catch (e: any) {
 			sendUserToast(`Run failed: ${e?.body ?? e?.message ?? e}`, true)
@@ -282,14 +309,126 @@
 		}
 	}
 
-	// Register the pipeline tools on this session's manager while this tab is the
-	// engaged (foreground) one. setPipelineHelpers rebuilds the global tool set to
-	// include the pipeline tools and tears them down on cleanup — so switching to
-	// another preview tab or session releases them.
-	$effect(() => {
-		if (!engaged) return
-		return aiChatManager.setPipelineHelpers(helpers)
-	})
+	// Register this folder's pipeline tools on the session's own manager for as long
+	// as the view is mounted — background tabs included, since each folder's tools
+	// act on its own state — and release them on unmount.
+	$effect(() => aiChatManager.setPipelineHelpers(helpers))
+
+	// ── Deploy all ───────────────────────────────────────────────────────────
+	// The same deploy as the pipeline page's "Save all", reached from this tab's
+	// button and from the session's changes list (through the runtime).
+	const pendingCount = $derived(
+		pe.drafts.size + pe.triggerDrafts.size + (pe.liveEditPath != undefined ? 1 : 0)
+	)
+	let deploying = $state(false)
+	let deployErrors = $state<Map<string, string>>(new Map())
+	let deployErrorsOpen = $state(false)
+
+	let triggerConfirmOpen = $state(false)
+	let resolveTriggerConfirm: ((ok: boolean) => void) | undefined
+	function confirmTriggers(): Promise<boolean> {
+		triggerConfirmOpen = true
+		return new Promise((resolve) => (resolveTriggerConfirm = resolve))
+	}
+	function answerTriggerConfirm(ok: boolean) {
+		triggerConfirmOpen = false
+		resolveTriggerConfirm?.(ok)
+		resolveTriggerConfirm = undefined
+	}
+
+	// A deploy asked for from the changes list can arrive while the tab is still
+	// loading this folder's drafts.
+	async function hydrated(timeoutMs = 10000): Promise<boolean> {
+		for (let waited = 0; !pe.hydratedFromDb && waited < timeoutMs; waited += 100) {
+			await new Promise((resolve) => setTimeout(resolve, 100))
+		}
+		return pe.hydratedFromDb
+	}
+
+	async function deployAll(): Promise<DeployResult> {
+		// Taken before any await: a second caller (the tab's button and the changes
+		// list both reach here) would otherwise replace the pending confirmation and
+		// leave the first one waiting forever.
+		if (deploying) return { success: false, error: 'This pipeline is already deploying.' }
+		deploying = true
+		try {
+			if (!(await hydrated())) return { success: false, error: 'The pipeline drafts did not load.' }
+			if (pendingCount === 0) {
+				// Nothing left to deploy, but an earlier deploy may have failed to save
+				// that: the server would still hold the deployed drafts.
+				const unsaved = await saveRemaining()
+				return unsaved ? { success: false, error: unsaved } : { success: true }
+			}
+			if (pe.triggerDrafts.size > 0 && !(await confirmTriggers())) {
+				return { success: false, error: 'Deploy cancelled.' }
+			}
+			// What the canvas promises for each draft, checked against what the
+			// backend derived once deployed.
+			const predicted = new Map(
+				[...pe.drafts.keys()].map((p) => [p, extractCascadeFacts(resolvedGraph, p)])
+			)
+			const { savedPaths, savedTriggers, errors } = await deployPipelineDrafts(pe, workspaceId)
+			assetPrefetch.forget(...savedPaths)
+			const bundleKey = maskKey(PIPELINE_DRAFT_KIND, pipelineBundlePath(path))
+			if (aiChatManager.modifiedItems?.has(bundleKey)) {
+				await aiChatManager.recordDeployedItems('script', savedPaths)
+			}
+			if (savedPaths.length > 0 || savedTriggers.length > 0) {
+				await graphRes.refetch()
+				const deployed = new Map([...predicted].filter(([p]) => savedPaths.includes(p)))
+				const drift = formatDrift(
+					diffDeployedGraph(deployed, (graphRes.current ?? EMPTY_GRAPH) as AssetGraphResponse)
+				)
+				if (drift) sendUserToast(drift, true)
+			}
+			// The session's changes list re-reads the draft once this resolves, so
+			// what is left of it has to be saved by then.
+			const unsaved = await saveRemaining()
+			deployErrors = errors
+			if (unsaved) return { success: false, error: `Deployed, but ${unsaved}` }
+			if (errors.size > 0) {
+				deployErrorsOpen = true
+				return {
+					success: false,
+					error: `${errors.size} of the pipeline's drafts failed to deploy, see its tab.`
+				}
+			}
+			return { success: true }
+		} finally {
+			deploying = false
+		}
+	}
+
+	// Saves what is left of the folder's draft and says why if that failed. A
+	// flush resolves even when the save failed, and the server would then keep
+	// drafts already deployed — deploying them again would recreate their
+	// triggers. A failed save stays queued until one succeeds, so the flush
+	// retries exactly what failed, an open script's unsaved edits included.
+	async function saveRemaining(): Promise<string | undefined> {
+		await tick()
+		const draft = {
+			workspace: workspaceId,
+			itemKind: PIPELINE_DRAFT_KIND,
+			path: pipelineBundlePath(path)
+		}
+		await UserDraftDbSyncer.flush(draft)
+		if (UserDraftDbSyncer.getConflict(draft).conflict)
+			return 'the remaining drafts conflict with a newer version.'
+		const sync = UserDraftDbSyncer.getState(draft)
+		if (sync.state === 'failed')
+			return `the remaining drafts could not be saved: ${sync.failureMessage ?? 'unknown error'}.`
+		return undefined
+	}
+
+	async function deployAllFromButton() {
+		const count = pendingCount
+		const res = await deployAll()
+		if (res.success) sendUserToast(`Deployed ${count} draft${count === 1 ? '' : 's'}`)
+	}
+
+	$effect(() => runtime.registerPipelineView(path, { deployAll }))
+	// A deploy waiting on the trigger confirmation must still settle when the tab goes.
+	onDestroy(() => answerTriggerConfirm(false))
 </script>
 
 <div class="flex flex-col h-full w-full bg-surface">
@@ -299,6 +438,31 @@
 		<Workflow size={14} />
 		<span class="font-mono text-emphasis truncate">f/{path}</span>
 		<span class="text-tertiary">· data pipeline</span>
+		{#if workspaceId}
+			<AutosaveIndicator
+				workspace={workspaceId}
+				itemKind={PIPELINE_DRAFT_KIND}
+				path={pipelineBundlePath(path)}
+				draftOnly
+				loadedFromDraft={pe.loadedFromDbDraft}
+			/>
+		{/if}
+		<div class="flex-1"></div>
+		{#if deployErrors.size > 0}
+			<PipelineDeployErrors errors={deployErrors} bind:open={deployErrorsOpen} />
+		{/if}
+		{#if pendingCount > 0}
+			<Button
+				variant="accent"
+				unifiedSize="xs"
+				startIcon={{ icon: deploying ? Loader2 : Save }}
+				onclick={deployAllFromButton}
+				disabled={deploying}
+				title={deploying ? 'Deploying drafts…' : `Deploy all ${pendingCount} drafts`}
+			>
+				{deploying ? 'Deploying…' : `Deploy all (${pendingCount})`}
+			</Button>
+		{/if}
 	</div>
 	<div class="flex-1 min-h-0">
 		<!-- Only block on the deployed-graph fetch when there's nothing to show yet.
@@ -328,6 +492,8 @@
 				folder={path}
 				viewportFitKey={viewportFitFolder}
 				persistDrafts={true}
+				modalPanel
+				prefetchingAssets={assetPrefetch.prefetching}
 				displayGraph={resolvedGraph}
 				mode="edit"
 				workspace={workspaceId}
@@ -338,12 +504,21 @@
 				onOpenWebhook={openWebhookDrawer}
 				onOpenDataUpload={openDataUploadRun}
 				focusUploadSignal={focusDataUploadSignal}
+				readyDataUploadPaths={dataUploads.readyPaths}
+				runFormInitialArgs={pe.openScriptPath ? dataUploads.argsFor(pe.openScriptPath) : undefined}
+				onRunFormArgsChange={dataUploads.stage}
 				{activeRunnable}
+				{runsRefreshKey}
+				{runsPendingJobId}
 				activeRunnableIds={activeRunnables.ids}
 				runStates={activeRunnables.states}
 				eventLogEvents={activeRunnables.events}
 				onRunProducer={runProducer}
 				onRunByPath={(path, args) => runNode(path, args)}
+				inputsOnly={uploadInputsPath !== undefined &&
+					(pe.openScriptPath === undefined || uploadInputsPath === pe.openScriptPath)}
+				onRunInputs={(path, args, live) => runNode(path, args, false, live)}
+				onShowScript={() => (uploadInputsPath = undefined)}
 				canRunByPath
 				onTestStateChange={(running) => {
 					const openPath = pe.openScriptPath
@@ -370,6 +545,7 @@
 					await graphRes.refetch()
 				}}
 				onScriptRenamed={async (oldPath, newPath) => {
+					assetPrefetch.forget(oldPath, newPath)
 					// Repoint the selection so the canvas follows the renamed node instead
 					// of staying on the now-gone old path until an unrelated refetch.
 					if (pe.selection?.kind === 'runnable' && pe.selection.path === oldPath) {
@@ -402,3 +578,10 @@
 	workspace={workspaceId}
 	onUpdate={() => graphRes.refetch()}
 />
+
+<PipelineDeployTriggersModal
+	open={triggerConfirmOpen}
+	triggerDrafts={pe.triggerDrafts}
+	onConfirmed={() => answerTriggerConfirm(true)}
+	onCanceled={() => answerTriggerConfirm(false)}
+/>
diff --git a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
index 1795c17fe5..d2d6e51efb 100644
--- a/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
+++ b/frontend/src/lib/components/sessions/PreviewRouterPicker.svelte
@@ -16,8 +16,9 @@ section or the flat layout.
 
 <script lang="ts">
 	import { untrack } from 'svelte'
-	import { Compass, FileText, Pen } from 'lucide-svelte'
+	import { Compass, FileText, NetworkIcon, Pen } from 'lucide-svelte'
 	import { resource } from 'runed'
+	import { AssetService } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import {
@@ -43,11 +44,11 @@ section or the flat layout.
 		PREVIEW_PAGES,
 		artifactKey,
 		isArtifactKey,
-		pageHref,
 		pageKey,
 		previewModeFor,
 		type PreviewTarget
 	} from './previewRouter'
+	import { useSessionPermissions } from './sessionPermissions.svelte'
 
 	type Kind = WorkspaceItemKind
 	type DrillPickerHandle = {
@@ -89,6 +90,8 @@ section or the flat layout.
 
 	const kinds: Kind[] = ['flow', 'script', 'app']
 	const effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
+	const permissions = useSessionPermissions(() => effectiveWorkspace)
+	const canEdit = (item: WorkspaceItem) => permissions.canEditItem(item)
 
 	let inner = $state<DrillPickerHandle | undefined>(undefined)
 	export function focus() {
@@ -154,20 +157,28 @@ section or the flat layout.
 	// `mode` is stamped here rather than left to the tab: picking is the reader
 	// saying "show me this", so it lands on the deployed page, and `navigate`
 	// would otherwise keep whichever side the re-pointed tab happened to be on.
+	// A draft-only item opens its editor, unless this user cannot save there.
 	function tagItems(nodes: DrillNode<WorkspaceItem>[]): DrillNode<PreviewTarget>[] {
 		return nodes.map((n) =>
 			n.type === 'leaf'
-				? { ...n, data: { type: 'item', item: n.data, mode: previewModeFor(n.data) } }
+				? {
+						...n,
+						data: {
+							type: 'item',
+							item: n.data,
+							mode: canEdit(n.data) ? previewModeFor(n.data) : 'view'
+						}
+					}
 				: { ...n, children: tagItems(n.children) }
 		)
 	}
 
-	// Open the item's editor. Offered on every item row, including the draft-only ones
-	// a plain click already opens there: a row that drops the button to say "you were
-	// getting this anyway" reads as one that cannot be edited.
+	// Open the item's editor. Offered on every item row this user can edit, including the
+	// draft-only ones a plain click already opens there: a row that drops the button to say
+	// "you were getting this anyway" reads as one that cannot be edited.
 	function editAction(leaf: DrillLeaf<PreviewTarget>) {
 		const target = leaf.data
-		if (target.type !== 'item') return undefined
+		if (target.type !== 'item' || !canEdit(target.item)) return undefined
 		return {
 			icon: Pen,
 			label: 'Edit',
@@ -192,7 +203,7 @@ section or the flat layout.
 			key: pageKey(p.path),
 			label: p.label,
 			icon: p.icon,
-			data: { type: 'page', href: pageHref(p.path), label: p.label }
+			data: { type: 'page', href: p.path, label: p.label }
 		}
 	}
 
@@ -204,7 +215,9 @@ section or the flat layout.
 		label: 'Pages',
 		icon: Compass,
 		searchGroup: true,
-		children: PREVIEW_PAGES.filter((p) => p.path !== '/').map(pageLeaf)
+		children: PREVIEW_PAGES.filter((p) => p.path !== '/' && permissions.pageAllowed(p)).map(
+			pageLeaf
+		)
 	})
 
 	// Session artifacts, when present, get their own branch between Pages and the
@@ -228,9 +241,39 @@ section or the flat layout.
 			: undefined
 	)
 
+	// Data pipelines are folders, not items, so they get a branch of their own
+	// rather than a leaf in the workspace tree.
+	const pipelinesResource = resource(
+		() => effectiveWorkspace,
+		async (ws) => (ws ? await AssetService.listPipelineFolders({ workspace: ws }) : [])
+	)
+	const pipelinesBranch = $derived<DrillBranch<PreviewTarget> | undefined>(
+		pipelinesResource.current && pipelinesResource.current.length > 0
+			? {
+					type: 'branch',
+					key: 'pipelines',
+					label: 'Data pipelines',
+					icon: NetworkIcon,
+					searchGroup: true,
+					children: pipelinesResource.current.map(({ folder }) => {
+						const path = `/pipeline/${encodeURIComponent(folder)}`
+						return {
+							type: 'leaf' as const,
+							key: pageKey(path),
+							label: `f/${folder}`,
+							icon: NetworkIcon,
+							data: { type: 'page', href: path, label: folder }
+						}
+					})
+				}
+			: undefined
+	)
+
 	const tree = $derived<DrillNode<PreviewTarget>[]>([
-		pagesBranch,
+		// An operator's workspace may enable none of them.
+		...(pagesBranch.children.length > 0 ? [pagesBranch] : []),
 		...(artifactsBranch ? [artifactsBranch] : []),
+		...(pipelinesBranch ? [pipelinesBranch] : []),
 		...tagItems(
 			buildWorkspaceTree({
 				loaded: loader.loaded,
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index 4fa9a5c082..3b8e722441 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -18,6 +18,7 @@
 		showsView
 	} from './previewRouter'
 	import { withMenuHidden } from './sessionMode.svelte'
+	import { useSessionPermissions } from './sessionPermissions.svelte'
 	import ArtifactViewer from '../copilot/chat/artifacts/ArtifactViewer.svelte'
 	import RunFormPreviewSlot from './RunFormPreviewSlot.svelte'
 	import { setOverlayHost } from '../common/overlayHost.svelte'
@@ -76,7 +77,19 @@
 	const itemPath = $derived(
 		slot.kind === 'editor' || slot.kind === 'viewer' ? slot.path : undefined
 	)
-	const mode = $derived(slot.kind === 'viewer' ? 'view' : 'edit')
+	const workspaceId = $derived(
+		session ? (getEffectiveWorkspaceId(session) ?? $workspaceStore ?? '') : ''
+	)
+	const permissions = useSessionPermissions(() => workspaceId || undefined)
+	// Every route into an editor ends here, the breadcrumb and the chat's openers included, so
+	// this is where an editor the user cannot save is turned into the deployed page.
+	const mode = $derived(
+		slot.kind === 'viewer' || (itemKind && !permissions.canOpenEditor(itemKind)) ? 'view' : 'edit'
+	)
+	// `new_draft` marks a raw app handed over by the new-app builder.
+	const newRawApp = $derived(
+		itemKind === 'raw_app' && new URL(tab.url, 'http://x').searchParams.get('new_draft') === 'true'
+	)
 	// A pinned deployed version, read from the tab URL rather than passed down: the tab
 	// URL is the single record of where this tab points.
 	const pinnedVersion = $derived(
@@ -99,9 +112,6 @@
 	// session"). Only the in-process editors need it handed over — an iframe tab
 	// loads the URL whole, params included.
 	const selectedId = $derived(parsePreviewSelectedId(tab.url))
-	const workspaceId = $derived(
-		session ? (getEffectiveWorkspaceId(session) ?? $workspaceStore ?? '') : ''
-	)
 	const isActiveSession = $derived(!!session && sessionState.currentSessionId === session.id)
 
 	// Resolved live from the session's store so an update_artifact re-renders the panel.
@@ -350,7 +360,10 @@
 					{#await import('./PipelineEditorView.svelte')}
 						{@render editorLoading()}
 					{:then Module}
-						<Module.default {runtime} path={itemPath} {workspaceId} {isActiveSession} {active} />
+						<!-- Keyed: the view binds one folder's state for its lifetime. -->
+						{#key itemPath}
+							<Module.default {runtime} path={itemPath} {workspaceId} {isActiveSession} {active} />
+						{/key}
 					{/await}
 				{:else}
 					{#await import('./RawAppEditorView.svelte')}
@@ -361,8 +374,10 @@
 							path={itemPath}
 							{workspaceId}
 							{onNavigate}
+							onSeeDetails={seeDetails}
 							{isActiveSession}
 							{active}
+							{newRawApp}
 						/>
 					{/await}
 				{/if}
@@ -385,6 +400,11 @@
 					/>
 				{/await}
 			</div>
+		{:else}
+			<!-- A pipeline has no deployed page, only its editor. -->
+			<div class="flex-1 flex items-center justify-center p-8 text-center text-sm text-secondary">
+				The pipeline editor saves drafts, which your role cannot do in this workspace.
+			</div>
 		{/if}
 	</div>
 {:else if slot.kind === 'pageitem' && mounted && runtime}
diff --git a/frontend/src/lib/components/sessions/RawAppEditorView.svelte b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
index bb6331a261..6b079c130d 100644
--- a/frontend/src/lib/components/sessions/RawAppEditorView.svelte
+++ b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
@@ -1,9 +1,25 @@
 <script lang="ts">
-	import { untrack } from 'svelte'
+	import { tick, untrack } from 'svelte'
+	import { goto } from '$lib/navigation'
+	import { sendUserToast } from '$lib/toast'
+	import { UserDraft } from '$lib/userDraft.svelte'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import RawAppTemplatePicker, {
+		type RawAppBuildMode,
+		type RawAppTemplatePickerResult
+	} from '$lib/components/raw_apps/RawAppTemplatePicker.svelte'
+	import { runtimeRawAppToDraft } from './appDraftCodec'
+	import ViewportOverlays from '$lib/components/common/ViewportOverlays.svelte'
+	import { withWorkspaceParam } from './sessionMode.svelte'
 	import RawAppEditor from '$lib/components/raw_apps/RawAppEditor.svelte'
 	import DiffDrawer from '$lib/components/DiffDrawer.svelte'
 	import type { WorkspaceItem } from '$lib/components/workspacePicker'
-	import type { SessionRuntime } from './sessionRuntime.svelte'
+	import { removeSession, type SessionRuntime } from './sessionRuntime.svelte'
+	import {
+		BUILDER_FRAMEWORK_TEMPLATES,
+		FRAMEWORK_TEMPLATES,
+		STARTER_RUNNABLES
+	} from '$lib/components/raw_apps/templates'
 	import SessionEditorTarget from './SessionEditorTarget.svelte'
 	import { runResetToDeployed } from '$lib/userDraftToast'
 	import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
@@ -20,24 +36,94 @@
 		path,
 		workspaceId,
 		onNavigate,
+		onSeeDetails,
 		isActiveSession = true,
-		active = true
+		active = true,
+		newRawApp = false
 	}: {
 		runtime: SessionRuntime
 		path: string
 		workspaceId: string
 		onNavigate?: (item: WorkspaceItem) => void
+		/** `Exit & see details` — flips this tab to the item's deployed view rather than
+		 * navigating out of the session. */
+		onSeeDetails?: (e: { path: string }) => void
 		/** Forwarded to SessionEditorTarget — only the visible session claims the
 		 * workspace's single live-editor slot. */
 		isActiveSession?: boolean
 		/** Whether this is the visible preview tab (forwarded as isActiveTab). */
 		active?: boolean
+		/** The tab was opened on an app the new-app builder just started. */
+		newRawApp?: boolean
 	} = $props()
 
 	// This tab's own raw-app cell; each open app editor binds its own store.
 	const cell = $derived(runtime.rawAppCell(path))
+
+	// New only while it is still the untouched template: once built on, telling the chat it
+	// is a fresh app would steer it away from the work already there.
+	const untouchedTemplate = $derived.by(() => {
+		const files = cell.store.val?.files
+		if (!newRawApp || (cell.saved.val && !cell.saved.val.no_deployed) || !files) return false
+		const count = Object.keys(files).length
+		return [
+			...Object.values(FRAMEWORK_TEMPLATES),
+			...Object.values(BUILDER_FRAMEWORK_TEMPLATES)
+		].some((template: Record<string, string>) => {
+			const keys = Object.keys(template)
+			return count === keys.length && keys.every((k) => files[k] === template[k])
+		})
+	})
 	let diffDrawer: DiffDrawer | undefined = $state()
 
+	// A new app arrives here before anything is saved, on the starter template: its setup
+	// is asked over the session it will be built in. Once saved it has been set up, which
+	// is also what a reload sees.
+	let setupSettled = $state(false)
+	const awaitingSetup = $derived(
+		newRawApp &&
+			!setupSettled &&
+			isActiveSession &&
+			active &&
+			cell.slot.loadedPath === path &&
+			!!cell.store.val &&
+			!cell.saved.val
+	)
+
+	async function onSetup(result: RawAppTemplatePickerResult, mode: RawAppBuildMode) {
+		setupSettled = true
+		const val = cell.store.val
+		if (!val) return
+		const setUp = {
+			...val,
+			files: { ...result.files },
+			runnables: { ...result.runnables, ...structuredClone(STARTER_RUNNABLES) },
+			data: result.data,
+			policy: result.policy
+		}
+		cell.store.val = setUp
+		// Saved now rather than on the autosave debounce: both ways out read it back by path.
+		const key = { workspace: workspaceId, itemKind: 'raw_app' as const, path }
+		UserDraft.save('raw_app', path, runtimeRawAppToDraft(setUp), { workspace: workspaceId })
+		await tick()
+		await UserDraftDbSyncer.flush(key)
+		await UserDraft.forcePersist('raw_app', path, { workspace: workspaceId })
+		const saved = UserDraftDbSyncer.getState(key)
+		if (saved.state === 'failed') {
+			sendUserToast(`Could not save the app: ${saved.failureMessage ?? 'unknown error'}`, true)
+			return
+		}
+		if (mode === 'code') {
+			// The session was opened for this app alone; with nothing said in it, it goes.
+			const unused = runtime.manager.displayMessages.length === 0
+			await goto(withWorkspaceParam(`/apps_raw/edit/${path}`, workspaceId))
+			if (unused) removeSession(runtime.sessionId)
+			return
+		}
+		// Remounts the editor so the preview builds the picked template.
+		await runtime.loadRawApp(workspaceId, path, true)
+	}
+
 	// Path typed in the editor header, surfaced when it differs from the stored
 	// path. Mirror it into the runtime draft as `draft_path` so the rename
 	// mutates this cell's store → the autosave sig changes → the draft is saved
@@ -233,6 +319,8 @@
 	{onNavigate}
 	{isActiveSession}
 	isActiveTab={active}
+	{newRawApp}
+	isNew={() => untouchedTemplate}
 	effectivePath={() =>
 		// A raw app's typed rename lives in `draft_path` (`val.path` is the storage
 		// key), unlike scripts where `val.path` is the typed name — without it the
@@ -240,6 +328,13 @@
 		(cell.store.val?.draft_path || cell.store.val?.path) ?? path}
 >
 	{#snippet editor()}
+		<!-- Over the whole page, not the preview pane: it decides what the session is for. -->
+		<ViewportOverlays>
+			<RawAppTemplatePicker
+				bind:open={() => awaitingSetup, (open) => (setupSettled = !open)}
+				onStart={onSetup}
+			/>
+		</ViewportOverlays>
 		{#if cell.store.val}
 			<!-- newApp: a draft-only app (no_deployed=true) has a truthy synthesized
 			     savedApp but no deployed row, so it must deploy via createApp — keying
@@ -272,9 +367,10 @@
 				newApp={!cell.saved.val || cell.saved.val.no_deployed === true}
 				{diffDrawer}
 				{onNavigate}
+				onDetails={onSeeDetails}
 				condensedHeader={true}
 				onResetToDeployed={reloadDeployed}
-				onDeploy={(e) => runtime.itemDeployed(workspaceId, 'raw_app', e.path)}
+				onDeploy={(e) => runtime.itemDeployed(workspaceId, 'raw_app', path, e.path)}
 				defaultSidebarCollapsed
 				sidebarStorageKey="raw-app-sidebar-collapsed-preview"
 				defaultSplitWithPreview={false}
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index 140300ea30..3929b78ca9 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -22,7 +22,7 @@
 	import { badgeCounts, badgeOf, buildDeployItems, type DeployItem } from './sessionDeployModel'
 	import { useExistingMaskKeys } from './sessionDeployModel.svelte'
 	import { previewTargetForDeployKind } from './sessionPreviewTabs.svelte'
-	import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
+	import { PIPELINE_DRAFT_KIND, pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 	import type { PreviewTarget } from './previewRouter'
 	import JobsSegment from '$lib/components/copilot/chat/JobsSegment.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
@@ -378,6 +378,11 @@
 		onDataChanged={refreshDock}
 		onItemDeployed={(item) =>
 			void runtime?.manager.renameModifiedItem(item.draftKind, item.path, item.displayPath)}
-		onItemDiscarded={(item) => void runtime?.manager.removeModifiedItem(item.draftKind, item.path)}
+		onItemDiscarded={(item) => {
+			void runtime?.manager.removeModifiedItem(item.draftKind, item.path)
+			const folder = pipelineFolderFromBundlePath(item.path)
+			if (item.draftKind === PIPELINE_DRAFT_KIND && folder) void runtime?.forgetPipelineDrafts(folder)
+		}}
+		deployPipeline={runtime?.deployPipeline}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte b/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
index fe5ab2d199..d921e435b0 100644
--- a/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
+++ b/frontend/src/lib/components/sessions/SessionDiffDrawer.svelte
@@ -2,10 +2,10 @@
 	import WorkspaceDiffDrawer from './WorkspaceDiffDrawer.svelte'
 	import { ArrowRight, GitFork, Pencil } from 'lucide-svelte'
 	import { userWorkspaces } from '$lib/stores'
-	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import { useSessionDeployModel } from './sessionDeployModel.svelte'
 	import type { DeployItem } from './sessionDeployModel'
+	import type { DeployResult } from '$lib/utils_workspace_deploy'
 
 	// Session "Edits" drawer. Builds the deploy model over the session
 	// workspace's drafts and hands it to WorkspaceDiffDrawer, which renders the
@@ -19,7 +19,8 @@
 		keys,
 		onDataChanged,
 		onItemDeployed,
-		onItemDiscarded
+		onItemDiscarded,
+		deployPipeline
 	}: {
 		workspaceId: string
 		parentWorkspaceId?: string
@@ -36,6 +37,8 @@
 		 *  drops it. */
 		onItemDeployed?: (item: DeployItem) => void
 		onItemDiscarded?: (item: DeployItem) => void
+		/** Forwarded to the deploy model: deploys a pipeline folder's draft bundle. */
+		deployPipeline?: (folder: string) => Promise<DeployResult>
 	} = $props()
 
 	const isFork = $derived(!!parentWorkspaceId)
@@ -51,7 +54,8 @@
 		mask: keys,
 		onDataChanged,
 		onItemDeployed,
-		onItemDiscarded
+		onItemDiscarded,
+		deployPipeline
 	}))
 
 	// Editor URL for a row (every item lives in the session workspace).
@@ -95,7 +99,7 @@
 					{ws?.name ?? workspaceId}
 				</span>
 				{#if ws?.is_dev_workspace}
-					<Badge color="indigo" small>{devBadgeText(ws.dev_workspace_label)}</Badge>
+					<DevWorkspaceBadge label={ws.dev_workspace_label} color={ws.color} fallbackColor="indigo" />
 				{/if}
 				<ArrowRight class="w-3 h-3 shrink-0 text-tertiary" />
 				<span class="font-medium truncate" title={parentWs?.name ?? parentWorkspaceId}>
diff --git a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
index 0ff2329abf..49e0c433d4 100644
--- a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
+++ b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
@@ -20,7 +20,9 @@
 		editor,
 		onNavigate,
 		isActiveSession = true,
-		isActiveTab = true
+		isActiveTab = true,
+		newRawApp = false,
+		isNew = undefined
 	}: {
 		runtime: SessionRuntime
 		kind: SessionTargetKind
@@ -43,6 +45,11 @@
 		 * tab must not, else chat actions resolve to the wrong item's path.
 		 */
 		isActiveTab?: boolean
+		/** A raw app the new-app builder just started: when nothing exists at `path` yet
+		 * the editor opens on the starter template. */
+		newRawApp?: boolean
+		/** Whether the item is still the template a new-item builder started it on. */
+		isNew?: () => boolean
 	} = $props()
 
 	// Mark this subtree as the session side panel: editors below detect the
@@ -71,7 +78,7 @@
 	function triggerLoad(): Promise<void> {
 		if (kind === 'flow') return runtime.loadFlow(workspaceId, path)
 		if (kind === 'script') return runtime.loadScript(workspaceId, path)
-		return runtime.loadRawApp(workspaceId, path)
+		return runtime.loadRawApp(workspaceId, path, false, false, newRawApp)
 	}
 
 	function buildCodec(): DraftSyncCodec<any> {
@@ -119,7 +126,8 @@
 			workspace: workspaceId,
 			itemKind: kind,
 			storagePath: path,
-			effectivePath: effectivePath()
+			effectivePath: effectivePath(),
+			isNew: isNew?.() ?? false
 		})
 		return () => UserDraft.clearLiveEditorDraft(kind, { workspace: workspaceId, storagePath: path })
 	})
diff --git a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
index 9a7fb20bd6..2d3d0fbef2 100644
--- a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
+++ b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
@@ -6,7 +6,6 @@
 	import { goto } from '$lib/navigation'
 	import { sendUserToast } from '$lib/toast'
 	import { page } from '$app/state'
-	import { base } from '$lib/base'
 
 	// Which side of the switch is active. `nav` = workspace navigation (the classic
 	// app), `session` = the sessions sidebar + chat + preview.
@@ -47,7 +46,7 @@
 		if (mode !== 'nav') return
 		// `goto` has no same-URL short-circuit, so navigating from home would push a
 		// duplicate history entry and make the next Back press look broken.
-		if (page.url.pathname === `${base}/`) return
+		if (page.url.pathname === '/') return
 		void goto('/')
 	}
 </script>
@@ -69,7 +68,7 @@
 			iconOnly={isCollapsed}
 			tooltip={isCollapsed ? 'Workspace' : undefined}
 			size="sm"
-			class="w-full justify-center"
+			class="w-full justify-center whitespace-nowrap"
 			onActivate={onNavActivate}
 		/>
 		<ToggleButton
@@ -80,7 +79,7 @@
 			iconOnly={isCollapsed}
 			tooltip={isCollapsed ? 'AI Sessions (beta)' : undefined}
 			size="sm"
-			class="w-full justify-center"
+			class="w-full justify-center whitespace-nowrap"
 		/>
 	{/snippet}
 </ToggleButtonGroup>
diff --git a/frontend/src/lib/components/sessions/SessionPicker.svelte b/frontend/src/lib/components/sessions/SessionPicker.svelte
index 9707b537b4..7e8283e406 100644
--- a/frontend/src/lib/components/sessions/SessionPicker.svelte
+++ b/frontend/src/lib/components/sessions/SessionPicker.svelte
@@ -2,7 +2,7 @@
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Checkbox from '$lib/components/common/checkbox/Checkbox.svelte'
-	import { Badge, Button } from '$lib/components/common'
+	import { Button } from '$lib/components/common'
 	import {
 		Archive,
 		ArchiveRestore,
@@ -66,8 +66,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import { currentWorkspaceRootId, workspaceRootId } from './sessionScope.svelte'
 	import { page } from '$app/state'
-	import { base } from '$app/paths'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import {
 		dateBucket,
 		GROUP_BY_OPTIONS,
@@ -119,7 +118,7 @@
 
 	// Only highlight the active session while the sessions page is open — elsewhere
 	// `currentSessionId` lingers but no row should appear selected.
-	const onSessionsPage = $derived(page.url.pathname.startsWith(`${base}/sessions`))
+	const onSessionsPage = $derived(page.url.pathname.startsWith('/sessions'))
 	const sessionActive = $derived(onSessionsPage)
 
 	interface Props {
@@ -1220,9 +1219,12 @@
 									{group.label}
 								</span>
 								{#if groupWs?.is_dev_workspace}
-									<Badge color="gray" small class="text-3xs px-1 py-0 shrink-0">
-										{devBadgeText(groupWs.dev_workspace_label)}
-									</Badge>
+									<DevWorkspaceBadge
+										label={groupWs.dev_workspace_label}
+										color={groupWs.color}
+										fallbackColor="gray"
+										class="text-3xs px-1 py-0 shrink-0"
+									/>
 								{/if}
 								{#if groupWsId}
 									<Button
@@ -1335,8 +1337,8 @@
 	bind:open={seedOfferOpen}
 	kind="X"
 	enterConfirms={false}
-	title="Keep this {seedOffer?.route.kind ?? 'item'} in the new session?"
-	description="You came here from {seedOffer?.route.itemPath ?? ''}."
+	title="Keep this {seedOffer?.kind ?? 'item'} in the new session?"
+	description="You came here from {seedOffer?.path ?? ''}."
 >
 	<p class="text-sm text-secondary">
 		Keeping it opens it in the preview, so the chat starts with it as context.
diff --git a/frontend/src/lib/components/sessions/SessionWrapper.svelte b/frontend/src/lib/components/sessions/SessionWrapper.svelte
index 3335de3d33..af00454f81 100644
--- a/frontend/src/lib/components/sessions/SessionWrapper.svelte
+++ b/frontend/src/lib/components/sessions/SessionWrapper.svelte
@@ -3,7 +3,8 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import AIChat from '$lib/components/copilot/chat/AIChat.svelte'
 	import EditableInput from '$lib/components/common/EditableInput.svelte'
-	import { Button, NameIdTooltip } from '$lib/components/common'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { Button } from '$lib/components/common'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import { AIChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
@@ -17,17 +18,12 @@
 	import {
 		Archive,
 		ArchiveRestore,
-		ArrowUpRight,
 		EllipsisVertical,
-		ExternalLink,
 		MessageSquareDashed,
 		Pencil,
-		Settings,
 		Trash2,
 		X
 	} from 'lucide-svelte'
-	import { type Item } from '$lib/utils'
-	import WorkspaceScopeTrigger from '$lib/components/WorkspaceScopeTrigger.svelte'
 	import SessionWorkspaceBar from './SessionWorkspaceBar.svelte'
 	import SessionChangesBar from './SessionChangesBar.svelte'
 	import { clearSessionRecovered, isSessionRecovered } from './sessionRecoveryNotice.svelte'
@@ -53,17 +49,15 @@
 	} from './sessionState.svelte'
 	import { getOrCreateRuntime, removeSession } from './sessionRuntime.svelte'
 	import { goto } from '$lib/navigation'
-	import { base } from '$app/paths'
 	import { splitterPointerCapture } from '$lib/utils/splitterPointerCapture'
 
-	// headerInset: extra left padding on the chat header so it clears a floating
-	// control (the collapsed-rail launcher) sitting at the screen's top-left.
 	let {
 		sessionId,
-		headerInset = false
+		headerInPage = false
 	}: {
 		sessionId: string
-		headerInset?: boolean
+		/** True for the session the page is showing: its header rides the page header bar. */
+		headerInPage?: boolean
 	} = $props()
 
 	// Parent keys by sessionId; this wrapper only mounts when the session exists.
@@ -112,34 +106,9 @@
 		})
 	})
 
-	// The workspace the session acts on, shown in the header "Acting on" strip via the shared
-	// WorkspaceScopeTrigger chip. `targetId` is also the workspace the chip's ellipsis menu targets.
-	const acting = $derived.by(() => {
-		const wsId = session ? getEffectiveWorkspaceId(session) : undefined
-		if (!wsId) return undefined
-		const name = $userWorkspaces.find((w) => w.id === wsId)?.name ?? wsId
-		return { targetId: wsId, name }
-	})
-
-	// Ellipsis menu on the "Acting on" chip. Both entries are real links (so
-	// modifier/middle clicks open a new tab); the `workspace` query param
-	// points the navigation at the acting workspace — the layout applies it on
-	// both full loads and client-side query changes. The trailing external-link
-	// glyphs make the leave-the-session navigation explicit.
-	const actingMenu = $derived<Item[]>([
-		{
-			displayName: 'Workspace settings',
-			icon: Settings,
-			href: `${base}/workspace_settings?workspace=${acting?.targetId ?? ''}`,
-			extra: externalLinkHint
-		},
-		{
-			displayName: 'Go to this workspace',
-			icon: ArrowUpRight,
-			href: `${base}/?workspace=${acting?.targetId ?? ''}`,
-			extra: externalLinkHint
-		}
-	])
+	// The workspace the session acts on. The page header's breadcrumb scopes itself to it, so a
+	// session running in a fork reads as that fork rather than as the navigation workspace.
+	const actingWorkspaceId = $derived(session ? getEffectiveWorkspaceId(session) : undefined)
 
 	// Load copilot config (models, providers) for the workspace the session acts
 	// on, not the navigation workspace — a session deliberately leaves
@@ -150,7 +119,7 @@
 	// otherwise race to clobber the active chat's model config.
 	$effect(() => {
 		if (sessionState.currentSessionId !== sessionId) return
-		const ws = acting?.targetId ?? $workspaceStore
+		const ws = actingWorkspaceId ?? $workspaceStore
 		if (ws) {
 			loadCopilot(ws)
 		}
@@ -334,10 +303,6 @@
 		'flex flex-row items-center justify-between gap-2 py-2 px-3 text-xs border rounded-md'
 </script>
 
-{#snippet externalLinkHint()}
-	<ExternalLink size={12} class="shrink-0 text-tertiary" />
-{/snippet}
-
 {#if !session || !runtime}
 	<div class="p-8 text-secondary text-sm">Session not found</div>
 {:else}
@@ -411,95 +376,81 @@
 	     sessions have their own empty-state affordances above. -->
 	{#snippet sessionEmptyHint()}{/snippet}
 
+	{#snippet sessionHeader()}
+		<EditableInput
+			bind:this={summaryInput}
+			value={session.summary ?? ''}
+			placeholder="Untitled session"
+			onSave={(v) => renameSession(session.id, v)}
+			class="text-xs font-normal"
+			inputClass="!text-xs !font-normal"
+		/>
+
+		<DropdownV2
+			fixedHeight={false}
+			placement="bottom-start"
+			enableFlyTransition
+			items={[
+				{
+					displayName: 'Rename',
+					icon: Pencil,
+					action: () => summaryInput?.edit()
+				},
+				...(session.archived
+					? // No Unarchive when the workspace is gone — it can't persist
+						// (putSession guard) and reconcile would re-archive it.
+						isUnavailable
+						? []
+						: [
+								{
+									displayName: 'Unarchive',
+									icon: ArchiveRestore,
+									action: () => setSessionArchived(session.id, false)
+								}
+							]
+					: [
+							{
+								displayName: 'Archive',
+								icon: Archive,
+								action: () => archiveAndReset()
+							}
+						]),
+				{
+					displayName: 'Delete',
+					icon: Trash2,
+					type: 'delete',
+					action: () => (deleteConfirmOpen = true)
+				}
+			]}
+		>
+			{#snippet buttonReplacement()}
+				<span
+					class="inline-flex items-center justify-center w-5 h-5 rounded text-tertiary hover:bg-surface-hover hover:text-primary"
+					title="More"
+				>
+					<EllipsisVertical size={14} />
+				</span>
+			{/snippet}
+		</DropdownV2>
+	{/snippet}
+
+	{#if headerInPage}
+		<!-- The chat's own header row is the page header on this route: the session's name is its
+		     breadcrumb, and the menu is its action. The workspace it acts on is named by the
+		     breadcrumb's own workspace part, the way every other route names it — a session in a
+		     fork reads like anything else in that fork. -->
+		<PageHeaderContent
+			section={{ label: session.summary ?? 'Untitled session', content: sessionHeader }}
+			{actingWorkspaceId}
+		/>
+	{/if}
+
 	<!-- The wrapper contributes only the chat column; edited items are shown in the
 	     page's preview tabs (PreviewTabHost) beside it, not a second pane here. The
 	     single Pane fills 100% (no explicit `size`, so Splitpanes auto-distributes). -->
 	<div class="flex-1 min-h-0 flex flex-col" use:splitterPointerCapture>
 		<Splitpanes horizontal={false} class="flex-1 min-h-0 splitter-hidden">
 			<Pane minSize={25} class="flex flex-col min-h-0 pb-2">
-				<header
-					class="flex flex-row items-center gap-1 {headerInset
-						? 'pl-11'
-						: 'pl-4'} pr-4 py-2 shrink-0"
-				>
-					<EditableInput
-						bind:this={summaryInput}
-						value={session.summary ?? ''}
-						placeholder="Untitled session"
-						onSave={(v) => renameSession(session.id, v)}
-						class="text-sm font-semibold"
-						inputClass="!text-sm !font-semibold"
-					/>
-					<DropdownV2
-						fixedHeight={false}
-						placement="bottom-start"
-						enableFlyTransition
-						items={[
-							{
-								displayName: 'Rename',
-								icon: Pencil,
-								action: () => summaryInput?.edit()
-							},
-							...(session.archived
-								? // No Unarchive when the workspace is gone — it can't persist
-									// (putSession guard) and reconcile would re-archive it.
-									isUnavailable
-									? []
-									: [
-											{
-												displayName: 'Unarchive',
-												icon: ArchiveRestore,
-												action: () => setSessionArchived(session.id, false)
-											}
-										]
-								: [
-										{
-											displayName: 'Archive',
-											icon: Archive,
-											action: () => archiveAndReset()
-										}
-									]),
-							{
-								displayName: 'Delete',
-								icon: Trash2,
-								type: 'delete',
-								action: () => (deleteConfirmOpen = true)
-							}
-						]}
-					>
-						{#snippet buttonReplacement()}
-							<span
-								class="inline-flex items-center justify-center w-5 h-5 rounded text-tertiary hover:bg-surface-hover hover:text-primary"
-								title="More"
-							>
-								<EllipsisVertical size={14} />
-							</span>
-						{/snippet}
-					</DropdownV2>
-					{#if acting && hasFirstUserMessage}
-						<!-- "Acting on" context: workspace root (avatar + name) and, when the
-					     session runs in a fork, the fork name (accent pill) — with a button
-					     to jump into that workspace. Compact; sits right after the title.
-					     Hidden until the session has started — a new (un-sent) session shows
-					     the "Run in" picker (SessionWorkspaceBar) instead. -->
-						<div class="flex items-center gap-1 min-w-0 text-2xs text-tertiary">
-							<span class="shrink-0">Acting on</span>
-							<!-- Hover reveals the workspace name + id + copy button (shared
-							     NameIdTooltip, same as the sidebar family picker), so the chip
-							     carries the copy affordance without an inline button. -->
-							<NameIdTooltip name={acting.name} id={acting.targetId}>
-								<WorkspaceScopeTrigger
-									workspaceId={acting.targetId}
-									showChevron={false}
-									interactive={false}
-									disableTitle
-									class="max-w-[16rem]"
-									menuItems={actingMenu}
-								/>
-							</NameIdTooltip>
-						</div>
-					{/if}
-				</header>
 				<div class="flex-1 min-h-0 w-full flex flex-col {hasFirstUserMessage ? '' : 'pt-8'}">
 					<AIChat
 						bind:this={aiChat}
diff --git a/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte b/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte
index 86b6ba030a..0d523a4e65 100644
--- a/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte
+++ b/frontend/src/lib/components/sessions/SessionsBetaBanner.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import { Button } from '$lib/components/common'
 	import { classes as alertClasses, icons as alertIcons } from '$lib/components/common/alert/model'
 	import { clearSessionsBetaOptOut } from '$lib/components/copilot/chat/global/gate'
@@ -22,7 +21,7 @@
 		<Button
 			variant="subtle"
 			unifiedSize="xs"
-			onclick={() => clearSessionsBetaOptOut(`${base}/sessions`)}
+			onclick={() => clearSessionsBetaOptOut('/sessions')}
 		>
 			Activate
 		</Button>
diff --git a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
index 6501dc8d3e..f5b7e8d34f 100644
--- a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
+++ b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
@@ -32,8 +32,9 @@
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import InputError from '$lib/components/InputError.svelte'
 	import PrefixedInput from '$lib/components/PrefixedInput.svelte'
-	import { Badge, Button, CopyButton } from '$lib/components/common'
-	import { devBadgeText, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
+	import { Button, CopyButton } from '$lib/components/common'
+	import { devLabelNoun } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 	import Select from '../select/Select.svelte'
 	import { Building, Check, GitFork, Plus, Settings } from 'lucide-svelte'
 
@@ -448,12 +449,12 @@
 								>{f.name}</span
 							>
 							{#if f.is_dev_workspace}
-								<Badge
-									color="dark-blue"
-									small
-									class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-									>{devBadgeText(f.dev_workspace_label)}</Badge
-								>
+								<DevWorkspaceBadge
+									label={f.dev_workspace_label}
+									color={f.color}
+									fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+									class="text-3xs px-1 py-0"
+								/>
 							{/if}
 							{#if isSelected(f.id)}
 								<Check size={14} class="shrink-0 ml-auto text-accent" />
diff --git a/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts b/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
index 6cad6121cd..e5f4ff9873 100644
--- a/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
+++ b/frontend/src/lib/components/sessions/modifiedItemsMask.test.ts
@@ -62,6 +62,12 @@ describe('diffInMask', () => {
 		expect(diffInMask(diff('script', 'u/me/s'), mask)).toBe(true)
 	})
 
+	it('selects only the scripts a masked pipeline deployed, not the rest of its folder', () => {
+		const mask = new Set(['data_pipeline:f/crm/data_pipeline', 'script:f/crm/clean'])
+		expect(diffInMask(diff('script', 'f/crm/clean'), mask)).toBe(true)
+		expect(diffInMask(diff('script', 'f/crm/unrelated'), mask)).toBe(false)
+	})
+
 	it('matches a legacy app diff under both its identity and bridged mask keys', () => {
 		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['app:u/me/legacy']))).toBe(true)
 		expect(diffInMask(diff('app', 'u/me/legacy'), new Set(['raw_app:u/me/legacy']))).toBe(true)
diff --git a/frontend/src/lib/components/sessions/modifiedItemsMask.ts b/frontend/src/lib/components/sessions/modifiedItemsMask.ts
index 7d0d3abbae..d597c46ec9 100644
--- a/frontend/src/lib/components/sessions/modifiedItemsMask.ts
+++ b/frontend/src/lib/components/sessions/modifiedItemsMask.ts
@@ -1,4 +1,5 @@
 import type { UserDraftItemKind, WorkspaceItemDiff } from '$lib/gen'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 
 // The "modified items mask" tracks which workspace items an AI chat touched via
 // tool calls. Each key is `${UserDraftItemKind}:${storagePath}`. UserDraftItemKind
@@ -45,6 +46,21 @@ export function forkDiffKindToUserDraftKind(kind: ForkDiffKind): UserDraftItemKi
 	return FORK_DIFF_KIND_TO_USER_DRAFT_KIND[kind]
 }
 
+// A pipeline the chat edited is masked as its folder's draft bundle, and each
+// script that bundle deploys is masked too, so a fork review selects exactly
+// those. The session's changes list shows deployed scripts of a masked
+// pipeline's folder as that pipeline's one row — any of them, since a script's
+// mask entry does not say whether a pipeline deploy or the chat put it there.
+export function foldedIntoPipelineRow(
+	mask: ReadonlySet<string>,
+	kind: UserDraftItemKind,
+	path: string
+): boolean {
+	if (kind !== 'script') return false
+	const folder = path.match(/^f\/([^/]+)\//)?.[1]
+	return !!folder && mask.has(maskKey(PIPELINE_DRAFT_KIND, pipelineBundlePath(folder)))
+}
+
 // True when a fork-comparison diff names an item present in the chat-modified mask.
 export function diffInMask(diff: WorkspaceItemDiff, mask: Set<string>): boolean {
 	const kind = forkDiffKindToUserDraftKind(diff.kind)
diff --git a/frontend/src/lib/components/sessions/openInSessionContext.ts b/frontend/src/lib/components/sessions/openInSessionContext.ts
index ddecb01b4f..af1a5113ad 100644
--- a/frontend/src/lib/components/sessions/openInSessionContext.ts
+++ b/frontend/src/lib/components/sessions/openInSessionContext.ts
@@ -1,6 +1,6 @@
 import { getContext, onDestroy, setContext } from 'svelte'
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
-import type { PreviewItemRoute } from './previewPaths'
+import type { SessionTarget } from './sessionState.svelte'
 
 // The "Open in AI session" hand-off, published by the component that owns the
 // item being edited (FlowBuilder, RawAppEditor) for AI entry points too deep in
@@ -38,20 +38,17 @@ export function getOpenInSessionHandoff(): OpenInSessionHandoff | undefined {
 	return getContext<OpenInSessionHandoff | undefined>(KEY)
 }
 
-/** The mounted editor's hand-off for the item `route` names, or undefined when
- * no editor on screen publishes one for it (a legacy app, a detail page).
- * Matched on the item rather than taken as "the latest registered": a script
- * editor mounted in a flow's drawer registers too, and the rail wants the
- * page's own item. */
+/** The mounted editor's hand-off for `target`, or undefined when no editor on
+ * screen publishes one for it (a detail page). Matched on the item rather than
+ * taken as "the latest registered": a script editor mounted in a flow's drawer
+ * registers too, and the rail wants the page's own item. */
 export function findMountedOpenInSessionSource(
-	route: PreviewItemRoute
+	target: SessionTarget
 ): OpenInSessionSource | undefined {
-	const kind = route.kind === 'app' ? (route.raw_app ? 'raw_app' : undefined) : route.kind
-	if (!kind) return undefined
 	for (const handoff of mounted) {
 		const source = handoff.source()
-		const target = source?.target
-		if (target && target.kind === kind && target.path === route.itemPath) return source
+		const t = source?.target
+		if (t && t.kind === target.kind && t.path === target.path) return source
 	}
 	return undefined
 }
diff --git a/frontend/src/lib/components/sessions/pageDrawerSession.ts b/frontend/src/lib/components/sessions/pageDrawerSession.ts
index 0a3e7435ca..35d0a4560b 100644
--- a/frontend/src/lib/components/sessions/pageDrawerSession.ts
+++ b/frontend/src/lib/components/sessions/pageDrawerSession.ts
@@ -12,8 +12,7 @@ import type { UserDraftItemKind } from '$lib/gen'
 // every trigger's save utils eager.
 import {
 	drawerHashFor,
-	pageHref,
-	stripBase,
+	barePath,
 	TRIGGER_PAGES,
 	RESOURCES_PATH,
 	SCHEDULES_PATH,
@@ -77,7 +76,7 @@ async function flushOrRefuse(query: Parameters<typeof UserDraftDbSyncer.flush>[0
 export function setPageDrawerAnchor(pagePath: string, itemPath: string | undefined): void {
 	if (!itemPath) return
 	const { pathname, search, hash } = window.location
-	if (stripBase(pathname) !== pagePath) return
+	if (barePath(pathname) !== pagePath) return
 	const anchor = `#${drawerHashFor(pagePath, itemPath)}`
 	if (hash === anchor) return
 	history.replaceState(history.state, '', `${pathname}${search}${anchor}`)
@@ -94,7 +93,7 @@ export async function clearPageDrawerAnchor(pagePath: string): Promise<void> {
 	// filters with shallow routing, which never reaches `page.url`, so rebuilding the query
 	// from it would drop the filters the user typed along with the anchor.
 	const { pathname, search, hash } = window.location
-	if (stripBase(pathname) !== pagePath || !hash) return
+	if (barePath(pathname) !== pagePath || !hash) return
 	await goto(`${pathname}${search}`, { replaceState: true, noScroll: true })
 }
 
@@ -112,14 +111,14 @@ export function pageDrawerSessionSource(
 	itemPath: string | undefined,
 	workspaceId: string | undefined
 ): OpenInSessionSource | undefined {
-	if (!itemPath || stripBase(page.url.pathname) !== pagePath) return undefined
+	if (!itemPath || barePath(page.url.pathname) !== pagePath) return undefined
 	const anchor = drawerHashFor(pagePath, itemPath)
 	const itemKind = DRAWER_DRAFT_KIND[pagePath]
 	return {
 		// The list behind the drawer is part of what the user is looking at, and its filters
 		// are written with shallow routing — so the query has to come from the document at
 		// click time, as the thunk exists for.
-		page: () => `${pageHref(pagePath)}${window.location.search}#${anchor}`,
+		page: () => `${pagePath}${window.location.search}#${anchor}`,
 		workspaceId,
 		// Autosave is debounced, and the preview reads the draft back through the server
 		// from a document of its own — routing before the POST lands opens the drawer on a
diff --git a/frontend/src/lib/components/sessions/previewPaths.ts b/frontend/src/lib/components/sessions/previewPaths.ts
index 10ad5b00ef..535cb1a272 100644
--- a/frontend/src/lib/components/sessions/previewPaths.ts
+++ b/frontend/src/lib/components/sessions/previewPaths.ts
@@ -1,5 +1,5 @@
-import { base } from '$lib/base'
 import type { WorkspaceItemKind } from '$lib/components/workspacePicker'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 
 // The paths a preview location can point at, and the base handling around them. Kept apart
 // from `previewRouter`, which reads a location's *view* from each page's filter schema and
@@ -62,7 +62,7 @@ export const drawerHashFor = (pagePath: string, itemPath: string) =>
 /** The full page a page item is edited on: its list page, with the row's drawer open. */
 export function pageItemPageHref(ref: PageItemRef): string {
 	const listPath = pageItemListPath(ref)
-	return `${pageHref(listPath)}#${drawerHashFor(listPath, ref.path)}`
+	return `${listPath}#${drawerHashFor(listPath, ref.path)}`
 }
 
 /** The list page a page item is edited from. */
@@ -79,14 +79,14 @@ export function pageItemListPath(ref: PageItemRef): string {
 	}
 }
 
-/** Whether a (base-stripped) path is the list page of a page item kind. */
+/** Whether a path is the list page of a page item kind. */
 export function isPageItemListPath(path: string): boolean {
 	return pageItemForListPath(path, '') !== undefined
 }
 
 /** The page item a list page's row names, or undefined for a page that lists none. */
 export function pageItemForListPath(pagePath: string, path: string): PageItemRef | undefined {
-	const clean = stripBase(pagePath)
+	const clean = barePath(pagePath)
 	if (clean === VARIABLES_PATH) return { kind: 'variable', path }
 	if (clean === RESOURCES_PATH) return { kind: 'resource', path }
 	if (clean === SCHEDULES_PATH) return { kind: 'schedule', path }
@@ -134,21 +134,18 @@ export function pageItemKindLabel(ref: PageItemRef): string {
 	}
 }
 
-/** Label a trigger list page from its (base-stripped) pathname, or undefined. */
+/** Label a trigger list page from its pathname, or undefined. */
 export function triggerLabelForPath(path: string): string | undefined {
-	const clean = stripBase(path)
+	const clean = barePath(path)
 	return Object.values(TRIGGER_PAGES).find((t) => t.path === clean)?.label
 }
 
 export const pageKey = (path: string) => `page:${path}`
-export const pageHref = (path: string) => `${base}${path}`
 
-/** Strip the deployment base prefix (and any query/hash) from a preview path
- * so it can be matched against `PREVIEW_PAGES` / parsed as an item route. */
-export function stripBase(path: string): string {
-	let p = path.split('?')[0].split('#')[0]
-	if (base && p.startsWith(base)) p = p.slice(base.length)
-	return p || '/'
+/** Strip the query and hash from a preview path so it can be matched against
+ * `PREVIEW_PAGES` / parsed as an item route. */
+export function barePath(path: string): string {
+	return path.split('?')[0].split('#')[0] || '/'
 }
 
 /** Which side of an item a route addresses: `/edit/` builds it, `/get/` shows the
@@ -166,7 +163,7 @@ export type PreviewItemRoute = {
 // non-item page (home, runs, …). Shared by the breadcrumb (drill segments) and
 // `previewRouter`'s tab resolver so both agree on what counts as an item route.
 export function parsePreviewItemRoute(fullPath: string): PreviewItemRoute | null {
-	const p = stripBase(fullPath)
+	const p = barePath(fullPath)
 	const m = p.match(/^\/(scripts|flows|apps|apps_raw)\/(edit|get)\/(.+)$/)
 	if (!m) return null
 	const itemPath = decodeURIComponent(m[3])
@@ -186,3 +183,11 @@ export function parseHistoricalScriptEdit(url: string): { path: string; hash: st
 	const hash = new URL(url, 'http://x').searchParams.get('hash')
 	return hash ? { path: route.itemPath, hash } : null
 }
+
+// A `/pipeline/<folder>` route is the data-pipeline graph editor for that folder
+// (the folder is a single path segment, not a workspace item path). The bare
+// `/pipeline` list page is not an editor. Returns the folder name, or null.
+export function parsePipelineRoute(fullPath: string): string | null {
+	const m = barePath(fullPath).match(/^\/pipeline\/([^/?#]+)/)
+	return m ? normalizePipelineFolder(decodeURIComponent(m[1])) : null
+}
diff --git a/frontend/src/lib/components/sessions/previewReload.ts b/frontend/src/lib/components/sessions/previewReload.ts
index d9259c900d..6d22309ee1 100644
--- a/frontend/src/lib/components/sessions/previewReload.ts
+++ b/frontend/src/lib/components/sessions/previewReload.ts
@@ -5,13 +5,13 @@ import {
 	pageItemUrl,
 	parsePageItemRoute,
 	parsePreviewItemRoute,
-	stripBase,
+	barePath,
 	TRIGGER_PAGES,
 	type PageItemRef,
 	type TriggerKind
 } from './previewPaths'
 
-// Which list pages a completed chat tool can change, as base-stripped paths
+// Which list pages a completed chat tool can change, as paths
 // (e.g. `/schedules`). This allowlist is the single source of truth for "does
 // this tool change a list page a preview tab might show". A new mutating tool
 // that surfaces on one of these pages must be added here or that tab silently
@@ -128,7 +128,7 @@ export function tabsToReload(
 	if (pages.size === 0) return []
 	return tabs.filter((t) => {
 		const pageItem = parsePageItemRoute(t.url)
-		if (!pageItem) return pages.has(stripBase(whereIs(t)))
+		if (!pageItem) return pages.has(barePath(whereIs(t)))
 		const listPath = pageItemListPath(pageItem)
 		if (!pages.has(listPath)) return false
 		const named = [...items].some((u) => pageItemListPath(parsePageItemRoute(u)!) === listPath)
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index 6614adfe80..2de5354c4d 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -9,14 +9,14 @@ import {
 	pageItemPageHref,
 	pageItemUrl,
 	pageKey,
-	pageHref,
 	parsePageItemRoute,
+	parsePipelineRoute,
 	parseHistoricalScriptEdit,
 	parsePreviewItemRoute,
 	RESOURCES_PATH,
 	RUNS_PATH,
 	SCHEDULES_PATH,
-	stripBase,
+	barePath,
 	VARIABLES_PATH,
 	WORKSPACE_SETTINGS_PATH,
 	triggerLabelForPath,
@@ -26,17 +26,19 @@ import {
 	type PreviewItemRoute,
 	type TriggerKind
 } from './previewPaths'
+import type { UserExt, UserWorkspace } from '$lib/stores'
+import { sidebarPageAllowed, type OperatorPageKey } from '../sidebar/operatorRoutes'
 // Re-exported so the preview code that already reads locations through this module keeps
 // one import, while a caller needing only a path can reach for the leaf instead.
 export {
 	pageItemListPath,
 	pageItemUrl,
 	pageKey,
-	pageHref,
 	parseHistoricalScriptEdit,
 	parsePageItemRoute,
+	parsePipelineRoute,
 	parsePreviewItemRoute,
-	stripBase,
+	barePath,
 	TRIGGER_PAGES,
 	type PageItemRef,
 	type PreviewItemMode,
@@ -63,7 +65,6 @@ import { buildVariablesFilterSchema } from '$lib/components/variables/variablesF
 import { buildResourcesFilterSchema } from '$lib/components/resources/resourcesFilter'
 import { buildAssetsFilterSchema } from '$lib/components/assets/assetsFilter'
 import { COMPARE_ITEMS_PARAM } from './modifiedItemsMask'
-import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import type { WorkspaceItem } from '$lib/components/workspacePicker'
 import type { SessionTargetKind } from './sessionRuntime.svelte'
 
@@ -102,22 +103,40 @@ export function previewModeFor(item: Pick<WorkspaceItem, 'draftOnly'>): PreviewI
 	return item.draftOnly ? 'edit' : 'view'
 }
 
-export type PreviewPage = { label: string; path: string; icon: DrillIcon }
+export type PreviewPage = {
+	label: string
+	path: string
+	icon: DrillIcon
+	/** The `operator_settings` key that admits an operator, as the sidebar reads it. */
+	operatorKey?: OperatorPageKey
+	adminOnly?: boolean
+}
+
+/** Whether `page` loads for `user` rather than showing its "not available" state. An unknown
+ * user is let through to every page but the admin-only ones. */
+export function previewPageAllowed(
+	page: PreviewPage,
+	user: Pick<UserExt, 'operator' | 'is_admin' | 'is_super_admin'> | undefined,
+	workspace: UserWorkspace | undefined
+): boolean {
+	if (page.adminOnly) return !!user && (user.is_admin || user.is_super_admin)
+	return !page.operatorKey || sidebarPageAllowed(user?.operator, workspace, page.operatorKey)
+}
 
 // Core workspace-level destinations the preview can route to. Intentionally
 // curated — the main pages, not every trigger sub-page (those live behind
 // EE/feature gating in SidebarContent and aren't worth duplicating here).
 export const PREVIEW_PAGES: PreviewPage[] = [
 	{ label: 'Home', path: '/', icon: Home },
-	{ label: 'Runs', path: RUNS_PATH, icon: Play },
-	{ label: 'Variables', path: VARIABLES_PATH, icon: DollarSign },
-	{ label: 'Resources', path: RESOURCES_PATH, icon: Boxes },
-	{ label: 'Schedules', path: SCHEDULES_PATH, icon: Calendar },
-	{ label: 'Assets', path: ASSETS_PATH, icon: Database },
-	{ label: 'Folders', path: FOLDERS_PATH, icon: FolderOpen },
-	{ label: 'Groups', path: GROUPS_PATH, icon: Users },
-	{ label: 'Workspace settings', path: WORKSPACE_SETTINGS_PATH, icon: Settings },
-	{ label: 'Audit logs', path: AUDIT_LOGS_PATH, icon: ScrollText }
+	{ label: 'Runs', path: RUNS_PATH, icon: Play, operatorKey: 'runs' },
+	{ label: 'Variables', path: VARIABLES_PATH, icon: DollarSign, operatorKey: 'variables' },
+	{ label: 'Resources', path: RESOURCES_PATH, icon: Boxes, operatorKey: 'resources' },
+	{ label: 'Schedules', path: SCHEDULES_PATH, icon: Calendar, operatorKey: 'schedules' },
+	{ label: 'Assets', path: ASSETS_PATH, icon: Database, operatorKey: 'assets' },
+	{ label: 'Folders', path: FOLDERS_PATH, icon: FolderOpen, operatorKey: 'folders' },
+	{ label: 'Groups', path: GROUPS_PATH, icon: Users, operatorKey: 'groups' },
+	{ label: 'Workspace settings', path: WORKSPACE_SETTINGS_PATH, icon: Settings, adminOnly: true },
+	{ label: 'Audit logs', path: AUDIT_LOGS_PATH, icon: ScrollText, operatorKey: 'audit_logs' }
 ]
 
 // The Compare & Deploy review page. Kept out of PREVIEW_PAGES (it's not a picker
@@ -142,7 +161,7 @@ const DRAWER_ANCHOR_PAGES = [SCHEDULES_PATH, VARIABLES_PATH, RESOURCES_PATH] as
 export function drawerAnchorFor(location: string): string | undefined {
 	const hashAt = location.indexOf('#')
 	if (hashAt < 0) return undefined
-	const route = stripBase(location)
+	const route = barePath(location)
 	const known =
 		(DRAWER_ANCHOR_PAGES as readonly string[]).includes(route) ||
 		Object.values(TRIGGER_PAGES).some((p) => p.path === route)
@@ -230,7 +249,7 @@ function pageRequestParamTable(): Record<string, readonly string[]> {
 
 /** The query params a request can set on `path` — empty for a page that takes none. */
 export function pageRequestParams(path: string): readonly string[] {
-	return pageRequestParamTable()[stripBase(path)] ?? []
+	return pageRequestParamTable()[barePath(path)] ?? []
 }
 
 /** What a preview location means, read against the page it points at. */
@@ -262,7 +281,7 @@ export function describeLocation(loc: string): PreviewLocation {
 		return { identity: `/scripts/edit/${historical.path}@${historical.hash}`, view: '', anchor: '' }
 	}
 	const canonical = canonicalizeObservedLoc(loc)
-	const path = stripBase(canonical)
+	const path = barePath(canonical)
 	const bare = canonical.split('#')[0]
 	const query = bare.includes('?') ? bare.slice(bare.indexOf('?') + 1) : ''
 	return {
@@ -414,10 +433,10 @@ export function previewLocationContext(loc: string): {
 	}
 }
 
-// Match a base-stripped preview pathname to a known page, for breadcrumb
+// Match a preview pathname to a known page, for breadcrumb
 // labelling + picker highlight. Exact match; '/' only matches home.
 export function matchPreviewPage(path: string): PreviewPage | undefined {
-	const clean = stripBase(path)
+	const clean = barePath(path)
 	return PREVIEW_PAGES.find((p) => p.path === clean)
 }
 
@@ -427,7 +446,7 @@ export function matchPreviewPage(path: string): PreviewPage | undefined {
  * matched — they take the generic path in `SessionPreviewTabs.open`, which
  * dedupes on the location ignoring the hash and re-points the tab it finds. */
 export function matchReusablePage(href: string): PreviewPage | undefined {
-	if (stripBase(href) === COMPARE_PAGE.path) return COMPARE_PAGE
+	if (barePath(href) === COMPARE_PAGE.path) return COMPARE_PAGE
 	return matchPreviewPage(href)
 }
 
@@ -445,11 +464,11 @@ export function previewLocationLabel(url: string): string {
 	if (page) return page.label
 	const trigger = triggerLabelForPath(url)
 	if (trigger) return trigger
-	const run = stripBase(url).match(/^\/run\/([^/?#]+)/)
+	const run = barePath(url).match(/^\/run\/([^/?#]+)/)
 	// Job ids are time-ordered, so runs started moments apart share their head.
 	if (run) return `Run ${decodeURIComponent(run[1]).slice(-8)}`
 	// The runs of one item, as a detail page's Runs button links them.
-	const itemRuns = stripBase(url).match(/^\/runs\/(.+)$/)
+	const itemRuns = barePath(url).match(/^\/runs\/(.+)$/)
 	if (itemRuns) return `Runs · ${decodeURIComponent(itemRuns[1]).split('/').pop()}`
 	const pipelineFolder = parsePipelineRoute(url)
 	if (pipelineFolder) return pipelineFolder
@@ -457,7 +476,7 @@ export function previewLocationLabel(url: string): string {
 	if (historical) return `${historical.path.split('/').pop()} @ ${historical.hash.slice(0, 8)}`
 	const parsed = parsePreviewItemRoute(url)
 	if (parsed) return parsed.itemPath.split('/').pop() ?? parsed.itemPath
-	return stripBase(url)
+	return barePath(url)
 }
 
 /** The friendly display leaf for a preview tab, or `undefined` to fall back to
@@ -502,14 +521,6 @@ export function parsePreviewSelectedId(url: string): string | undefined {
 	}
 }
 
-// A `/pipeline/<folder>` route is the data-pipeline graph editor for that folder
-// (the folder is a single path segment, not a workspace item path). The bare
-// `/pipeline` list page is not an editor. Returns the folder name, or null.
-export function parsePipelineRoute(fullPath: string): string | null {
-	const m = stripBase(fullPath).match(/^\/pipeline\/([^/?#]+)/)
-	return m ? normalizePipelineFolder(decodeURIComponent(m[1])) : null
-}
-
 // The id (before the query) is the artifact's stable routing identity; the name rides in the
 // hash so the tab strip labels it without a store lookup, and the version in the query so the
 // tab persists it.
@@ -562,9 +573,9 @@ export const isArtifactKey = (key: string) => key.startsWith('artifact:')
 // How a preview tab should render: as an in-process live editor, the deployed
 // item's view page, or an iframe fallback. An item of a wrappable kind (script,
 // flow, raw app) mounts its per-(kind,path) cell editor on `/edit/` and its viewer
-// on `/get/`; a `/pipeline/<folder>` route mounts the data-pipeline graph editor
-// (single, shared runtime.pipelineEditorState — `path` is the folder); the list page
-// of a page item kind mounts that list; everything
+// on `/get/`; a `/pipeline/<folder>` route mounts the data-pipeline graph editor of
+// that folder (`path` is the folder); the list page of a page item kind mounts that
+// list; everything
 // else (static pages, regular drag-and-drop apps, any other route) stays an iframe.
 export type PreviewSlot =
 	| { kind: 'editor'; editorKind: SessionTargetKind | 'pipeline'; path: string }
@@ -582,7 +593,7 @@ export function resolvePreviewTab(url: string): PreviewSlot {
 	if (runForm) return { kind: 'runform', toolCallId: runForm.toolCallId }
 	const pageItem = parsePageItemRoute(url)
 	if (pageItem) return { kind: 'pageitem', ref: pageItem }
-	const route = stripBase(url)
+	const route = barePath(url)
 	if (isPageItemListPath(route)) return { kind: 'pagelist', path: route }
 	const pipelineFolder = parsePipelineRoute(url)
 	if (pipelineFolder) {
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts b/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
index 981b4cc752..f22ffdd0b7 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.svelte.ts
@@ -1,6 +1,9 @@
 import { getDraftItems, type DraftItem } from '$lib/workspaceDrafts.svelte'
+import { get } from 'svelte/store'
+import { userWorkspaces } from '$lib/stores'
 import {
 	checkDeployPermission,
+	checkDeployRules,
 	checkItemExists,
 	deployPermissionForKind,
 	getItemValue,
@@ -27,6 +30,8 @@ import {
 import { maskKey } from './modifiedItemsMask'
 import { sessionState } from './sessionState.svelte'
 import { logFeatureUsage } from '$lib/utils/featureUsage'
+import { AssetService } from '$lib/gen'
+import { PIPELINE_DRAFT_KIND, pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 
 export type DeploymentStatus = { status: 'loading' | 'failed'; error?: string }
 
@@ -52,6 +57,9 @@ export interface SessionDeployModelArgs {
 	onItemDiscarded?: (item: DeployItem) => void
 	/** Chat-modified-items mask; undefined shows every draft. */
 	mask?: Set<string>
+	/** Deploys a pipeline folder's draft bundle, which no per-item deploy can: it
+	 *  expands into the folder's scripts and triggers. */
+	deployPipeline?: (folder: string) => Promise<DeployResult>
 }
 
 export interface DiffValues {
@@ -59,6 +67,15 @@ export interface DiffValues {
 	after: unknown
 }
 
+// A pipeline has no row of its own: it exists while its folder holds pipeline scripts.
+async function itemExists(kind: Kind, path: string, workspace: string): Promise<boolean> {
+	if (kind !== PIPELINE_DRAFT_KIND) return checkItemExists(kind, path, workspace)
+	const folder = pipelineFolderFromBundlePath(path)
+	if (!folder) return false
+	const pipelines = await AssetService.listPipelineFolders({ workspace })
+	return pipelines.some((p) => p.folder === folder)
+}
+
 /** Resolves which mask-only candidates still exist in the session workspace
  *  (deployed) vs are gone (discarded drafts / deleted items) — the
  *  `existingKeys` input of `buildDeployItems`. Undefined while resolving, so
@@ -100,7 +117,7 @@ export function useExistingMaskKeys(
 			// workspace; a discarded or deleted one doesn't.
 			void Promise.all(
 				cands.map((c) =>
-					checkItemExists(c.deployKind, c.path, workspaceId)
+					itemExists(c.deployKind, c.path, workspaceId)
 						.then((exists) => (exists ? c.key : null))
 						.catch(() => null)
 				)
@@ -214,6 +231,9 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 	// button disables with a reason instead of failing on click. `ok` defaults
 	// true while resolving (fail-open).
 	let deployPerm = $state<DeployPermission>({ ok: true })
+	// `checkDeployPermission` refuses every operator, but flows.rs lets one with the
+	// workspace's `builder_flows` right deploy flows, under the rules alone.
+	let builderFlowPerm = $state<DeployPermission | undefined>(undefined)
 	let deployPermFetchedFor = ''
 	$effect(() => {
 		const ws = getArgs().workspaceId
@@ -223,12 +243,25 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 			// Reset to fail-open for the new workspace and drop a stale resolution
 			// (a slower fetch for the previous workspace must not gate this one).
 			deployPerm = { ok: true }
-			void checkDeployPermission(ws).then((perm) => {
-				if (deployPermFetchedFor === ws) deployPerm = perm
+			builderFlowPerm = undefined
+			void checkDeployPermission(ws).then(async (perm) => {
+				if (deployPermFetchedFor !== ws) return
+				deployPerm = perm
+				const builder =
+					get(userWorkspaces).find((w) => w.id === ws)?.operator_settings?.builder_flows === true
+				if (perm.refusedBy === 'operator' && builder) {
+					const rules = await checkDeployRules(ws)
+					if (deployPermFetchedFor === ws) builderFlowPerm = rules
+				}
 			})
 		})
 	})
 
+	function permissionFor(kind: Kind): DeployPermission {
+		if (kind === 'flow' && builderFlowPerm) return deployPermissionForKind(builderFlowPerm, kind)
+		return deployPermissionForKind(deployPerm, kind)
+	}
+
 	// ── Deploy execution ─────────────────────────────────────────────────────
 	// Per-item transient deploy state (keyed by DeployItem.key): loading or
 	// failed. Success has no status — the row's badge flipping to Deployed is
@@ -246,11 +279,18 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 	async function runPlan(entry: DeployPlanEntry): Promise<DeployResult> {
 		const cur = getArgs().workspaceId
 		switch (entry.op) {
-			case 'deploy_draft':
+			case 'deploy_draft': {
+				const folder =
+					entry.draftKind === PIPELINE_DRAFT_KIND
+						? pipelineFolderFromBundlePath(entry.path)
+						: undefined
+				const deployPipeline = getArgs().deployPipeline
+				if (folder && deployPipeline) return deployPipeline(folder)
 				return deployDraft(entry.draftKind, entry.path, cur, {
 					draftOnly: entry.draftOnly,
 					rawApp: entry.rawApp
 				})
+			}
 			case 'discard':
 				return discardDraft(entry.draftKind, entry.path, cur, entry.draftOnly, entry.legacy)
 		}
@@ -271,8 +311,7 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 		// Don't attempt a deploy we know the user can't make (no write permission on
 		// the path, or refused by the preflight for this kind) — the UI disables it
 		// too; this is the guard behind that.
-		if (!discard && (!item.canWrite || !deployPermissionForKind(deployPerm, item.deployKind).ok))
-			return false
+		if (!discard && (!item.canWrite || !permissionFor(item.deployKind).ok)) return false
 		setStatus(item.key, { status: 'loading' })
 		deploying = true
 		try {
@@ -314,6 +353,16 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 
 	// ── Diff values (one resolver for tree + column) ─────────────────────────
 	async function loadDiffValues(item: DeployItem): Promise<DiffValues> {
+		const pipelineFolder =
+			item.draftKind === PIPELINE_DRAFT_KIND ? pipelineFolderFromBundlePath(item.path) : undefined
+		if (pipelineFolder) {
+			// Dynamic: the pipeline deploy module reaches every trigger kind's save utils.
+			const { loadPipelineDraftDiff } = await import(
+				'$lib/components/assets/AssetGraph/pipelineDeploy.svelte'
+			)
+			if (item.hasDraft) return loadPipelineDraftDiff(getArgs().workspaceId, pipelineFolder)
+			return { before: undefined, after: undefined }
+		}
 		const base = diffBaseFor(item, getArgs().workspaceId)
 		if (base.kind === 'draft') {
 			const { deployed, draft } = await getDraftDiffValues(
@@ -358,7 +407,7 @@ export function useSessionDeployModel(getArgs: () => SessionDeployModelArgs) {
 		 * that kind stays deployable while a script row does not.
 		 */
 		deployPermissionForKind(kind: Kind): DeployPermission {
-			return deployPermissionForKind(deployPerm, kind)
+			return permissionFor(kind)
 		},
 		deployRow,
 		discardRow
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.test.ts b/frontend/src/lib/components/sessions/sessionDeployModel.test.ts
index 7fa4e3cca8..ee2a4115da 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.test.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.test.ts
@@ -101,6 +101,15 @@ describe('buildDeployItems', () => {
 		expect(items[0].hasDraft).toBe(true)
 	})
 
+	it("a pipeline's deployed scripts fold into its one row", () => {
+		const bundle = maskKey('data_pipeline', 'f/crm/data_pipeline')
+		const node = maskKey('script', 'f/crm/clean')
+		const mask = new Set([bundle, node])
+		const items = buildDeployItems({ draftItems: [], mask, existingKeys: new Set([bundle, node]) })
+		expect(items.map((i) => i.key)).toEqual([bundle])
+		expect(maskOnlyCandidates({ draftItems: [], mask }).map((c) => c.key)).toEqual([bundle])
+	})
+
 	it('maskOnlyCandidates returns keys not covered by a draft', () => {
 		const cands = maskOnlyCandidates({
 			draftItems: [draft('script', 'u/a/draft')],
diff --git a/frontend/src/lib/components/sessions/sessionDeployModel.ts b/frontend/src/lib/components/sessions/sessionDeployModel.ts
index d38de06c86..4933f3a64a 100644
--- a/frontend/src/lib/components/sessions/sessionDeployModel.ts
+++ b/frontend/src/lib/components/sessions/sessionDeployModel.ts
@@ -1,7 +1,7 @@
 import type { UserDraftItemKind } from '$lib/gen'
 import type { DraftItem } from '$lib/workspaceDrafts.svelte'
 import type { Kind } from '$lib/utils_deployable'
-import { maskKey } from './modifiedItemsMask'
+import { foldedIntoPipelineRow, maskKey } from './modifiedItemsMask'
 
 // Unified item model for the session Review & Deploy surface. This is the pure,
 // UI-free core: every item the session touched is either a pending **draft** or
@@ -128,6 +128,7 @@ export function buildDeployItems(input: BuildInput): DeployItem[] {
 			if (sep < 0) continue
 			const udk = k.slice(0, sep) as UserDraftItemKind
 			const path = k.slice(sep + 1)
+			if (foldedIntoPipelineRow(mask, udk, path)) continue
 			seen.add(k)
 			out.push({
 				key: k,
@@ -172,6 +173,7 @@ export function maskOnlyCandidates(
 		if (sep < 0) continue
 		const udk = k.slice(0, sep) as UserDraftItemKind
 		const path = k.slice(sep + 1)
+		if (foldedIntoPipelineRow(mask, udk, path)) continue
 		out.push({ key: k, draftKind: udk, deployKind: deployKindOf(udk, udk === 'raw_app'), path })
 	}
 	return out
diff --git a/frontend/src/lib/components/sessions/sessionMirror.svelte.ts b/frontend/src/lib/components/sessions/sessionMirror.svelte.ts
index f30d66ca45..657f120e98 100644
--- a/frontend/src/lib/components/sessions/sessionMirror.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMirror.svelte.ts
@@ -998,9 +998,23 @@ async function flush(): Promise<void> {
 		let settledAny = false
 		let leftForNext = false
 		for (const [ws, w] of work) {
-			const out = await pushWorkspace(ws, w, email)
-			if (out.status === 'abort') return
-			if (out.status === 'off') {
+			// A push carries whole transcripts, and a workspace that keeps no backups is
+			// asked again on every page load: one this page has not heard from yet is asked
+			// with the listing first, which costs nothing to refuse.
+			let probe: 'on' | 'off' | 'failed' = 'on'
+			if (!wsState.has(ws)) {
+				const listing = await fetchListing(ws)
+				if (getCurrentUserEmail() !== email) return
+				probe = listing === 'off' || listing === 'failed' ? listing : 'on'
+				if (probe === 'on') wsState.set(ws, 'on')
+			}
+			if (probe === 'failed') {
+				backOff()
+				continue
+			}
+			const out = probe === 'off' ? undefined : await pushWorkspace(ws, w, email)
+			if (out?.status === 'abort') return
+			if (!out || out.status === 'off') {
 				markOff(ws)
 				await staleWorkspaceSync(ws, email)
 				// Same rule as the loop above: a removal is worth keeping only for a session
@@ -1189,22 +1203,28 @@ function unpackBackup(
 
 type BackupListing = Awaited<ReturnType<typeof AiService.listAiSessionBackups>>
 
-/** The workspace's listing; `off` when it keeps no backups, `failed` when it could not be
- * listed this time. */
-async function listWorkspace(ws: string, email: string): Promise<BackupListing | 'off' | 'failed'> {
+/** The workspace's listing as the server answers it; `off` when it keeps no backups,
+ * `failed` when it could not be listed this time. */
+async function fetchListing(ws: string): Promise<BackupListing | 'off' | 'failed'> {
 	let listing
 	try {
 		listing = await AiService.listAiSessionBackups({ workspace: ws })
 	} catch (e) {
 		const status = statusOf(e)
-		if (status === 404 || status === 403) {
-			markOff(ws)
-			return 'off'
-		}
+		// 404: a build without object storage, or a storage whose resource is gone.
+		// 403: nothing this token may back up.
+		if (status === 404 || status === 403) return 'off'
 		console.warn('Could not list session backups', e)
 		return 'failed'
 	}
-	if (!listing.enabled) {
+	return listing.enabled ? listing : 'off'
+}
+
+/** `fetchListing`, with what it says of the workspace recorded for the page. */
+async function listWorkspace(ws: string, email: string): Promise<BackupListing | 'off' | 'failed'> {
+	const listing = await fetchListing(ws)
+	if (listing === 'failed') return 'failed'
+	if (listing === 'off') {
 		markOff(ws)
 		return 'off'
 	}
diff --git a/frontend/src/lib/components/sessions/sessionMirror.test.ts b/frontend/src/lib/components/sessions/sessionMirror.test.ts
index 55a1acc138..9a8a211ded 100644
--- a/frontend/src/lib/components/sessions/sessionMirror.test.ts
+++ b/frontend/src/lib/components/sessions/sessionMirror.test.ts
@@ -150,6 +150,7 @@ beforeEach(async () => {
 	__resetMirrorForTesting()
 	pushMock.mockReset()
 	listMock.mockReset()
+	listMock.mockResolvedValue({ enabled: true, sessions: [] })
 	pullMock.mockReset()
 	chatImport.unavailable = false
 	chatImport.pruneFails = false
@@ -316,6 +317,30 @@ describe('sessionMirror flush', () => {
 		expect((await __syncRowsForTesting(EMAIL)).some((r) => r.id === 'sr')).toBe(false)
 	})
 
+	it('asks a workspace it has not heard from before sending it a transcript', async () => {
+		const s: Session = { id: 'sp', name: 'session-1', createdAt: 1, workspace_id: 'ws' }
+		sessionState.sessions = [s]
+		await putSession(s)
+		const { ApiError } = await import('$lib/gen')
+		listMock.mockRejectedValueOnce(
+			new ApiError({ method: 'GET', url: '' } as never, { status: 404 } as never, 'no resource')
+		)
+		await __flushForTesting()
+		expect(listMock).toHaveBeenCalledTimes(1)
+		expect(pushMock).not.toHaveBeenCalled()
+		expect(await pendingDirty()).toEqual(['sp'])
+
+		// A page that heard the workspace keeps backups pushes without asking again.
+		__resetMirrorForTesting()
+		pushMock.mockResolvedValue({ enabled: true, results: [{ id: 'sp' }] })
+		await __flushForTesting()
+		await putSession({ ...s, summary: 'changed' })
+		await __flushForTesting()
+		expect(listMock).toHaveBeenCalledTimes(2)
+		expect(pushMock).toHaveBeenCalledTimes(2)
+		expect(await pendingDirty()).toEqual([])
+	})
+
 	it('keeps the marks when the push fails, and stops for a workspace without storage', async () => {
 		const s: Session = { id: 's2', name: 'session-2', createdAt: 1, workspace_id: 'ws' }
 		const never: Session = { id: 's2b', name: 'session-3', createdAt: 2, workspace_id: 'ws' }
@@ -355,11 +380,11 @@ describe('sessionMirror flush', () => {
 
 		// Backups an admin turns on again elsewhere are noticed once the page's memory of
 		// them being off expires, with nothing else prompting it: the removal goes then.
-		listMock.mockResolvedValue({ enabled: true, sessions: [] })
+		listMock.mockClear()
 		pushMock.mockResolvedValueOnce({ enabled: true, results: [{ id: 's2' }] })
 		await vi.waitFor(() => expect(pushMock).toHaveBeenCalledTimes(4), { timeout: 3000 })
 		expect(pushMock.mock.calls[3][0].requestBody.removed).toEqual(['s2'])
-		await vi.waitFor(() => expect(listMock).toHaveBeenCalledTimes(1))
+		await vi.waitFor(() => expect(listMock).toHaveBeenCalled())
 		await __settleForTesting()
 		expect(pendingKeys()).toEqual([])
 	})
@@ -426,7 +451,7 @@ describe('sessionMirror flush', () => {
 		await __flushForTesting()
 		expect(pushMock).toHaveBeenCalledTimes(2)
 
-		listMock.mockResolvedValue({ enabled: true, sessions: [] })
+		listMock.mockClear()
 		pushMock.mockResolvedValueOnce({ enabled: true, results: [{ id: 'so' }] })
 		usersWorkspaceStore.set({ email: EMAIL, workspaces: [] } as never)
 		backupSettingsChanged('ws')
diff --git a/frontend/src/lib/components/sessions/sessionMode.svelte.ts b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
index a2c20e08a8..c6aea96a67 100644
--- a/frontend/src/lib/components/sessions/sessionMode.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
@@ -1,9 +1,12 @@
-import { base } from '$app/paths'
 import type { SessionTarget } from './sessionState.svelte'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 
 // Maps a session's editor target to the canonical full-page Windmill route.
 export function sessionTargetHref(target: SessionTarget | undefined): string | undefined {
 	if (!target) return undefined
+	if (target.kind === 'pipeline') {
+		return `/pipeline/${encodeURIComponent(normalizePipelineFolder(target.path))}`
+	}
 	const seg =
 		target.kind === 'script'
 			? 'scripts/edit'
@@ -13,12 +16,12 @@ export function sessionTargetHref(target: SessionTarget | undefined): string | u
 					? 'apps_raw/edit'
 					: undefined
 	if (!seg) return undefined
-	return `${base}/${seg}/${target.path}`
+	return `/${seg}/${target.path}`
 }
 
 // Point a preview tab's URL at a place inside the previewed editor (the flow
 // step to select). The params are not part of the item's identity — every tab
-// resolver strips the query (see previewRouter's stripBase) — so they only ever
+// resolver strips the query (see previewRouter's barePath) — so they only ever
 // steer where the editor opens. No-op without params.
 export function withPreviewParams(
 	url: string | undefined,
@@ -47,6 +50,30 @@ export function withMenuHidden(url: string, workspaceId?: string): string {
 	}
 }
 
+// Remembers `nomenubar` for the rest of this iframe's life. Navigating inside a preview drops
+// the query param (client-side routing and full loads both), and the global nav must not pop
+// back in. sessionStorage so it survives a reload within the frame; the top window never writes
+// it, so an ordinary tab and the oauth callback still toggle normally.
+export function rememberMenuHidden(url: URL): void {
+	if (typeof window === 'undefined' || window.self === window.top) return
+	if (url.searchParams.get('nomenubar') !== 'true') return
+	try {
+		sessionStorage.setItem('nomenubar_embedded', 'true')
+	} catch {}
+}
+
+// Whether this page is shown without the workspace navigation. The layout drops the sidebar and
+// the band's trail, so a page whose only control lives in the band has to carry it itself — see
+// InWorkspaceAppViewer's Edit button. Read this rather than the raw query param: a preview tab
+// that has navigated no longer carries it.
+export function isMenuHidden(url: URL): boolean {
+	return (
+		url.searchParams.get('nomenubar') === 'true' ||
+		url.pathname.startsWith('/oauth/callback/') ||
+		isSessionPreviewFrame()
+	)
+}
+
 // True when this window is a sessions-preview iframe: embedded, with the `nomenubar` flag
 // the preview always sets and the logged layout stickies into sessionStorage.
 export function isSessionPreviewFrame(): boolean {
diff --git a/frontend/src/lib/components/sessions/sessionMode.test.ts b/frontend/src/lib/components/sessions/sessionMode.test.ts
index 9bc67b9a58..75d3445fed 100644
--- a/frontend/src/lib/components/sessions/sessionMode.test.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.test.ts
@@ -13,9 +13,13 @@ describe('sessionTargetHref', () => {
 		expect(sessionTargetHref({ kind: 'raw_app', path: 'u/me/app' })).toBe('/apps_raw/edit/u/me/app')
 	})
 
-	it('returns undefined for no target or a kind without a full-page route', () => {
+	it('maps a pipeline to its folder page, whichever form the folder is given in', () => {
+		expect(sessionTargetHref({ kind: 'pipeline', path: 'crm' })).toBe('/pipeline/crm')
+		expect(sessionTargetHref({ kind: 'pipeline', path: 'f/crm' })).toBe('/pipeline/crm')
+	})
+
+	it('returns undefined for no target', () => {
 		expect(sessionTargetHref(undefined)).toBeUndefined()
-		expect(sessionTargetHref({ kind: 'pipeline', path: 'u/me/pipe' })).toBeUndefined()
 	})
 })
 
diff --git a/frontend/src/lib/components/sessions/sessionPermissions.svelte.ts b/frontend/src/lib/components/sessions/sessionPermissions.svelte.ts
new file mode 100644
index 0000000000..aedb59fbf6
--- /dev/null
+++ b/frontend/src/lib/components/sessions/sessionPermissions.svelte.ts
@@ -0,0 +1,31 @@
+import { fromStore } from 'svelte/store'
+import { userWorkspaces } from '$lib/stores'
+import { useActingUser } from '$lib/actingUser.svelte'
+import { useEditRights } from '$lib/operatorWriteRights'
+import type { WorkspaceItem } from '$lib/components/workspacePicker'
+import { previewPageAllowed, type PreviewPage } from './previewRouter'
+
+/**
+ * What the session UI may offer in `workspace`. Its editors save drafts, so it reads
+ * `roleCanDraft` / `canDraftItem` — the rule the chat's draft tools and `open_preview` follow — so
+ * a control and the tool behind it never disagree. An unknown user reads as able to draft, as the toolset does before access
+ * resolves: hiding every editor from a developer while `whoami` is in flight is the worse
+ * mistake, and the server refuses an operator anyway. Reads context and registers an effect:
+ * call during component initialisation.
+ */
+export function useSessionPermissions(workspace: () => string | undefined) {
+	const rights = useEditRights(workspace)
+	const user = useActingUser(workspace)
+	const workspaces = fromStore(userWorkspaces)
+	const entry = $derived(workspaces.current.find((w) => w.id === workspace()))
+
+	return {
+		/** Whether this user can save the drafts the `kind` editor writes. */
+		canOpenEditor: (kind: string) => rights.roleCanDraft(kind),
+		/** The same, and this item's own permissions let them write it. */
+		canEditItem: (item: Pick<WorkspaceItem, 'kind' | 'path' | 'extraPerms'>) =>
+			rights.canDraftItem(item.kind, item.path, item.extraPerms),
+		/** Whether the page loads for this user rather than refusing them. */
+		pageAllowed: (page: PreviewPage) => previewPageAllowed(page, user.current, entry)
+	}
+}
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index cf23b2b646..b1f14fadbe 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -1,4 +1,3 @@
-import { base } from '$lib/base'
 import { randomUUID } from '$lib/utils/uuid'
 import { editPathFor, viewPathFor, type WorkspaceItem } from '$lib/components/workspacePicker'
 import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
@@ -20,12 +19,13 @@ import {
 	previewLocationLabel,
 	resolvePreviewTab,
 	runFormUrl,
-	stripBase,
+	barePath,
 	type ArtifactVersionTarget,
 	type PreviewItemMode,
 	type PreviewTarget
 } from './previewRouter'
 import type { SessionPreviewTab, SessionTarget } from './sessionState.svelte'
+import { sessionTargetHref } from './sessionMode.svelte'
 import type { Kind } from '$lib/utils_deployable'
 import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 import {
@@ -112,11 +112,11 @@ function targetUrl(target: PreviewTarget, onto?: SessionPreviewTab): string {
 	// A re-point with no mode keeps the side the tab is already on, so an AI write to
 	// an item the user left on View does not yank them back to the editor.
 	const mode = target.mode ?? (onto ? (parsePreviewItemRoute(onto.url)?.mode ?? 'edit') : 'edit')
-	if (mode !== 'view') return `${base}${editPathFor(target.item)}`
+	if (mode !== 'view') return editPathFor(target.item)
 	// Not carried over from `onto`: a version pin is something the reader asked for
 	// once, so every other re-point of this tab lands on the current deployed version.
 	const pin = target.version ? `?version=${encodeURIComponent(target.version)}` : ''
-	return `${base}${viewPathFor(target.item)}${pin}`
+	return `${viewPathFor(target.item)}${pin}`
 }
 
 // Point a tab at a new destination. Clears `friendlyLabel`/`friendlyPath`
@@ -174,7 +174,7 @@ export function previewTargetForSessionTarget(
 ): PreviewTarget | undefined {
 	if (kind === 'pipeline') {
 		const folder = normalizePipelineFolder(path)
-		return { type: 'page', href: `${base}/pipeline/${encodeURIComponent(folder)}`, label: folder }
+		return { type: 'page', href: `/pipeline/${encodeURIComponent(folder)}`, label: folder }
 	}
 	const item: WorkspaceItem =
 		kind === 'raw_app'
@@ -454,20 +454,15 @@ export class SessionPreviewTabs {
 			}
 		}
 		const url = targetUrl(target)
-		// Pipeline previews all share one runtime.pipelineEditorState, so keep at
-		// most one pipeline tab: re-point the existing one to the requested folder
-		// rather than opening a second pipeline editor that would fight over the
-		// shared state (`focused` when it already showed this folder, else `opened`
-		// since the view now shows a different pipeline).
+		// One tab per pipeline folder: two would mount two editors over one folder's
+		// state and draft.
 		const pipelineFolder = parsePipelineRoute(url)
 		if (pipelineFolder) {
-			const existing = this.#tabs.find((t) => parsePipelineRoute(t.url) !== null)
+			const existing = this.#tabs.find((t) => parsePipelineRoute(t.url) === pipelineFolder)
 			if (existing) {
-				const same = existing.url === url
-				this.#retarget(existing, url)
 				this.#activeId = existing.id
 				this.#flush()
-				return { status: same ? 'focused' : 'opened' }
+				return { status: 'focused' }
 			}
 		}
 		// Dedupe artifacts by id, not full url: an update may have changed the name the url carries.
@@ -542,15 +537,11 @@ export class SessionPreviewTabs {
 				return
 			}
 		}
-		// Keep at most one pipeline tab (all share runtime.pipelineEditorState): if a
-		// *different* tab already hosts a pipeline, retarget and focus it rather than
-		// turning the active tab into a second pipeline editor racing the shared
-		// state. Same invariant as open(); a no-op when the active tab is that tab.
+		// Same one-tab-per-folder rule as open(): focus the tab already on this folder.
 		const pipelineFolder = parsePipelineRoute(targetUrl(target))
 		if (pipelineFolder) {
-			const existing = this.#tabs.find((x) => parsePipelineRoute(x.url) !== null)
+			const existing = this.#tabs.find((x) => parsePipelineRoute(x.url) === pipelineFolder)
 			if (existing && existing.id !== t.id) {
-				this.#retarget(existing, targetUrl(target, existing))
 				this.#activeId = existing.id
 				this.#flush()
 				return
@@ -651,6 +642,25 @@ export class SessionPreviewTabs {
 		this.#flush()
 	}
 
+	/** Follow an item its editor deployed under a new path, in place: the editor is keyed
+	 * on the path, and nothing is left to edit at the old one. */
+	retargetEditor(from: SessionTarget, to: SessionTarget): void {
+		const tab = this.#tabs.find((t) => isItemTabFor(t.url, from, 'edit'))
+		if (!tab) return
+		// One editor per item: a tab already on the new path keeps it.
+		const existing = this.#tabs.find((t) => t.id !== tab.id && isItemTabFor(t.url, to, 'edit'))
+		if (existing) {
+			const wasActive = this.#activeId === tab.id
+			this.close(tab.id)
+			if (wasActive) this.#activeId = existing.id
+		} else {
+			const url = sessionTargetHref(to)
+			if (!url) return
+			retargetTab(tab, url)
+		}
+		this.#flush()
+	}
+
 	closeArtifact(artifactId: string): void {
 		const tab = this.#tabs.find((t) => parseArtifactRoute(t.url)?.id === artifactId)
 		if (tab) this.close(tab.id)
@@ -783,7 +793,7 @@ export function selectPreviewTabsToClose(
 // whose hash is app state, and any page can carry a filter value the user typed.
 function previewLocationDetail(where: string): string {
 	const { location, open } = previewLocationContext(where)
-	const detail = [location === stripBase(where) ? undefined : location, open && `open: ${open}`]
+	const detail = [location === barePath(where) ? undefined : location, open && `open: ${open}`]
 		.filter(Boolean)
 		.join(', ')
 	return detail ? ` (${detail})` : ''
@@ -819,7 +829,7 @@ export function describePreview(
 							? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
 							: // Trigger list pages land here (they're outside PREVIEW_PAGES), and
 								// their `#<path>` is the trigger the drawer has open.
-								`${stripBase(where)}${previewLocationDetail(where)}`
+								`${barePath(where)}${previewLocationDetail(where)}`
 		const slotKind = resolvePreviewTab(t.url).kind
 		const live =
 			slotKind === 'editor' || slotKind === 'pageitem'
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index 5e0eccb92f..669e9fc594 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -11,7 +11,6 @@ import {
 } from './sessionPreviewTabs.svelte'
 import { artifactUrl, type PreviewTarget } from './previewRouter'
 import type { SessionPreviewTab } from './sessionState.svelte'
-import { base } from '$lib/base'
 
 // In-memory adapter spy: records persisted snapshots, no IDB.
 function makeAdapter() {
@@ -48,10 +47,10 @@ const dndAppTarget: PreviewTarget = {
 	item: { kind: 'app', path: 'u/me/legacy', summary: '' }
 }
 const pageTarget: PreviewTarget = { type: 'page', href: '/runs', label: 'Runs' }
-const pipelineTarget: PreviewTarget = { type: 'page', href: `${base}/pipeline/crm`, label: 'crm' }
+const pipelineTarget: PreviewTarget = { type: 'page', href: '/pipeline/crm', label: 'crm' }
 const pipelineTarget2: PreviewTarget = {
 	type: 'page',
-	href: `${base}/pipeline/sales`,
+	href: '/pipeline/sales',
 	label: 'sales'
 }
 const artifactTarget: PreviewTarget = { type: 'artifact', id: 'art1', name: 'Plan' }
@@ -149,7 +148,7 @@ describe('previewTargetForSessionTarget', () => {
 	it('maps pipeline to its folder route page target', () => {
 		expect(previewTargetForSessionTarget('pipeline', 'my_folder')).toEqual({
 			type: 'page',
-			href: `${base}/pipeline/my_folder`,
+			href: '/pipeline/my_folder',
 			label: 'my_folder'
 		})
 	})
@@ -159,7 +158,7 @@ describe('previewTargetForSessionTarget', () => {
 		// path `f/f/<folder>/…`.
 		expect(previewTargetForSessionTarget('pipeline', 'f/my_folder')).toEqual({
 			type: 'page',
-			href: `${base}/pipeline/my_folder`,
+			href: '/pipeline/my_folder',
 			label: 'my_folder'
 		})
 	})
@@ -241,6 +240,21 @@ describe('page item tabs', () => {
 		])
 	})
 
+	it('follows an editor deployed under a new path in place', () => {
+		const o = owner()
+		o.open({
+			type: 'item',
+			item: { kind: 'app', raw_app: true, path: 'u/me/draft_1', summary: '' }
+		})
+		const id = o.tabs[0].id
+		o.retargetEditor(
+			{ kind: 'raw_app', path: 'u/me/draft_1' },
+			{ kind: 'raw_app', path: 'u/me/app' }
+		)
+		const url = '/apps_raw/edit/u/me/app'
+		expect(o.tabs).toEqual([{ id, url, loc: url }])
+	})
+
 	it('restores a tab saved on a row’s drawer as the row it was last on', () => {
 		const snap = hydratePreviewTabs({
 			previewTabs: [
@@ -439,7 +453,7 @@ describe('SessionPreviewTabs.open', () => {
 
 	it('dedupes a run form by tool call, and hands that tab to the run in place', () => {
 		const o = owner()
-		o.open({ type: 'page', href: `${base}/runs`, label: 'Runs' })
+		o.open({ type: 'page', href: '/runs', label: 'Runs' })
 		o.open({ type: 'runform', toolCallId: 'call_1', label: 'Run refund' })
 		const id = o.tabs[1].id
 		// The label carries the script's summary, which is not what identifies the call.
@@ -447,10 +461,10 @@ describe('SessionPreviewTabs.open', () => {
 			'focused'
 		)
 		expect(o.tabs).toHaveLength(2)
-		o.retargetRunForm('call_1', `${base}/run/01a0?workspace=w`)
+		o.retargetRunForm('call_1', '/run/01a0?workspace=w')
 		// Still second: a tab that followed its call to the run has not moved in the strip.
 		expect(o.tabs[1].id).toBe(id)
-		expect(o.tabs[1].url).toBe(`${base}/run/01a0?workspace=w`)
+		expect(o.tabs[1].url).toBe('/run/01a0?workspace=w')
 	})
 
 	it('re-points the same tab (no duplicate) when the artifact was renamed', () => {
@@ -563,19 +577,22 @@ describe('SessionPreviewTabs.navigate', () => {
 		expect(o.tabs.find((t) => t.id === pageTabId)?.url).toBe('/runs')
 	})
 
-	it('retargets the one pipeline tab instead of turning the active tab into a second', () => {
+	it('keeps one tab per pipeline folder, several folders side by side', () => {
 		const o = owner()
 		o.open(pipelineTarget)
-		const pipelineTabId = o.activeId
-		o.open(scriptTarget) // a second, non-pipeline tab is now active
-		const scriptTabId = o.activeId
-		o.navigate(pipelineTarget2)
-		// No second pipeline editor: the existing one is retargeted and focused.
+		const crmTabId = o.activeId
+		o.open(pipelineTarget2)
+		const salesTabId = o.activeId
 		expect(o.tabs).toHaveLength(2)
-		expect(o.activeId).toBe(pipelineTabId)
-		expect(o.tabs.find((t) => t.id === pipelineTabId)?.url).toBe(`${base}/pipeline/sales`)
-		// The script tab is untouched.
-		expect(o.tabs.find((t) => t.id === scriptTabId)?.url).toBe('/scripts/edit/u/me/foo')
+		expect(salesTabId).not.toBe(crmTabId)
+		o.open(scriptTarget)
+		// A folder already open is focused, from open() and navigate() alike.
+		o.open(pipelineTarget)
+		expect(o.activeId).toBe(crmTabId)
+		o.navigate(pipelineTarget2)
+		expect(o.activeId).toBe(salesTabId)
+		expect(o.tabs).toHaveLength(3)
+		expect(o.tabs.find((t) => t.id === crmTabId)?.url).toBe('/pipeline/crm')
 	})
 
 	it('retargets the active pipeline tab in place to a new folder', () => {
@@ -585,7 +602,7 @@ describe('SessionPreviewTabs.navigate', () => {
 		o.navigate(pipelineTarget2)
 		expect(o.tabs).toHaveLength(1)
 		expect(o.activeId).toBe(tabId)
-		expect(o.tabs[0].url).toBe(`${base}/pipeline/sales`)
+		expect(o.tabs[0].url).toBe('/pipeline/sales')
 	})
 
 	it('focuses the tab already viewing the artifact instead of duplicating the viewer', () => {
@@ -1100,12 +1117,12 @@ describe('SessionPreviewTabs.pulseFocus', () => {
 		const o = owner()
 		const run: PreviewTarget = {
 			type: 'page',
-			href: `${base}/run/job-1?workspace=fork`,
+			href: '/run/job-1?workspace=fork',
 			label: 'Run'
 		}
 		o.open(run)
 		// What the frame reports back has the injected params stripped.
-		o.observeLocation(o.activeId, `${base}/run/job-1?workspace=fork&nomenubar=true`)
+		o.observeLocation(o.activeId, '/run/job-1?workspace=fork&nomenubar=true')
 		expect(o.tabs.length).toBe(1)
 		expect(o.open(run).status).toBe('focused')
 		expect(o.tabs.length).toBe(1)
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 77d0a5c200..2995366ae0 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -1,12 +1,14 @@
 import { SvelteMap } from 'svelte/reactivity'
 import { get } from 'svelte/store'
-import { base } from '$lib/base'
 import { invalidate as invalidateWorkspaceItems } from '$lib/components/workspacePicker'
 import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
 import { AIChatManager, AIMode } from '$lib/components/copilot/chat/AIChatManager.svelte'
 import { PipelineEditorState } from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+import { PIPELINE_DRAFT_KIND, pipelineBundlePath, pipelineLocalMirrorKey } from '$lib/pipelinePaths'
+import type { DeployResult } from '$lib/utils_workspace_deploy'
 import { initFlow } from '$lib/components/flows/flowStore.svelte'
 import {
+	ApiError,
 	AppService,
 	FlowService,
 	ScriptService,
@@ -27,10 +29,12 @@ type SavedScript = Omit<Script & UserDraftOverlay, 'draft'> & { draft?: NewScrip
 type SavedFlow = Omit<Flow & UserDraftOverlay, 'draft'> & { draft?: Flow }
 import type { HiddenRunnable } from '$lib/components/apps/types'
 import { type RawAppData, DEFAULT_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
-import { userWorkspaces, workspaceStore } from '$lib/stores'
+import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+import { react19Template, STARTER_RUNNABLES } from '$lib/components/raw_apps/templates'
+import { random_adj } from '$lib/components/random_positive_adjetive'
 import { copilotWorkspace } from '$lib/aiStore'
 import { loadCopilot } from '$lib/components/copilot/loadCopilot'
-import { emptySchema, type StateStore } from '$lib/utils'
+import { emptySchema, userPathPrefix, type StateStore } from '$lib/utils'
 import {
 	localRunEnded,
 	localRunStarted,
@@ -99,6 +103,7 @@ import {
 	type RawAppRunsProvider,
 	type RawAppScreenshotRequester
 } from '$lib/components/raw_apps/utils'
+import { resolveGlobalDraftStoragePathByKind } from '$lib/components/copilot/chat/global/userDraftAdapter'
 import type {
 	RawAppDomQuery,
 	RawAppDomRequester,
@@ -132,6 +137,12 @@ export interface LoadSlot {
 
 export type SessionTargetKind = 'flow' | 'script' | 'raw_app'
 
+/** What a mounted pipeline editor view offers the rest of the session. */
+export interface PipelineView {
+	/** Deploy all of the folder's drafts; failures stay drafts and are shown in the view. */
+	deployAll(): Promise<DeployResult>
+}
+
 // The live runtime value a raw-app editor cell binds. Legacy drag-and-drop apps
 // are intentionally NOT hosted in the session preview (only code-based raw apps).
 export interface RawAppRuntimeValue {
@@ -204,9 +215,17 @@ export interface SessionRuntime {
 	// (renderer) and the open_preview/get_preview_status tools cross it, so the
 	// tab model has exactly one live copy.
 	readonly previewTabs: SessionPreviewTabs
-	// Pipeline target state — persists across editor hide/show (the pane unmounts
-	// on hide, so this can't be component-local) and across session switches.
-	readonly pipelineEditorState: PipelineEditorState
+	// Pipeline editor state per folder — persists across editor remounts and
+	// session switches, so it can't be component-local. Created on first use.
+	pipelineEditor(folder: string): PipelineEditorState
+	// A mounted pipeline editor view offers its deploy here; returns the unregister.
+	registerPipelineView(folder: string, view: PipelineView): () => void
+	// Deploy a folder's pipeline drafts through its editor tab, opening the tab if
+	// needed: the tab hydrates the drafts and shows what deployed and what failed.
+	deployPipeline(folder: string): Promise<DeployResult>
+	// Drop a folder's in-memory drafts once its draft bundle is discarded, so an
+	// open or later-mounted editor does not save them back.
+	forgetPipelineDrafts(folder: string): Promise<void>
 	// Per-(kind, path) editor cells (content/baseline stores + load slot), created
 	// on demand. Each editable preview tab resolves its own cell, so several items
 	// stay live at once.
@@ -230,7 +249,10 @@ export interface SessionRuntime {
 		workspace: string,
 		path: string,
 		force?: boolean,
-		deployedOnly?: boolean
+		deployedOnly?: boolean,
+		/** Open the starter template when nothing exists at `path` yet: a new app whose
+		 * setup has not been confirmed. Held in the cell only, nothing is saved. */
+		seedIfMissing?: boolean
 	): Promise<void>
 	/** Register a mounted raw-app preview's log requester, keyed by app path, like
 	 * `registerDomRequester`: build state is per editor, so reads route to the app edited. */
@@ -263,7 +285,14 @@ export interface SessionRuntime {
 	 * the deploy just changed. One call rather than a sequence at each deploy site — a
 	 * caller that remembers three of the four leaves a stale draft count or a picker
 	 * that still calls the item a draft. */
-	itemDeployed(workspace: string, kind: 'script' | 'flow' | 'raw_app', path: string): void
+	itemDeployed(
+		workspace: string,
+		kind: 'script' | 'flow' | 'raw_app',
+		path: string,
+		/** Where the deploy landed, when not at `path`: a new item parked at a
+		 * `draft_<uuid>` storage path deploys under the name it was given. */
+		deployedPath?: string
+	): void
 }
 
 const runtimes = new SvelteMap<string, SessionRuntime>()
@@ -570,7 +599,7 @@ function createRuntime(session: Session): SessionRuntime {
 	manager.openRunInPreview = ({ jobId, workspace, label }) => {
 		previewTabs.open({
 			type: 'page',
-			href: `${base}/run/${jobId}?workspace=${workspace}`,
+			href: `/run/${jobId}?workspace=${workspace}`,
 			label
 		})
 	}
@@ -583,7 +612,7 @@ function createRuntime(session: Session): SessionRuntime {
 	}
 	manager.closeRunForm = (toolCallId) => previewTabs.closeRunForm(toolCallId)
 	manager.showRunInPlaceOfForm = ({ toolCallId, jobId, workspace }) => {
-		previewTabs.retargetRunForm(toolCallId, `${base}/run/${jobId}?workspace=${workspace}`)
+		previewTabs.retargetRunForm(toolCallId, `/run/${jobId}?workspace=${workspace}`)
 	}
 	// Read off the tab list rather than the slot's lifecycle: a tab the user has switched
 	// away from is unmounted but still open, and the card must keep its form hidden until it
@@ -605,10 +634,78 @@ function createRuntime(session: Session): SessionRuntime {
 	// picker lists, so changeMode's network refreshes would fire once per listing.
 	manager.configureGlobalMode()
 
-	// Pipeline target state lives on the runtime (not the PipelineEditorView
-	// component) so the in-session drafts survive hide/show of the editor pane —
-	// the pane unmounts on hide, and a component-local store would be discarded.
-	const pipelineEditorState = new PipelineEditorState()
+	const pipelineEditors = new Map<string, PipelineEditorState>()
+	function pipelineEditor(folder: string): PipelineEditorState {
+		const key = normalizePipelineFolder(folder)
+		let editor = pipelineEditors.get(key)
+		if (!editor) {
+			editor = new PipelineEditorState()
+			editor.folder = key
+			pipelineEditors.set(key, editor)
+		}
+		return editor
+	}
+
+	const pipelineViews = new Map<string, PipelineView>()
+	const pipelineViewWaiters = new Map<string, Set<(view: PipelineView) => void>>()
+	function registerPipelineView(folder: string, view: PipelineView): () => void {
+		const key = normalizePipelineFolder(folder)
+		pipelineViews.set(key, view)
+		const waiters = pipelineViewWaiters.get(key)
+		pipelineViewWaiters.delete(key)
+		waiters?.forEach((notify) => notify(view))
+		return () => {
+			if (pipelineViews.get(key) === view) pipelineViews.delete(key)
+		}
+	}
+	function pipelineViewFor(folder: string, timeoutMs = 15000): Promise<PipelineView | undefined> {
+		const mounted = pipelineViews.get(folder)
+		if (mounted) return Promise.resolve(mounted)
+		return new Promise((resolve) => {
+			const waiters = pipelineViewWaiters.get(folder) ?? new Set()
+			pipelineViewWaiters.set(folder, waiters)
+			const notify = (view: PipelineView) => {
+				clearTimeout(timer)
+				resolve(view)
+			}
+			const timer = setTimeout(() => {
+				waiters.delete(notify)
+				resolve(undefined)
+			}, timeoutMs)
+			waiters.add(notify)
+		})
+	}
+	manager.setPipelineReopener((folder) => {
+		const target = previewTargetForSessionTarget('pipeline', folder)
+		if (target) previewTabs.open(target)
+	})
+	async function deployPipeline(folder: string): Promise<DeployResult> {
+		const key = normalizePipelineFolder(folder)
+		const target = previewTargetForSessionTarget('pipeline', key)
+		if (target) previewTabs.open(target)
+		const view = await pipelineViewFor(key)
+		if (!view) return { success: false, error: `The pipeline editor for f/${key} did not open.` }
+		return view.deployAll()
+	}
+	async function forgetPipelineDrafts(folder: string): Promise<void> {
+		const key = normalizePipelineFolder(folder)
+		const editor = pipelineEditors.get(key)
+		if (editor) {
+			// The open pane saves its edits back as a draft when it closes: let it, then
+			// drop that draft with the rest, or it would come back afterwards.
+			await editor.closePane()
+			editor.drafts = new Map()
+			editor.triggerDrafts = new Map()
+			editor.clearLiveOverlays()
+		}
+		// The editor's crash mirror, which its load falls back to when the DB has
+		// no draft: left behind, it would restore what was just discarded.
+		try {
+			localStorage.removeItem(pipelineLocalMirrorKey(key))
+		} catch {
+			// Storage unavailable: nothing was mirrored either.
+		}
+	}
 
 	const runtimeLogRequesters = new Map<string, RawAppRuntimeLogRequester>()
 	// appPath → requester, one entry per mounted raw-app preview tab.
@@ -622,7 +719,10 @@ function createRuntime(session: Session): SessionRuntime {
 		sessionId: session.id,
 		manager,
 		previewTabs,
-		pipelineEditorState,
+		pipelineEditor,
+		registerPipelineView,
+		deployPipeline,
+		forgetPipelineDrafts,
 		flowCell,
 		loadedEditorPath,
 		deployedRevision,
@@ -814,7 +914,13 @@ function createRuntime(session: Session): SessionRuntime {
 
 		rawAppCell,
 
-		async loadRawApp(workspace: string, path: string, force = false, deployedOnly = false) {
+		async loadRawApp(
+			workspace: string,
+			path: string,
+			force = false,
+			deployedOnly = false,
+			seedIfMissing = false
+		) {
 			const { slot, store, saved } = rawAppCell(path)
 			if (slot.loadedPath === path && slot.loadedWorkspace === workspace && !force) return
 			// See loadScript: forced reload remounts via the render gate.
@@ -944,6 +1050,28 @@ function createRuntime(session: Session): SessionRuntime {
 				slot.loadedPath = path
 				slot.loadedWorkspace = workspace
 			} catch (err) {
+				if (seedIfMissing && !deployedOnly && err instanceof ApiError && err.status === 404) {
+					const user = get(userStore)
+					saved.val = undefined
+					store.val = {
+						files: { ...react19Template },
+						runnables: structuredClone(STARTER_RUNNABLES),
+						data: { ...DEFAULT_DATA },
+						policy: {
+							on_behalf_of: user?.username.includes('@') ? user.username : `u/${user?.username}`,
+							on_behalf_of_email: user?.email,
+							execution_mode: 'publisher'
+						},
+						summary: '',
+						path,
+						// The name a deploy lands on, as the full-page editor suggests one: without
+						// it the app would deploy under its `draft_<uuid>` storage path.
+						draft_path: `${userPathPrefix(user?.username)}${random_adj()}_app`
+					}
+					slot.loadedPath = path
+					slot.loadedWorkspace = workspace
+					return
+				}
 				console.error('Failed to load raw app', err)
 				slot.notFound = true
 			} finally {
@@ -951,7 +1079,16 @@ function createRuntime(session: Session): SessionRuntime {
 			}
 		},
 
-		itemDeployed(workspace, kind, path) {
+		itemDeployed(workspace, kind, storagePath, deployedPath = storagePath) {
+			if (deployedPath !== storagePath) {
+				// Nothing is deployed at the storage path, so its editor would go on
+				// creating the item again and its draft would outlive the deploy: drop
+				// the draft and move the tab to where the item now lives.
+				UserDraft.stopSync(kind, storagePath, { workspace })
+				UserDraft.discard(kind, storagePath, undefined, { workspace })
+				previewTabs.retargetEditor({ kind, path: storagePath }, { kind, path: deployedPath })
+			}
+			const path = deployedPath
 			// After deploy the editor state equals the deployed value; the reload
 			// below re-seeds the cell from it, which must NOT POST as a fresh draft.
 			// The full-page editor guards this with discardDraftAfterDeploy, but the
@@ -984,7 +1121,7 @@ function createRuntime(session: Session): SessionRuntime {
 		},
 		async requestRuntimeLogs(limit, appPath) {
 			const path =
-				appPath ??
+				(appPath && draftStoragePath(session, 'raw_app', appPath)) ??
 				activeDomAppPath ??
 				(runtimeLogRequesters.size === 1 ? [...runtimeLogRequesters.keys()][0] : undefined)
 			if (path === undefined) {
@@ -1020,7 +1157,7 @@ function createRuntime(session: Session): SessionRuntime {
 			// its element's app even when another tab is now visible), else the
 			// active preview, else the only one open.
 			const path =
-				query.appPath ??
+				(query.appPath && draftStoragePath(session, 'raw_app', query.appPath)) ??
 				activeDomAppPath ??
 				(domRequesters.size === 1 ? [...domRequesters.keys()][0] : undefined)
 			if (path === undefined) return undefined
@@ -1117,6 +1254,18 @@ export function listRuntimes(): SessionRuntime[] {
 	return Array.from(runtimes.values())
 }
 
+/** A pipeline deleted outside the session: every live session on its workspace
+ * drops what it holds of it. Its in-memory drafts would otherwise keep showing the
+ * pipeline in the preview, and autosave would write the deleted draft back. */
+export function forgetDeletedPipeline(workspace: string, folder: string): void {
+	const key = normalizePipelineFolder(folder)
+	for (const runtime of runtimes.values()) {
+		if (runtime.manager.operatingWorkspace !== workspace) continue
+		void runtime.forgetPipelineDrafts(key)
+		void runtime.manager.removeModifiedItem(PIPELINE_DRAFT_KIND, pipelineBundlePath(key))
+	}
+}
+
 export function getRuntime(sessionId: string): SessionRuntime | undefined {
 	return runtimes.get(sessionId)
 }
@@ -1224,6 +1373,18 @@ export function removeSession(sessionId: string): void {
 	deleteSessionState(sessionId)
 }
 
+// The chat calls a new item by its chosen name while its draft is stored at
+// `draft_<uuid>`; resolve the name the way the chat's write tools do.
+function draftStoragePath(
+	session: Session,
+	kind: 'script' | 'flow' | 'raw_app',
+	path: string
+): string {
+	return session.workspace_id
+		? resolveGlobalDraftStoragePathByKind(session.workspace_id, kind, path)
+		: path
+}
+
 // Register the global open_preview tool handler once at module load. It
 // dispatches to the *calling* session (sessionId threaded from the tool ctx),
 // falling back to the UI-active session only when none was passed — so a
@@ -1239,7 +1400,10 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path, mode }) =
 	if (!session) {
 		return 'Error: no active session to open the preview in.'
 	}
-	const target = previewTargetForSessionTarget(kind, path)
+	const target = previewTargetForSessionTarget(
+		kind,
+		mode === 'view' || kind === 'pipeline' ? path : draftStoragePath(session, kind, path)
+	)
 	if (!target) {
 		return `Error: ${kind} targets cannot be shown in the preview panel.`
 	}
@@ -1255,8 +1419,8 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path, mode }) =
 	// "Unknown tool call" error on the first node it tries to build.
 	if (kind === 'pipeline') {
 		const folder = normalizePipelineFolder(path)
-		const ready = await runtime.manager.waitForPipelineHelpers()
-		// A backgrounded session's preview tab does not mount, so its editor never
+		const ready = await runtime.manager.waitForPipelineHelpers(folder)
+		// A session whose page is not mounted never mounts the editor, so it never
 		// registers — don't claim success, or the model calls build_pipeline_node
 		// into the void. Tell it the tools aren't available and how to recover.
 		if (!ready) {
@@ -1266,7 +1430,7 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path, mode }) =
 		// off the owner path twice over) is rejected by build_pipeline_node.
 		return `${
 			result.status === 'focused' ? 'Focused the' : 'Opened the'
-		} pipeline editor for folder "${folder}" in the side panel. Its nodes go at paths under \`f/${folder}/\` (e.g. \`f/${folder}/<node_name>\`).`
+		} pipeline editor for folder "${folder}" in the side panel. build_pipeline_node, edit_pipeline_node and the other pipeline tools are now in your tool list: call them in your next step. Its nodes go at paths under \`f/${folder}/\` (e.g. \`f/${folder}/<node_name>\`).`
 	}
 	return result.status === 'focused'
 		? `A preview tab is already showing ${kind} "${path}" — focused it.`
@@ -1342,7 +1506,7 @@ setClosePreviewTabsHandler(({ sessionId: callerSessionId, all, match }) => {
 
 // After a chat deploy, reload the calling session's preview — only if it's open
 // showing that exact item.
-setDeployedInSessionHandler(({ sessionId: callerSessionId, kind, path }) => {
+setDeployedInSessionHandler(({ sessionId: callerSessionId, kind, storagePath, path }) => {
 	const sessionId = callerSessionId ?? sessionState.currentSessionId
 	if (!sessionId) return
 	const session = sessionState.sessions.find((s) => s.id === sessionId)
@@ -1351,12 +1515,12 @@ setDeployedInSessionHandler(({ sessionId: callerSessionId, kind, path }) => {
 	// Peek without creating a cell: a deploy for an item with no open editor tab
 	// must not allocate an empty cell that lingers until the next prune. The caches
 	// still answer for the item, so they are dropped either way.
-	if (runtime.loadedEditorPath(kind, path) !== path) {
+	if (runtime.loadedEditorPath(kind, storagePath) !== storagePath) {
 		invalidateWorkspaceDrafts(session.workspace_id)
 		invalidateWorkspaceItems(session.workspace_id, kind === 'raw_app' ? 'app' : kind)
 		return
 	}
-	runtime.itemDeployed(session.workspace_id, kind, path)
+	runtime.itemDeployed(session.workspace_id, kind, storagePath, path)
 })
 
 setGetRuntimeLogsHandler(async ({ sessionId: callerSessionId, limit, appPath }) => {
@@ -1409,6 +1573,14 @@ setGetRuntimeLogsHandler(async ({ sessionId: callerSessionId, limit, appPath })
 			toolResult: report
 		}
 	}
+	if (previewLogs?.sdkConsentPending) {
+		return {
+			aiResult:
+				'The app built, but the preview is waiting for the user to approve the permissions the app declares in policy.frontend_sdk_scopes, so its code is not running. This is not a bug in the app: do not change the code. Ask the user to approve the permissions in the preview, then call get_app_runtime_logs again.',
+			uiMessage: 'Waiting for permission approval',
+			toolResult: 'Waiting for permission approval'
+		}
+	}
 	const entries = previewLogs?.entries
 	if (entries === undefined) {
 		return {
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
index 36a91ee453..30b7792487 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
@@ -15,7 +15,7 @@ import {
 	type SessionTarget
 } from './sessionState.svelte'
 import { sessionTargetHref, withPreviewParams } from './sessionMode.svelte'
-import { parsePreviewItemRoute, type PreviewItemRoute } from './previewPaths'
+import { parsePipelineRoute, parsePreviewItemRoute } from './previewPaths'
 import { findMountedOpenInSessionSource } from './openInSessionContext'
 // Type-only: erased at compile time, so the component graph stays out of this
 // navigation seam (see the dynamic import in openEditorInSession).
@@ -42,10 +42,28 @@ export function rememberNavRoute(pathnameWithSearch: string): void {
 }
 
 /** An item editor the user reached session mode from, as the in-app href a new
- * session's preview can open, plus the item it edits (for naming it). */
-export type NewSessionSeed = { url: string; route: PreviewItemRoute }
+ * session's preview can open, plus what it edits (for naming it). */
+export type NewSessionSeed = { url: string; kind: string; path: string }
 
-// The item (flow, script, app) the user came to session mode from, or undefined
+/** What an editor route edits: a session target, or an unset target for an item
+ * with no in-session editor (a legacy app), which is opened by its page instead. */
+function editedAt(
+	url: string
+): { target: SessionTarget | undefined; kind: string; path: string } | undefined {
+	const folder = parsePipelineRoute(url)
+	if (folder)
+		return { target: { kind: 'pipeline', path: folder }, kind: 'pipeline', path: `f/${folder}` }
+	const route = parsePreviewItemRoute(url)
+	if (!route) return undefined
+	const kind = route.kind === 'app' ? (route.raw_app ? 'raw_app' : undefined) : route.kind
+	return {
+		target: kind ? { kind, path: route.itemPath } : undefined,
+		kind: route.kind,
+		path: route.itemPath
+	}
+}
+
+// The item (flow, script, app, pipeline) the user came to session mode from, or undefined
 // when they came from anywhere else. A "New session" asked for after arriving
 // from an item is usually a session about that item, but the arrival route
 // (`enterSessionMode`) resumes whatever session was open, so the picker offers
@@ -56,8 +74,8 @@ export type NewSessionSeed = { url: string; route: PreviewItemRoute }
 export function takeNewSessionSeed(): NewSessionSeed | undefined {
 	if (navRouteOffered) return undefined
 	navRouteOffered = true
-	const route = parsePreviewItemRoute(lastNavRoute)
-	return route ? { url: lastNavRoute, route } : undefined
+	const edited = editedAt(lastNavRoute)
+	return edited ? { url: lastNavRoute, kind: edited.kind, path: edited.path } : undefined
 }
 
 // The session entering session mode resumes: the active one if selected, else
@@ -102,8 +120,8 @@ const RESUME_IDLE_LIMIT_MS = 60 * 60 * 1000
 // enterSessionMode does. Rejects when the editor could not persist its draft,
 // so the caller can stay on the page and say so.
 export async function enterSessionModeFromNav(): Promise<void> {
-	const route = parsePreviewItemRoute(lastNavRoute)
-	if (route) {
+	const edited = editedAt(lastNavRoute)
+	if (edited) {
 		const resumable = resumableSession()
 		if (!resumable || Date.now() - sessionLastActivityAt(resumable) > RESUME_IDLE_LIMIT_MS) {
 			// The editor's own hand-off is what its "Open in AI session" button uses:
@@ -112,7 +130,7 @@ export async function enterSessionModeFromNav(): Promise<void> {
 			// workspace the item lives in. Only an item with no such editor on
 			// screen (a legacy app, a detail page) is opened by route, as last
 			// persisted, in the workspace the route was scoped to.
-			const source = findMountedOpenInSessionSource(route)
+			const source = edited.target && findMountedOpenInSessionSource(edited.target)
 			if (source) await openSourceInSession(source)
 			else await openPageInSession(lastNavRoute, workspaceParamOf(lastNavRoute))
 			return
@@ -178,6 +196,24 @@ async function openInSession(
 	workspaceId?: string,
 	opts?: { seedPrompt?: string; autoSend?: boolean }
 ): Promise<void> {
+	await goto(await sessionHrefFor(url, workspaceId, opts))
+}
+
+/** A fresh session's page, with an editor in its preview. For a `load` that sends the
+ * user there by redirect, where a `goto` would start a second navigation. */
+export function editorSessionHref(
+	target: SessionTarget,
+	workspaceId?: string,
+	previewParams?: Record<string, string>
+): Promise<string> {
+	return sessionHrefFor(withPreviewParams(sessionTargetHref(target), previewParams), workspaceId)
+}
+
+async function sessionHrefFor(
+	url: string | undefined,
+	workspaceId?: string,
+	opts?: { seedPrompt?: string; autoSend?: boolean }
+): Promise<string> {
 	// Seed the fresh session's preview with a single tab on `url` so it opens
 	// straight onto what the caller wants (resetSessionPreviewTabs also writes
 	// through a live runtime if one already exists for this id).
@@ -198,7 +234,7 @@ async function openInSession(
 		navRouteOffered = true
 	}
 	selectSession(session.id)
-	await goto(sessionPageHref(session.id))
+	return sessionPageHref(session.id)
 }
 
 // Open an editor's own hand-off, running its `beforeOpen` (which persists the
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.test.ts b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
index 4eae32da6b..497e3cbad9 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.test.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
@@ -259,16 +259,21 @@ describe('takeNewSessionSeed', () => {
 		rememberNavRoute('/flows/edit/u/me/my_flow?workspace=ws')
 		expect(takeNewSessionSeed()).toEqual({
 			url: '/flows/edit/u/me/my_flow?workspace=ws',
-			route: { kind: 'flow', raw_app: false, itemPath: 'u/me/my_flow', mode: 'edit' }
+			kind: 'flow',
+			path: 'u/me/my_flow'
 		})
 		// A dismissed or taken offer is not repeated until the user leaves again.
 		expect(takeNewSessionSeed()).toBeUndefined()
 		rememberNavRoute('/apps_raw/edit/f/team/dashboard?workspace=ws')
-		expect(takeNewSessionSeed()?.route).toEqual({
-			kind: 'app',
-			raw_app: true,
-			itemPath: 'f/team/dashboard',
-			mode: 'edit'
+		expect(takeNewSessionSeed()).toMatchObject({ kind: 'app', path: 'f/team/dashboard' })
+	})
+
+	it('offers the pipeline the user came from, named by its folder', () => {
+		rememberNavRoute('/pipeline/crm?workspace=ws')
+		expect(takeNewSessionSeed()).toEqual({
+			url: '/pipeline/crm?workspace=ws',
+			kind: 'pipeline',
+			path: 'f/crm'
 		})
 	})
 
diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index 8ee5391443..56952eb584 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -245,6 +245,8 @@
 	// Undefined wherever the workspace is: `/api/mcp/w/undefined/mcp` reads like a real URL
 	// and is copyable, so the OAuth panel withholds it rather than showing a broken one. The
 	// token branch guards the same case by disabling its generate button.
+	// On the browsing origin, not the API base url: the OAuth metadata the server
+	// publishes for this URL is built from `base_url`, and a client rejects a mismatch.
 	const mcpUrl = $derived(
 		isAllWorkspaces
 			? `${window.location.origin}/api/mcp/gateway`
diff --git a/frontend/src/lib/components/settings/PremiumInfo.svelte b/frontend/src/lib/components/settings/PremiumInfo.svelte
index 4053313a17..06c490426a 100644
--- a/frontend/src/lib/components/settings/PremiumInfo.svelte
+++ b/frontend/src/lib/components/settings/PremiumInfo.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { run } from 'svelte/legacy'
 
-	import { base } from '$lib/base'
 	import { capitalize, pluralize, sendUserToast } from '$lib/utils'
 	import DataTable from '$lib/components/table/DataTable.svelte'
 	import Cell from '$lib/components/table/Cell.svelte'
@@ -31,11 +30,13 @@
 				status?: string
 				developerNb: number
 				operatorNb: number
+				serviceAccountNb: number
 				seatsFromUsers: number
 				seatsFromExtraComps: number
 				usedSeats: number
 				owner: string
 				is_past_due: boolean
+				is_canceled?: boolean
 				max_tolerated_executions?: number
 		  }
 		| undefined = $state(undefined)
@@ -48,7 +49,7 @@
 		Team: [
 			`<b>$10/mo</b> per seat`,
 			`Every seat includes <b>10 000</b> executions`,
-			`Every seat includes either 1 developer OR 2 operators`
+			`Every seat includes either 1 developer OR 2 operators or service accounts`
 		],
 		Enterprise: [
 			`Dedicated and isolated database and workers available (EU/US/Asia)`,
@@ -80,6 +81,7 @@
 			// which is exactly when the endpoint returns the breakdown.
 			developerNb: billable.developers ?? 0,
 			operatorNb: billable.operators ?? 0,
+			serviceAccountNb: billable.service_accounts ?? 0,
 			seatsFromUsers,
 			seatsFromExtraComps,
 			usedSeats: seatsFromUsers + seatsFromExtraComps
@@ -162,11 +164,19 @@
 	<div class="flex flex-col gap-1">
 		<SettingsPageHeader
 			title={premiumInfo?.premium && plan
-				? `Plan: ${capitalize(plan)} plan${plan === 'team' ? ' (usage-based)' : ''}`
+				? plan === 'team_canceled'
+					? 'Plan: Team plan (canceled)'
+					: `Plan: ${capitalize(plan)} plan${plan === 'team' ? ' (usage-based)' : ''}`
 				: 'Plan: Free plan'}
 			class="mb-0"
 		/>
-		{#if premiumInfo?.status === 'past_due'}
+		{#if premiumInfo?.is_canceled}
+			<p class="text-base">
+				Your final invoice has been sent. The team plan stays active until the end of the month, up
+				to the {premiumInfo.max_tolerated_executions?.toLocaleString('en-US')} executions paid for,
+				then this workspace moves to the free plan.
+			</p>
+		{:else if premiumInfo?.status === 'past_due'}
 			<p class="text-red-500 text-base">
 				{#if premiumInfo.max_tolerated_executions === undefined || premiumInfo.usage > premiumInfo.max_tolerated_executions}
 					Your last invoice is unpaid, you cannot run any more jobs. Please update your payment
@@ -184,7 +194,7 @@
 		<Button
 			endIcon={{ icon: ExternalLink }}
 			variant="accent"
-			href="{base}/api/w/{$workspaceStore}/workspaces/billing_portal">Customer Portal</Button
+			href="/api/w/{$workspaceStore}/workspaces/billing_portal">Customer Portal</Button
 		>
 		<p class="text-xs text-primary mt-1">
 			See invoices, change billing information or subscription details.
@@ -250,8 +260,7 @@
 									<div class="flex flex-col gap-0.5">
 										<div class="font-medium">Developers</div>
 										<p class="text-xs text-secondary">
-											Calculated on the MAXIMUM number of users in a given billing period, see the
-											Customer Portal for more info.
+											1 seat each.
 										</p>
 									</div>
 								</Cell>
@@ -266,8 +275,7 @@
 									<div class="flex flex-col gap-0.5">
 										<div class="font-medium">Operators</div>
 										<p class="text-xs text-secondary">
-											Calculated on the MAXIMUM number of operators in a given billing period, see
-											the Customer Portal for more info.
+											Half a seat each.
 										</p>
 									</div>
 								</Cell>
@@ -277,17 +285,34 @@
 									</div>
 								</Cell>
 							</tr>
+							<tr>
+								<Cell first>
+									<div class="flex flex-col gap-0.5">
+										<div class="font-medium">Service accounts</div>
+										<p class="text-xs text-secondary">
+											Half a seat each, whatever their role.
+										</p>
+									</div>
+								</Cell>
+								<Cell last numeric>
+									<div class="text-sm text-secondary">
+										{formatNumber(premiumInfo.serviceAccountNb)}
+									</div>
+								</Cell>
+							</tr>
 							<tr class="bg-slate-50 dark:bg-slate-900/40">
 								<Cell first>
 									<div class="flex flex-col gap-0.5">
 										<div class="font-semibold text-sm">Seats from users</div>
 										<p class="text-xs text-secondary">
-											1 developer = 1 seat, 2 operators = 1 seat.
+											1 developer = 1 seat, 2 operators or service accounts = 1 seat.
 										</p>
 										<p class="text-[11px] text-secondary font-mono">
-											u = ceil({formatNumber(premiumInfo.developerNb)} + {formatNumber(
+											u = ceil({formatNumber(premiumInfo.developerNb)} + ({formatNumber(
 												premiumInfo.operatorNb
-											)}/2) = {formatNumber(premiumInfo.seatsFromUsers)}
+											)} + {formatNumber(premiumInfo.serviceAccountNb)})/2) = {formatNumber(
+												premiumInfo.seatsFromUsers
+											)}
 										</p>
 									</div>
 								</Cell>
@@ -355,8 +380,9 @@
 											Used seats (billed)
 										</div>
 										<p class="text-xs text-secondary">
-											Highest between seats from 'Developers + Operators' and 'Seats from
-											executions'. This is the number of seats used for billing this month.
+											'Seats from users' plus 'Extra seats from computations'. Billed on the
+											highest total reached during the month; your invoices in the Customer Portal
+											show what was billed.
 										</p>
 										<p class="text-[11px] text-secondary font-mono">
 											u + c = {formatNumber(premiumInfo.usedSeats)}
@@ -389,7 +415,7 @@
 			<div class="text-sm font-semibold text-primary">Estimate your monthly cost</div>
 			<p class="text-xs text-secondary max-w-xl">
 				This is a rough estimate based on your expected team size and workload. Actual billing is
-				based on the maximum number of users and executions in a given month.
+				based on the highest seat total reached during the month.
 			</p>
 		</div>
 
@@ -564,7 +590,7 @@
 							<Button
 								size="xs"
 								color="bg-blue-500 text-white"
-								href="{base}/api/w/{$workspaceStore}/workspaces/checkout?plan=team"
+								href="/api/w/{$workspaceStore}/workspaces/checkout?plan=team"
 							>
 								Upgrade to Team plan</Button
 							>
diff --git a/frontend/src/lib/components/settings/ScopeSelector.svelte b/frontend/src/lib/components/settings/ScopeSelector.svelte
index 24c9b99562..663e043035 100644
--- a/frontend/src/lib/components/settings/ScopeSelector.svelte
+++ b/frontend/src/lib/components/settings/ScopeSelector.svelte
@@ -15,6 +15,8 @@
 		class?: string
 		/** Renders above the scope-list card, below the Selected Scopes summary. */
 		topSlot?: Snippet
+		/** What an empty selection means, shown when no scope is selected. */
+		emptyLabel?: string
 	}
 
 	interface ScopeState {
@@ -38,7 +40,8 @@
 		selectedScopes = $bindable([]),
 		disabled = false,
 		class: className = '',
-		topSlot
+		topSlot,
+		emptyLabel = 'No scopes selected. Token will have full access.'
 	}: Props = $props()
 
 	let scopeDomains = $state<ScopeDomain[] | null>(null)
@@ -532,7 +535,7 @@
 			</div>
 
 			{#if selectedScopes.length === 0}
-				<p class="text-xs text-secondary">No scopes selected. Token will have full access.</p>
+				<p class="text-xs text-secondary">{emptyLabel}</p>
 			{:else if hasAdministratorScope}
 				<p class="text-xs text-secondary"
 					>Administrator scope grants full access to all resources.</p
@@ -640,7 +643,7 @@
 											? 'bg-surface-disabled opacity-60'
 											: 'bg-surface-tertiary'}"
 									>
-										<div class="flex justify-between items-center">
+										<div class="flex justify-between items-center min-h-7">
 											<label
 												class={twMerge(
 													'flex items-center gap-2 flex-1 min-w-0',
@@ -674,7 +677,7 @@
 													>
 														{#snippet trigger()}
 															<Button
-																size="xs"
+																unifiedSize="sm"
 																disabled={isDisabled}
 																variant="default"
 																startIcon={resourcePathArray.length > 0
@@ -714,7 +717,7 @@
 																		onclick={() => {
 																			addResourcePath(scope.value, currentInput)
 																		}}
-																		size="xs"
+																		unifiedSize="sm"
 																		disabled={!currentInput.trim()}
 																	>
 																		Add
diff --git a/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte b/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
index da7cd5a3de..b9ad80f63e 100644
--- a/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
+++ b/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
@@ -31,6 +31,7 @@
 	// Kept out of `operatorWorkspaceSettings` so the visibility table's "Enable all" never flips a
 	// write right, and so these rows stay out of that table.
 	let builderFlows = $state(false)
+	let builderApps = $state(false)
 	// Withdrawable rather than granted: operators hold these until an admin turns them off.
 	let manageSchedules = $state(true)
 	let manageTriggers = $state(true)
@@ -38,6 +39,7 @@
 	let originalSettings = $state({
 		...untrack(() => operatorWorkspaceSettings),
 		builder_flows: false,
+		builder_apps: false,
 		manage_schedules: true,
 		manage_triggers: true
 	})
@@ -51,15 +53,24 @@
 	const settingsPayload = $derived({
 		...operatorWorkspaceSettings,
 		builder_flows: builderFlows,
+		builder_apps: builderApps,
 		manage_schedules: manageSchedules,
 		manage_triggers: manageTriggers
 	})
 
-	// The seat cost lands when the right is first granted, so confirm only on that transition.
-	const grantsBuilderRight = $derived(builderFlows && !originalSettings.builder_flows)
+	// The seat cost lands on the first right granted, so confirm only when going from neither to
+	// either. Adding the second one later is already paid for.
+	const grantsFirstBuilderRight = $derived(
+		(builderFlows || builderApps) &&
+			!(originalSettings.builder_flows || originalSettings.builder_apps)
+	)
+
+	const grantedBuilderKinds = $derived(
+		[builderFlows && 'flows', builderApps && 'full-code apps'].filter(Boolean).join(' and ')
+	)
 
 	function onSaveClicked() {
-		if (grantsBuilderRight) {
+		if (grantsFirstBuilderRight) {
 			confirmBuilderOpen = true
 		} else {
 			saveSettings()
@@ -105,17 +116,20 @@
 				// would be saved here with the next unrelated change, builder rights among them.
 				const {
 					builder_flows: remoteFlows,
+					builder_apps: remoteApps,
 					manage_schedules: remoteSchedules,
 					manage_triggers: remoteTriggers,
 					...remoteVisibility
 				} = settings.operator_settings ?? {}
 				operatorWorkspaceSettings = { ...defaultVisibility, ...remoteVisibility }
 				builderFlows = remoteFlows ?? false
+				builderApps = remoteApps ?? false
 				manageSchedules = remoteSchedules ?? true
 				manageTriggers = remoteTriggers ?? true
 				originalSettings = {
 					...operatorWorkspaceSettings,
 					builder_flows: builderFlows,
+					builder_apps: builderApps,
 					manage_schedules: manageSchedules,
 					manage_triggers: manageTriggers
 				}
@@ -155,8 +169,8 @@
 
 	<Section
 		small
-		label="Build flows"
-		description="Let operators compose flows out of scripts and flows that are already deployed. They still cannot write code. Granting this makes each operator consume a full seat instead of half a seat."
+		label="Build flows and apps"
+		description="Let operators build flows out of deployed scripts and flows, and full-code apps whose frontend code they write. Apps always run sandboxed, and operators still cannot write backend scripts. Granting either right makes each operator consume a full seat instead of half a seat."
 		wrapperClass="mb-6"
 		class="flex flex-col gap-y-1"
 	>
@@ -165,6 +179,11 @@
 			options={{ right: 'Operators can build flows' }}
 			size="xs"
 		/>
+		<Toggle
+			bind:checked={builderApps}
+			options={{ right: 'Operators can build full-code apps' }}
+			size="xs"
+		/>
 	</Section>
 
 	<Section
@@ -269,8 +288,8 @@
 			instance is billed.
 		</span>
 		<span>
-			They can create, edit and delete flows wherever their folder permissions already let them
-			write. Review those permissions before enabling.
+			They can create, edit and delete {grantedBuilderKinds} wherever their folder permissions already
+			let them write. Review those permissions before enabling.
 		</span>
 	</div>
 </ConfirmationModal>
diff --git a/frontend/src/lib/components/sidebar/CriticalAlertModal.svelte b/frontend/src/lib/components/sidebar/CriticalAlertModal.svelte
index 4a41c65a31..acc8165014 100644
--- a/frontend/src/lib/components/sidebar/CriticalAlertModal.svelte
+++ b/frontend/src/lib/components/sidebar/CriticalAlertModal.svelte
@@ -16,7 +16,6 @@
 	import List from '$lib/components/common/layout/List.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { BellOff, Bell, ExternalLink, Settings } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import Notification from '$lib/components/common/alert/Notification.svelte'
 
 	interface Props {
@@ -71,7 +70,7 @@
 		await updateHasUnacknowledgedCriticalAlerts(false)
 		checkForNewAlertsInterval = setInterval(() => {
 			updateHasUnacknowledgedCriticalAlerts(true)
-		}, 15000)
+		}, 30000)
 	})
 
 	onDestroy(() => {
@@ -255,7 +254,7 @@
 								<Button
 									size="xs"
 									color="light"
-									href="{base}/?workspace=admins#superadmin-settings"
+									href="/?workspace=admins#superadmin-settings"
 									target="_blank"
 								>
 									<div class="w-full">
@@ -270,7 +269,7 @@
 								<Button
 									size="xs"
 									color="light"
-									href="{base}/workspace_settings?tab=error_handler"
+									href="/workspace_settings?tab=error_handler"
 									target="_blank"
 								>
 									Workspace Critical Alert Settings <ExternalLink size="16" />
@@ -283,7 +282,7 @@
 				<Button
 					size="xs"
 					variant="default"
-					href="{base}/workspace_settings?tab=error_handler"
+					href="/workspace_settings?tab=error_handler"
 					target="_blank"
 				>
 					<List horizontal justify="between" gap="sm">
diff --git a/frontend/src/lib/components/sidebar/FinishAccountSetup.svelte b/frontend/src/lib/components/sidebar/FinishAccountSetup.svelte
index 8115f3a3d7..9a3080137a 100644
--- a/frontend/src/lib/components/sidebar/FinishAccountSetup.svelte
+++ b/frontend/src/lib/components/sidebar/FinishAccountSetup.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import type { Component } from 'svelte'
-	import { base } from '$lib/base'
 	import { UserService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { Button } from '$lib/components/common'
@@ -106,7 +105,7 @@
 								// Read by the OAuth callback: a provider asserting another address is refused
 								// rather than opening a second account under it (see oauth2_ee.rs).
 								document.cookie = `finish_setup=${encodeURIComponent(email)}; path=/; max-age=600; SameSite=Lax`
-								window.location.assign(`${base}/api/oauth/login/${login.type}`)
+								window.location.assign(`/api/oauth/login/${login.type}`)
 							}}
 						>
 							Continue with {login.displayName}
diff --git a/frontend/src/lib/components/sidebar/MenuButton.svelte b/frontend/src/lib/components/sidebar/MenuButton.svelte
index 3d0286a4af..e6f23361bf 100644
--- a/frontend/src/lib/components/sidebar/MenuButton.svelte
+++ b/frontend/src/lib/components/sidebar/MenuButton.svelte
@@ -54,6 +54,8 @@
 		// Classes for the label line only — `class` reaches the button, the label and the
 		// sublabel alike, which is the wrong tool for colouring one line of the two.
 		labelClass?: string | undefined
+		// Draw the colour disc at 20px rather than 26px, for denser rows such as the page header.
+		compact?: boolean
 	}
 
 	let {
@@ -79,7 +81,8 @@
 		emphasizeLabel = false,
 		disableTitle = false,
 		ariaLabel = undefined,
-		labelClass = undefined
+		labelClass = undefined,
+		compact = false
 	}: Props = $props()
 
 	let buttonRef: HTMLButtonElement | HTMLAnchorElement | undefined = $state(undefined)
@@ -94,7 +97,7 @@
 	<Popover
 		appearTimeout={0}
 		disappearTimeout={0}
-		class="w-full"
+		class={compact ? 'w-auto' : 'w-full'}
 		disablePopup={!isCollapsed}
 		placement="right"
 	>
@@ -119,7 +122,8 @@
 			{href}
 			data-light-mode={lightMode}
 			class={twMerge(
-				'group flex items-center px-2 py-2 font-light rounded-md gap-2 w-full',
+				'group flex items-center px-2 py-2 font-light rounded-md gap-2',
+				compact ? 'w-auto' : 'w-full',
 				sidebarClasses.hoverBg,
 				'transition-all relative',
 				sublabel ? 'h-10' : 'h-8',
@@ -134,11 +138,23 @@
 			{#if icon}
 				{@const SvelteComponent = icon}
 				{#if color}
-					<svg width="26" height="26" viewBox="0 0 26 26" class="flex-shrink-0 -ml-[5px]">
-						<circle cx="13" cy="13" r="13" fill={color} />
-						<foreignObject x="5" y="5" width="16" height="16">
+					{@const disc = compact ? 20 : 26}
+					{@const glyph = compact ? 12 : 16}
+					<svg
+						width={disc}
+						height={disc}
+						viewBox="0 0 {disc} {disc}"
+						class="flex-shrink-0 {compact ? '-ml-[3px]' : '-ml-[5px]'}"
+					>
+						<circle cx={disc / 2} cy={disc / 2} r={disc / 2} fill={color} />
+						<foreignObject
+							x={(disc - glyph) / 2}
+							y={(disc - glyph) / 2}
+							width={glyph}
+							height={glyph}
+						>
 							<SvelteComponent
-								size={16}
+								size={glyph}
 								class={twMerge(sidebarClasses.iconText, 'transition-colors', iconClasses)}
 								{...iconProps}
 							/>
@@ -158,7 +174,7 @@
 				{/if}
 			{/if}
 
-			<div class="flex flex-col text-left grow min-w-0">
+			<div class="flex flex-col text-left min-w-0 {compact ? '' : 'grow'}">
 				{#if !isCollapsed && label}
 					<div
 						class={twMerge(
diff --git a/frontend/src/lib/components/sidebar/MenuLink.svelte b/frontend/src/lib/components/sidebar/MenuLink.svelte
index 1c6b7ec715..ebe4a8b768 100644
--- a/frontend/src/lib/components/sidebar/MenuLink.svelte
+++ b/frontend/src/lib/components/sidebar/MenuLink.svelte
@@ -3,7 +3,6 @@
 	import type { MenubarMenuElements } from '@melt-ui/svelte'
 	import { navigating, page } from '$app/stores'
 	import Popover from '../Popover.svelte'
-	import { base } from '$app/paths'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
 	import { goto } from '$app/navigation'
 	import { twMerge } from 'tailwind-merge'
@@ -40,7 +39,7 @@
 	let isSelected = $state(false)
 
 	navigating.subscribe(() => {
-		if (href === `${base}/`) {
+		if (href === '/') {
 			isSelected = $page.url.pathname === href
 		} else {
 			isSelected = $page.url.pathname.startsWith(href)
diff --git a/frontend/src/lib/components/sidebar/OperatorMenu.svelte b/frontend/src/lib/components/sidebar/OperatorMenu.svelte
deleted file mode 100644
index 2d35ce7e10..0000000000
--- a/frontend/src/lib/components/sidebar/OperatorMenu.svelte
+++ /dev/null
@@ -1,337 +0,0 @@
-<script lang="ts">
-	import {
-		Home,
-		Menu as MenuIcon,
-		Play,
-		Settings,
-		LogOut,
-		Moon,
-		Sun,
-		Code2,
-		LayoutDashboard,
-		Calendar,
-		ServerCog,
-		Table2,
-		GraduationCap
-	} from 'lucide-svelte'
-	import SwitchWorkspaceSubmenu from './SwitchWorkspaceSubmenu.svelte'
-	import {
-		OPERATOR_MAIN_LINKS,
-		OPERATOR_SECONDARY_LINKS,
-		OPERATOR_TRIGGER_LINKS,
-		type OperatorMenuLink,
-		type OperatorTriggerLink
-	} from './operatorRoutes'
-	import { base } from '$lib/base'
-	import { page } from '$app/state'
-	import { TOUR_PARAM, TOUR_PARAM_VALUE } from '$lib/components/tutorials/operatorTour'
-
-	import MultiplayerMenu from './MultiplayerMenu.svelte'
-	import { Plus } from 'lucide-svelte'
-	import {
-		enterpriseLicense,
-		superadmin,
-		usedTriggerKinds,
-		userWorkspaces,
-		workspaceColor,
-		workspaceStore
-	} from '$lib/stores'
-	import { twMerge } from 'tailwind-merge'
-	import { getContrastTextColor } from '$lib/utils'
-	import { USER_SETTINGS_HASH } from './settings'
-	import { logout } from '$lib/logoutKit'
-	import DarkModeObserver from '../DarkModeObserver.svelte'
-	import BarsStaggered from '../icons/BarsStaggered.svelte'
-	import { Menu, Menubar, MenuItem } from '$lib/components/meltComponents'
-	import MenuButton, { sidebarClasses } from './MenuButton.svelte'
-	import MenuLink from './MenuLink.svelte'
-	import type { FavoriteKind } from './FavoriteMenu.svelte'
-	let darkMode: boolean = $state(false)
-	let showExtraTriggers = $state(false)
-	// The menu opens on hover, so this doubles as "the pointer is on the button":
-	// it slides the workspace name out beside the icon, and keeps it out once a
-	// click has pinned the menu open and the pointer has moved away.
-	let menuOpen = $state(false)
-
-	interface Props {
-		isCollapsed?: boolean
-		favoriteLinks?: {
-			label: string
-			href: string
-			kind: FavoriteKind
-		}[]
-	}
-
-	let { isCollapsed = false, favoriteLinks = [] }: Props = $props()
-
-	const MAIN_LINK_ICONS: Record<string, any> = { home: Home, runs: Play, schedules: Calendar }
-	let activeWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
-	let workspaceName = $derived(activeWorkspace?.name ?? $workspaceStore ?? '')
-	// Home is where an operator lands and gets their bearings, so the name stays out there
-	// rather than waiting for a hover. Everywhere else the button is the page's own chrome
-	// and stays out of the way until asked.
-	let showWorkspaceName = $derived(menuOpen || page.url.pathname === `${base}/`)
-	// Most workspaces never get a colour (it is only ever set explicitly), and this button
-	// floats over page content with nothing else behind it — so the disc falls back to a
-	// neutral rather than vanishing, keeping the glyph on a ground of its own everywhere.
-	// A token rather than a hex so it follows the theme; getContrastTextColor only parses
-	// hex, so it returns undefined here and the glyph keeps its themed `text-hint`.
-	const NEUTRAL_DISC = 'rgb(var(--color-surface-sunken))'
-
-	let mainMenuLinks = $derived(
-		OPERATOR_MAIN_LINKS.map((link) => ({ ...link, icon: MAIN_LINK_ICONS[link.id] })).filter(
-			(link) => link.id === 'home' || filterLink(link)
-		)
-	)
-
-	function filterLink(link: OperatorMenuLink) {
-		if (!$userWorkspaces || !$workspaceStore) return false
-		return activeWorkspace?.operator_settings?.[link.id] === true
-	}
-	let secondMenuLinks: OperatorMenuLink[] = $derived(OPERATOR_SECONDARY_LINKS.filter(filterLink))
-	let allTriggerLinks: OperatorTriggerLink[] = $derived(OPERATOR_TRIGGER_LINKS.filter(filterLink))
-	let secondMenuTriggerLinks = $derived(
-		allTriggerLinks.filter((link) => $usedTriggerKinds.includes(link.kind))
-	)
-	let extraTriggerLinks = $derived(
-		allTriggerLinks.filter((link) => !$usedTriggerKinds.includes(link.kind))
-	)
-</script>
-
-<Menubar>
-	{#snippet children({ createMenu })}
-		<Menu
-			{createMenu}
-			placement="bottom-start"
-			openOnHover
-			usePointerDownOutside
-			submenuSafe
-			bind:open={menuOpen}
-			on:close={() => (showExtraTriggers = false)}
-		>
-			{#snippet triggr({ trigger, pinned })}
-				{@const iconColor = getContrastTextColor($workspaceColor)}
-				<!-- Ground for the expanded state only: the button floats over page content and its
-				     hover tint is translucent, so the name would otherwise sit on whatever is
-				     underneath. Icon-only needs none — the disc is always drawn. -->
-				<div class="flex rounded-md {showWorkspaceName ? 'bg-surface' : ''}">
-					<MenuButton
-						class="!text-xs"
-						buttonClass={twMerge(
-							'!pl-3.5 !pr-2 !w-auto',
-							// A hover-opened menu leaves the button plain once the pointer moves on;
-							// keeping the tint is what tells you the click pinned it.
-							pinned ? sidebarClasses.selectedBg : ''
-						)}
-						icon={MenuIcon}
-						isCollapsed={false}
-						lightMode
-						color={$workspaceColor ?? NEUTRAL_DISC}
-						iconProps={iconColor ? { style: `color: ${iconColor}` } : undefined}
-						label={showWorkspaceName ? workspaceName : undefined}
-						ariaLabel={workspaceName ? `Menu — ${workspaceName}` : 'Menu'}
-						{trigger}
-					/>
-				</div>
-			{/snippet}
-			{#snippet children({ item, builders })}
-				<div class="w-full max-w-full">
-					{#each favoriteLinks ?? [] as favorite (favorite.href)}
-						<MenuItem
-							href={favorite.href}
-							{item}
-							class={twMerge(
-								'w-full inline-flex flex-row px-2 py-2',
-								'data-[highlighted]:bg-surface-hover'
-							)}
-						>
-							<span class="center-center">
-								{#if favorite.kind == 'script'}
-									<Code2 size={16} />
-								{:else if favorite.kind == 'flow'}
-									<BarsStaggered size={16} />
-								{:else if favorite.kind == 'app' || favorite.kind == 'raw_app'}
-									<LayoutDashboard size={16} />
-								{:else if favorite.kind == 'asset'}
-									<Table2 size={16} />
-								{/if}
-							</span>
-							<span class="text-primary ml-2 grow min-w-0 text-xs truncate">
-								{favorite.label}
-							</span>
-						</MenuItem>
-					{/each}
-				</div>
-
-				{#each mainMenuLinks as menuLink (menuLink.href ?? menuLink.label)}
-					<MenuLink class="!text-xs" {...menuLink} {isCollapsed} {item} lightMode />
-				{/each}
-
-				<div class="divide-y" role="none">
-					<div role="none">
-						<MenuItem
-							href={USER_SETTINGS_HASH}
-							class={twMerge(
-								'flex flex-row gap-3.5 items-center px-2 py-2',
-								sidebarClasses.text,
-								'transition-colors',
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							lightMode
-							{item}
-						>
-							<Settings size={14} />
-							Account settings
-						</MenuItem>
-
-						<MenuItem
-							href="{base}/?{TOUR_PARAM}={TOUR_PARAM_VALUE}"
-							class={twMerge(
-								'flex flex-row gap-3.5 items-center px-2 py-2',
-								sidebarClasses.text,
-								'transition-colors',
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							lightMode
-							{item}
-						>
-							<GraduationCap size={14} />
-							Take the tour
-						</MenuItem>
-					</div>
-
-					<div role="none">
-						<MenuItem
-							onClick={() => {
-								if (!document.documentElement.classList.contains('dark')) {
-									document.documentElement.classList.add('dark')
-									window.localStorage.setItem('dark-mode', 'dark')
-								} else {
-									document.documentElement.classList.remove('dark')
-									window.localStorage.setItem('dark-mode', 'light')
-								}
-							}}
-							lightMode
-							class={twMerge(
-								'w-full flex gap-3.5 px-2 py-2',
-								'transition-colors',
-								sidebarClasses.text,
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							{item}
-						>
-							{#if darkMode}
-								<Sun size={14} />
-							{:else}
-								<Moon size={14} />
-							{/if}
-							Switch theme
-						</MenuItem>
-						<SwitchWorkspaceSubmenu {builders} {item} />
-
-						{#if $superadmin}
-							<MenuItem
-								href="#superadmin-settings"
-								class={twMerge(
-									'flex flex-row gap-3.5 items-center px-2 py-2 ',
-									'text-secondary text-xs',
-									'cursor-pointer',
-									'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-								)}
-								{item}
-							>
-								<ServerCog size={14} />
-								Instance settings
-							</MenuItem>
-						{/if}
-
-						<MenuItem
-							onClick={() => logout()}
-							class={twMerge(
-								'flex flex-row gap-3.5  items-center px-2 py-2 w-full',
-								'text-primary text-xs',
-								'cursor-pointer',
-								'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-							)}
-							{item}
-						>
-							<LogOut size={14} />
-							Sign out
-						</MenuItem>
-					</div>
-					<div role="none">
-						{#snippet renderSecondMenuLinks(menuLinks: OperatorMenuLink[])}
-							{#each menuLinks as menuLink (menuLink.href ?? menuLink.label)}
-								<MenuItem
-									href={menuLink.href}
-									class={twMerge(
-										'flex flex-row gap-3.5 items-center px-2 py-2 text-secondary text-2xs cursor-pointer',
-										'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-									)}
-									{item}
-								>
-									{menuLink.label}
-								</MenuItem>
-							{/each}
-						{/snippet}
-						{#if secondMenuLinks.length || secondMenuTriggerLinks.length || extraTriggerLinks.length}
-							<div class="divide-y">
-								{#if secondMenuLinks.length}<div
-										>{@render renderSecondMenuLinks(secondMenuLinks)}</div
-									>{/if}
-								{#if secondMenuTriggerLinks.length}<div
-										>{@render renderSecondMenuLinks(secondMenuTriggerLinks)}</div
-									>{/if}
-								{#if extraTriggerLinks.length}<div>
-										<!-- svelte-ignore a11y_no_static_element_interactions -->
-										<div
-											role="none"
-											onclickcapture={(e) => {
-												// This row expands the list below it instead of acting on the selection, and
-												// melt keeps the menu open only for a click it sees as defaultPrevented.
-												// Svelte delegates onclick to the root, which runs after melt's own listener,
-												// and a capture listener on the item itself would be ordered only by
-												// registration, so an ancestor's capture phase is what reliably wins.
-												e.preventDefault()
-												showExtraTriggers = !showExtraTriggers
-											}}
-										>
-											<MenuItem
-												class={twMerge(
-													'flex flex-row gap-3.5 items-center px-2 py-2 w-full text-secondary text-2xs cursor-pointer',
-													'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-												)}
-												{item}
-											>
-												<Plus size={12} />
-												<span class="text-2xs">More triggers</span>
-											</MenuItem>
-										</div>
-										{#if showExtraTriggers}
-											{#each extraTriggerLinks as menuLink (menuLink.href)}
-												<MenuItem
-													href={menuLink.href}
-													class={twMerge(
-														'flex flex-row gap-3.5 items-center px-2 py-2 pl-6 text-tertiary text-2xs cursor-pointer',
-														'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-													)}
-													{item}
-												>
-													{menuLink.label}
-												</MenuItem>
-											{/each}
-										{/if}
-									</div>{/if}
-							</div>
-						{/if}
-						{#if $enterpriseLicense}
-							<MultiplayerMenu />
-						{/if}
-					</div>
-				</div>
-			{/snippet}
-		</Menu>
-	{/snippet}
-</Menubar>
-
-<DarkModeObserver bind:darkMode />
diff --git a/frontend/src/lib/components/sidebar/SettingsMenu.svelte b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
index e0951f37cd..95dc03992c 100644
--- a/frontend/src/lib/components/sidebar/SettingsMenu.svelte
+++ b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
@@ -18,9 +18,9 @@
 		Crown,
 		Gauge,
 		Trash2,
-		KeyRound
+		KeyRound,
+		GraduationCap
 	} from 'lucide-svelte'
-	import { base } from '$app/paths'
 	import { goto } from '$lib/navigation'
 	import { type Item } from '$lib/utils'
 	import { logout } from '$lib/logoutKit'
@@ -38,6 +38,8 @@
 	import { USER_SETTINGS_HASH, SUPERADMIN_SETTINGS_HASH } from './settings'
 	import { accountSetup } from './accountSetup.svelte'
 	import { EXECUTIONS_HINT } from './executionsHint'
+	import { sidebarPageAllowed } from './operatorRoutes'
+	import { TOUR_PARAM, TOUR_PARAM_VALUE } from '$lib/components/tutorials/operatorTour'
 	import {
 		userWorkspaces,
 		workspaceStore,
@@ -189,12 +191,12 @@
 								icon: Building,
 								// The `workspace` query param switches the app to the target
 								// workspace on arrival (full loads and client-side navs alike).
-								href: `${base}/workspace_settings?workspace=${workspaceSettingsTarget}`
+								href: `/workspace_settings?workspace=${workspaceSettingsTarget}`
 							}
 						: {
 								displayName: `${currentWs?.name ?? $workspaceStore ?? 'Workspace'} settings`,
 								icon: Building,
-								href: `${base}/workspace_settings`
+								href: '/workspace_settings'
 							}
 				]
 			: []),
@@ -248,6 +250,15 @@
 					icon: Settings,
 					action: () => goto(USER_SETTINGS_HASH)
 				},
+				...($userStore?.operator
+					? [
+							{
+								displayName: 'Take the tour',
+								icon: GraduationCap,
+								action: () => goto(`/?${TOUR_PARAM}=${TOUR_PARAM_VALUE}`)
+							}
+						]
+					: []),
 				...(cloudHosted && $isPremiumStore === false
 					? [
 							{
@@ -265,9 +276,9 @@
 	])
 
 	const logsItems = $derived<Item[]>([
-		{ displayName: 'Audit logs', icon: Eye, href: `${base}/audit_logs` },
+		{ displayName: 'Audit logs', icon: Eye, href: '/audit_logs' },
 		...($devopsRole
-			? [{ displayName: 'Service logs', icon: Logs, href: `${base}/service_logs` }]
+			? [{ displayName: 'Service logs', icon: Logs, href: '/service_logs' }]
 			: []),
 		...($enterpriseLicense
 			? [
@@ -305,8 +316,9 @@
 	<MenuLink
 		class="!text-xs"
 		label="Workers"
-		href="{base}/workers"
+		href="/workers"
 		icon={ServerCog}
+		disabled={!sidebarPageAllowed($userStore?.operator, currentWs, 'workers')}
 		{isCollapsed}
 		aiId="sidebar-menu-link-workers"
 		aiDescription="Button to navigate to workers"
@@ -350,9 +362,9 @@
 		<MenuLink
 			class="!text-xs"
 			label="Audit logs"
-			href="{base}/audit_logs"
+			href="/audit_logs"
 			icon={Eye}
-			disabled={$userStore?.operator}
+			disabled={!sidebarPageAllowed($userStore?.operator, currentWs, 'audit_logs')}
 			{isCollapsed}
 			aiId="sidebar-menu-link-audit-logs"
 			aiDescription="Button to navigate to audit logs"
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index b43bc2988e..3c38494145 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -12,31 +12,25 @@
 	} from '$lib/stores'
 	import { isForkOwner } from '$lib/utils/workspaceHierarchy'
 	import { SIDEBAR_SHOW_SCHEDULES } from '$lib/consts'
+	import { NAV_PAGES } from './navPages'
 	import {
 		BookOpen,
 		ServerCog,
-		Boxes,
 		Calendar,
-		DollarSign,
 		Eye,
 		Logs,
 		FolderCog,
-		FolderOpen,
 		Github,
 		HelpCircle,
-		Home,
 		LogOut,
 		Newspaper,
-		Play,
 		Route,
 		Settings,
 		UserCog,
-		Users,
 		Plus,
 		Unplug,
 		AlertCircle,
 		Database,
-		Pyramid,
 		MailIcon,
 		ChevronDown,
 		ChevronRight
@@ -47,7 +41,6 @@
 	import DiscordIcon from '../icons/brands/Discord.svelte'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import { base } from '$lib/base'
 	import { page } from '$app/state'
 	import SideBarNotification from './SideBarNotification.svelte'
 	import KafkaIcon from '../icons/triggers/KafkaIcon.svelte'
@@ -72,6 +65,7 @@
 	import GoogleCloudIcon from '../icons/triggers/GoogleCloudIcon.svelte'
 	import AzureIcon from '../icons/triggers/AzureIcon.svelte'
 	import { leaveCurrentWorkspace } from './leaveWorkspace'
+	import { sidebarPageAllowed, type OperatorPageKey } from './operatorRoutes'
 	import { markChangelogsOpened, readRecentChangelogs } from './changelogs'
 
 	const { recent: recentChangelogs, hasNew } = readRecentChangelogs()
@@ -188,78 +182,63 @@
 		return count
 	}
 
+	const currentWs = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
+	function allows(key: OperatorPageKey) {
+		return sidebarPageAllowed($userStore?.operator, currentWs, key)
+	}
+
 	const itemClass = twMerge(
 		'text-secondary font-normal w-full block px-4 py-2 text-2xs data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
 	)
-	let mainMenuLinks = $derived(
-		[
-			{
-				label: 'Home',
-				href: `${base}/`,
-				icon: Home,
-				aiId: 'sidebar-menu-link-home',
-				aiDescription:
-					"Button to navigate to home which contains all the user's scripts, flows and apps"
-			},
-			{
-				label: 'Runs',
-				href: `${base}/runs`,
-				icon: Play,
-				aiId: 'sidebar-menu-link-runs',
-				aiDescription: 'Button to navigate to runs',
-				onclick: () => {
-					setTimeout(() => {
-						window.dispatchEvent(new Event('popstate'))
-					}, 100)
-				}
-			},
-			{
-				label: 'Variables',
-				href: `${base}/variables`,
-				icon: DollarSign,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-variables',
-				aiDescription: 'Button to navigate to variables'
-			},
-			{
-				label: 'Resources',
-				href: `${base}/resources`,
-				icon: Boxes,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-resources',
-				aiDescription: 'Button to navigate to resources'
-			},
-			{
-				label: 'Assets',
-				href: `${base}/assets`,
-				icon: Pyramid,
-				aiId: 'sidebar-menu-link-assets',
-				aiDescription: 'Button to navigate to assets'
-			},
-			{
-				label: 'Folders',
-				href: `${base}/folders`,
-				icon: FolderOpen,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-folders',
-				aiDescription: 'Button to navigate to folders'
-			},
-			{
-				label: 'Groups',
-				href: `${base}/groups`,
-				icon: Users,
-				disabled: $userStore?.operator,
-				aiId: 'sidebar-menu-link-groups',
-				aiDescription: 'Button to navigate to groups'
+	// Labels, paths and icons come from the shared page table, so the nav and the page header's
+	// breadcrumb always call a page the same thing. Everything else here is nav-only.
+	const MAIN_MENU_EXTRAS: Record<
+		string,
+		{ aiId: string; aiDescription: string; onclick?: () => void }
+	> = {
+		Home: {
+			aiId: 'sidebar-menu-link-home',
+			aiDescription:
+				"Button to navigate to home which contains all the user's scripts, flows and apps"
+		},
+		Runs: {
+			aiId: 'sidebar-menu-link-runs',
+			aiDescription: 'Button to navigate to runs',
+			onclick: () => {
+				setTimeout(() => {
+					window.dispatchEvent(new Event('popstate'))
+				}, 100)
 			}
-		].filter((l) => !excludeMainLabels.includes(l.label))
+		},
+		Variables: {
+			aiId: 'sidebar-menu-link-variables',
+			aiDescription: 'Button to navigate to variables'
+		},
+		Resources: {
+			aiId: 'sidebar-menu-link-resources',
+			aiDescription: 'Button to navigate to resources'
+		},
+		Assets: { aiId: 'sidebar-menu-link-assets', aiDescription: 'Button to navigate to assets' },
+		Folders: { aiId: 'sidebar-menu-link-folders', aiDescription: 'Button to navigate to folders' },
+		Groups: { aiId: 'sidebar-menu-link-groups', aiDescription: 'Button to navigate to groups' }
+	}
+	let mainMenuLinks = $derived(
+		NAV_PAGES.filter((p) => p.label in MAIN_MENU_EXTRAS)
+			.map((p) => ({
+				label: p.label,
+				href: p.path === '/' ? `/` : `${p.path}`,
+				icon: p.icon,
+				disabled: p.operatorKey ? !allows(p.operatorKey) : false,
+				...MAIN_MENU_EXTRAS[p.label]
+			}))
+			.filter((l) => !excludeMainLabels.includes(l.label))
 	)
 	let defaultExtraTriggerLinks = $derived([
 		{
 			label: 'HTTP',
 			href: '/routes',
 			icon: Route,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'http',
 			aiId: 'sidebar-menu-link-http',
 			aiDescription: 'Button to navigate to HTTP routes'
@@ -268,7 +247,7 @@
 			label: 'WebSockets',
 			href: '/websocket_triggers',
 			icon: Unplug,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'ws',
 			aiId: 'sidebar-menu-link-ws',
 			aiDescription: 'Button to navigate to websocket triggers'
@@ -277,7 +256,7 @@
 			label: 'Postgres',
 			href: '/postgres_triggers',
 			icon: Database,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'postgres',
 			aiId: 'sidebar-menu-link-postgres',
 			aiDescription: 'Button to navigate to Postgres triggers'
@@ -286,7 +265,7 @@
 			label: 'Kafka' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/kafka_triggers',
 			icon: KafkaIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'kafka',
 			aiId: 'sidebar-menu-link-kafka',
 			aiDescription: 'Button to navigate to Kafka triggers'
@@ -295,7 +274,7 @@
 			label: 'NATS' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/nats_triggers',
 			icon: NatsIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'nats',
 			aiId: 'sidebar-menu-link-nats',
 			aiDescription: 'Button to navigate to NATS triggers'
@@ -304,7 +283,7 @@
 			label: 'SQS' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/sqs_triggers',
 			icon: AwsIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'sqs',
 			aiId: 'sidebar-menu-link-sqs',
 			aiDescription: 'Button to navigate to SQS triggers'
@@ -313,7 +292,7 @@
 			label: 'GCP Pub/Sub' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/gcp_triggers',
 			icon: GoogleCloudIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'gcp',
 			aiId: 'sidebar-menu-link-gcp',
 			aiDescription: 'Button to navigate to GCP Pub/Sub triggers'
@@ -322,7 +301,7 @@
 			label: 'Azure Event Grid' + ($enterpriseLicense ? '' : ' (EE)'),
 			href: '/azure_triggers',
 			icon: AzureIcon,
-			disabled: $userStore?.operator || !$enterpriseLicense,
+			disabled: !allows('triggers') || !$enterpriseLicense,
 			kind: 'azure',
 			aiId: 'sidebar-menu-link-azure',
 			aiDescription: 'Button to navigate to Azure Event Grid triggers'
@@ -331,7 +310,7 @@
 			label: 'MQTT',
 			href: '/mqtt_triggers',
 			icon: MqttIcon,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'mqtt',
 			aiId: 'sidebar-menu-link-mqtt',
 			aiDescription: 'Button to navigate to MQTT triggers'
@@ -340,7 +319,7 @@
 			label: 'AMQP',
 			href: '/amqp_triggers',
 			icon: AmqpIcon,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'amqp',
 			aiId: 'sidebar-menu-link-amqp',
 			aiDescription: 'Button to navigate to AMQP triggers'
@@ -349,7 +328,7 @@
 			label: 'Email',
 			href: '/email_triggers',
 			icon: MailIcon,
-			disabled: $userStore?.operator,
+			disabled: !allows('triggers'),
 			kind: 'email',
 			aiId: 'sidebar-menu-link-email',
 			aiDescription: 'Button to navigate to Email triggers'
@@ -373,9 +352,9 @@
 	let triggerMenuLinks = $derived([
 		{
 			label: 'Schedules',
-			href: `${base}/schedules`,
+			href: '/schedules',
 			icon: Calendar,
-			disabled: !SIDEBAR_SHOW_SCHEDULES || $userStore?.operator,
+			disabled: !SIDEBAR_SHOW_SCHEDULES || !allows('schedules'),
 			aiId: 'sidebar-menu-link-schedules',
 			aiDescription: 'Button to navigate to schedules'
 		},
@@ -390,7 +369,6 @@
 	)
 	// Admins, superadmins, and fork creators reach workspace settings (the latter
 	// for the fork members screen; see isForkOwner / backend authorize_fork_owner_add_user).
-	const currentWs = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
 	const canManageWorkspace = $derived(
 		$userStore?.is_admin || $superadmin || isForkOwner(currentWs, $userStore?.email)
 	)
@@ -420,7 +398,7 @@
 					? [
 							{
 								label: 'Workspace',
-								href: `${base}/workspace_settings`,
+								href: '/workspace_settings',
 								icon: FolderCog,
 								aiId: 'sidebar-menu-link-workspace',
 								aiDescription: 'Button to navigate to workspace settings',
@@ -458,9 +436,9 @@
 		},
 		{
 			label: 'Workers',
-			href: `${base}/workers`,
+			href: '/workers',
 			icon: ServerCog,
-			disabled: $userStore?.operator,
+			disabled: !allows('workers'),
 			aiId: 'sidebar-menu-link-workers',
 			aiDescription: 'Button to navigate to workers'
 		},
@@ -473,7 +451,7 @@
 					subItems: [
 						{
 							label: 'Audit logs',
-							href: `${base}/audit_logs`,
+							href: '/audit_logs',
 							icon: Eye,
 							aiId: 'sidebar-menu-link-audit-logs',
 							aiDescription: 'Button to navigate to audit logs'
@@ -482,7 +460,7 @@
 							? [
 									{
 										label: 'Service logs',
-										href: `${base}/service_logs`,
+										href: '/service_logs',
 										icon: Logs,
 										aiId: 'sidebar-menu-link-service-logs',
 										aiDescription: 'Button to navigate to service logs'
@@ -507,9 +485,9 @@
 				}
 			: {
 					label: 'Audit logs',
-					href: `${base}/audit_logs`,
+					href: '/audit_logs',
 					icon: Eye,
-					disabled: $userStore?.operator,
+					disabled: !allows('audit_logs'),
 					aiId: 'sidebar-menu-link-audit-logs',
 					aiDescription: 'Button to navigate to audit logs'
 				}
@@ -551,7 +529,7 @@
 								{#each triggerMenuLinks as menuLink (menuLink.href ?? menuLink.label)}
 									<MenuLink class="!text-xs" {...menuLink} {isCollapsed} />
 								{/each}
-								{#if extraTriggerLinks.length > 0 && !$userStore?.operator}
+								{#if extraTriggerLinks.length > 0 && allows('triggers')}
 									<Menu {createMenu} usePointerDownOutside>
 										{#snippet triggr({ trigger })}
 											<MeltButton
diff --git a/frontend/src/lib/components/sidebar/SwitchWorkspaceSubmenu.svelte b/frontend/src/lib/components/sidebar/SwitchWorkspaceSubmenu.svelte
deleted file mode 100644
index 1f9b4f410f..0000000000
--- a/frontend/src/lib/components/sidebar/SwitchWorkspaceSubmenu.svelte
+++ /dev/null
@@ -1,68 +0,0 @@
-<script lang="ts">
-	import { untrack } from 'svelte'
-	import { melt } from '@melt-ui/svelte'
-	import type { MenubarMenuBuilders, MenubarMenuElements } from '@melt-ui/svelte'
-	import { Building, ChevronRight } from 'lucide-svelte'
-	import { twMerge } from 'tailwind-merge'
-	import { sidebarClasses } from './MenuButton.svelte'
-	import WorkspacePickerBody from './WorkspacePickerBody.svelte'
-	import { MenuItem } from '$lib/components/meltComponents'
-	import { clearWorkspaceFromStorage } from '$lib/stores'
-	import { base } from '$lib/base'
-
-	interface Props {
-		// Submenu builders from the enclosing melt Menu — createSubmenu must be
-		// called against this specific menu instance (same pattern as DropdownSubmenuItem).
-		builders: MenubarMenuBuilders
-		// Melt uses the parent menu's item builder for submenu rows too, so the
-		// picker body's MenuItems work here unchanged.
-		item: MenubarMenuElements['item']
-	}
-
-	let { builders, item }: Props = $props()
-
-	const {
-		elements: { subTrigger, subMenu },
-		states: { subOpen }
-	} = untrack(() => builders).createSubmenu()
-</script>
-
-<button
-	use:melt={$subTrigger}
-	class={twMerge(
-		'flex flex-row gap-3.5 items-center px-2 py-2 w-full',
-		sidebarClasses.text,
-		'transition-colors',
-		'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-	)}
->
-	<Building size={14} class="shrink-0" />
-	<span class="grow text-left">Switch workspace</span>
-	<ChevronRight size={14} class="shrink-0 text-tertiary" />
-</button>
-
-{#if $subOpen}
-	<div
-		use:melt={$subMenu}
-		class="z-[6001] w-56 bg-surface border rounded-md shadow-md focus:outline-none"
-	>
-		<WorkspacePickerBody {item} strictWorkspaceSelect />
-		<!-- The picker's list scrolls inside itself, so this sits below it and stays reachable
-		     however many workspaces the operator belongs to. -->
-		<div class="border-t border-border-light" role="none">
-			<MenuItem
-				href="{base}/user/workspaces"
-				onClick={() => clearWorkspaceFromStorage()}
-				class={twMerge(
-					'w-full flex flex-row gap-2 px-4 py-2 font-normal',
-					sidebarClasses.text,
-					'hover:bg-surface-hover hover:text-primary',
-					'data-[highlighted]:bg-surface-hover data-[highlighted]:text-primary'
-				)}
-				{item}
-			>
-				All workspaces
-			</MenuItem>
-		</div>
-	</div>
-{/if}
diff --git a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
index ddcbd9ca95..3902715d5a 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
@@ -14,9 +14,19 @@
 		createMenu: MenubarBuilders['createMenu']
 		// When used outside of the side bar, where links to workspace settings and such don't make as much sense.
 		strictWorkspaceSelect?: boolean
+		// Denser trigger for the page header bar: a smaller disc and a lighter name, so the
+		// workspace reads as the scope of the breadcrumb beside it rather than a heading.
+		compact?: boolean
 	}
 
-	let { isCollapsed = false, createMenu, strictWorkspaceSelect = false }: Props = $props()
+	let {
+		isCollapsed = false,
+		createMenu,
+		strictWorkspaceSelect = false,
+		compact = false
+	}: Props = $props()
+
+	let menu: Menu | undefined = $state(undefined)
 
 	// The active workspace's family root — shown in the trigger so a forked active workspace still
 	// surfaces its family name here (the fork itself is shown in the breadcrumb). Resolved exactly
@@ -29,7 +39,7 @@
 	const ambiguousNames = $derived(ambiguousWorkspaceNames($userWorkspaces))
 </script>
 
-<Menu {createMenu} usePointerDownOutside placement="bottom-start">
+<Menu bind:this={menu} {createMenu} usePointerDownOutside placement="bottom-start">
 	{#snippet triggr({ trigger })}
 		<!-- Family header reflects the family (root) color, not the active
 		     workspace's — switching into a fork must not recolor it. -->
@@ -41,7 +51,7 @@
 			name={currentFamily?.name ?? $workspaceStore ?? ''}
 			id={currentFamily?.id ?? $workspaceStore ?? ''}
 			disablePopup={isCollapsed}
-			class="block w-full"
+			class={compact ? 'block' : 'block w-full'}
 		>
 			<MenuButton
 				icon={Building}
@@ -53,8 +63,10 @@
 				{isCollapsed}
 				color={familyColor}
 				showChevron
-				emphasizeLabel
+				emphasizeLabel={!compact}
 				disableTitle
+				{compact}
+				labelClass={compact ? 'wm-workspace-name text-primary font-medium' : 'wm-workspace-name'}
 				{trigger}
 			/>
 		</NameIdTooltip>
@@ -63,6 +75,11 @@
 	{#snippet children({ item })}
 		<!-- The only strict caller is a standalone page (svix webhook creation) that owns its
 		     own navigation, so there a switch must leave the page where it is. -->
-		<WorkspacePickerBody {item} {strictWorkspaceSelect} keepPageOnSwitch={strictWorkspaceSelect} />
+		<WorkspacePickerBody
+			{item}
+			{strictWorkspaceSelect}
+			keepPageOnSwitch={strictWorkspaceSelect}
+			closeMenu={() => menu?.close()}
+		/>
 	{/snippet}
 </Menu>
diff --git a/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte b/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte
index fa4468fa6a..3719e35d35 100644
--- a/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { untrack } from 'svelte'
+	import { tick, untrack } from 'svelte'
 	import type { MenubarMenuElements } from '@melt-ui/svelte'
 	import { workspaceMenuHref } from './workspaceMenuHref'
 	import { isOperatorInWorkspace } from './operatorRoutes'
@@ -18,13 +18,12 @@
 	import { Check, ChevronDown, ChevronRight, Plus, Settings } from 'lucide-svelte'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
 	import { SvelteSet } from 'svelte/reactivity'
-	import { Badge, CopyButton } from '$lib/components/common'
+	import { CopyButton } from '$lib/components/common'
 	import { MenuItem, Tooltip } from '$lib/components/meltComponents'
 	import { EXECUTIONS_HINT } from './executionsHint'
 	import WorkspaceIcon from '$lib/components/workspace/WorkspaceIcon.svelte'
 	import { fixupUrlAfterWorkspaceSwitch } from './workspaceSwitchUrl'
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 	import { page } from '$app/state'
 	import { switchWorkspace } from '$lib/storeUtils'
 	import MultiplayerMenu from './MultiplayerMenu.svelte'
@@ -39,7 +38,7 @@
 	} from '$lib/utils/workspaceHierarchy'
 	import { canCreateFork } from '$lib/utils/editInFork'
 	import { workspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 
 	interface Props {
 		// The melt item builder of the menu (or submenu) hosting this list. Melt
@@ -48,14 +47,26 @@
 		item: MenubarMenuElements['item']
 		// When used outside of the side bar, where links to workspace settings and such don't make as much sense.
 		strictWorkspaceSelect?: boolean
+		/** Closes the menu this list lives in, so a workspace switch does not run under an open
+		 *  panel. The host owns the menu, so only it can. */
+		closeMenu?: () => void
 		// Set by a picker embedded in a page that drives its own navigation, so switching
 		// workspaces must not navigate away from it. Separate from strictWorkspaceSelect,
-		// which only strips the sidebar-specific rows — the operator submenu sets that one
-		// and still wants the switch to move the page.
+		// which only strips the sidebar-specific rows.
 		keepPageOnSwitch?: boolean
+		/** Opens with every family closed, forks included. For a picker whose job is to move between
+		 *  families rather than within one — a session's, where the fork is the session's own and
+		 *  not something the picker should offer to change. */
+		collapseFamilies?: boolean
 	}
 
-	let { item, strictWorkspaceSelect = false, keepPageOnSwitch = false }: Props = $props()
+	let {
+		item,
+		strictWorkspaceSelect = false,
+		keepPageOnSwitch = false,
+		collapseFamilies = false,
+		closeMenu
+	}: Props = $props()
 
 	async function toggleSwitchWorkspace(id: string) {
 		if ($workspaceStore === id) {
@@ -107,8 +118,13 @@
 		if (e.ctrlKey || e.metaKey || e.shiftKey || e.altKey) {
 			return
 		}
+		// This click is handled here rather than by melt, so melt never closes the menu for it and
+		// the panel would sit through the switch — which renames the workspace in the header,
+		// moving the very trigger the panel hangs from, with floating-ui chasing it across the
+		// viewport. Close first, let that reach the DOM, then switch.
 		e.preventDefault()
-		toggleSwitchWorkspace(workspace.id)
+		closeMenu?.()
+		void tick().then(() => toggleSwitchWorkspace(workspace.id))
 	}
 
 	// Family-first picker: list the workspace families (roots) with their forks
@@ -117,7 +133,7 @@
 	// scope header's WorkspaceFamilyPicker remains the primary fork surface.
 	//
 	// strictWorkspaceSelect is used where this list has no scope header beside it
-	// (standalone pages such as svix webhook creation, the operator menu), so
+	// (standalone pages such as svix webhook creation), so
 	// there forks must stay directly selectable — list the full hierarchy
 	// unconditionally.
 	const hierarchy = $derived($userWorkspaces ? buildWorkspaceHierarchy($userWorkspaces) : [])
@@ -140,16 +156,41 @@
 	const canForkHere = $derived(
 		(!isCloudHosted() || $maybePremium) && $workspaceStore !== 'admins' && canCreateFork($userStore)
 	)
+	// The row mechanics below — which family to expand, which collapsed row carries the tick — key on
+	// a depth-0 row of the list, which `buildWorkspaceHierarchy` puts at the highest workspace the
+	// caller can see: parentless, or with a parent absent from their list. `findWorkspaceAncestors`
+	// stops at that same visibility boundary, so it lands on the same row.
+	const lineageRoot = $derived.by(() => {
+		const id = $workspaceStore ?? undefined
+		if (!id) return undefined
+		const ancestors = findWorkspaceAncestors(id, $userWorkspaces ?? [])
+		return ancestors.at(-1) ?? $userWorkspaces?.find((w) => w.id === id)
+	})
+
 	const familyWorkspaces = $derived.by(() => {
-		if (strictWorkspaceSelect) return hierarchy
 		let rootId: string | undefined
-		return hierarchy.filter((h) => {
-			if (h.depth === 0) {
-				rootId = h.workspace.id
-				return true
-			}
-			return !!rootId && expandedFamilies.has(rootId)
-		})
+		const visible = strictWorkspaceSelect
+			? hierarchy
+			: hierarchy.filter((h) => {
+					if (h.depth === 0) {
+						rootId = h.workspace.id
+						return true
+					}
+					return !!rootId && expandedFamilies.has(rootId)
+				})
+		// The family the user is standing in leads the list, its forks travelling with it: the
+		// workspace they are in is the one they look for first, and the one the tick is on.
+		const activeRoot = lineageRoot?.id
+		if (!activeRoot) return visible
+		const families: { root: string | undefined; rows: typeof visible }[] = []
+		for (const h of visible) {
+			if (h.depth === 0 || families.length === 0) families.push({ root: h.workspace.id, rows: [h] })
+			else families[families.length - 1].rows.push(h)
+		}
+		const at = families.findIndex((f) => f.root === activeRoot)
+		if (at <= 0) return visible
+		const [active] = families.splice(at, 1)
+		return [active, ...families].flatMap((f) => f.rows)
 	})
 
 	// ArrowRight/ArrowLeft expand/collapse the keyboard-highlighted family (melt
@@ -173,27 +214,13 @@
 		e.stopPropagation()
 	}
 
-	// The row mechanics below — which family to expand, which collapsed row carries the tick — key on
-	// a depth-0 row of the list, which `buildWorkspaceHierarchy` puts at the highest workspace the
-	// caller can see: parentless, or with a parent absent from their list. `findWorkspaceAncestors`
-	// stops at that same visibility boundary, so it lands on the same row.
-	const lineageRoot = $derived.by(() => {
-		const id = $workspaceStore ?? undefined
-		if (!id) return undefined
-		const ancestors = findWorkspaceAncestors(id, $userWorkspaces ?? [])
-		return ancestors.at(-1) ?? $userWorkspaces?.find((w) => w.id === id)
-	})
-
 	const ambiguousNames = $derived(ambiguousWorkspaceNames($userWorkspaces))
 
-	// Seeded once per instance: opening while a fork is active expands that fork's family,
-	// putting the tick on the active fork's own row instead of on its collapsed root. The
-	// host menu renders this only while open, so in practice each open gets a fresh
-	// instance and therefore a fresh expansion state — except across a close and re-open
-	// inside the menu's 100ms outro, where Svelte resumes the same instance and whatever
-	// was expanded by hand survives.
+	// Seeded once per instance: the family the user is standing in opens expanded, so its forks —
+	// the ones they are most likely to switch between — are there without a click, and the tick
+	// sits on the actual workspace rather than on its collapsed root. Other families stay closed.
 	untrack(() => {
-		if (lineageRoot && lineageRoot.id !== $workspaceStore) {
+		if (!collapseFamilies && lineageRoot && familiesWithForks.has(lineageRoot.id)) {
 			expandedFamilies.add(lineageRoot.id)
 		}
 	})
@@ -281,12 +308,12 @@
 										{workspace.name}{workspace.disabled ? ' (user disabled)' : ''}
 									</div>
 									{#if workspace.is_dev_workspace}
-										<Badge
-											color="dark-blue"
-											small
-											class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-											>{devBadgeText(workspace.dev_workspace_label)}</Badge
-										>
+										<DevWorkspaceBadge
+											label={workspace.dev_workspace_label}
+											color={workspace.color}
+											fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+											class="text-3xs px-1 py-0"
+										/>
 									{/if}
 								</div>
 								{#if ambiguousNames.has(workspace.name)}
@@ -339,17 +366,13 @@
 	{#if (isCloudHosted() || $superadmin || canForkHere) && !strictWorkspaceSelect}
 		<div class="py-1" role="none">
 			{#if isCloudHosted() || $superadmin}
-				<MenuItem href="{base}/user/create_workspace" class={itemClass} {item}>
+				<MenuItem href="/user/create_workspace" class={itemClass} {item}>
 					<Plus size={16} />
 					Workspace
 				</MenuItem>
 			{/if}
 			{#if canForkHere}
-				<MenuItem
-					class={itemClass}
-					onClick={() => (globalForkModal.val = { opened: true })}
-					{item}
-				>
+				<MenuItem class={itemClass} onClick={() => (globalForkModal.val = { opened: true })} {item}>
 					<Plus size={16} />
 					Workspace fork
 				</MenuItem>
@@ -359,7 +382,7 @@
 	{#if canManageWorkspace && !strictWorkspaceSelect}
 		<div class="py-1" role="none">
 			<MenuItem
-				href="{base}/workspace_settings?workspace={$workspaceStore}"
+				href="/workspace_settings?workspace={$workspaceStore}"
 				class={itemClass}
 				{item}
 			>
@@ -373,7 +396,7 @@
 	{#if !strictWorkspaceSelect}
 		<div class="py-1" role="none">
 			<MenuItem
-				href="{base}/user/workspaces"
+				href="/user/workspaces"
 				onClick={() => clearWorkspaceFromStorage()}
 				class={itemClass}
 				{item}
diff --git a/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte b/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
index 31762045f1..bd5f4e96e4 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceScopeHeader.svelte
@@ -8,7 +8,6 @@
 	} from '$lib/stores'
 	import { switchWorkspace } from '$lib/storeUtils'
 	import { fixupUrlAfterWorkspaceSwitch } from './workspaceSwitchUrl'
-	import { base } from '$lib/base'
 	import { workspaceAIClients } from '$lib/components/copilot/lib'
 	import WorkspaceFamilyPicker from '$lib/components/sessions/WorkspaceFamilyPicker.svelte'
 	import WorkspaceScopeTrigger from '$lib/components/WorkspaceScopeTrigger.svelte'
@@ -19,7 +18,10 @@
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
 
-	let { isCollapsed = false }: { isCollapsed?: boolean } = $props()
+	// `compact` is the page header's variant: sized to its label on one line, rather than filling
+	// a rail's width.
+	let { isCollapsed = false, compact = false }: { isCollapsed?: boolean; compact?: boolean } =
+		$props()
 
 	const effectiveId = $derived($workspaceStore ?? undefined)
 	// Resolve once here and pass to the picker + trigger below, avoiding a duplicate lookup (see
@@ -47,7 +49,7 @@
 	const canManageWorkspace = $derived(
 		$userStore?.is_admin || $superadmin || isForkOwner(currentWs, $userStore?.email)
 	)
-	const settingsHref = $derived(canManageWorkspace ? `${base}/workspace_settings` : undefined)
+	const settingsHref = $derived(canManageWorkspace ? '/workspace_settings' : undefined)
 	const settingsLabel = $derived(`${currentWs?.name ?? effectiveId ?? 'Workspace'} settings`)
 
 	function switchWorkspaceDirect(id: string) {
@@ -62,7 +64,11 @@
 	}
 </script>
 
-<div class="flex items-center min-w-0 px-2 {isCollapsed ? 'justify-center' : ''} py-0.5 rounded-md">
+<div
+	class="flex items-center min-w-0 {compact ? '' : 'px-2'} {isCollapsed
+		? 'justify-center'
+		: ''} py-0.5 rounded-md"
+>
 	<WorkspaceFamilyPicker
 		selectedId={effectiveId}
 		{forkableWorkspaces}
@@ -70,7 +76,7 @@
 		onRequestCreateFork={openForkModal}
 		{settingsHref}
 		{settingsLabel}
-		class="min-w-0 w-full"
+		class={compact ? 'min-w-0' : 'min-w-0 w-full'}
 	>
 		{#snippet trigger()}
 			<WorkspaceScopeTrigger
@@ -78,8 +84,8 @@
 				{forkableWorkspaces}
 				{isCollapsed}
 				{rootLabel}
-				wrap
-				class="w-full"
+				wrap={!compact}
+				class={compact ? '' : 'w-full'}
 			/>
 		{/snippet}
 	</WorkspaceFamilyPicker>
diff --git a/frontend/src/lib/components/sidebar/navDetached.svelte.ts b/frontend/src/lib/components/sidebar/navDetached.svelte.ts
new file mode 100644
index 0000000000..19568eaddc
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navDetached.svelte.ts
@@ -0,0 +1,28 @@
+import { fromStore } from 'svelte/store'
+import { userStore } from '$lib/stores'
+import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
+
+// One preference per role rather than one per account. The same person is both — an operator in
+// one workspace, a developer in the next — and the two want different things from the sidebar, so
+// a single key would carry whichever was pressed last into the other role and never give it back.
+// Empty until that role presses detach or attach once.
+const operatorPref = useLocalStorageValue<string>('nav_detached_operator', '', 'string')
+const devPref = useLocalStorageValue<string>('nav_detached_dev', '', 'string')
+const user = fromStore(userStore)
+
+/** Whether the sidebar is detached: hidden behind a floating button that slides it in over the page. */
+export const navDetached = {
+	get val(): boolean {
+		// Unasked, operators start detached: many of them navigate through a workspace's own app,
+		// and a docked sidebar would take its width.
+		const operator = !!user.current?.operator
+		const pref = operator ? operatorPref : devPref
+		if (pref.val === 'true') return true
+		if (pref.val === 'false') return false
+		return operator
+	},
+	set val(detached: boolean) {
+		const pref = user.current?.operator ? operatorPref : devPref
+		pref.val = String(detached)
+	}
+}
diff --git a/frontend/src/lib/components/sidebar/navHandlePlacement.svelte.ts b/frontend/src/lib/components/sidebar/navHandlePlacement.svelte.ts
new file mode 100644
index 0000000000..5fb7b43860
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navHandlePlacement.svelte.ts
@@ -0,0 +1,50 @@
+import { BAR_HEIGHT_PX } from '../pageHeaderRegistry.svelte'
+
+// Opening the detached sidebar's card, from the band's own handle or from the corner control that
+// stands in for it on a page which hides the band.
+let opener: (() => void) | undefined
+// Closing it once the pointer is off both the handle and the card, which the layout owns because
+// the card is its markup.
+let hoverClose: { schedule: () => void; cancel: () => void } | undefined
+
+// Where the card's top edge goes: the header's bottom edge, so the two meet in a line rather than
+// the card starting at whatever height the control that opened it happens to have. Measured at open
+// time rather than fixed, so the card follows the header's own height. On a page that hides the
+// header, the header is still what the card will sit under — it comes down with it — so its height
+// is read even while it is off-screen. The fallback matches the header's resting height.
+const FALLBACK_CARD_TOP = BAR_HEIGHT_PX
+const GAP_UNDER_HANDLE = 6
+let cardTop = $state(FALLBACK_CARD_TOP)
+
+export const navHandleSlot = {
+	/** Distance from the top of the viewport to the card's top edge, in px. */
+	get cardTop(): number {
+		return cardTop
+	},
+	/** The root layout owns the card, so it registers how to open and hover-close it. */
+	setOpener(open: () => void, close?: { schedule: () => void; cancel: () => void }) {
+		opener = open
+		hoverClose = close
+	},
+	/** Pointer left the handle: close, unless it lands on the card before the delay is up. */
+	scheduleClose() {
+		hoverClose?.schedule()
+	},
+	/**
+	 * Opens the card under the page header, or under `anchor` when there is no header to sit
+	 * beneath — an embed, where whatever reached for the nav is all the card has to hang from.
+	 */
+	open(anchor?: Element | null) {
+		hoverClose?.cancel()
+		const band = document.querySelector('[data-page-header]')
+		const bandHeight = band?.getBoundingClientRect().height
+		if (bandHeight) {
+			cardTop = Math.round(bandHeight)
+		} else {
+			const bottom = anchor?.getBoundingClientRect().bottom
+			cardTop =
+				bottom != null && bottom > 0 ? Math.round(bottom) + GAP_UNDER_HANDLE : FALLBACK_CARD_TOP
+		}
+		opener?.()
+	}
+}
diff --git a/frontend/src/lib/components/sidebar/navPages.test.ts b/frontend/src/lib/components/sidebar/navPages.test.ts
new file mode 100644
index 0000000000..e2e849ac6b
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navPages.test.ts
@@ -0,0 +1,20 @@
+import { describe, it, expect } from 'vitest'
+import { navPageFor } from './navPages'
+
+describe('navPageFor', () => {
+	it('keeps an item route on its page', () => {
+		expect(navPageFor('/runs/f/demo/x')?.label).toBe('Runs')
+	})
+
+	it('does not let Home swallow every route', () => {
+		expect(navPageFor('/audit_logs')?.label).toBe('Audit logs')
+		expect(navPageFor('/')?.label).toBe('Home')
+	})
+
+	it('falls back to the first segment for a route the table does not name', () => {
+		expect(navPageFor('/service_logs/x')).toMatchObject({
+			label: 'Service logs',
+			path: '/service_logs'
+		})
+	})
+})
diff --git a/frontend/src/lib/components/sidebar/navPages.ts b/frontend/src/lib/components/sidebar/navPages.ts
new file mode 100644
index 0000000000..385b93abcc
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/navPages.ts
@@ -0,0 +1,67 @@
+import {
+	Boxes,
+	Calendar,
+	DollarSign,
+	Eye,
+	FolderOpen,
+	Home,
+	HardHat,
+	Play,
+	Pyramid,
+	Unplug,
+	Users
+} from 'lucide-svelte'
+import type { OperatorPageKey } from './operatorRoutes'
+
+/**
+ * The names the page header's breadcrumb gives the workspace's own pages, and the rows the
+ * sidebar's main group is built from.
+ *
+ * Every entry names a page for the breadcrumb, and its `icon` goes there too. Only the entries
+ * `SidebarContent`'s `MAIN_MENU_EXTRAS` also lists become sidebar links from here — Schedules,
+ * HTTP routes, Workers and Audit logs are grouped differently there and carry their own row, so
+ * for those four the `operatorKey` below goes unread. Keep the labels in step with those rows by
+ * hand.
+ */
+export type NavPage = {
+	label: string
+	/** Path under `base`, matched against the current route by longest prefix. */
+	path: string
+	icon: any
+	/** The `operator_settings` key that admits an operator, when the page has one. */
+	operatorKey?: OperatorPageKey
+}
+
+export const NAV_PAGES: NavPage[] = [
+	{ label: 'Home', path: '/', icon: Home },
+	{ label: 'Runs', path: '/runs', icon: Play, operatorKey: 'runs' },
+	{ label: 'Variables', path: '/variables', icon: DollarSign, operatorKey: 'variables' },
+	{ label: 'Resources', path: '/resources', icon: Boxes, operatorKey: 'resources' },
+	{ label: 'Assets', path: '/assets', icon: Pyramid, operatorKey: 'assets' },
+	{ label: 'Folders', path: '/folders', icon: FolderOpen, operatorKey: 'folders' },
+	{ label: 'Groups', path: '/groups', icon: Users, operatorKey: 'groups' },
+	{ label: 'Schedules', path: '/schedules', icon: Calendar, operatorKey: 'schedules' },
+	// "Triggers" is the group the sidebar files this under, not the page: the row there reads HTTP.
+	{ label: 'HTTP routes', path: '/routes', icon: Unplug, operatorKey: 'triggers' },
+	{ label: 'Workers', path: '/workers', icon: HardHat, operatorKey: 'workers' },
+	{ label: 'Audit logs', path: '/audit_logs', icon: Eye, operatorKey: 'audit_logs' }
+]
+
+/**
+ * The page a route belongs to. Longest match wins, so `/runs/f/demo/x` is still Runs, and a route
+ * the table does not name falls back to its first segment (`/service_logs` → "Service logs").
+ */
+export function navPageFor(path: string): NavPage | undefined {
+	const match = NAV_PAGES.filter(
+		(p) => p.path === path || (p.path !== '/' && path.startsWith(p.path + '/'))
+	).sort((a, b) => b.path.length - a.path.length)[0]
+	if (match) return match
+	const first = path.split('/').filter(Boolean)[0]
+	if (!first) return undefined
+	const label = first.replace(/_/g, ' ')
+	return {
+		label: label.charAt(0).toUpperCase() + label.slice(1),
+		path: `/${first}`,
+		icon: undefined
+	}
+}
diff --git a/frontend/src/lib/components/sidebar/operatorRoutes.test.ts b/frontend/src/lib/components/sidebar/operatorRoutes.test.ts
new file mode 100644
index 0000000000..bf14926d00
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/operatorRoutes.test.ts
@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest'
+import { sidebarPageAllowed } from './operatorRoutes'
+import type { UserWorkspace } from '$lib/stores'
+
+const ws = (operator_settings: any): UserWorkspace =>
+	({ id: 'w', name: 'w', username: 'u', operator_settings }) as UserWorkspace
+
+describe('sidebarPageAllowed', () => {
+	it('shows every page to anyone who is not an operator', () => {
+		expect(sidebarPageAllowed(false, ws(null), 'runs')).toBe(true)
+		expect(sidebarPageAllowed(undefined, undefined, 'runs')).toBe(true)
+	})
+
+	it('admits an operator only where the workspace turned the page on', () => {
+		expect(sidebarPageAllowed(true, ws({ runs: true }), 'runs')).toBe(true)
+		expect(sidebarPageAllowed(true, ws({ runs: false }), 'runs')).toBe(false)
+	})
+
+	it('withholds a page the settings do not mention', () => {
+		// `=== true`, not truthiness: a right absent from the jsonb, or settings that were never
+		// written, must not read as granted.
+		expect(sidebarPageAllowed(true, ws({ variables: true }), 'runs')).toBe(false)
+		expect(sidebarPageAllowed(true, ws(null), 'runs')).toBe(false)
+		expect(sidebarPageAllowed(true, undefined, 'runs')).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/sidebar/operatorRoutes.ts b/frontend/src/lib/components/sidebar/operatorRoutes.ts
index 1abd7aeb93..6824c36c62 100644
--- a/frontend/src/lib/components/sidebar/operatorRoutes.ts
+++ b/frontend/src/lib/components/sidebar/operatorRoutes.ts
@@ -1,61 +1,41 @@
-import { base } from '$lib/base'
+import type { OperatorSettings } from '$lib/gen'
 import type { UserWorkspace } from '$lib/stores'
 
 /**
- * The pages an operator can reach, each paired with the `operator_settings` key
- * that admits them — the operator menu lists only the entries the active
- * workspace permits.
+ * An `operator_settings` key that admits an operator to one page (`triggers` to all of them).
+ *
+ * Only the visibility flags: the same object also carries the write rights `builder_flows`,
+ * `manage_schedules` and `manage_triggers`, which the `=== true` rule below answers wrongly. A
+ * write right is granted unless withdrawn, so its absence means "never configured" rather than
+ * "no" — see `docs/operator-write-rights.md`.
  */
-export type OperatorMenuLink = {
-	label: string
-	/** `operator_settings` key gating the page. */
-	id: string
-	href: string
+export type OperatorPageKey = Extract<
+	keyof NonNullable<OperatorSettings>,
+	| 'runs'
+	| 'schedules'
+	| 'resources'
+	| 'variables'
+	| 'assets'
+	| 'audit_logs'
+	| 'triggers'
+	| 'groups'
+	| 'folders'
+	| 'workers'
+>
+
+/**
+ * Whether the sidebar shows the page behind `key`. Everyone but an operator sees every page
+ * (other gates, such as admin-only entries, still apply); an operator sees only the pages the
+ * workspace's `operator_settings` turn on.
+ */
+export function sidebarPageAllowed(
+	isOperator: boolean | undefined,
+	workspace: UserWorkspace | undefined,
+	key: OperatorPageKey
+): boolean {
+	return !isOperator || workspace?.operator_settings?.[key] === true
 }
 
-export type OperatorTriggerLink = OperatorMenuLink & { kind: string }
-
-/** Home needs no setting — it is the one page every operator always has. */
-export const OPERATOR_MAIN_LINKS: OperatorMenuLink[] = [
-	{ label: 'Home', id: 'home', href: `${base}/` },
-	{ label: 'Runs', id: 'runs', href: `${base}/runs` },
-	{ label: 'Schedules', id: 'schedules', href: `${base}/schedules` }
-]
-
-export const OPERATOR_SECONDARY_LINKS: OperatorMenuLink[] = [
-	{ label: 'Resources', id: 'resources', href: `${base}/resources` },
-	{ label: 'Variables', id: 'variables', href: `${base}/variables` },
-	{ label: 'Assets', id: 'assets', href: `${base}/assets` },
-	{ label: 'Groups', id: 'groups', href: `${base}/groups` },
-	{ label: 'Folders', id: 'folders', href: `${base}/folders` },
-	{ label: 'Workers', id: 'workers', href: `${base}/workers` },
-	{ label: 'Audit logs', id: 'audit_logs', href: `${base}/audit_logs` }
-]
-
-export const OPERATOR_TRIGGER_LINKS: OperatorTriggerLink[] = [
-	{ label: 'Custom HTTP routes', id: 'triggers', href: `${base}/routes`, kind: 'http' },
-	{ label: 'Websocket triggers', id: 'triggers', href: `${base}/websocket_triggers`, kind: 'ws' },
-	{
-		label: 'Postgres triggers',
-		id: 'triggers',
-		href: `${base}/postgres_triggers`,
-		kind: 'postgres'
-	},
-	{ label: 'Kafka triggers', id: 'triggers', href: `${base}/kafka_triggers`, kind: 'kafka' },
-	{ label: 'NATS triggers', id: 'triggers', href: `${base}/nats_triggers`, kind: 'nats' },
-	{ label: 'SQS triggers', id: 'triggers', href: `${base}/sqs_triggers`, kind: 'sqs' },
-	{ label: 'GCP Pub/Sub triggers', id: 'triggers', href: `${base}/gcp_triggers`, kind: 'gcp' },
-	{
-		label: 'Azure Event Grid triggers',
-		id: 'triggers',
-		href: `${base}/azure_triggers`,
-		kind: 'azure'
-	},
-	{ label: 'MQTT triggers', id: 'triggers', href: `${base}/mqtt_triggers`, kind: 'mqtt' },
-	{ label: 'AMQP triggers', id: 'triggers', href: `${base}/amqp_triggers`, kind: 'amqp' },
-	{ label: 'Email triggers', id: 'triggers', href: `${base}/email_triggers`, kind: 'email' }
-]
-
 /**
  * Whether the user is an operator in `workspace`. The server nulls
  * `operator_settings` for a non-operator, so a non-null value narrows an operator
diff --git a/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts b/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
index df8e668fba..24925f2198 100644
--- a/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
+++ b/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
@@ -46,6 +46,43 @@ describe('workspaceMenuHref', () => {
 		).toBe('/runs?workspace=w')
 	})
 
+	// The compare page reads the workspace it compares from `workspace_id`, so a switch that
+	// left it behind sent the page back to the workspace just left on the next reload.
+	it('swaps workspace_id alongside workspace', () => {
+		expect(
+			workspaceMenuHref({
+				pathname: '/forks/compare',
+				searchParams: new URLSearchParams('workspace_id=wm-fork-a&mode=fork'),
+				id: 'wm-fork-b',
+				sameFamily: true
+			})
+		).toBe('/forks/compare?workspace_id=wm-fork-b&mode=fork&workspace=wm-fork-b')
+	})
+
+	it('does not add workspace_id to a page that had none', () => {
+		expect(
+			workspaceMenuHref({
+				pathname: '/runs',
+				searchParams: new URLSearchParams('job=123'),
+				id: 'w',
+				sameFamily: true
+			})
+		).toBe('/runs?job=123&workspace=w')
+	})
+
+	// `target` is the compare page's one-off migration destination, picked for the workspace
+	// being left. Carried over it can point the new workspace at itself.
+	it('drops an arbitrary compare target', () => {
+		expect(
+			workspaceMenuHref({
+				pathname: '/forks/compare',
+				searchParams: new URLSearchParams('workspace_id=wm-fork-a&target=wm-fork-b&mode=fork'),
+				id: 'wm-fork-b',
+				sameFamily: true
+			})
+		).toBe('/forks/compare?workspace_id=wm-fork-b&mode=fork&workspace=wm-fork-b')
+	})
+
 	// An operator lands on home in the workspace they switch into. The href has to carry
 	// that too, not just the click handler: this is what a middle-click opens.
 	it('points at home, dropping the current page and its params, when landOnHome is set', () => {
diff --git a/frontend/src/lib/components/sidebar/workspaceMenuHref.ts b/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
index 57342f2b08..707104955d 100644
--- a/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
+++ b/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
@@ -1,5 +1,3 @@
-import { base } from '$lib/base'
-
 // Href for a workspace-switch link in the sidebar WorkspaceMenu: stay on the
 // current path and just swap the `workspace` query param, so a modifier/middle
 // click (open in new tab, which bypasses the onClick fast-path) lands on the
@@ -20,10 +18,21 @@ export function workspaceMenuHref(args: {
 	landOnHome?: boolean
 }): string {
 	if (args.landOnHome) {
-		return `${base}/?workspace=${encodeURIComponent(args.id)}`
+		return `/?workspace=${encodeURIComponent(args.id)}`
 	}
 	const params = new URLSearchParams(args.searchParams)
 	params.set('workspace', args.id)
+	// `workspace_id` names the workspace a page acts on rather than the one the app is pointed at
+	// — the compare page's source. A switch moves it too, or the link lands on a page still
+	// working on the workspace just left. Only rewritten, never added: a page that does not use
+	// it has no business gaining it.
+	if (params.has('workspace_id')) {
+		params.set('workspace_id', args.id)
+	}
+	// The compare page's one-off migration destination, chosen for the workspace being left. Kept,
+	// it would survive into a workspace it was never picked for — including the target itself,
+	// leaving that page comparing a workspace with itself.
+	params.delete('target')
 	if (!args.sameFamily) {
 		params.delete('session')
 		params.delete('session_name')
diff --git a/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts b/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts
index 82130e3f95..c8bc6d070c 100644
--- a/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts
+++ b/frontend/src/lib/components/sidebar/workspaceSwitchUrl.ts
@@ -1,13 +1,20 @@
 import { page } from '$app/state'
-import { replaceState } from '$app/navigation'
 import { goto } from '$lib/navigation'
 
 // Post-workspace-switch URL fixup shared by the sidebar workspace pickers.
 // Item-scoped pages would show a wrong-workspace (or missing) item after a
-// switch — go home instead. Otherwise, really rewrite a ?workspace= param in
-// the address bar (mutating page.url is a no-op there): left stale, it gets
-// re-applied on reload or when exiting session mode restores the route,
+// switch — go home instead. Otherwise, really rewrite the params in the address
+// bar that name a workspace (mutating page.url is a no-op there): left stale,
+// they get re-applied on reload or when exiting session mode restores the route,
 // silently switching the workspace back.
+//
+// `workspace_id` names the workspace a page acts on (the compare page's pair) and
+// `workspace` the one the app is pointed at; a switch moves both. `target`, the
+// compare page's one-off migration destination, is dropped instead of rewritten:
+// it was chosen for the workspace being left, and keeping it could point the new
+// one at itself.
+const WORKSPACE_PARAMS = ['workspace', 'workspace_id']
+const STALE_AFTER_SWITCH = ['target']
 const EDIT_PAGES = [
 	'/scripts/edit/',
 	'/flows/edit/',
@@ -28,9 +35,32 @@ export async function fixupUrlAfterWorkspaceSwitch(
 ): Promise<void> {
 	if (EDIT_PAGES.some((p) => page.route.id?.includes(p) ?? false) || opts?.landOnHome) {
 		await goto('/')
-	} else if (page.url.searchParams.get('workspace')) {
-		const url = new URL(window.location.href)
-		url.searchParams.set('workspace', id)
-		replaceState(url, page.state)
+		return
 	}
+	// `window.location`, never `page.url`: a param written by a previous shallow update
+	// is in the address bar but not in `page.url`, so rebuilding from it would undo that
+	// write (see the note on `setQuery` in $lib/navigation).
+	const url = new URL(window.location.href)
+	let changed = false
+	for (const key of WORKSPACE_PARAMS) {
+		if (url.searchParams.get(key) === id) continue
+		if (!url.searchParams.has(key)) continue
+		url.searchParams.set(key, id)
+		changed = true
+	}
+	for (const key of STALE_AFTER_SWITCH) {
+		if (!url.searchParams.has(key)) continue
+		url.searchParams.delete(key)
+		changed = true
+	}
+	if (!changed) return
+	// `goto` rather than `replaceState`: a page reading these params through `page.url`
+	// (the compare page derives the workspace it compares from them) sees nothing when
+	// they are written shallowly, since SvelteKit refreshes `page.url` only on a
+	// router-driven navigation.
+	await goto(`${url.pathname}${url.search}${url.hash}`, {
+		replaceState: true,
+		noScroll: true,
+		keepFocus: true
+	})
 }
diff --git a/frontend/src/lib/components/triggers/CaptureSection.svelte b/frontend/src/lib/components/triggers/CaptureSection.svelte
index 5b1980e1b4..4fa2fab5fb 100644
--- a/frontend/src/lib/components/triggers/CaptureSection.svelte
+++ b/frontend/src/lib/components/triggers/CaptureSection.svelte
@@ -31,14 +31,17 @@
 	import { formatDateShort } from '$lib/utils'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import DisplayResultControlBar from '$lib/components/DisplayResultControlBar.svelte'
-	import { base } from '$lib/base'
 	import Description from '$lib/components/Description.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import { FlaskConical } from 'lucide-svelte'
 	import Alert from '../common/alert/Alert.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { useTriggerLock } from '$lib/operatorWriteRights'
 
 	const operatingWorkspace = useOperatingWorkspace()
+	// Saving a capture config is a trigger write the server refuses to a withdrawn operator, so
+	// every capture kind locks here rather than each editor passing it down.
+	const triggerLock = useTriggerLock()
 
 	interface Props {
 		disabled?: boolean | undefined
@@ -289,7 +292,7 @@
 							<Button
 								size="xs"
 								on:click={() => dispatch('captureToggle', {})}
-								{disabled}
+								disabled={disabled || !!$triggerLock}
 								variant={captureInfo.active ? 'default' : 'accent-secondary'}
 								selected={captureInfo.active}
 								startIcon={captureInfo.active
@@ -327,12 +330,14 @@
 								<div
 									class={twMerge(
 										'absolute top-0 left-0 w-full text-center',
-										disabled === true ? 'text-red-600 dark:text-red-400' : ''
+										disabled === true && !$triggerLock ? 'text-red-600 dark:text-red-400' : ''
 									)}
 									in:fade={{ duration: 100, delay: 50 }}
 									out:fade={{ duration: 50 }}
 								>
-									{#if disabled === true}
+									{#if $triggerLock}
+										{$triggerLock}.
+									{:else if disabled === true}
 										Enter a valid configuration to start capturing.
 									{:else}
 										{@render description?.()}
@@ -457,7 +462,6 @@
 
 			{#if displayResult && toolbarLocation === 'external'}
 				<DisplayResultControlBar
-					{base}
 					result={selectedCapture?.main_args}
 					disableTooltips={false}
 					on:open-drawer={() => {
diff --git a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
index 86c5ad74b8..050b0e32b9 100644
--- a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
+++ b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
@@ -22,9 +22,16 @@
 		 * `default_permissioned_as` rules and preselects the matching default.
 		 */
 		path?: string | undefined
+		/** Read-only editor: show the stored value, offer no choice and announce no change. */
+		disabled?: boolean
 	}
 
-	let { permissionedAs, onPermissionedAsChange, path = undefined }: Props = $props()
+	let {
+		permissionedAs,
+		onPermissionedAsChange,
+		path = undefined,
+		disabled = false
+	}: Props = $props()
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
 	const actingUser = $derived(operatingUser.current)
@@ -77,13 +84,20 @@
 			permissionedAs !== effectivePermissionedAs
 	)
 
-	const shouldRender = $derived(!!wsId && (permissionedAs !== undefined || canPreserve))
+	const shouldRender = $derived(
+		!!wsId && (permissionedAs !== undefined || (canPreserve && !disabled))
+	)
 
 	// For non-admin users editing a trigger owned by someone else: signal that
 	// permissioned_as will change to the current user (backend ignores preserve for non-admins).
 	// Only fires when there's an actual change (DB value differs from current user).
 	$effect(() => {
-		if (!canPreserve && permissionedAs !== undefined && permissionedAs !== myPermissionedAs) {
+		if (
+			!disabled &&
+			!canPreserve &&
+			permissionedAs !== undefined &&
+			permissionedAs !== myPermissionedAs
+		) {
 			onPermissionedAsChange(undefined, false)
 		}
 	})
@@ -107,7 +121,7 @@
 {#if shouldRender && wsId}
 	<div class="flex items-center gap-1.5 text-2xs text-tertiary mb-4">
 		<span>Permissioned as</span>
-		{#if canPreserve}
+		{#if canPreserve && !disabled}
 			<OnBehalfOfSelector
 				targetWorkspace={wsId}
 				targetValue={permissionedAs}
@@ -127,7 +141,7 @@
 			{/if}
 		{:else if permissionedAs}
 			<strong class="text-secondary">{permissionedAs}</strong>
-			{#if willChange}
+			{#if willChange && !disabled}
 				<AlertTriangle class="w-3.5 h-3.5 text-yellow-500" />
 				<span class="text-yellow-600 dark:text-yellow-400"
 					>will change to <strong>{effectivePermissionedAs}</strong> on save</span
diff --git a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
index ab8b850fa2..b59a925c84 100644
--- a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
+++ b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
@@ -10,7 +10,7 @@
 	import type { TriggerMode } from '$lib/gen'
 	import TriggerModeToggle from './TriggerModeToggle.svelte'
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
-	import { stripBase, TRIGGER_PAGES, SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
+	import { barePath, TRIGGER_PAGES, SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
 	import { pageDrawerSessionSource } from '../sessions/pageDrawerSession'
 	import { page } from '$app/state'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
@@ -40,6 +40,7 @@
 		 * editor has to pass it: every other editor renders with a `trigger`,
 		 * whose `type` is the same value. */
 		triggerKind?: TriggerType
+		saveLabel?: string
 	}
 
 	let {
@@ -60,7 +61,8 @@
 		suspendedJobsModal,
 		disableSuspendedMode = false,
 		triggerPath,
-		triggerKind
+		triggerKind,
+		saveLabel = 'Save'
 	}: Props = $props()
 	const operatingWorkspace = useOperatingWorkspace()
 	const wsId = $derived($operatingWorkspace)
@@ -72,7 +74,7 @@
 	// when it renders in a script/flow editor's Triggers panel, which has the
 	// editor's own button. A trigger being created has no path to deep-link at.
 	const triggerPagePath = $derived.by(() => {
-		const route = stripBase(page.url.pathname)
+		const route = barePath(page.url.pathname)
 		if (route === SCHEDULES_PATH) return route
 		return Object.values(TRIGGER_PAGES).some((p) => p.path === route) ? route : undefined
 	})
@@ -120,7 +122,7 @@
 			}}
 			loading={isLoading}
 		>
-			Save
+			{saveLabel}
 		</Button>
 	{/if}
 {:else}
diff --git a/frontend/src/lib/components/triggers/TriggerList.svelte b/frontend/src/lib/components/triggers/TriggerList.svelte
index 3a529b7597..1ccbd21d0e 100644
--- a/frontend/src/lib/components/triggers/TriggerList.svelte
+++ b/frontend/src/lib/components/triggers/TriggerList.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { onDestroy, untrack } from 'svelte'
-	import { base } from '$app/paths'
 	import { page } from '$app/stores'
 	import {
 		AzureTriggerService,
@@ -73,7 +72,7 @@
 	import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
 	import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
 	import TriggerModeToggle from './TriggerModeToggle.svelte'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { useEditRights, useTriggerLock } from '$lib/operatorWriteRights'
 	import { getHttpRoute } from './http/utils'
 	import { getEmailAddress, getEmailDomain } from './email/utils'
 	import { TRIGGER_LIST_CONFIG, type TriggerRow } from './triggerListConfig'
@@ -84,6 +83,7 @@
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
 	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	let { triggerKind }: { triggerKind: TriggerKind } = $props()
 
@@ -148,7 +148,7 @@
 	}
 
 	function openLink(href: string) {
-		if (hosted) hosted.openLink(`${base}${href}`)
+		if (hosted) hosted.openLink(href)
 		else goto(href)
 	}
 
@@ -697,7 +697,7 @@
 	{@const effectiveMode = draft_only ? 'disabled' : mode}
 	{@const live = isLive(row)}
 	{@const copy = copyUrl(row)}
-	{@const canEdit = canWrite && !$triggerLock}
+	{@const canEdit = editRights.canEditItem('trigger', path, extra_perms)}
 
 	<div
 		class={twMerge(
@@ -824,7 +824,7 @@
 						{
 							displayName: 'Audit logs',
 							icon: Eye,
-							href: `${base}/audit_logs?resource=${path}`
+							href: `/audit_logs?resource=${path}`
 						},
 						{
 							displayName: 'Permissions',
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
index 8e73e32d78..f72749f988 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
@@ -136,8 +136,9 @@
 								/>
 								<button
 									transition:fade|local={{ duration: 100 }}
-									class="rounded-full p-1 bg-surface-secondary duration-200 hover:bg-surface-hover"
+									class="rounded-full p-1 bg-surface-secondary duration-200 hover:bg-surface-hover disabled:opacity-50 disabled:cursor-not-allowed"
 									aria-label="Clear"
+									disabled={!can_write}
 									onclick={() => {
 										if (exchange) {
 											exchange.routing_keys = (exchange.routing_keys ?? []).filter(
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
index 9c3ec78ae3..055e9b3be3 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: AmqpTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
index f2f3f81c0c..79ab8fc08d 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
@@ -11,8 +11,8 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -46,7 +46,7 @@
 		useOperatingUser,
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -112,8 +112,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
@@ -172,14 +173,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -212,8 +219,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -243,6 +256,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -335,6 +349,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -431,7 +450,9 @@
 			? can_write
 				? `Edit AMQP trigger ${initialPath}`
 				: `AMQP trigger ${initialPath}`
-			: 'New AMQP trigger'}
+			: saveDraftHandler
+				? 'Draft AMQP trigger'
+				: 'New AMQP trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -489,6 +510,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
@@ -506,6 +528,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
index ede9e8e58f..ec81c31fbf 100644
--- a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
@@ -9,8 +9,8 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
 	import Label from '$lib/components/Label.svelte'
@@ -35,7 +35,7 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
 	import TriggerRetriesAndErrorHandler from '../TriggerRetriesAndErrorHandler.svelte'
@@ -45,7 +45,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let initialPath = $state('')
@@ -65,8 +65,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 
@@ -83,7 +84,7 @@
 	let permissionedAs = $state<string | undefined>(undefined)
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
-	let base_endpoint = $derived(`${window.location.origin}${base}`)
+	let base_endpoint = $derived(apiBaseUrl())
 
 	let optionTabSelected: 'error_handler' | 'retries' = $state('error_handler')
 	let errorHandlerSelected: ErrorHandler = $state('slack')
@@ -160,6 +161,7 @@
 	) {
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -320,7 +322,9 @@
 			topic_name,
 			subscription_name,
 			event_type_filters,
-			base_endpoint,
+			// The capture URL shown to the user stays on the browsing origin, so the
+			// endpoint registered for it must too.
+			base_endpoint: window.location.origin,
 			path
 		}
 	}
@@ -465,6 +469,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte
index 101b84f770..57ed70f6e7 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditor.svelte
@@ -27,6 +27,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: EmailTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
index fd3b20864a..cec615560a 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
@@ -18,8 +18,8 @@
 		type TriggerMode
 	} from '$lib/gen'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
 	import Label from '$lib/components/Label.svelte'
@@ -43,7 +43,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	let {
 		useDrawer = true,
@@ -91,8 +91,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let extraPerms = $state<Record<string, boolean> | undefined>(undefined)
 	let error_handler_path: string | undefined = $state()
@@ -139,14 +140,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Partial<NewEmailTrigger>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -188,8 +195,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Partial<EmailTrigger>
+		defaultValues?: Partial<EmailTrigger>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -218,6 +231,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig as Partial<EmailTrigger>)
 		} finally {
 			clearTimeout(loader)
 			drawerLoading = false
@@ -276,6 +290,11 @@
 	}
 
 	async function triggerScript(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getEmailTriggerConfig()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		if (customSaveBehavior) {
 			customSaveBehavior(emailConfig)
 			drawer?.closeDrawer()
@@ -390,6 +409,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
@@ -501,6 +521,7 @@
 			{edit}
 			isLoading={deploymentLoading}
 			onUpdate={triggerScript}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{isDeployed}
@@ -520,7 +541,9 @@
 			? can_write
 				? `Edit email trigger ${initialPath}`
 				: `Email trigger ${initialPath}`
-			: 'New email trigger'}
+			: saveDraftHandler
+				? 'Draft email trigger'
+				: 'New email trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
diff --git a/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte b/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
index a77d12ebef..b6ba7bfa28 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
@@ -3,7 +3,6 @@
 	import CaptureSection from '../CaptureSection.svelte'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
-	import { base } from '$lib/base'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
@@ -32,7 +31,7 @@
 		if (!captureInfo) {
 			return
 		}
-		return `${window.location.origin}${base}/api/w/${$operatingWorkspace}/capture_u/gcp/${
+		return `${window.location.origin}/api/w/${$operatingWorkspace}/capture_u/gcp/${
 			captureInfo.isFlow ? 'flow' : 'script'
 		}/${captureInfo.path}`
 	}
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte
index f86706e8ab..9c3111b0fb 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditor.svelte
@@ -22,6 +22,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: GcpTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
index ade1de1f70..a33573a1d1 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
@@ -13,7 +13,7 @@
 	} from '$lib/gen'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 
 	import { Button, Url } from '$lib/components/common'
@@ -28,23 +28,17 @@
 		useOperatingWorkspace
 	} from '$lib/components/operatingWorkspace.svelte'
 
-	// Declared before `DEFAULT_PUSH_CONFIG` / the `base_endpoint` prop default,
-	// which call `getBaseUrl()` (a `wsId` reader) during component init.
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
 	const actingUser = $derived(operatingUser.current)
 	const wsId = $derived($operatingWorkspace)
+	const base_endpoint = $derived(`${apiBaseUrl()}/api/gcp/w/${wsId!}`)
 
 	let topic_items: string[] = $state([])
 	let subscription_items: string[] = $state([])
 	let loadingTopic = $state(false)
 	let loadingSubscription = $state(false)
 
-	const DEFAULT_PUSH_CONFIG: PushConfig = {
-		audience: getBaseUrl(),
-		authenticate: false
-	}
-
 	async function loadAllPubSubTopicsFromProject() {
 		// Listing is admin-only under application default credentials, and a non-admin viewing an
 		// inherited trigger cannot change the topic anyway, so asking would only raise a 403 toast.
@@ -117,7 +111,6 @@
 		delivery_type?: DeliveryType | undefined
 		delivery_config: PushConfig | undefined
 		subscription_mode?: SubscriptionMode
-		base_endpoint?: string
 		path?: string
 		showTestingBadge?: boolean
 		cloud_subscription_id?: string
@@ -139,7 +132,6 @@
 		delivery_type = $bindable('pull'),
 		delivery_config = $bindable(),
 		subscription_mode = $bindable('create_update'),
-		base_endpoint = $bindable(getBaseUrl()),
 		auto_acknowledge_msg = $bindable(true),
 		ack_deadline = $bindable(),
 		path = '',
@@ -199,17 +191,9 @@
 		if (!delivery_type) {
 			delivery_type = 'pull'
 		} else if (delivery_type === 'push' && !delivery_config) {
-			delivery_config = DEFAULT_PUSH_CONFIG
+			delivery_config = { audience: base_endpoint, authenticate: false }
 		}
 	})
-	function getBaseUrl() {
-		return `${window.location.origin}${base}/api/gcp/w/${wsId!}`
-	}
-
-	$effect(() => {
-		!base_endpoint && (base_endpoint = getBaseUrl())
-	})
-
 	$effect(() => {
 		if (emptyStringTrimmed(subscription_id) && !emptyStringTrimmed(path)) {
 			subscription_id = `windmill-${wsId!}-${path.replaceAll('/', '_')}`
@@ -229,20 +213,22 @@
 				<div class="flex flex-col gap-3 mt-2">
 					<ToggleButtonGroup
 						selected={usesDefaultCredentials ? 'default' : 'resource'}
+						disabled={!can_write}
 						on:selected={(e) => onCredentialsModeChange(e.detail === 'default')}
 					>
-						{#snippet children({ item })}
+						{#snippet children({ item, disabled })}
 							<ToggleButton
 								label="Service account"
 								value="resource"
 								tooltip="Authenticate with a service account key held in a GCP resource."
 								showTooltipIcon
 								{item}
+								{disabled}
 							/>
 							<ToggleButton
 								label="Application default credentials"
 								value="default"
-								disabled={!canUseDefaultCredentials}
+								disabled={disabled || !canUseDefaultCredentials}
 								tooltip={canUseDefaultCredentials
 									? 'Authenticate as the Windmill server itself, using the credentials of its environment (workload identity, the metadata server, or GOOGLE_APPLICATION_CREDENTIALS).'
 									: 'Workspace admins can authenticate as the Windmill server itself. Ask one to set this up.'}
@@ -256,6 +242,7 @@
 						<ResourcePicker
 							workspace={wsId}
 							resourceType="gcloud"
+							disabled={!can_write}
 							bind:value={
 								() => gcp_resource_path,
 								(v) => {
@@ -313,6 +300,7 @@
 						<div class="flex flex-row gap-1 mt-2">
 							<Select
 								loading={loadingTopic}
+								disabled={!can_write}
 								disablePortal
 								clearable
 								class="grow shrink"
@@ -347,19 +335,21 @@
 					<div class="flex flex-col gap-3">
 						<ToggleButtonGroup
 							bind:selected={subscription_mode}
+							disabled={!can_write}
 							on:selected={(e) => {
 								if (e.detail === 'existing' && subscription_items.length === 0) {
 									loadAllSubscriptionFromGooglePubSubTopic()
 								}
 							}}
 						>
-							{#snippet children({ item })}
+							{#snippet children({ item, disabled })}
 								<ToggleButton
 									label="Create/Update"
 									value="create_update"
 									tooltip="Create a new subscription or update an existing one with custom settings"
 									showTooltipIcon
 									{item}
+									{disabled}
 								/>
 								<ToggleButton
 									label="Existing subscription"
@@ -367,6 +357,7 @@
 									tooltip="Select an existing subscription from GCP Pub/Sub"
 									showTooltipIcon
 									{item}
+									{disabled}
 								/>
 							{/snippet}
 						</ToggleButtonGroup>
@@ -382,6 +373,7 @@
 										autocomplete="off"
 										placeholder="Enter subscription ID (leave empty to auto-generate)"
 										bind:value={create_update_subscription_id}
+										disabled={!can_write}
 										oninput={(event) => {
 											subscription_id = event?.currentTarget.value
 										}}
@@ -394,14 +386,15 @@
 									tooltip="Select the delivery type for the Pub/Sub subscription. If the subscription already exists and you want to keep it as-is, choose the same delivery type as in Google Cloud. You can switch the type here if the API allows it — otherwise, make the change directly in Google Cloud."
 								>
 									<div class="flex flex-col gap-2 mt-2">
-										<ToggleButtonGroup bind:selected={delivery_type}>
-											{#snippet children({ item })}
+										<ToggleButtonGroup bind:selected={delivery_type} disabled={!can_write}>
+											{#snippet children({ item, disabled })}
 												<ToggleButton
 													label="Pull"
 													tooltip="Create a subscription where your service will pull messages from the queue. Suitable for services that periodically check for new messages."
 													value="pull"
 													showTooltipIcon
 													{item}
+													{disabled}
 												/>
 												<ToggleButton
 													label="Push"
@@ -409,6 +402,7 @@
 													showTooltipIcon
 													value="push"
 													{item}
+													{disabled}
 												/>
 											{/snippet}
 										</ToggleButtonGroup>
@@ -425,7 +419,7 @@
 													required={true}
 												/>
 											</p>
-											<Toggle bind:checked={delivery_config.authenticate} />
+											<Toggle bind:checked={delivery_config.authenticate} disabled={!can_write} />
 										</Subsection>
 										{#if delivery_config.authenticate}
 											<Subsection
@@ -450,6 +444,7 @@
 								<div class="flex gap-1">
 									<Select
 										loading={loadingSubscription}
+										disabled={!can_write}
 										disablePortal
 										clearable
 										class="grow shrink"
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
index 43d5f8e28c..7c905a2778 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
@@ -9,8 +9,8 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
 	import Label from '$lib/components/Label.svelte'
@@ -36,7 +36,7 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
 	import TriggerRetriesAndErrorHandler from '../TriggerRetriesAndErrorHandler.svelte'
@@ -48,7 +48,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let initialPath = $state('')
@@ -69,8 +69,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let topic_id: string = $state('')
@@ -88,7 +89,7 @@
 	let permissionedAs = $state<string | undefined>(undefined)
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
-	let base_endpoint = $derived(`${window.location.origin}${base}`)
+	let base_endpoint = $derived(apiBaseUrl())
 	let auto_acknowledge_msg = $state(true)
 	let ack_deadline: number | undefined = $state()
 	let optionTabSelected: 'settings' | 'error_handler' | 'retries' = $state('error_handler')
@@ -163,14 +164,20 @@
 	)
 	const captureConfig = $derived.by(untrack(() => isEditor) ? getGcpCaptureConfig : () => ({}))
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultValues?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -201,8 +208,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -244,6 +257,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			drawerLoading = false
 		}
@@ -307,6 +321,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getGcpConfig()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = gcpConfig
@@ -359,7 +378,9 @@
 			subscription_id,
 			delivery_type,
 			delivery_config,
-			base_endpoint,
+			// The capture URL shown to the user stays on the browsing origin, so the
+			// endpoint registered for it must too.
+			base_endpoint: window.location.origin,
 			auto_acknowledge_msg,
 			ack_deadline,
 			topic_id,
@@ -441,7 +462,9 @@
 			? can_write
 				? `Edit GCP Pub/Sub trigger ${initialPath}`
 				: `GCP Pub/Sub trigger ${initialPath}`
-			: 'New GCP Pub/Sub trigger'}
+			: saveDraftHandler
+				? 'Draft GCP Pub/Sub trigger'
+				: 'New GCP Pub/Sub trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -498,6 +521,7 @@
 			{allowDraft}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
@@ -517,6 +541,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
@@ -633,7 +658,7 @@
 											tooltip="When enabled (recommended), Windmill automatically acknowledges Pub/Sub messages after successful processing. When disabled, your script/flow must explicitly acknowledge each message."
 										>
 											<div class="mt-2">
-												<Toggle bind:checked={auto_acknowledge_msg} />
+												<Toggle bind:checked={auto_acknowledge_msg} disabled={!can_write} />
 											</div>
 											{#if !auto_acknowledge_msg}
 												<div class="mt-3">
diff --git a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
index b0cc491393..024086552c 100644
--- a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
@@ -15,7 +15,7 @@
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import Label from '$lib/components/Label.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { ClipboardCopy, Download, Trash } from 'lucide-svelte'
@@ -136,7 +136,7 @@
 			obj = {
 				openapi_spec_format: lang,
 				info,
-				url: `${window.location.origin}${base}`,
+				url: apiBaseUrl(),
 				http_route_filters: getHttpRouteFilters(),
 				webhook_filters: getWebhookFilters()
 			}
@@ -155,7 +155,7 @@
 				requestBody: {
 					openapi_spec_format,
 					info,
-					url: `${window.location.origin}${base}`,
+					url: apiBaseUrl(),
 					http_route_filters: getHttpRouteFilters(),
 					webhook_filters: getWebhookFilters()
 				}
@@ -225,7 +225,7 @@
 				{/snippet}
 				<CopyableCodeBlock
 					code={`token=${emptyString(token) ? '' : token}; \\
-curl -X POST "${window.location.origin}${base}/api/w/${$operatingWorkspace!}/openapi/generate" \\
+curl -X POST "${apiBaseUrl()}/api/w/${$operatingWorkspace!}/openapi/generate" \\
 -H "Authorization: Bearer $token" \\
 -H "Content-Type: application/json" \\
 -d '${JSON.stringify(obj)}'`}
diff --git a/frontend/src/lib/components/triggers/http/RouteCapture.svelte b/frontend/src/lib/components/triggers/http/RouteCapture.svelte
index 5cbe3570dc..45cc886693 100644
--- a/frontend/src/lib/components/triggers/http/RouteCapture.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteCapture.svelte
@@ -3,7 +3,6 @@
 	import CopyableCodeBlock from '$lib/components/details/CopyableCodeBlock.svelte'
 	import { bash } from 'svelte-highlight/languages'
 	// import { page } from '$app/state'
-	import { base } from '$lib/base'
 	import type { CaptureInfo } from '../CaptureSection.svelte'
 	import CaptureSection from '../CaptureSection.svelte'
 	import { isObject } from '$lib/utils'
@@ -36,7 +35,7 @@
 	const wsId = $derived($operatingWorkspace)
 
 	let captureURL = $derived(
-		`${location.origin}${base}/api/w/${wsId}/capture_u/http/${
+		`${location.origin}/api/w/${wsId}/capture_u/http/${
 			captureInfo?.isFlow ? 'flow' : 'script'
 		}/${captureInfo?.path.replaceAll('/', '.')}/${route_path ?? ''}`
 	)
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
index 042a639014..0cc479554e 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
@@ -22,14 +22,8 @@
 		type TriggerMode
 	} from '$lib/gen'
 	import { usedTriggerKinds } from '$lib/stores'
-	import {
-		canWrite,
-		capitalize,
-		emptyString,
-		generateRandomString,
-		sendUserToast
-	} from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, generateRandomString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2, Pipette, Plus } from 'lucide-svelte'
 	import Label from '$lib/components/Label.svelte'
@@ -82,7 +76,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	let {
 		useDrawer = true,
@@ -165,8 +159,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let extraPerms = $state<Record<string, boolean> | undefined>(undefined)
 	let summary: string | undefined = $state()
@@ -278,6 +273,7 @@
 	) {
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -592,6 +588,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
@@ -727,6 +724,7 @@
 											{#key is_static_website}
 												<FileUpload
 													folderOnly={is_static_website}
+													disabled={!can_write}
 													allowMultiple={false}
 													randomFileKey={true}
 													on:addition={(evt) => {
diff --git a/frontend/src/lib/components/triggers/http/utils.ts b/frontend/src/lib/components/triggers/http/utils.ts
index ed03ef86aa..cc4d366be4 100644
--- a/frontend/src/lib/components/triggers/http/utils.ts
+++ b/frontend/src/lib/components/triggers/http/utils.ts
@@ -1,4 +1,4 @@
-import { base } from '$lib/base'
+import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 import { isCloudHosted } from '$lib/cloud'
 import { random_adj } from '$lib/components/random_positive_adjetive'
 import type { HttpMethod, NewHttpTrigger } from '$lib/gen'
@@ -33,8 +33,7 @@ export function allowedOriginRejection(origin: string): string | undefined {
 	if (origin === '') return 'An origin must not be empty'
 	if (origin.length > MAX_ALLOWED_ORIGIN_LEN)
 		return `'${origin.slice(0, 40)}…' is longer than any origin a browser sends`
-	if (origin.includes(','))
-		return `'${origin}' must not contain a comma, which separates entries`
+	if (origin.includes(',')) return `'${origin}' must not contain a comma, which separates entries`
 	if (origin.toLowerCase() === 'null')
 		return `'null' is what a sandboxed iframe sends, so it would allow any page that can open one`
 	if (!/^[\x21-\x7e]+$/.test(origin))
@@ -85,8 +84,7 @@ export function allowedOriginWarning(origin: string): string | undefined {
 	if (rest.startsWith(':')) return `'${origin}' has no host`
 	// An unclosed bracket would otherwise leave `portStart` at zero, which reads
 	// as "no port" and lets the entry through unremarked.
-	if (rest.startsWith('[') && !rest.includes(']'))
-		return `'${origin}' has an unclosed IPv6 host`
+	if (rest.startsWith('[') && !rest.includes(']')) return `'${origin}' has an unclosed IPv6 host`
 	const portStart = rest.startsWith('[') ? rest.indexOf(']') + 1 : rest.indexOf(':')
 	// A trailing colon is a port, an empty one — distinct from having none.
 	const port = portStart > 0 && rest[portStart] === ':' ? rest.slice(portStart + 1) : undefined
@@ -160,7 +158,7 @@ export function getHttpRoute(
 	workspaced_route: boolean,
 	workspace_id: string
 ) {
-	return `${location.origin}${base}/api/${route_prefix}/${
+	return `${apiBaseUrl()}/api/${route_prefix}/${
 		isCloudHosted() || workspaced_route ? workspace_id + '/' : ''
 	}${route_path ?? ''}`
 }
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte
index 73d32c0d52..0769c8ed0e 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: KafkaTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
index cd79c98015..e3c7b07c40 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
@@ -12,8 +12,8 @@
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { KafkaTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2, RotateCcw } from 'lucide-svelte'
@@ -42,7 +42,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -108,8 +108,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
@@ -174,14 +175,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -217,8 +224,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		nDefaultValues?: Record<string, any>
+		nDefaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -252,6 +265,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -334,6 +348,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -453,7 +472,9 @@
 			? can_write
 				? `Edit Kafka trigger ${initialPath}`
 				: `Kafka trigger ${initialPath}`
-			: 'New Kafka trigger'}
+			: saveDraftHandler
+				? 'Draft Kafka trigger'
+				: 'New Kafka trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -511,6 +532,7 @@
 			{isDeployed}
 			{saveDisabled}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
@@ -528,6 +550,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
index 4f31a9c891..f0c9e3eae4 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
@@ -128,11 +128,26 @@
 												>
 											</span>
 										</div>
-										<ToggleButtonGroup bind:selected={v.qos}>
-											{#snippet children({ item })}
-												<ToggleButton value={'qos0'} label="At most once (QoS 0)" {item} />
-												<ToggleButton value={'qos1'} label="At least once (QoS 1)" {item} />
-												<ToggleButton value={'qos2'} label="Exactly once (QoS 2)" {item} />
+										<ToggleButtonGroup bind:selected={v.qos} disabled={!can_write}>
+											{#snippet children({ item, disabled })}
+												<ToggleButton
+													value={'qos0'}
+													label="At most once (QoS 0)"
+													{item}
+													{disabled}
+												/>
+												<ToggleButton
+													value={'qos1'}
+													label="At least once (QoS 1)"
+													{item}
+													{disabled}
+												/>
+												<ToggleButton
+													value={'qos2'}
+													label="Exactly once (QoS 2)"
+													{item}
+													{disabled}
+												/>
 											{/snippet}
 										</ToggleButtonGroup>
 									</label>
@@ -159,8 +174,9 @@
 							</div>
 							<button
 								transition:fade|local={{ duration: 100 }}
-								class="rounded-full p-1 bg-surface-secondary duration-200 hover:bg-surface-hover"
+								class="rounded-full p-1 bg-surface-secondary duration-200 hover:bg-surface-hover disabled:opacity-50 disabled:cursor-not-allowed"
 								aria-label="Clear"
+								disabled={!can_write}
 								onclick={() => {
 									subscribe_topics = subscribe_topics.filter((_, index) => index !== i)
 								}}
@@ -175,6 +191,7 @@
 							variant="default"
 							size="xs"
 							btnClasses="mt-1"
+							disabled={!can_write}
 							on:click={() => {
 								subscribe_topics = [
 									...subscribe_topics,
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte
index fea56a3750..c8300ee81e 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: MqttTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
index 09c944ed7c..deab34ba59 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
@@ -11,8 +11,8 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -51,7 +51,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -118,8 +118,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
@@ -169,14 +170,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -212,8 +219,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -248,6 +261,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -347,6 +361,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -427,7 +446,9 @@
 			? can_write
 				? `Edit MQTT trigger ${initialPath}`
 				: `MQTT trigger ${initialPath}`
-			: 'New MQTT trigger'}
+			: saveDraftHandler
+				? 'Draft MQTT trigger'
+				: 'New MQTT trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -485,6 +506,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			onToggleMode={handleToggleMode}
@@ -502,6 +524,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
@@ -605,10 +628,10 @@
 						<div class="mt-4">
 							{#if optionTabSelected === 'connection_options'}
 								<div class="flex p-2 flex-col gap-2 mt-3">
-									<ToggleButtonGroup bind:selected={client_version}>
-										{#snippet children({ item })}
-											<ToggleButton value="v5" label="Version 5" {item} />
-											<ToggleButton value="v3" label="Version 3" {item} />
+									<ToggleButtonGroup bind:selected={client_version} disabled={!can_write}>
+										{#snippet children({ item, disabled })}
+											<ToggleButton value="v5" label="Version 5" {item} {disabled} />
+											<ToggleButton value="v3" label="Version 3" {item} {disabled} />
 										{/snippet}
 									</ToggleButtonGroup>
 
@@ -625,6 +648,7 @@
 											textClass="font-normal text-sm"
 											color="nord"
 											size="xs"
+											disabled={!can_write}
 											bind:checked={v5_config.clean_start}
 											options={{
 												right: 'Clean start',
@@ -641,6 +665,7 @@
 												textClass="font-normal text-sm"
 												color="nord"
 												size="xs"
+												disabled={!can_write}
 												bind:checked={activateV5Options.session_expiry_interval}
 												on:change={(ev) => {
 													if (!ev.detail) {
@@ -672,6 +697,7 @@
 												textClass="font-normal text-sm"
 												color="nord"
 												size="xs"
+												disabled={!can_write}
 												bind:checked={activateV5Options.topic_alias_maximum}
 												on:change={(ev) => {
 													if (!ev.detail) {
@@ -703,6 +729,7 @@
 											textClass="font-normal text-sm"
 											color="nord"
 											size="xs"
+											disabled={!can_write}
 											checked={v3_config.clean_session}
 											on:change={() => {
 												v3_config.clean_session = !v3_config.clean_session
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
index 3a4be41a04..9e8dc592e9 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
@@ -9,8 +9,8 @@
 		saveNativeTriggerFromCfg
 	} from './utils'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights, useTriggerLock } from '$lib/operatorWriteRights'
 	import { Button } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
@@ -37,6 +37,7 @@
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
 	const actingUser = $derived(operatingUser.current)
+	const editRights = useEditRights()
 
 	interface Props {
 		service: NativeServiceName
@@ -119,9 +120,9 @@
 	// Derived, not snapshotted at load: the acting user's role arrives on its own schedule, and
 	// a trigger that loaded first would otherwise stay read-only until reopened.
 	const can_write = $derived(
-		(writeVerdict ??
-			(permsScriptPath === undefined || canWrite(permsScriptPath, {}, actingUser))) &&
-			!$triggerLock
+		writeVerdict === undefined && permsScriptPath !== undefined
+			? editRights.canEditItem('trigger', permsScriptPath, {})
+			: writeVerdict !== false && editRights.roleCanAuthor('trigger')
 	)
 	let originalConfig = $state<Record<string, any> | undefined>(undefined)
 	let initialConfig = $state<Record<string, any> | undefined>(undefined)
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
index e45f3f9eab..e6bf8928bc 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
@@ -3,9 +3,8 @@
 	import type { NativeServiceName, TriggerMode } from '$lib/gen/types.gen'
 	import type { ExtendedNativeTrigger } from './utils'
 	import { getServiceConfig } from './utils'
-	import { canWrite, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
-	import { userStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/utils'
+	import { useEditRights, useTriggerLock } from '$lib/operatorWriteRights'
 	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -19,6 +18,7 @@
 	import GoogleCalendarIcon from '$lib/components/icons/GoogleCalendarIcon.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	const operatingWorkspace = useOperatingWorkspace()
 
@@ -111,7 +111,7 @@
 			{#each triggers as trigger (trigger.external_id)}
 				{@const isFlow = trigger.is_flow}
 				{@const href = `${isFlow ? '/flows/get' : '/scripts/get'}/${trigger.script_path}`}
-				{@const canEdit = canWrite(trigger.script_path, {}, $userStore) && !$triggerLock}
+				{@const canEdit = editRights.canEditItem('trigger', trigger.script_path, {})}
 				<div
 					class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0 first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
 				>
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte
index aa5585a7b6..add8b43d75 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: NatsTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
index 33af8a3d40..33ff526853 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
@@ -11,8 +11,8 @@
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { NatsTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -37,7 +37,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -103,8 +103,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
@@ -157,14 +158,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -206,8 +213,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		nDefaultValues?: Record<string, any>
+		nDefaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -241,6 +254,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -326,6 +340,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = natsConfig
@@ -424,7 +443,9 @@
 			? can_write
 				? `Edit NATS trigger ${initialPath}`
 				: `NATS trigger ${initialPath}`
-			: 'New NATS trigger'}
+			: saveDraftHandler
+				? 'Draft NATS trigger'
+				: 'New NATS trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -481,6 +502,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{cloudDisabled}
@@ -499,6 +521,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte
index 66702a54ab..c9ec98881c 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, undefined, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: PostgresTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
index 2072041c28..0d15877f3a 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
@@ -19,8 +19,8 @@
 		type TriggerMode
 	} from '$lib/gen'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, emptyString, emptyStringTrimmed, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { emptyString, emptyStringTrimmed, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -37,7 +37,6 @@
 	import RelationPicker from './RelationPicker.svelte'
 	import { invalidRelations, savePostgresTriggerFromCfg } from './utils'
 	import CheckPostgresRequirement from './CheckPostgresRequirement.svelte'
-	import { base } from '$lib/base'
 	import { untrack, type Snippet } from 'svelte'
 	import TriggerEditorToolbar from '../TriggerEditorToolbar.svelte'
 	import PermissionedAsLine from '../PermissionedAsLine.svelte'
@@ -59,7 +58,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -124,8 +123,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading: boolean = $state(true)
 	let showLoading: boolean = $state(false)
@@ -258,14 +258,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -307,8 +313,14 @@
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
 		defaultValues?: Record<string, any>,
-		newDraft?: boolean
+		newDraft?: boolean,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -352,6 +364,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			clearTimeout(loadingTimeout)
 			drawerLoading = false
@@ -477,6 +490,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		const cfg = postgresConfig
 		if (!cfg) {
 			return
@@ -518,7 +536,7 @@
 					postgres_resource_path
 				}
 			})
-			window.open(operatingHref(`${base}/scripts/add?id=${templateId}`))
+			window.open(operatingHref(`/scripts/add?id=${templateId}`))
 			loading = false
 		} catch (error) {
 			loading = false
@@ -608,7 +626,9 @@
 			? can_write
 				? `Edit Postgres trigger ${initialPath}`
 				: `Postgres trigger ${initialPath}`
-			: 'New Postgres trigger'}
+			: saveDraftHandler
+				? 'Draft Postgres trigger'
+				: 'New Postgres trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}{@render actionsSnippet()}{/snippet}
@@ -663,6 +683,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{mode}
@@ -684,6 +705,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/triggers/scheduled/ScheduledPollPanel.svelte b/frontend/src/lib/components/triggers/scheduled/ScheduledPollPanel.svelte
index 8f582107e4..2865ba8fd5 100644
--- a/frontend/src/lib/components/triggers/scheduled/ScheduledPollPanel.svelte
+++ b/frontend/src/lib/components/triggers/scheduled/ScheduledPollPanel.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import Label from '$lib/components/Label.svelte'
-	import { base } from '$lib/base'
 	import Description from '$lib/components/Description.svelte'
 </script>
 
@@ -17,7 +16,7 @@
 				1. Choose a trigger script using the script picker that will poll for new events regularly <img
 					class="shadow-lg rounded"
 					alt="script picker"
-					src="{base}/script-picker.png"
+					src="/script-picker.png"
 					width="400"
 				/>
 			</li>
@@ -26,7 +25,7 @@
 				2. Add logic to process each new event <img
 					class="shadow-lg rounded"
 					alt="create action"
-					src="{base}/create_action.png"
+					src="/create_action.png"
 					width="500"
 				/>
 			</li>
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte
new file mode 100644
index 0000000000..1b785b293e
--- /dev/null
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleAdvancedOptions.svelte
@@ -0,0 +1,670 @@
+<script lang="ts" module>
+	import { handlerFullPath } from '$lib/components/ErrorOrRecoveryHandler.svelte'
+	import { SettingService, type ErrorHandler, type Retry } from '$lib/gen'
+
+	export type ScheduleAdvancedState = {
+		errorHandlerSelected: ErrorHandler
+		errorHandlerPath: string | undefined
+		errorHandleritemKind: 'flow' | 'script'
+		errorHandlerExtraArgs: Record<string, any>
+		wsErrorHandlerMuted: boolean
+		failedTimes: number
+		failedExact: boolean
+		recoveryHandlerSelected: ErrorHandler
+		recoveryHandlerPath: string | undefined
+		recoveryHandlerItemKind: 'flow' | 'script'
+		recoveryHandlerExtraArgs: Record<string, any>
+		recoveredTimes: number
+		successHandlerSelected: ErrorHandler
+		successHandlerPath: string | undefined
+		successHandlerItemKind: 'flow' | 'script'
+		successHandlerExtraArgs: Record<string, any>
+		retry: Retry | undefined
+		dynamicSkipPath: string | undefined
+		tag: string | undefined
+	}
+
+	export function emptyScheduleAdvanced(): ScheduleAdvancedState {
+		return {
+			errorHandlerSelected: 'slack',
+			errorHandlerPath: undefined,
+			errorHandleritemKind: 'script',
+			errorHandlerExtraArgs: {},
+			wsErrorHandlerMuted: false,
+			failedTimes: 1,
+			failedExact: false,
+			recoveryHandlerSelected: 'slack',
+			recoveryHandlerPath: undefined,
+			recoveryHandlerItemKind: 'script',
+			recoveryHandlerExtraArgs: {},
+			recoveredTimes: 1,
+			successHandlerSelected: 'slack',
+			successHandlerPath: undefined,
+			successHandlerItemKind: 'script',
+			successHandlerExtraArgs: {},
+			retry: undefined,
+			dynamicSkipPath: undefined,
+			tag: undefined
+		}
+	}
+
+	/** Which built-in handler a hub path is, or `custom`. */
+	export function getHandlerType(
+		isHandler: 'error' | 'recovery' | 'success',
+		scriptPath: string
+	): ErrorHandler {
+		const handlerMap = {
+			error: {
+				teams: '/workspace-or-schedule-error-handler-teams',
+				slack: '/workspace-or-schedule-error-handler-slack',
+				email: '/workspace-or-error-handler-email'
+			},
+			recovery: {
+				teams: '/schedule-recovery-handler-teams',
+				slack: '/schedule-recovery-handler-slack',
+				email: '/workspace-or-error-handler-email'
+			},
+			success: {
+				teams: '/schedule-success-handler-teams',
+				slack: '/schedule-success-handler-slack',
+				email: '/workspace-or-error-handler-email'
+			}
+		}
+
+		for (const [type, suffix] of Object.entries(handlerMap[isHandler])) {
+			if (scriptPath.startsWith('hub/') && scriptPath.endsWith(suffix)) {
+				return type as ErrorHandler
+			}
+		}
+		return 'custom'
+	}
+
+	const splitHandler = (path: string) => {
+		const [kind, ...rest] = path.split('/')
+		return { kind: kind as 'flow' | 'script', path: rest.join('/') }
+	}
+
+	/** The Advanced tabs of a new schedule: the workspace's default error, recovery
+	 * and success handlers, where it sets them. */
+	export async function loadDefaultScheduleAdvanced(wsId: string): Promise<ScheduleAdvancedState> {
+		const a = emptyScheduleAdvanced()
+		const [err, rec, suc] = (await Promise.all(
+			['error', 'recovery', 'success'].map((k) =>
+				SettingService.getGlobal({ key: `default_${k}_handler_${wsId}` })
+			)
+		)) as any[]
+		if (err) {
+			const h = splitHandler(err.errorHandlerPath)
+			a.wsErrorHandlerMuted = err.wsErrorHandlerMuted
+			a.errorHandleritemKind = h.kind
+			a.errorHandlerPath = h.path
+			a.errorHandlerExtraArgs = err.errorHandlerExtraArgs
+			a.errorHandlerSelected = getHandlerType('error', h.path)
+			a.failedTimes = err.failedTimes
+			a.failedExact = err.failedExact
+		}
+		if (rec) {
+			const h = splitHandler(rec.recoveryHandlerPath)
+			a.recoveryHandlerItemKind = h.kind
+			a.recoveryHandlerPath = h.path
+			a.recoveryHandlerExtraArgs = rec.recoveryHandlerExtraArgs
+			a.recoveryHandlerSelected = getHandlerType('recovery', h.path)
+			a.recoveredTimes = rec.recoveredTimes
+		}
+		if (suc) {
+			const h = splitHandler(suc.successHandlerPath)
+			a.successHandlerItemKind = h.kind
+			a.successHandlerPath = h.path
+			a.successHandlerExtraArgs = suc.successHandlerExtraArgs
+			a.successHandlerSelected = getHandlerType('success', h.path)
+		}
+		return a
+	}
+
+	/** The schedule fields the Advanced tabs own, as the schedule API takes them. */
+	export function scheduleAdvancedCfg(a: ScheduleAdvancedState) {
+		return {
+			on_failure: a.errorHandlerPath
+				? handlerFullPath(a.errorHandlerSelected, a.errorHandleritemKind, a.errorHandlerPath)
+				: undefined,
+			on_failure_times: a.failedTimes,
+			on_failure_exact: a.failedExact,
+			on_failure_extra_args: a.errorHandlerPath ? a.errorHandlerExtraArgs : undefined,
+			on_recovery: a.recoveryHandlerPath
+				? handlerFullPath(
+						a.recoveryHandlerSelected,
+						a.recoveryHandlerItemKind,
+						a.recoveryHandlerPath
+					)
+				: undefined,
+			on_recovery_times: a.recoveredTimes,
+			on_recovery_extra_args: a.recoveryHandlerPath ? a.recoveryHandlerExtraArgs : {},
+			on_success: a.successHandlerPath
+				? handlerFullPath(a.successHandlerSelected, a.successHandlerItemKind, a.successHandlerPath)
+				: undefined,
+			on_success_extra_args: a.successHandlerPath ? a.successHandlerExtraArgs : {},
+			ws_error_handler_muted: a.wsErrorHandlerMuted,
+			retry: a.retry,
+			tag: a.tag,
+			dynamic_skip: a.dynamicSkipPath
+		}
+	}
+</script>
+
+<script lang="ts">
+	import { Alert, Button, Tab, Tabs } from '$lib/components/common'
+	import ErrorOrRecoveryHandler from '$lib/components/ErrorOrRecoveryHandler.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
+	import Section from '$lib/components/Section.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import WorkerTagPicker from '$lib/components/WorkerTagPicker.svelte'
+	import FlowRetries from '$lib/components/flows/content/FlowRetries.svelte'
+	import { ScheduleService } from '$lib/gen'
+	import { enterpriseLicense } from '$lib/stores'
+	import { emptyString, sendUserToast } from '$lib/utils'
+	import { Loader2, Save } from 'lucide-svelte'
+
+	// The schedule drawer's Advanced tabs, shared with editors that configure a
+	// schedule before it exists (the pipeline editor's create wizard).
+	interface Props {
+		wsId: string | undefined
+		itemKind: 'flow' | 'script'
+		canWrite: boolean
+		loading?: boolean
+		errorHandlerSelected: ErrorHandler
+		errorHandlerPath: string | undefined
+		errorHandleritemKind: 'flow' | 'script'
+		errorHandlerExtraArgs: Record<string, any>
+		wsErrorHandlerMuted: boolean
+		failedTimes: number
+		failedExact: boolean
+		recoveryHandlerSelected: ErrorHandler
+		recoveryHandlerPath: string | undefined
+		recoveryHandlerItemKind: 'flow' | 'script'
+		recoveryHandlerExtraArgs: Record<string, any>
+		recoveredTimes: number
+		successHandlerSelected: ErrorHandler
+		successHandlerPath: string | undefined
+		successHandlerItemKind: 'flow' | 'script'
+		successHandlerExtraArgs: Record<string, any>
+		retry: Retry | undefined
+		dynamicSkipPath: string | undefined
+		tag: string | undefined
+	}
+
+	let {
+		wsId,
+		itemKind,
+		canWrite,
+		loading = false,
+		errorHandlerSelected = $bindable(),
+		errorHandlerPath = $bindable(),
+		errorHandleritemKind = $bindable(),
+		errorHandlerExtraArgs = $bindable(),
+		wsErrorHandlerMuted = $bindable(),
+		failedTimes = $bindable(),
+		failedExact = $bindable(),
+		recoveryHandlerSelected = $bindable(),
+		recoveryHandlerPath = $bindable(),
+		recoveryHandlerItemKind = $bindable(),
+		recoveryHandlerExtraArgs = $bindable(),
+		recoveredTimes = $bindable(),
+		successHandlerSelected = $bindable(),
+		successHandlerPath = $bindable(),
+		successHandlerItemKind = $bindable(),
+		successHandlerExtraArgs = $bindable(),
+		retry = $bindable(),
+		dynamicSkipPath = $bindable(),
+		tag = $bindable()
+	}: Props = $props()
+
+	let optionTabSelected:
+		| 'error_handler'
+		| 'recovery_handler'
+		| 'success_handler'
+		| 'retries'
+		| 'dynamic_skip'
+		| 'tag' = $state('error_handler')
+
+	// Carry the acting workspace onto "create from template" routes, so the script is created
+	// in the workspace this schedule lives in.
+	const wsParam = $derived(wsId ? `&workspace=${encodeURIComponent(wsId)}` : '')
+
+	async function saveAsDefaultErrorHandler(overrideExisting: boolean) {
+		if (!$enterpriseLicense) {
+			sendUserToast(`Setting default error handler is an enterprise edition feature`, true)
+			return
+		}
+		if (wsId) {
+			await ScheduleService.setDefaultErrorOrRecoveryHandler({
+				workspace: wsId!,
+				requestBody: {
+					handler_type: 'error',
+					override_existing: overrideExisting,
+					path:
+						errorHandlerPath == undefined
+							? undefined
+							: handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath),
+					extra_args: errorHandlerExtraArgs,
+					number_of_occurence: failedTimes,
+					number_of_occurence_exact: failedExact,
+					workspace_handler_muted: wsErrorHandlerMuted
+				}
+			})
+			if (errorHandlerPath !== undefined) {
+				sendUserToast(`Default error handler saved to ${errorHandlerPath}`, false)
+			} else {
+				sendUserToast(`Default error handler reset`, false)
+			}
+		}
+	}
+
+	async function saveAsDefaultRecoveryHandler(overrideExisting: boolean) {
+		if (!$enterpriseLicense) {
+			sendUserToast(`Setting default recovery handler is an enterprise edition feature`, true)
+			return
+		}
+		if (wsId) {
+			await ScheduleService.setDefaultErrorOrRecoveryHandler({
+				workspace: wsId!,
+				requestBody: {
+					handler_type: 'recovery',
+					override_existing: overrideExisting,
+					path:
+						recoveryHandlerPath === undefined
+							? undefined
+							: handlerFullPath(
+									recoveryHandlerSelected,
+									recoveryHandlerItemKind,
+									recoveryHandlerPath
+								),
+					extra_args: recoveryHandlerExtraArgs,
+					number_of_occurence: recoveredTimes
+				}
+			})
+			if (recoveryHandlerPath !== undefined) {
+				sendUserToast(`Default recovery handler saved to ${recoveryHandlerPath}`, false)
+			} else {
+				sendUserToast(`Default recovery handler reset`, false)
+			}
+		}
+	}
+
+	async function saveAsDefaultSuccessHandler(overrideExisting: boolean) {
+		if (!$enterpriseLicense) {
+			sendUserToast(`Setting default success handler is an enterprise edition feature`, true)
+			return
+		}
+		if (wsId) {
+			await ScheduleService.setDefaultErrorOrRecoveryHandler({
+				workspace: wsId!,
+				requestBody: {
+					handler_type: 'success',
+					override_existing: overrideExisting,
+					path:
+						successHandlerPath === undefined
+							? undefined
+							: handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath),
+					extra_args: successHandlerExtraArgs,
+					number_of_occurence: recoveredTimes
+				}
+			})
+			if (successHandlerPath !== undefined) {
+				sendUserToast(`Default success handler saved to ${successHandlerPath}`, false)
+			} else {
+				sendUserToast(`Default success handler reset`, false)
+			}
+		}
+	}
+</script>
+
+<div class="flex flex-col gap-2 min-h-96">
+	{#if !loading}
+		<Tabs bind:selected={optionTabSelected}>
+			<Tab value="error_handler" label="Error Handler" />
+			<Tab value="recovery_handler" label="Recovery Handler" />
+			<Tab value="success_handler" label="Success Handler" />
+			<Tab value="retries" label="Retries" />
+			<Tab value="dynamic_skip" label="Dynamic skip" />
+			{#if itemKind === 'script'}
+				<Tab value="tag" label="Custom tag" />
+			{/if}
+		</Tabs>
+		{#if optionTabSelected === 'error_handler'}
+			<Section label="Error handler">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+				{/snippet}
+				{#snippet action()}
+					<div class="flex flex-row items-center gap-1 text-xs text-secondary">
+						<Dropdown
+							disabled={!canWrite}
+							items={[
+								{
+									displayName: `Override future schedules only`,
+									action: () => saveAsDefaultErrorHandler(false)
+								},
+								{
+									displayName: 'Override all existing',
+									type: 'delete',
+									action: () => saveAsDefaultErrorHandler(true)
+								}
+							]}
+						>
+							{#snippet buttonReplacement()}
+								<Save size={12} class="mr-1" />
+								Set as default
+							{/snippet}
+						</Dropdown>
+					</div>
+				{/snippet}
+				<div class="flex flex-row py-2">
+					<Toggle
+						size="xs"
+						disabled={!canWrite || !$enterpriseLicense}
+						bind:checked={wsErrorHandlerMuted}
+						options={{ right: 'Mute workspace error handler for this schedule' }}
+					/>
+				</div>
+
+				<ErrorOrRecoveryHandler
+					workspace={wsId}
+					isEditable={canWrite}
+					errorOrRecovery="error"
+					showScriptHelpText={true}
+					bind:handlerSelected={errorHandlerSelected}
+					bind:handlerPath={errorHandlerPath}
+					toggleText="Alert channel on error"
+					customScriptTemplate="/scripts/add?hub=hub%2F19743%2Fwindmill%2Fschedule_error_handler_template"
+					bind:customHandlerKind={errorHandleritemKind}
+					bind:handlerExtraArgs={errorHandlerExtraArgs}
+				>
+					{#snippet customTabTooltip()}
+						<Tooltip>
+							<div class="flex gap-20 items-start mt-3">
+								<div class="text-xs"
+									>The following args will be passed to the error handler:
+									<ul class="mt-1 ml-2">
+										<li
+											><b>workspace_id</b>: The ID of the workspace that the schedule belongs to.</li
+										>
+										<li><b>job_id</b>: The UUID of the job that errored.</li>
+										<li><b>path</b>: The path of the script or flow that failed.</li>
+										<li><b>is_flow</b>: Whether the runnable is a flow.</li>
+										<li><b>schedule_path</b>: The path of the schedule.</li>
+										<li><b>error</b>: The error details.</li>
+										<li
+											><b>failed_times</b>: Minimum number of times the schedule failed before
+											calling the error handler.</li
+										>
+										<li><b>started_at</b>: The start datetime of the latest job that failed.</li>
+									</ul>
+								</div>
+							</div>
+						</Tooltip>
+					{/snippet}
+				</ErrorOrRecoveryHandler>
+				<div class="flex flex-row items-center justify-between">
+					<div class="flex flex-row items-center mt-4 font-semibold text-xs gap-2">
+						<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}>
+							Triggered when schedule failed</p
+						>
+						<select
+							class="!w-14"
+							bind:value={failedExact}
+							disabled={!canWrite || !$enterpriseLicense || emptyString(errorHandlerPath)}
+						>
+							<option value={false}>&gt;=</option>
+							<option value={true}>==</option>
+						</select>
+						<input
+							type="number"
+							class="!w-14 text-center {emptyString(errorHandlerPath) ? 'text-primary' : ''}"
+							bind:value={failedTimes}
+							disabled={!canWrite || !$enterpriseLicense}
+							min="1"
+						/>
+						<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}
+							>time{failedTimes > 1 ? 's in a row' : ''}</p
+						>
+					</div>
+				</div>
+			</Section>
+		{:else if optionTabSelected === 'recovery_handler'}
+			{@const disabled = !canWrite || emptyString($enterpriseLicense)}
+			<Section label="Recovery handler">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+				{/snippet}
+				{#snippet action()}
+					<div class="flex flex-row items-center text-secondary text-xs gap-2">
+						defaults
+						<Dropdown
+							{disabled}
+							items={[
+								{
+									displayName: `Override future schedules only`,
+									action: () => saveAsDefaultRecoveryHandler(false)
+								},
+								{
+									displayName: 'Override all existing',
+									type: 'delete',
+									action: () => saveAsDefaultRecoveryHandler(true)
+								}
+							]}
+						>
+							{#snippet buttonReplacement()}
+								<Save size={12} class="mr-1" />
+								Set as default
+							{/snippet}
+						</Dropdown>
+					</div>
+				{/snippet}
+				<ErrorOrRecoveryHandler
+					workspace={wsId}
+					isEditable={!disabled}
+					errorOrRecovery="recovery"
+					bind:handlerSelected={recoveryHandlerSelected}
+					bind:handlerPath={recoveryHandlerPath}
+					toggleText="Alert channel when error recovered"
+					customScriptTemplate="/scripts/add?hub=hub%2F9082%2Fwindmill%2Fschedule_recovery_handler_template"
+					bind:customHandlerKind={recoveryHandlerItemKind}
+					bind:handlerExtraArgs={recoveryHandlerExtraArgs}
+				>
+					{#snippet customTabTooltip()}
+						<Tooltip>
+							<div class="flex gap-20 items-start mt-3">
+								<div class="text-xs"
+									>The following args will be passed to the recovery handler:
+									<ul class="mt-1 ml-2">
+										<li><b>path</b>: The path of the script or flow that recovered.</li>
+										<li><b>is_flow</b>: Whether the runnable is a flow.</li>
+										<li><b>schedule_path</b>: The path of the schedule.</li>
+										<li><b>error</b>: The error of the last job that errored</li>
+										<li><b>error_started_at</b>: The start datetime of the last job that errored</li
+										>
+										<li
+											><b>success_times</b>: The number of times the schedule succeeded before
+											calling the recovery handler.</li
+										>
+										<li><b>success_result</b>: The result of the latest successful job</li>
+										<li
+											><b>success_started_at</b>: The start datetime of the latest successful job</li
+										>
+									</ul>
+								</div>
+							</div>
+						</Tooltip>
+					{/snippet}
+				</ErrorOrRecoveryHandler>
+				<div class="flex flex-row items-center justify-between">
+					<div
+						class="flex flex-row items-center mt-5 font-semibold text-xs {emptyString(
+							recoveryHandlerPath
+						)
+							? 'text-primary'
+							: ''}"
+					>
+						<p>Triggered when schedule recovered</p>
+						<input
+							type="number"
+							class="!w-14 mx-2 text-center"
+							bind:value={recoveredTimes}
+							min="1"
+							{disabled}
+						/>
+						<p>time{recoveredTimes > 1 ? 's in a row' : ''}</p>
+					</div>
+				</div>
+			</Section>
+		{:else if optionTabSelected === 'success_handler'}
+			{@const disabled = !canWrite || emptyString($enterpriseLicense)}
+			<Section label="Success handler">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+				{/snippet}
+				{#snippet action()}
+					<div class="flex flex-row items-center text-secondary text-xs gap-2">
+						defaults
+						<Dropdown
+							{disabled}
+							items={[
+								{
+									displayName: `Override future schedules only`,
+									action: () => saveAsDefaultSuccessHandler(false)
+								},
+								{
+									displayName: 'Override all existing',
+									type: 'delete',
+									action: () => saveAsDefaultSuccessHandler(true)
+								}
+							]}
+						>
+							{#snippet buttonReplacement()}
+								<Save size={12} class="mr-1" />
+								Set as default
+							{/snippet}
+						</Dropdown>
+					</div>
+				{/snippet}
+				<ErrorOrRecoveryHandler
+					workspace={wsId}
+					isEditable={!disabled}
+					errorOrRecovery="success"
+					bind:handlerSelected={successHandlerSelected}
+					bind:handlerPath={successHandlerPath}
+					toggleText="Alert channel when successful"
+					customScriptTemplate="/scripts/add?hub=hub%2F9071%2Fwindmill%2Fschedule_success_handler_template"
+					bind:customHandlerKind={successHandlerItemKind}
+					bind:handlerExtraArgs={successHandlerExtraArgs}
+				>
+					{#snippet customTabTooltip()}
+						<Tooltip>
+							<div class="flex gap-20 items-start mt-3">
+								<div class="text-xs"
+									>The following args will be passed to the success handler:
+									<ul class="mt-1 ml-2">
+										<li><b>path</b>: The path of the script or flow that succeeded.</li>
+										<li><b>is_flow</b>: Whether the runnable is a flow.</li>
+										<li><b>schedule_path</b>: The path of the schedule.</li>
+										<li><b>success_result</b>: The result of the successful job</li>
+										<li><b>success_started_at</b>: The start datetime of the successful job</li>
+									</ul>
+								</div>
+							</div>
+						</Tooltip>
+					{/snippet}
+				</ErrorOrRecoveryHandler>
+			</Section>
+		{:else if optionTabSelected === 'retries'}
+			{@const disabled = !canWrite || emptyString($enterpriseLicense)}
+			<Section label="Retries">
+				{#snippet header()}
+					<div class="flex flex-row gap-2">
+						{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
+					</div>
+					<Tooltip>
+						If defined, upon error this schedule will be retried with a delay and a maximum number
+						of attempts as defined below.
+						<br />
+						This is only available for individual script. For flows, retries can be set on each flow
+						step in the flow editor.
+					</Tooltip>
+				{/snippet}
+				{#if itemKind !== 'script'}
+					<Alert type="info" title="Only available for scripts" class="mb-2">
+						Error Handler and Retries are only available for scripts. For flows, use the built-in <a
+							href="https://www.windmill.dev/docs/flows/flow_error_handler"
+							target="_blank">error handler</a
+						>
+						and <a href="https://www.windmill.dev/docs/flows/retries" target="_blank">retries</a>.
+					</Alert>
+				{:else}
+					<FlowRetries bind:flowModuleRetry={retry} disabled={itemKind !== 'script' || disabled} />
+				{/if}
+			</Section>
+		{:else if optionTabSelected === 'dynamic_skip'}
+			<Section label="Dynamic skip">
+				{#snippet header()}
+					<Tooltip>
+						Optional script to filter scheduled dates. Receives the proposed datetime and returns
+						boolean. True = run on this date, False = skip to next occurrence.
+					</Tooltip>
+				{/snippet}
+				<div class="flex flex-col gap-6">
+					<Label label="Dynamic skip script">
+						<div class="flex flex-row">
+							<ScriptPicker
+								workspace={wsId}
+								disabled={!canWrite}
+								bind:scriptPath={dynamicSkipPath}
+								kinds={['script']}
+								allowRefresh={canWrite}
+								clearable
+							/>
+							{#if !dynamicSkipPath}
+								<Button
+									btnClasses="ml-4 whitespace-nowrap"
+									variant="default"
+									size="xs"
+									href="/scripts/add?hub=hub%2F19822%2Fwindmill%2Fdynamic_skip_template{wsParam}"
+									disabled={!canWrite}
+									target="_blank"
+								>
+									Create from template
+								</Button>
+							{/if}
+						</div>
+					</Label>
+					<Alert type="info" size="xs" title="Handler requirements">
+						Handler must return a boolean value. Return true to execute the scheduled job, false to
+						skip.
+					</Alert>
+				</div>
+			</Section>
+		{:else if optionTabSelected === 'tag'}
+			<Section
+				label="Custom script tag"
+				tooltip="When set, the script tag will be overridden by this tag"
+			>
+				<WorkerTagPicker
+					bind:tag
+					workspaceId={wsId}
+					popupPlacement="top-end"
+					disabled={!canWrite}
+				/>
+			</Section>
+		{/if}
+	{:else}
+		<Loader2 class="animate-spin" />
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte
index 78e569d3f3..295498f428 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditor.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { tickPainted } from '$lib/utils/paint'
 	import type ScheduleEditorInner from './ScheduleEditorInner.svelte'
+	import type { Schedule } from '$lib/gen'
 
 	let { onUpdate }: { onUpdate?: (path?: string) => void } = $props()
 
@@ -29,6 +30,17 @@
 		drawer?.openNew(is_flow, initial_script_path, undefined, schedule_path, fixedScriptPath)
 	}
 
+	/** Edit a schedule that exists only as the caller's draft; Save hands it back. */
+	export async function openDraft(
+		cfg: Schedule,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await loadInner()
+		await tickPainted()
+		drawer?.openNew(false, cfg.script_path, cfg, undefined, cfg.script_path, { onSaveDraft })
+	}
+
 	let drawer: ScheduleEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
index 12cd4c143e..141e67fd1b 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
@@ -1,11 +1,17 @@
 <script lang="ts">
-	import { Alert, Badge, Button, ButtonType, Tab, Tabs } from '$lib/components/common'
+	import { Alert, Badge, Button, ButtonType } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
 	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
+	import ScheduleAdvancedOptions, {
+		emptyScheduleAdvanced,
+		getHandlerType,
+		loadDefaultScheduleAdvanced,
+		scheduleAdvancedCfg
+	} from './ScheduleAdvancedOptions.svelte'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import CronInput from '$lib/components/CronInput.svelte'
@@ -15,36 +21,26 @@
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 	import { loadSchema } from '$lib/infer'
 	import PipelineLockedRunnableInfo from '$lib/components/triggers/PipelineLockedRunnableInfo.svelte'
-	import ErrorOrRecoveryHandler, {
-		handlerFullPath
-	} from '$lib/components/ErrorOrRecoveryHandler.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
 	import {
 		FlowService,
 		ScheduleService,
 		type Script,
 		ScriptService,
 		type Flow,
-		SettingService,
 		type Retry,
 		type Schedule,
 		type ErrorHandler
 	} from '$lib/gen'
-	import { enterpriseLicense } from '$lib/stores'
-	import { canWrite, emptyString, formatCron, sendUserToast, cronV1toV2 } from '$lib/utils'
-	import { useScheduleLock } from '$lib/operatorWriteRights'
-	import { base } from '$lib/base'
+	import { emptyString, formatCron, sendUserToast, cronV1toV2 } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import Section from '$lib/components/Section.svelte'
-	import { List, Loader2, Save, AlertTriangle } from 'lucide-svelte'
+	import { List, Loader2, AlertTriangle } from 'lucide-svelte'
 	import autosize from '$lib/autosize'
 	import TriggerEditorToolbar from '$lib/components/triggers/TriggerEditorToolbar.svelte'
 	import { saveScheduleFromCfg } from '$lib/components/flows/scheduleUtils'
 	import DateTimeInput from '$lib/components/DateTimeInput.svelte'
-	import FlowRetries from '$lib/components/flows/content/FlowRetries.svelte'
-	import Label from '$lib/components/Label.svelte'
-	import WorkerTagPicker from '$lib/components/WorkerTagPicker.svelte'
 	import { runScheduleNow } from '../scheduled/utils'
 	import { handleConfigChange } from '../utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
@@ -55,7 +51,7 @@
 	import PermissionedAsLine from '../PermissionedAsLine.svelte'
 	import { useActingUser } from '$lib/actingUser.svelte'
 	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
-	const scheduleLock = useScheduleLock()
+	const editRights = useEditRights()
 
 	let {
 		useDrawer = true,
@@ -74,12 +70,6 @@
 		trigger = undefined
 	} = $props()
 
-	let optionTabSelected:
-		| 'error_handler'
-		| 'recovery_handler'
-		| 'success_handler'
-		| 'retries'
-		| 'dynamic_skip' = $state('error_handler')
 	let initialPath = $state('')
 	let edit = $state(true)
 	let schedule: string = $state('0 0 12 * *')
@@ -139,6 +129,10 @@
 	let isValid = $state(true)
 	let allowSchedule = $derived(isValid && validCRON && script_path != '')
 	let deploymentLoading = $state(false)
+	// Set by `openNew({ onSaveDraft })`: the caller keeps the schedule as its own
+	// draft, so Save hands it the config instead of writing it, and nothing may
+	// autosave a workspace trigger draft for a path that is not deployed.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
 	let permissionedAs = $state<string | undefined>(undefined)
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
@@ -150,7 +144,9 @@
 	const acting = useActingUser(() => wsId)
 	const actingUser = $derived(acting.current)
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, extraPerms, actingUser)) && !$scheduleLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('schedule')
+			: editRights.canEditItem('schedule', permsPath, extraPerms)
 	)
 	// Editing the runnable is closed to operators, and an unresolved acting user is no
 	// evidence that this one isn't.
@@ -164,14 +160,11 @@
 				emptyString(errorHandlerExtraArgs['channel'])) ||
 			!can_write
 	)
-	// Carry the acting workspace onto "create from template" routes, so the script is created
-	// in the workspace this schedule lives in.
-	const wsParam = $derived(wsId ? `&workspace=${encodeURIComponent(wsId)}` : '')
 	const scheduleCfg = $derived.by(getScheduleCfg)
 
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_schedule',
-		path: () => initialPath,
+		path: () => (saveDraftHandler ? '' : initialPath),
 		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => scheduleCfg,
@@ -190,6 +183,8 @@
 		}, 100) // Do not show loading spinner for the first 100ms
 		drawerLoading = true
 		acting.forgetFailures()
+		editRights.forgetFailures()
+		saveDraftHandler = undefined
 		try {
 			drawer?.openDrawer()
 			setPageDrawerAnchor(SCHEDULES_PATH, ePath)
@@ -259,66 +254,23 @@
 				successHandlerExtraArgs = {}
 			}
 		} else {
-			let defaultErrorHandlerMaybe = undefined
-			let defaultRecoveryHandlerMaybe = undefined
-			let defaultSuccessHandlerMaybe = undefined
-			if (wsId) {
-				defaultErrorHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_error_handler_' + wsId!
-				})) as any
-				defaultRecoveryHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_recovery_handler_' + wsId!
-				})) as any
-				defaultSuccessHandlerMaybe = (await SettingService.getGlobal({
-					key: 'default_success_handler_' + wsId!
-				})) as any
-			}
-
-			if (defaultErrorHandlerMaybe !== undefined && defaultErrorHandlerMaybe !== null) {
-				wsErrorHandlerMuted = defaultErrorHandlerMaybe['wsErrorHandlerMuted']
-				let splitted = (defaultErrorHandlerMaybe['errorHandlerPath'] as string).split('/')
-				errorHandleritemKind = splitted[0] as 'flow' | 'script'
-				errorHandlerPath = splitted.slice(1)?.join('/')
-				errorHandlerExtraArgs = defaultErrorHandlerMaybe['errorHandlerExtraArgs']
-				errorHandlerSelected = getHandlerType('error', errorHandlerPath)
-				failedTimes = defaultErrorHandlerMaybe['failedTimes']
-				failedExact = defaultErrorHandlerMaybe['failedExact']
-			} else {
-				wsErrorHandlerMuted = false
-				errorHandlerPath = undefined
-				errorHandleritemKind = 'script'
-				errorHandlerExtraArgs = {}
-				errorHandlerSelected = 'slack'
-				failedTimes = 1
-				failedExact = false
-			}
-			if (defaultRecoveryHandlerMaybe !== undefined && defaultRecoveryHandlerMaybe !== null) {
-				let splitted = (defaultRecoveryHandlerMaybe['recoveryHandlerPath'] as string).split('/')
-				recoveryHandlerItemKind = splitted[0] as 'flow' | 'script'
-				recoveryHandlerPath = splitted.slice(1)?.join('/')
-				recoveryHandlerExtraArgs = defaultRecoveryHandlerMaybe['recoveryHandlerExtraArgs']
-				recoveryHandlerSelected = getHandlerType('recovery', recoveryHandlerPath)
-				recoveredTimes = defaultRecoveryHandlerMaybe['recoveredTimes']
-			} else {
-				recoveryHandlerPath = undefined
-				recoveryHandlerItemKind = 'script'
-				recoveryHandlerExtraArgs = {}
-				recoveryHandlerSelected = 'slack'
-				recoveredTimes = 1
-			}
-			if (defaultSuccessHandlerMaybe !== undefined && defaultSuccessHandlerMaybe !== null) {
-				let splitted = (defaultSuccessHandlerMaybe['successHandlerPath'] as string).split('/')
-				successHandlerItemKind = splitted[0] as 'flow' | 'script'
-				successHandlerPath = splitted.slice(1)?.join('/')
-				successHandlerExtraArgs = defaultSuccessHandlerMaybe['successHandlerExtraArgs']
-				successHandlerSelected = getHandlerType('success', successHandlerPath)
-				recoveredTimes = defaultSuccessHandlerMaybe['recoveredTimes']
-			} else {
-				successHandlerPath = undefined
-				successHandlerItemKind = 'script'
-				successHandlerExtraArgs = {}
-				successHandlerSelected = 'slack'
-			}
+			const d = wsId ? await loadDefaultScheduleAdvanced(wsId) : emptyScheduleAdvanced()
+			wsErrorHandlerMuted = d.wsErrorHandlerMuted
+			errorHandlerPath = d.errorHandlerPath
+			errorHandleritemKind = d.errorHandleritemKind
+			errorHandlerExtraArgs = d.errorHandlerExtraArgs
+			errorHandlerSelected = d.errorHandlerSelected
+			failedTimes = d.failedTimes
+			failedExact = d.failedExact
+			recoveryHandlerPath = d.recoveryHandlerPath
+			recoveryHandlerItemKind = d.recoveryHandlerItemKind
+			recoveryHandlerExtraArgs = d.recoveryHandlerExtraArgs
+			recoveryHandlerSelected = d.recoveryHandlerSelected
+			recoveredTimes = d.recoveredTimes
+			successHandlerPath = d.successHandlerPath
+			successHandlerItemKind = d.successHandlerItemKind
+			successHandlerExtraArgs = d.successHandlerExtraArgs
+			successHandlerSelected = d.successHandlerSelected
 		}
 	}
 
@@ -328,14 +280,16 @@
 		defaultValues?: Schedule,
 		schedule_path?: string,
 		fixedScriptPath_?: string,
-		opts: { getDraft?: boolean } = {}
+		opts: { getDraft?: boolean; onSaveDraft?: (cfg: Record<string, any>) => boolean } = {}
 	) {
 		const getDraft = opts.getDraft ?? true
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
 		drawerLoading = true
 		acting.forgetFailures()
+		editRights.forgetFailures()
 		try {
 			let s: Schedule | undefined
 			if (schedule_path) {
@@ -389,6 +343,7 @@
 			no_flow_overlap = s?.no_flow_overlap ?? false
 			wsErrorHandlerMuted = s?.ws_error_handler_muted ?? false
 			retry = s?.retry ?? undefined
+			dynamicSkipPath = s?.dynamic_skip ?? undefined
 
 			await setScheduleHandler(s)
 			permissionedAs = undefined
@@ -432,93 +387,6 @@
 		}
 	}
 
-	async function saveAsDefaultErrorHandler(overrideExisting: boolean) {
-		if (!$enterpriseLicense) {
-			sendUserToast(`Setting default error handler is an enterprise edition feature`, true)
-			return
-		}
-		if (wsId) {
-			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: wsId!,
-				requestBody: {
-					handler_type: 'error',
-					override_existing: overrideExisting,
-					path:
-						errorHandlerPath == undefined
-							? undefined
-							: handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath),
-					extra_args: errorHandlerExtraArgs,
-					number_of_occurence: failedTimes,
-					number_of_occurence_exact: failedExact,
-					workspace_handler_muted: wsErrorHandlerMuted
-				}
-			})
-			if (errorHandlerPath !== undefined) {
-				sendUserToast(`Default error handler saved to ${errorHandlerPath}`, false)
-			} else {
-				sendUserToast(`Default error handler reset`, false)
-			}
-		}
-	}
-
-	async function saveAsDefaultRecoveryHandler(overrideExisting: boolean) {
-		if (!$enterpriseLicense) {
-			sendUserToast(`Setting default recovery handler is an enterprise edition feature`, true)
-			return
-		}
-		if (wsId) {
-			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: wsId!,
-				requestBody: {
-					handler_type: 'recovery',
-					override_existing: overrideExisting,
-					path:
-						recoveryHandlerPath === undefined
-							? undefined
-							: handlerFullPath(
-									recoveryHandlerSelected,
-									recoveryHandlerItemKind,
-									recoveryHandlerPath
-								),
-					extra_args: recoveryHandlerExtraArgs,
-					number_of_occurence: recoveredTimes
-				}
-			})
-			if (recoveryHandlerPath !== undefined) {
-				sendUserToast(`Default recovery handler saved to ${recoveryHandlerPath}`, false)
-			} else {
-				sendUserToast(`Default recovery handler reset`, false)
-			}
-		}
-	}
-
-	async function saveAsDefaultSuccessHandler(overrideExisting: boolean) {
-		if (!$enterpriseLicense) {
-			sendUserToast(`Setting default success handler is an enterprise edition feature`, true)
-			return
-		}
-		if (wsId) {
-			await ScheduleService.setDefaultErrorOrRecoveryHandler({
-				workspace: wsId!,
-				requestBody: {
-					handler_type: 'success',
-					override_existing: overrideExisting,
-					path:
-						successHandlerPath === undefined
-							? undefined
-							: handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath),
-					extra_args: successHandlerExtraArgs,
-					number_of_occurence: recoveredTimes
-				}
-			})
-			if (successHandlerPath !== undefined) {
-				sendUserToast(`Default success handler saved to ${successHandlerPath}`, false)
-			} else {
-				sendUserToast(`Default success handler reset`, false)
-			}
-		}
-	}
-
 	/**
 	 * Apply the deployed config to the form, then return the saved-draft overlay
 	 * so the caller captures `initialConfig` from the deployed-only form BEFORE
@@ -631,6 +499,11 @@
 	async function scheduleScript(): Promise<void> {
 		const previousPath = initialPath
 		const scheduleCfg = getScheduleCfg()
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(scheduleCfg))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const isSaved = await saveScheduleFromCfg(scheduleCfg, edit, wsId!)
 		if (isSaved) {
@@ -641,36 +514,6 @@
 		deploymentLoading = false
 	}
 
-	function getHandlerType(
-		isHandler: 'error' | 'recovery' | 'success',
-		scriptPath: string
-	): ErrorHandler {
-		const handlerMap = {
-			error: {
-				teams: '/workspace-or-schedule-error-handler-teams',
-				slack: '/workspace-or-schedule-error-handler-slack',
-				email: '/workspace-or-error-handler-email'
-			},
-			recovery: {
-				teams: '/schedule-recovery-handler-teams',
-				slack: '/schedule-recovery-handler-slack',
-				email: '/workspace-or-error-handler-email'
-			},
-			success: {
-				teams: '/schedule-success-handler-teams',
-				slack: '/schedule-success-handler-slack',
-				email: '/workspace-or-error-handler-email'
-			}
-		}
-
-		for (const [type, suffix] of Object.entries(handlerMap[isHandler])) {
-			if (scriptPath.startsWith('hub/') && scriptPath.endsWith(suffix)) {
-				return type as ErrorHandler
-			}
-		}
-		return 'custom'
-	}
-
 	let drawer: Drawer | undefined = $state()
 
 	let pathC: Path | undefined = $state()
@@ -705,32 +548,34 @@
 			is_flow: is_flow,
 			args: args,
 			enabled: enabled,
-			on_failure: errorHandlerPath
-				? handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath)
-				: undefined,
-			on_failure_times: failedTimes,
-			on_failure_exact: failedExact,
-			on_failure_extra_args: errorHandlerPath ? errorHandlerExtraArgs : undefined,
-			on_recovery: recoveryHandlerPath
-				? handlerFullPath(recoveryHandlerSelected, recoveryHandlerItemKind, recoveryHandlerPath)
-				: undefined,
-			on_recovery_times: recoveredTimes,
-			on_recovery_extra_args: recoveryHandlerPath ? recoveryHandlerExtraArgs : {},
-			on_success: successHandlerPath
-				? handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath)
-				: undefined,
-			on_success_extra_args: successHandlerPath ? successHandlerExtraArgs : {},
-			ws_error_handler_muted: wsErrorHandlerMuted,
-			retry: retry,
+			...scheduleAdvancedCfg({
+				errorHandlerSelected,
+				errorHandlerPath,
+				errorHandleritemKind,
+				errorHandlerExtraArgs,
+				wsErrorHandlerMuted,
+				failedTimes,
+				failedExact,
+				recoveryHandlerSelected,
+				recoveryHandlerPath,
+				recoveryHandlerItemKind,
+				recoveryHandlerExtraArgs,
+				recoveredTimes,
+				successHandlerSelected,
+				successHandlerPath,
+				successHandlerItemKind,
+				successHandlerExtraArgs,
+				retry,
+				dynamicSkipPath,
+				tag
+			}),
 			summary: summary != '' ? summary : undefined,
 			labels: labels,
 			description: description,
 			no_flow_overlap: no_flow_overlap,
-			tag: tag,
 			paused_until: paused_until,
 			cron_version: cronVersion,
 			extra_perms: extraPerms,
-			dynamic_skip: dynamicSkipPath,
 			permissioned_as: selectedPermissionedAs,
 			preserve_permissioned_as: preservePermissionedAs || undefined
 		}
@@ -799,6 +644,7 @@
 			onToggleMode={(mode) => handleToggleEnabled(mode === 'enabled')}
 			{isDeployed}
 			disableSuspendedMode
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 		>
 			{#snippet extra()}
 				{#if !drawerLoading && edit}
@@ -808,7 +654,7 @@
 							variant="default"
 							startIcon={{ icon: List }}
 							disabled={!allowSchedule || pathError != '' || emptyString(script_path)}
-							href={`${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`}
+							href={`/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`}
 						>
 							View runs
 						</Button>
@@ -837,6 +683,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
@@ -870,7 +717,7 @@
 							bind:value={summary}
 						/>
 					</label>
-					<LabelsInput bind:labels class="-mt-4" />
+					<LabelsInput bind:labels class="-mt-4" disabled={!can_write} />
 
 					<div class="flex flex-col gap-1">
 						<label for="path" class="text-xs font-semibold text-emphasis">Path</label>
@@ -980,7 +827,7 @@
 							disabled={!can_write}
 						/>
 						{#if showPauseUntil}
-							<DateTimeInput bind:value={paused_until} />
+							<DateTimeInput bind:value={paused_until} disabled={!can_write} />
 						{/if}
 					</div>
 				</div>
@@ -1030,6 +877,7 @@
 						<Toggle
 							options={{ right: 'no overlap of flows' }}
 							bind:checked={no_flow_overlap}
+							disabled={!can_write}
 							class="mt-2"
 						/>
 					{/if}
@@ -1093,367 +941,37 @@
 						]}
 					/>
 				{/snippet}
-				{@render errorHandler()}
+				<ScheduleAdvancedOptions
+					{wsId}
+					{itemKind}
+					canWrite={can_write}
+					{loading}
+					bind:errorHandlerSelected
+					bind:errorHandlerPath
+					bind:errorHandleritemKind
+					bind:errorHandlerExtraArgs
+					bind:wsErrorHandlerMuted
+					bind:failedTimes
+					bind:failedExact
+					bind:recoveryHandlerSelected
+					bind:recoveryHandlerPath
+					bind:recoveryHandlerItemKind
+					bind:recoveryHandlerExtraArgs
+					bind:recoveredTimes
+					bind:successHandlerSelected
+					bind:successHandlerPath
+					bind:successHandlerItemKind
+					bind:successHandlerExtraArgs
+					bind:retry
+					bind:dynamicSkipPath
+					bind:tag
+				/>
 			</Section>
 			<div class="pb-8" />
 		</div>
 	{/if}
 {/snippet}
 
-{#snippet errorHandler()}
-	<div class="flex flex-col gap-2 min-h-96">
-		{#if !loading}
-			<Tabs bind:selected={optionTabSelected}>
-				<Tab value="error_handler" label="Error Handler" />
-				<Tab value="recovery_handler" label="Recovery Handler" />
-				<Tab value="success_handler" label="Success Handler" />
-				<Tab value="retries" label="Retries" />
-				<Tab value="dynamic_skip" label="Dynamic skip" />
-				{#if itemKind === 'script'}
-					<Tab value="tag" label="Custom tag" />
-				{/if}
-			</Tabs>
-			{#if optionTabSelected === 'error_handler'}
-				<Section label="Error handler">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-					{/snippet}
-					{#snippet action()}
-						<div class="flex flex-row items-center gap-1 text-xs text-secondary">
-							<Dropdown
-								disabled={!can_write}
-								items={[
-									{
-										displayName: `Override future schedules only`,
-										action: () => saveAsDefaultErrorHandler(false)
-									},
-									{
-										displayName: 'Override all existing',
-										type: 'delete',
-										action: () => saveAsDefaultErrorHandler(true)
-									}
-								]}
-							>
-								{#snippet buttonReplacement()}
-									<Save size={12} class="mr-1" />
-									Set as default
-								{/snippet}
-							</Dropdown>
-						</div>
-					{/snippet}
-					<div class="flex flex-row py-2">
-						<Toggle
-							size="xs"
-							disabled={!can_write || !$enterpriseLicense}
-							bind:checked={wsErrorHandlerMuted}
-							options={{ right: 'Mute workspace error handler for this schedule' }}
-						/>
-					</div>
-
-					<ErrorOrRecoveryHandler
-						workspace={wsId}
-						isEditable={can_write}
-						errorOrRecovery="error"
-						showScriptHelpText={true}
-						bind:handlerSelected={errorHandlerSelected}
-						bind:handlerPath={errorHandlerPath}
-						toggleText="Alert channel on error"
-						customScriptTemplate="/scripts/add?hub=hub%2F19743%2Fwindmill%2Fschedule_error_handler_template"
-						bind:customHandlerKind={errorHandleritemKind}
-						bind:handlerExtraArgs={errorHandlerExtraArgs}
-					>
-						{#snippet customTabTooltip()}
-							<Tooltip>
-								<div class="flex gap-20 items-start mt-3">
-									<div class="text-xs"
-										>The following args will be passed to the error handler:
-										<ul class="mt-1 ml-2">
-											<li
-												><b>workspace_id</b>: The ID of the workspace that the schedule belongs to.</li
-											>
-											<li><b>job_id</b>: The UUID of the job that errored.</li>
-											<li><b>path</b>: The path of the script or flow that failed.</li>
-											<li><b>is_flow</b>: Whether the runnable is a flow.</li>
-											<li><b>schedule_path</b>: The path of the schedule.</li>
-											<li><b>error</b>: The error details.</li>
-											<li
-												><b>failed_times</b>: Minimum number of times the schedule failed before
-												calling the error handler.</li
-											>
-											<li><b>started_at</b>: The start datetime of the latest job that failed.</li>
-										</ul>
-									</div>
-								</div>
-							</Tooltip>
-						{/snippet}
-					</ErrorOrRecoveryHandler>
-					<div class="flex flex-row items-center justify-between">
-						<div class="flex flex-row items-center mt-4 font-semibold text-xs gap-2">
-							<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}>
-								Triggered when schedule failed</p
-							>
-							<select
-								class="!w-14"
-								bind:value={failedExact}
-								disabled={!$enterpriseLicense || emptyString(errorHandlerPath)}
-							>
-								<option value={false}>&gt;=</option>
-								<option value={true}>==</option>
-							</select>
-							<input
-								type="number"
-								class="!w-14 text-center {emptyString(errorHandlerPath) ? 'text-primary' : ''}"
-								bind:value={failedTimes}
-								disabled={!$enterpriseLicense}
-								min="1"
-							/>
-							<p class={emptyString(errorHandlerPath) ? 'text-primary' : ''}
-								>time{failedTimes > 1 ? 's in a row' : ''}</p
-							>
-						</div>
-					</div>
-				</Section>
-			{:else if optionTabSelected === 'recovery_handler'}
-				{@const disabled = !can_write || emptyString($enterpriseLicense)}
-				<Section label="Recovery handler">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-					{/snippet}
-					{#snippet action()}
-						<div class="flex flex-row items-center text-secondary text-xs gap-2">
-							defaults
-							<Dropdown
-								{disabled}
-								items={[
-									{
-										displayName: `Override future schedules only`,
-										action: () => saveAsDefaultRecoveryHandler(false)
-									},
-									{
-										displayName: 'Override all existing',
-										type: 'delete',
-										action: () => saveAsDefaultRecoveryHandler(true)
-									}
-								]}
-							>
-								{#snippet buttonReplacement()}
-									<Save size={12} class="mr-1" />
-									Set as default
-								{/snippet}
-							</Dropdown>
-						</div>
-					{/snippet}
-					<ErrorOrRecoveryHandler
-						workspace={wsId}
-						isEditable={!disabled}
-						errorOrRecovery="recovery"
-						bind:handlerSelected={recoveryHandlerSelected}
-						bind:handlerPath={recoveryHandlerPath}
-						toggleText="Alert channel when error recovered"
-						customScriptTemplate="/scripts/add?hub=hub%2F9082%2Fwindmill%2Fschedule_recovery_handler_template"
-						bind:customHandlerKind={recoveryHandlerItemKind}
-						bind:handlerExtraArgs={recoveryHandlerExtraArgs}
-					>
-						{#snippet customTabTooltip()}
-							<Tooltip>
-								<div class="flex gap-20 items-start mt-3">
-									<div class="text-xs"
-										>The following args will be passed to the recovery handler:
-										<ul class="mt-1 ml-2">
-											<li><b>path</b>: The path of the script or flow that recovered.</li>
-											<li><b>is_flow</b>: Whether the runnable is a flow.</li>
-											<li><b>schedule_path</b>: The path of the schedule.</li>
-											<li><b>error</b>: The error of the last job that errored</li>
-											<li
-												><b>error_started_at</b>: The start datetime of the last job that errored</li
-											>
-											<li
-												><b>success_times</b>: The number of times the schedule succeeded before
-												calling the recovery handler.</li
-											>
-											<li><b>success_result</b>: The result of the latest successful job</li>
-											<li
-												><b>success_started_at</b>: The start datetime of the latest successful job</li
-											>
-										</ul>
-									</div>
-								</div>
-							</Tooltip>
-						{/snippet}
-					</ErrorOrRecoveryHandler>
-					<div class="flex flex-row items-center justify-between">
-						<div
-							class="flex flex-row items-center mt-5 font-semibold text-xs {emptyString(
-								recoveryHandlerPath
-							)
-								? 'text-primary'
-								: ''}"
-						>
-							<p>Triggered when schedule recovered</p>
-							<input
-								type="number"
-								class="!w-14 mx-2 text-center"
-								bind:value={recoveredTimes}
-								min="1"
-								{disabled}
-							/>
-							<p>time{recoveredTimes > 1 ? 's in a row' : ''}</p>
-						</div>
-					</div>
-				</Section>
-			{:else if optionTabSelected === 'success_handler'}
-				{@const disabled = !can_write || emptyString($enterpriseLicense)}
-				<Section label="Success handler">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-					{/snippet}
-					{#snippet action()}
-						<div class="flex flex-row items-center text-secondary text-xs gap-2">
-							defaults
-							<Dropdown
-								{disabled}
-								items={[
-									{
-										displayName: `Override future schedules only`,
-										action: () => saveAsDefaultSuccessHandler(false)
-									},
-									{
-										displayName: 'Override all existing',
-										type: 'delete',
-										action: () => saveAsDefaultSuccessHandler(true)
-									}
-								]}
-							>
-								{#snippet buttonReplacement()}
-									<Save size={12} class="mr-1" />
-									Set as default
-								{/snippet}
-							</Dropdown>
-						</div>
-					{/snippet}
-					<ErrorOrRecoveryHandler
-						workspace={wsId}
-						isEditable={!disabled}
-						errorOrRecovery="success"
-						bind:handlerSelected={successHandlerSelected}
-						bind:handlerPath={successHandlerPath}
-						toggleText="Alert channel when successful"
-						customScriptTemplate="/scripts/add?hub=hub%2F9071%2Fwindmill%2Fschedule_success_handler_template"
-						bind:customHandlerKind={successHandlerItemKind}
-						bind:handlerExtraArgs={successHandlerExtraArgs}
-					>
-						{#snippet customTabTooltip()}
-							<Tooltip>
-								<div class="flex gap-20 items-start mt-3">
-									<div class="text-xs"
-										>The following args will be passed to the success handler:
-										<ul class="mt-1 ml-2">
-											<li><b>path</b>: The path of the script or flow that succeeded.</li>
-											<li><b>is_flow</b>: Whether the runnable is a flow.</li>
-											<li><b>schedule_path</b>: The path of the schedule.</li>
-											<li><b>success_result</b>: The result of the successful job</li>
-											<li><b>success_started_at</b>: The start datetime of the successful job</li>
-										</ul>
-									</div>
-								</div>
-							</Tooltip>
-						{/snippet}
-					</ErrorOrRecoveryHandler>
-				</Section>
-			{:else if optionTabSelected === 'retries'}
-				{@const disabled = !can_write || emptyString($enterpriseLicense)}
-				<Section label="Retries">
-					{#snippet header()}
-						<div class="flex flex-row gap-2">
-							{#if !$enterpriseLicense}<span class="text-xs text-secondary">(ee only)</span>{/if}
-						</div>
-						<Tooltip>
-							If defined, upon error this schedule will be retried with a delay and a maximum number
-							of attempts as defined below.
-							<br />
-							This is only available for individual script. For flows, retries can be set on each flow
-							step in the flow editor.
-						</Tooltip>
-					{/snippet}
-					{#if itemKind !== 'script'}
-						<Alert type="info" title="Only available for scripts" class="mb-2">
-							Error Handler and Retries are only available for scripts. For flows, use the built-in <a
-								href="https://www.windmill.dev/docs/flows/flow_error_handler"
-								target="_blank">error handler</a
-							>
-							and <a href="https://www.windmill.dev/docs/flows/retries" target="_blank">retries</a>.
-						</Alert>
-					{:else}
-						<FlowRetries
-							bind:flowModuleRetry={retry}
-							disabled={itemKind !== 'script' || disabled}
-						/>
-					{/if}
-				</Section>
-			{:else if optionTabSelected === 'dynamic_skip'}
-				<Section label="Dynamic skip">
-					{#snippet header()}
-						<Tooltip>
-							Optional script to filter scheduled dates. Receives the proposed datetime and returns
-							boolean. True = run on this date, False = skip to next occurrence.
-						</Tooltip>
-					{/snippet}
-					<div class="flex flex-col gap-6">
-						<Label label="Dynamic skip script">
-							<div class="flex flex-row">
-								<ScriptPicker
-									workspace={wsId}
-									disabled={!can_write}
-									bind:scriptPath={dynamicSkipPath}
-									kinds={['script']}
-									allowRefresh={can_write}
-									clearable
-								/>
-								{#if !dynamicSkipPath}
-									<Button
-										btnClasses="ml-4 whitespace-nowrap"
-										variant="default"
-										size="xs"
-										href="/scripts/add?hub=hub%2F19822%2Fwindmill%2Fdynamic_skip_template{wsParam}"
-										disabled={!can_write}
-										target="_blank"
-									>
-										Create from template
-									</Button>
-								{/if}
-							</div>
-						</Label>
-						<Alert type="info" size="xs" title="Handler requirements">
-							Handler must return a boolean value. Return true to execute the scheduled job, false
-							to skip.
-						</Alert>
-					</div>
-				</Section>
-			{:else if optionTabSelected === 'tag'}
-				<Section
-					label="Custom script tag"
-					tooltip="When set, the script tag will be overridden by this tag"
-				>
-					<WorkerTagPicker
-						bind:tag
-						workspaceId={wsId}
-						popupPlacement="top-end"
-						disabled={!can_write}
-					/>
-				</Section>
-			{/if}
-		{:else}
-			<Loader2 class="animate-spin" />
-		{/if}
-	</div>
-{/snippet}
-
 {#snippet drawerBody()}
 	<DrawerContent
 		hideClose={inline && !onClose}
@@ -1463,7 +981,9 @@
 			? can_write
 				? `Edit schedule ${initialPath}`
 				: `View schedule ${initialPath}`
-			: 'New schedule'}
+			: saveDraftHandler
+				? 'Draft schedule'
+				: 'New schedule'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte
index 4d593f2e92..f2a6a2b630 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditor.svelte
@@ -21,6 +21,21 @@
 		drawer?.openNew(is_flow, initial_script_path, defaultValues)
 	}
 
+	/** Edit a trigger that exists only as the caller's draft; Save hands the config back. */
+	export async function openDraft(
+		scriptPath: string,
+		defaults: Record<string, any>,
+		saved: Record<string, any> | undefined,
+		onSaveDraft: (cfg: Record<string, any>) => boolean
+	) {
+		open = true
+		await tickPainted()
+		drawer?.openNew(false, scriptPath, defaults as any, {
+			onSaveDraft,
+			draftConfig: saved
+		})
+	}
+
 	let drawer: SqsTriggerEditorInner | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
index 7a648ab63b..f3daec431d 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
@@ -73,23 +73,30 @@
 
 						<ToggleButtonGroup
 							bind:selected={aws_auth_resource_type}
+							disabled={!can_write}
 							on:selected={() => {
 								aws_resource_path = ''
 							}}
 						>
-							{#snippet children({ item })}
-								<ToggleButton label="Credentials" value="credentials" {item} />
-								<ToggleButton label="Oidc" value="oidc" {item} />
+							{#snippet children({ item, disabled })}
+								<ToggleButton label="Credentials" value="credentials" {item} {disabled} />
+								<ToggleButton label="Oidc" value="oidc" {item} {disabled} />
 							{/snippet}
 						</ToggleButtonGroup>
 
 						{#if aws_auth_resource_type === 'credentials'}
-							<ResourcePicker workspace={wsId} resourceType="aws" bind:value={aws_resource_path} />
+							<ResourcePicker
+								workspace={wsId}
+								resourceType="aws"
+								bind:value={aws_resource_path}
+								disabled={!can_write}
+							/>
 						{:else if aws_auth_resource_type === 'oidc'}
 							<ResourcePicker
 								workspace={wsId}
 								resourceType="aws_oidc"
 								bind:value={aws_resource_path}
+								disabled={!can_write}
 							/>
 						{/if}
 						{#if isValid}
@@ -130,6 +137,7 @@
 				<div class="mt-2">
 					<ToggleButtonGroup
 						selected={tab}
+						disabled={!can_write}
 						on:selected={({ detail }) => {
 							if (detail === 'all') {
 								cached = message_attributes
@@ -140,9 +148,9 @@
 							tab = detail
 						}}
 					>
-						{#snippet children({ item })}
-							<ToggleButton value="all" label="All attributes" {item} />
-							<ToggleButton value="specific" label="Specific attributes" {item} />
+						{#snippet children({ item, disabled })}
+							<ToggleButton value="all" label="All attributes" {item} {disabled} />
+							<ToggleButton value="specific" label="Specific attributes" {item} {disabled} />
 						{/snippet}
 					</ToggleButtonGroup>
 				</div>
@@ -153,7 +161,7 @@
 						onCreateItem={(x) => message_attributes.push(x)}
 						placeholder="Set message attributes"
 						noItemsMsg="Add message attributes to filter on"
-						disabled={tab === 'all'}
+						disabled={tab === 'all' || !can_write}
 					/>
 				</div>
 			</Subsection>
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
index 0995a2e1b6..1ce283392f 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
@@ -9,8 +9,8 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
 	import Label from '$lib/components/Label.svelte'
@@ -43,7 +43,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -109,8 +109,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
@@ -152,14 +153,20 @@
 		is_flow = itemKind === 'flow'
 	})
 
+	// Set by `openNew(…, { onSaveDraft })`: the caller keeps the trigger as its own
+	// draft, so Save hands it the config instead of writing it.
+	let saveDraftHandler: ((cfg: Record<string, any>) => boolean) | undefined = $state(undefined)
+
 	export async function openEdit(
 		ePath: string,
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		saveDraftHandler = undefined
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -199,8 +206,14 @@
 	export async function openNew(
 		nis_flow: boolean,
 		fixedScriptPath_?: string,
-		defaultValues?: Record<string, any>
+		defaultValues?: Record<string, any>,
+		opts: {
+			onSaveDraft?: (cfg: Record<string, any>) => boolean
+			/** A config this editor saved before, re-applied over the defaults. */
+			draftConfig?: Record<string, any>
+		} = {}
 	) {
+		saveDraftHandler = opts.onSaveDraft
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100)
@@ -229,6 +242,7 @@
 			selectedPermissionedAs = undefined
 			preservePermissionedAs = false
 			originalConfig = undefined
+			if (opts.draftConfig) await loadTriggerConfig(opts.draftConfig)
 		} finally {
 			initialConfig = structuredClone($state.snapshot(getSaveCfg()))
 			clearTimeout(loadingTimeout)
@@ -336,6 +350,11 @@
 	}
 
 	async function updateTrigger(): Promise<void> {
+		if (saveDraftHandler) {
+			if (!saveDraftHandler($state.snapshot(getSaveCfg()))) return
+			drawer?.closeDrawer()
+			return
+		}
 		deploymentLoading = true
 		const previousPath = initialPath
 		const cfg = getSaveCfg()
@@ -406,7 +425,9 @@
 			? can_write
 				? `Edit SQS trigger ${initialPath}`
 				: `SQS trigger ${initialPath}`
-			: 'New SQS trigger'}
+			: saveDraftHandler
+				? 'Draft SQS trigger'
+				: 'New SQS trigger'}
 		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet actions()}
@@ -463,6 +484,7 @@
 			isLoading={deploymentLoading}
 			{isDeployed}
 			onUpdate={updateTrigger}
+			saveLabel={saveDraftHandler ? 'Save draft' : undefined}
 			{onReset}
 			{onDelete}
 			{mode}
@@ -481,6 +503,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/triggers/triggers.svelte.ts b/frontend/src/lib/components/triggers/triggers.svelte.ts
index cd25328ff6..7fe40d111d 100644
--- a/frontend/src/lib/components/triggers/triggers.svelte.ts
+++ b/frontend/src/lib/components/triggers/triggers.svelte.ts
@@ -23,14 +23,15 @@ import {
 	type NativeTrigger,
 	type NativeServiceName
 } from '$lib/gen'
-import { enterpriseLicense } from '$lib/stores'
+import { enterpriseLicense, userWorkspaces } from '$lib/stores'
 
 import { getLightConfig, sortTriggers, updateTriggersCount, type Trigger } from './utils'
 import { get, type Writable } from 'svelte/store'
 import type { TriggerType } from './utils'
 import type { UserExt } from '$lib/stores'
 import type { ScheduleTrigger } from '../triggers'
-import { canWrite, formatCron, generateRandomString } from '$lib/utils'
+import { formatCron, generateRandomString } from '$lib/utils'
+import { canEditItem } from '$lib/editRights'
 
 export class Triggers {
 	#triggers = $state<Trigger[]>([])
@@ -130,9 +131,14 @@ export class Triggers {
 	updateTriggers(
 		remoteTriggers: any[],
 		type: TriggerType,
+		workspaceId: string,
 		user: UserExt | undefined = undefined
 	): number {
 		const currentTriggers = this.#triggers
+		const operatorSettings = get(userWorkspaces).find(
+			(w) => w.id === workspaceId
+		)?.operator_settings
+		const kind = type === 'schedule' ? 'schedule' : 'trigger'
 		// Identify triggers with draftConfig to preserve
 		const configuredTriggers = currentTriggers.filter(
 			(t) => t.type === type && !t.isDraft && t.draftConfig
@@ -151,7 +157,7 @@ export class Triggers {
 				path: trigger.path,
 				isPrimary: type === 'schedule' && trigger.path === trigger.script_path,
 				isDraft: false,
-				canWrite: canWrite(trigger.path, trigger.extra_perms, user),
+				canWrite: canEditItem(kind, trigger.path, trigger.extra_perms, user, operatorSettings),
 				draftConfig: draftConfig,
 				lightConfig: getLightConfig(type, trigger)
 			}
@@ -199,7 +205,7 @@ export class Triggers {
 				isFlow
 			})
 
-			const scheduleCount = this.updateTriggers(allDeployedSchedules, 'schedule', user)
+			const scheduleCount = this.updateTriggers(allDeployedSchedules, 'schedule', workspaceId, user)
 			const updatedPrimarySchedule = this.#triggers.find((s) => s.isPrimary)
 			triggersCountStore.update((triggersCount) => {
 				return {
@@ -234,7 +240,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const wsCount = this.updateTriggers(wsTriggers, 'websocket', user)
+			const wsCount = this.updateTriggers(wsTriggers, 'websocket', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -260,7 +266,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const pgCount = this.updateTriggers(pgTriggers, 'postgres', user)
+			const pgCount = this.updateTriggers(pgTriggers, 'postgres', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -286,7 +292,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const kafkaCount = this.updateTriggers(kafkaTriggers, 'kafka', user)
+			const kafkaCount = this.updateTriggers(kafkaTriggers, 'kafka', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -312,7 +318,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const natsCount = this.updateTriggers(natsTriggers, 'nats', user)
+			const natsCount = this.updateTriggers(natsTriggers, 'nats', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -338,7 +344,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const mqttCount = this.updateTriggers(mqttTriggers, 'mqtt', user)
+			const mqttCount = this.updateTriggers(mqttTriggers, 'mqtt', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -364,7 +370,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const amqpCount = this.updateTriggers(amqpTriggers, 'amqp', user)
+			const amqpCount = this.updateTriggers(amqpTriggers, 'amqp', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -390,7 +396,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const sqsCount = this.updateTriggers(sqsTriggers, 'sqs', user)
+			const sqsCount = this.updateTriggers(sqsTriggers, 'sqs', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -416,7 +422,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const gcpCount = this.updateTriggers(gcpTriggers, 'gcp', user)
+			const gcpCount = this.updateTriggers(gcpTriggers, 'gcp', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -442,7 +448,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const azureCount = this.updateTriggers(azureTriggers, 'azure', user)
+			const azureCount = this.updateTriggers(azureTriggers, 'azure', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -468,7 +474,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const httpCount = this.updateTriggers(httpTriggers, 'http', user)
+			const httpCount = this.updateTriggers(httpTriggers, 'http', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -494,7 +500,7 @@ export class Triggers {
 				path,
 				isFlow
 			})
-			const emailCount = this.updateTriggers(emailTriggers, 'email', user)
+			const emailCount = this.updateTriggers(emailTriggers, 'email', workspaceId, user)
 			triggersCountStore.update((triggersCount) => {
 				return {
 					...(triggersCount ?? {}),
@@ -530,7 +536,7 @@ export class Triggers {
 				extra_perms: {},
 				service_config: t.service_config
 			}))
-			const count = this.updateTriggers(triggerData, serviceName, user)
+			const count = this.updateTriggers(triggerData, serviceName, workspaceId, user)
 			const countProperty = `${serviceName}_count`
 			triggersCountStore.update((triggersCount) => {
 				return {
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
index 9033aab3cf..218430316a 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
@@ -16,7 +16,7 @@
 	import ClipboardPanel from '../../details/ClipboardPanel.svelte'
 	import { copyToClipboard, isObject, readFieldsRecursively } from '$lib/utils'
 	// import { page } from '$app/state'
-	import { base } from '$lib/base'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
 	import TriggerTokens from '../TriggerTokens.svelte'
 	import { userStore } from '$lib/stores'
 	import UserSettings from '../../UserSettings.svelte'
@@ -46,7 +46,7 @@
 	const operatingWorkspace = useOperatingWorkspace()
 	const wsId = $derived($operatingWorkspace)
 
-	const WEBHOOK_BASE_URL = $derived(`${location.origin}${base}/api/w/${wsId}/jobs`)
+	const WEBHOOK_BASE_URL = $derived(`${apiBaseUrl()}/api/w/${wsId}/jobs`)
 
 	let baseWebhookUrl = $derived.by(() => {
 		let webhookUrlPath: string
@@ -223,9 +223,7 @@ async function triggerJob() {
 function waitForJobCompletion(UUID) {
   return new Promise(async (resolve, reject) => {
     try {
-      const endpoint = \`${
-				location.origin
-			}/api/w/${wsId}/jobs_u/completed/get_result_maybe/\${UUID}\`;
+      const endpoint = \`${apiBaseUrl()}/api/w/${wsId}/jobs_u/completed/get_result_maybe/\${UUID}\`;
       const checkResponse = await fetch(endpoint, {
         method: 'GET',
         headers: ${JSON.stringify(headers(), null, 2).replaceAll('\n', '\n\t\t\t\t')}
@@ -268,7 +266,7 @@ ${
 		? 'echo -E $RESULT | jq'
 		: requestType === 'async'
 			? `
-URL="${location.origin}/api/w/${wsId}/jobs_u/completed/get_result_maybe/$UUID"
+URL="${apiBaseUrl()}/api/w/${wsId}/jobs_u/completed/get_result_maybe/$UUID"
 while true; do
   curl -s -H "Authorization: Bearer $TOKEN" $URL -o res.json
   COMPLETED=$(cat res.json | jq .completed)
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
index c626f678ef..8cfe3480fe 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
@@ -25,8 +25,8 @@
 		type TriggerMode
 	} from '$lib/gen'
 	import { usedTriggerKinds } from '$lib/stores'
-	import { canWrite, emptySchema, emptyString, sendUserToast } from '$lib/utils'
-	import { useTriggerLock } from '$lib/operatorWriteRights'
+	import { emptySchema, emptyString, sendUserToast } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2, X, Plus } from 'lucide-svelte'
@@ -59,7 +59,7 @@
 		useOperatingWorkspace,
 		useOperatingWorkspaceHref
 	} from '$lib/components/operatingWorkspace.svelte'
-	const triggerLock = useTriggerLock()
+	const editRights = useEditRights()
 
 	interface Props {
 		useDrawer?: boolean
@@ -137,8 +137,9 @@
 	// The acting user in the operating workspace arrives asynchronously, and an unknown user
 	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
 	const can_write = $derived(
-		(permsPath === undefined || canWrite(permsPath, permsForWrite ?? {}, actingUser)) &&
-			!$triggerLock
+		permsPath === undefined
+			? editRights.roleCanAuthor('trigger')
+			: editRights.canEditItem('trigger', permsPath, permsForWrite)
 	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
@@ -206,6 +207,7 @@
 	) {
 		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
 		operatingUser.forgetFailures()
+		editRights.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -572,6 +574,7 @@
 	{:else}
 		<PermissionedAsLine
 			{permissionedAs}
+			disabled={!can_write}
 			{path}
 			onPermissionedAsChange={(pa, preserve) => {
 				selectedPermissionedAs = pa
diff --git a/frontend/src/lib/components/tutorials/OperatorTour.svelte b/frontend/src/lib/components/tutorials/OperatorTour.svelte
index cc7f4ab4a5..8c414cac7a 100644
--- a/frontend/src/lib/components/tutorials/OperatorTour.svelte
+++ b/frontend/src/lib/components/tutorials/OperatorTour.svelte
@@ -1,8 +1,7 @@
 <script lang="ts">
 	import type { DriveStep } from 'driver.js'
-	import { wait } from '$lib/utils'
 	import Tutorial from './Tutorial.svelte'
-	import { markOperatorTourSeen, MENU_OPEN_DELAY_MS } from './operatorTour'
+	import { markOperatorTourSeen } from './operatorTour'
 
 	let tutorial: Tutorial | undefined = $state(undefined)
 	let running = false
@@ -25,7 +24,7 @@
 <Tutorial
 	bind:this={tutorial}
 	{onDestroyed}
-	getSteps={(driver) => {
+	getSteps={() => {
 		const steps: DriveStep[] = [
 			{
 				popover: {
@@ -60,19 +59,12 @@
 			},
 			{
 				popover: {
-					title: 'Finally, the Menu section',
+					title: 'Finally, the sidebar',
 					description:
-						'Explore available tabs where you can access your history of runs, your scheduled scripts, and your workspaces.<p style="margin-top: 12px; padding-top: 12px; border-top: 1px solid rgba(128,128,128,0.3); font-size: 0.9em; opacity: 0.9;"><strong>💡 Want to see this again?</strong> Pick <strong>Take the tour</strong> from that same menu.</p>',
-					onNextClick: async () => {
-						// The step points into the menu, so it has to be open before the popover
-						// lands on it — and open is also where the entry to re-run the tour is.
-						const menuButton = document.querySelector('[role="menuitem"]') as HTMLElement | null
-						menuButton?.click()
-						await wait(MENU_OPEN_DELAY_MS)
-						driver.destroy()
-					}
+						'Explore the pages you can open from here: your history of runs, your scheduled scripts and your workspaces.<p style="margin-top: 12px; padding-top: 12px; border-top: 1px solid rgba(128,128,128,0.3); font-size: 0.9em; opacity: 0.9;"><strong>💡 Want to see this again?</strong> Pick <strong>Take the tour</strong> from your account menu, under <strong>Settings</strong>.</p>'
 				},
-				element: '[role="menuitem"]'
+				// Whichever the sidebar currently is: the floating handle when detached, the rail when not.
+				element: '[data-nav-handle], #sidebar'
 			}
 		]
 
diff --git a/frontend/src/lib/components/tutorials/operatorTour.ts b/frontend/src/lib/components/tutorials/operatorTour.ts
index 5c4269e84d..4ece54b66e 100644
--- a/frontend/src/lib/components/tutorials/operatorTour.ts
+++ b/frontend/src/lib/components/tutorials/operatorTour.ts
@@ -13,8 +13,6 @@ export const TOUR_PARAM_VALUE = 'operator'
 
 /** Long enough for the home page's tabs to exist before the first step points at one. */
 export const TOUR_START_DELAY_MS = 500
-/** Time for the sidebar to open before the last step points into it. */
-export const MENU_OPEN_DELAY_MS = 300
 
 export async function hasSeenOperatorTour(): Promise<boolean> {
 	// A failure answers "seen": the tour interrupts the page, and interrupting someone who
diff --git a/frontend/src/lib/components/variables/VariablesList.svelte b/frontend/src/lib/components/variables/VariablesList.svelte
index 66f293a11d..3805b51bbb 100644
--- a/frontend/src/lib/components/variables/VariablesList.svelte
+++ b/frontend/src/lib/components/variables/VariablesList.svelte
@@ -38,7 +38,8 @@
 	import type { ContextualVariable, ListableVariable, WorkspaceDeployUISettings } from '$lib/gen'
 	import { enterpriseLicense, userWorkspaces } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
-	import { canWrite, isOwner, truncate } from '$lib/utils'
+	import { isOwner, truncate } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { isDeployable, ALL_DEPLOYABLE } from '$lib/utils_deployable'
 	import {
 		Plus,
@@ -64,6 +65,7 @@
 
 	const operatingWorkspace = useOperatingWorkspace()
 	const operatingUser = useOperatingUser()
+	const editRights = useEditRights()
 	const hosted = useHostedPage()
 
 	function editVariable(path: string) {
@@ -205,7 +207,7 @@
 		const result = (await VariableService.listVariable(apiParams)).map((x) => {
 			return {
 				canWrite:
-					canWrite(x.path, x.extra_perms!, operatingUser.current) &&
+					editRights.canEditItem('variable', x.path, x.extra_perms) &&
 					x.workspace_id == $operatingWorkspace,
 				...x
 			}
diff --git a/frontend/src/lib/components/wizards/AppPicker.svelte b/frontend/src/lib/components/wizards/AppPicker.svelte
index 17f384c71d..7e8a1e91a6 100644
--- a/frontend/src/lib/components/wizards/AppPicker.svelte
+++ b/frontend/src/lib/components/wizards/AppPicker.svelte
@@ -2,18 +2,14 @@
 	import { getContext, onMount } from 'svelte'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
 	import { AppService, type ListableApp } from '$lib/gen'
-	import { canWrite } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import type { AppViewerContext } from '../apps/types'
 	import Alert from '../common/alert/Alert.svelte'
 	import Select from '../select/Select.svelte'
-	import {
-		useOperatingUser,
-		useOperatingWorkspace
-	} from '$lib/components/operatingWorkspace.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	const operatingWorkspace = useOperatingWorkspace()
-	const operatingUser = useOperatingUser()
-	const actingUser = $derived(operatingUser.current)
+	const editRights = useEditRights()
 
 	interface Props {
 		value?: string
@@ -32,9 +28,8 @@
 		).map((app: ListableApp) => {
 			return {
 				canWrite:
-					canWrite(app.path!, app.extra_perms!, actingUser) &&
-					app.workspace_id == $operatingWorkspace &&
-					!actingUser?.operator,
+					editRights.canEditItem('app', app.path!, app.extra_perms) &&
+					app.workspace_id == $operatingWorkspace,
 				...app
 			}
 		})
diff --git a/frontend/src/lib/components/workspace/WorkspaceCard.svelte b/frontend/src/lib/components/workspace/WorkspaceCard.svelte
index 9da4979cd9..e82b4863c4 100644
--- a/frontend/src/lib/components/workspace/WorkspaceCard.svelte
+++ b/frontend/src/lib/components/workspace/WorkspaceCard.svelte
@@ -12,7 +12,8 @@
 	import WorkspaceIcon from './WorkspaceIcon.svelte'
 	import WorkspaceCard from './WorkspaceCard.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import { devBadgeText, devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import { devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceBadge from '$lib/components/DevWorkspaceBadge.svelte'
 
 	interface ExtendedWorkspace extends UserWorkspace {
 		_children?: ExtendedWorkspace[]
@@ -143,12 +144,12 @@
 							{/if}
 						</span>
 						{#if workspace.is_dev_workspace}
-							<Badge
-								color="dark-blue"
-								small
-								class="text-3xs px-1 py-0 dark:bg-surface-accent-primary text-white dark:text-white"
-								>{devBadgeText(workspace.dev_workspace_label)}</Badge
-							>
+							<DevWorkspaceBadge
+								label={workspace.dev_workspace_label}
+								color={workspace.color}
+								fallbackClass="dark:bg-surface-accent-primary text-white dark:text-white"
+								class="text-3xs px-1 py-0"
+							/>
 						{/if}
 						<span class="text-secondary text-xs">-</span>
 						{#if workspace.id === 'admins'}
diff --git a/frontend/src/lib/components/workspacePicker.ts b/frontend/src/lib/components/workspacePicker.ts
index 61b4d3239e..c33ad36843 100644
--- a/frontend/src/lib/components/workspacePicker.ts
+++ b/frontend/src/lib/components/workspacePicker.ts
@@ -19,6 +19,8 @@ export type WorkspaceItem = {
 	 * so read it with `draftOnly` to tell "nothing deployed" from "deployed, with
 	 * edits pending". */
 	hasDraft?: boolean
+	/** The item's own sharing, which `canEditItem` reads with the folder rules. */
+	extraPerms?: Record<string, boolean>
 }
 
 /** Path to display (and group by) in pickers: the friendly draft path when
@@ -140,7 +142,8 @@ export async function loadKind(
 				kind: 'flow' as const,
 				draftPath: f.draft_path,
 				draftOnly: f.draft_only ?? false,
-				hasDraft: f.is_draft ?? false
+				hasDraft: f.is_draft ?? false,
+				extraPerms: f.extra_perms
 			}))
 		} else if (kind === 'script') {
 			const scripts = await ScriptService.listScripts({
@@ -154,7 +157,8 @@ export async function loadKind(
 				kind: 'script' as const,
 				draftPath: s.draft_path,
 				draftOnly: s.draft_only ?? false,
-				hasDraft: s.is_draft ?? false
+				hasDraft: s.is_draft ?? false,
+				extraPerms: s.extra_perms
 			}))
 		} else {
 			const apps = await AppService.listApps({
@@ -168,7 +172,8 @@ export async function loadKind(
 				raw_app: a.raw_app ?? false,
 				draftPath: a.draft_path,
 				draftOnly: a.draft_only ?? false,
-				hasDraft: a.is_draft ?? false
+				hasDraft: a.is_draft ?? false,
+				extraPerms: a.extra_perms
 			}))
 		}
 		// Only commit if the cache version hasn't changed since we started —
diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
index e6a0dce4fd..959b666363 100644
--- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
@@ -28,6 +28,7 @@
 		devWorkspacesInChainAbove
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
+	import { isOperatorInWorkspace } from '$lib/components/sidebar/operatorRoutes'
 	import {
 		fetchProtectionRulesForWorkspace,
 		isRuleUnconditionallyActiveInRulesets
@@ -63,7 +64,6 @@
 	import TextInput from '../text_input/TextInput.svelte'
 	import { jobManager } from '$lib/services/JobManager'
 	import Alert from '../common/alert/Alert.svelte'
-	import { base } from '$lib/base'
 	import Label from '../Label.svelte'
 	import ForkDatatableSection from './ForkDatatableSection.svelte'
 	import Select from '../select/Select.svelte'
@@ -128,9 +128,14 @@
 	let forkableWorkspaces = $derived(forkable.current)
 
 	// Base candidates are the current workspace's family: its root first, then every fork/dev under it.
+	// Never one the user is an operator in: a fork does not carry the role, so forking such a base
+	// would hand them a full-rights copy of it.
 	let familyRoot = $derived(findWorkspaceRoot($workspaceStore, forkableWorkspaces))
 	let baseCandidates = $derived(
-		familyRoot ? [familyRoot, ...findWorkspaceDescendants(familyRoot.id, forkableWorkspaces)] : []
+		(familyRoot
+			? [familyRoot, ...findWorkspaceDescendants(familyRoot.id, forkableWorkspaces)]
+			: []
+		).filter((w) => !isOperatorInWorkspace(w))
 	)
 	let baseItems = $derived(
 		baseCandidates.map((w) => ({
@@ -1100,7 +1105,7 @@
 				disabled={forkCreationLoading}
 				variant="default"
 				size="sm"
-				href="{base}/user/workspaces">&leftarrow; Back to workspaces</Button
+				href="/user/workspaces">&leftarrow; Back to workspaces</Button
 			>
 		{/if}
 		{#if !forkCreationLoading}
diff --git a/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte b/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
index 828940fa4a..496c967d7f 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
@@ -10,7 +10,7 @@
 	import DataTable from '../table/DataTable.svelte'
 	import Head from '../table/Head.svelte'
 	import Row from '../table/Row.svelte'
-	import { KeyRound } from 'lucide-svelte'
+	import { CircleHelp, KeyRound } from 'lucide-svelte'
 	import {
 		FolderService,
 		GroupService,
@@ -23,9 +23,15 @@
 	import { superadmin } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { deepEqual } from 'fast-equals'
-	import { ADMIN_DATATABLE_ROLE, isDatatableRoleName } from '../dbTypes'
+	import { ADMIN_DATATABLE_ROLE, NO_DEFAULT_DATATABLE_ROLE, isDatatableRoleName } from '../dbTypes'
 	import PgAclEditor from '../datatableAcl/PgAclEditor.svelte'
-	import InstanceRolesButton from './InstanceRolesButton.svelte'
+	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
+	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
+	import {
+		pgInstanceName as pgInstanceNameOf,
+		handleRoleCreationError,
+		offerUnusedRoleDrop
+	} from './datatableRoleModals'
 
 	let {
 		workspace,
@@ -44,10 +50,8 @@
 	} = $props()
 
 	// `id` is the instance role's catalog id (or the reserved `admin`), which is what the tenant
-	// lists are keyed by — so renaming a role instance-side moves nothing here. A row without an id
-	// names a role the instance does not define yet: it cannot be saved until a superadmin creates
-	// it, and takes the new role's id once they have.
-	type EditedRole = { id: string | undefined; name: string | undefined; tenants: string[] }
+	// lists are keyed by — so renaming a role instance-side moves nothing here.
+	type EditedRole = { id: string; name: string | undefined; tenants: string[] }
 	type Edited = { permissioned: boolean; roles: EditedRole[]; defaultRoleId: string }
 
 	let drawerOpen = $state(false)
@@ -72,7 +76,7 @@
 
 	const editable = $derived(!!info?.editable)
 	const governing = $derived(info?.governing_workspace_id)
-	// The instance catalog, read again after the instance roles drawer changes it.
+	// The instance catalog, with the roles created from this drawer since it was loaded.
 	let catalog = $state<InstanceDatatableRole[] | undefined>(undefined)
 	const availableRoles: InstanceDatatableRole[] = $derived(catalog ?? info?.available_roles ?? [])
 	// A role is a login on one cluster, and this drawer's is the data table's: name it, or the
@@ -80,11 +84,12 @@
 	const clusterName = $derived(
 		info?.cluster === 'external_instance' ? 'the external cluster' : "Windmill's database"
 	)
+	const pgInstanceName = $derived(pgInstanceNameOf(info?.cluster))
 	const unusedRoles = $derived(availableRoles.filter((r) => !roles.some((row) => row.id === r.id)))
-	const pendingRoles = $derived(roles.filter((r) => r.id === undefined))
-	let instanceRoles: InstanceRolesButton | undefined = $state(undefined)
-
-	const roleKey = (role: EditedRole) => role.id ?? `pending:${role.name}`
+	const confirmationModal = createAsyncConfirmationModal()
+	// Every member of the governing workspace, as the tenant lists spell it.
+	const EVERYONE_TENANT = '*'
+	let aclEditor = $state<PgAclEditor | undefined>(undefined)
 
 	const hasUnsavedChanges = $derived(
 		!deepEqual($state.snapshot(saved), {
@@ -108,9 +113,13 @@
 					(a, b) => Number(b.id === ADMIN_DATATABLE_ROLE) - Number(a.id === ADMIN_DATATABLE_ROLE)
 				)
 			// A data table never put under roles comes back with none; admin is what turning the toggle
-			// on starts from.
+			// on starts from, open to everyone so that turning it on changes nothing by itself.
 			if (!loaded.some((r) => r.id === ADMIN_DATATABLE_ROLE)) {
-				loaded.unshift({ id: ADMIN_DATATABLE_ROLE, name: ADMIN_DATATABLE_ROLE, tenants: [] })
+				loaded.unshift({
+					id: ADMIN_DATATABLE_ROLE,
+					name: ADMIN_DATATABLE_ROLE,
+					tenants: [EVERYONE_TENANT]
+				})
 			}
 			info = res
 			catalog = undefined
@@ -134,7 +143,7 @@
 				FolderService.listFolderNames({ workspace: ws })
 			])
 			tenantItems = [
-				{ value: '*', label: 'Everyone', group: 'Anyone in the workspace' },
+				{ value: EVERYONE_TENANT, label: 'Everyone', group: 'Anyone in the workspace' },
 				...users.map((u) => ({ value: `u/${u}`, label: u, group: 'Users' })),
 				...groups.map((g) => ({ value: `g/${g}`, label: g, group: 'Groups' })),
 				...folders.map((f) => ({ value: `f/${f}`, label: f, group: 'Folders' }))
@@ -152,9 +161,9 @@
 		roles.push({ id: role.id, name: role.name, tenants: [] })
 	}
 
-	/** Adds a role by name: the instance's role of that name, or a pending row for one it does not
-	 * define yet. */
-	function addRoleByName(typed: string) {
+	/** Adds the instance's role of that name. One the instance does not define is created first,
+	 * which only a superadmin may do. */
+	async function addRoleByName(typed: string) {
 		const name = typed.trim()
 		if (!isDatatableRoleName(name) || name.toLowerCase() === ADMIN_DATATABLE_ROLE) {
 			sendUserToast(
@@ -165,35 +174,87 @@
 		}
 		if (roles.some((r) => r.name === name)) return
 		const existing = availableRoles.find((r) => r.name === name)
-		roles.push({ id: existing?.id, name, tenants: [] })
-	}
-
-	function removeRole(role: EditedRole) {
-		const key = roleKey(role)
-		roles = roles.filter((r) => roleKey(r) !== key)
-		if (role.id !== undefined && defaultRoleId === role.id) defaultRoleId = ADMIN_DATATABLE_ROLE
-	}
-
-	/** Reads the instance catalog again and gives each pending row the id of the role now defined
-	 * under its name. */
-	async function refreshCatalog() {
-		let fresh: InstanceDatatableRole[]
-		try {
-			fresh = await SettingService.listInstanceDatatableRoles({ cluster: info?.cluster })
-		} catch (e) {
-			sendUserToast(e?.body ?? e?.message ?? String(e), true)
+		if (existing) {
+			roles.push({ id: existing.id, name, tenants: [] })
 			return
 		}
-		catalog = fresh
-		for (const row of roles) {
-			if (row.id !== undefined) continue
-			const created = fresh.find((r) => r.name === row.name)
-			if (created) row.id = created.id
+		if (!$superadmin) {
+			await confirmationModal.ask({
+				title: `Role ${name} does not exist`,
+				children: `This role doesn't exist in ${pgInstanceName}. Ask a superadmin to create it.`,
+				confirmationText: 'OK',
+				type: 'info',
+				hideCancel: true
+			})
+			return
+		}
+		let created: InstanceDatatableRole | undefined
+		let failure: unknown
+		await confirmationModal.ask({
+			title: `Role ${name} does not exist`,
+			children: `(Superadmin) Create this role in ${pgInstanceName}?`,
+			confirmationText: 'Create role',
+			type: 'info',
+			onConfirmed: async () => {
+				try {
+					created = await SettingService.createInstanceDatatableRole({
+						requestBody: { name, cluster: info?.cluster }
+					})
+				} catch (e) {
+					failure = e
+				}
+			}
+		})
+		if (created) addCreatedRole(created)
+		// Handled once this modal has closed: the take-over offer opens in the same one.
+		if (failure) {
+			await handleRoleCreationError(failure, {
+				name,
+				cluster: info?.cluster,
+				confirmationModal,
+				onTakenOver: addCreatedRole
+			})
 		}
 	}
 
+	function addCreatedRole(created: InstanceDatatableRole) {
+		catalog = [...availableRoles, created]
+		if (!roles.some((r) => r.id === created.id)) {
+			roles.push({ id: created.id, name: created.name, tenants: [] })
+		}
+	}
+
+	async function removeRole(role: EditedRole) {
+		if (defaultRoleId === role.id) {
+			const confirmed = await confirmationModal.ask({
+				title: 'Remove the default role?',
+				children: `Jobs that name no role connect as ${role.name ?? role.id}. Without it the data table has no default role: they connect with the roles of the person running them, and are refused when that person has none.`,
+				confirmationText: 'Remove',
+				type: 'danger'
+			})
+			if (!confirmed) return
+			defaultRoleId = NO_DEFAULT_DATATABLE_ROLE
+		}
+		roles = roles.filter((r) => r.id !== role.id)
+	}
+
+	const defaultRoleName = $derived(roles.find((r) => r.id === defaultRoleId)?.name ?? defaultRoleId)
+	const defaultsToAdmin = $derived(defaultRoleId === ADMIN_DATATABLE_ROLE)
+	const hasNoDefault = $derived(defaultRoleId === NO_DEFAULT_DATATABLE_ROLE)
+	const hasOtherRoles = $derived(roles.some((r) => r.id !== ADMIN_DATATABLE_ROLE))
+	const adminOpenToEveryone = $derived(
+		!!roles.find((r) => r.id === ADMIN_DATATABLE_ROLE)?.tenants.includes(EVERYONE_TENANT)
+	)
+
 	async function save() {
 		saving = true
+		// Turning roles off clears the whole block, so every role it named is removed.
+		const kept = permissioned ? roles.map((r) => r.id) : []
+		const removedIds = saved.permissioned
+			? saved.roles
+					.map((r) => r.id)
+					.filter((id) => id !== ADMIN_DATATABLE_ROLE && !kept.includes(id))
+			: []
 		try {
 			const msg = await WorkspaceService.setDatatablePermissions({
 				workspace,
@@ -201,11 +262,27 @@
 				requestBody: {
 					permissioned,
 					default_role: defaultRoleId,
-					roles: roles.map((r) => ({ id: r.id!, tenants: $state.snapshot(r.tenants) }))
+					roles: roles.map((r) => ({ id: r.id, tenants: $state.snapshot(r.tenants) }))
 				}
 			})
 			sendUserToast(msg)
 			await load()
+			// A role is a login of the whole Postgres instance: whether this was the last data table
+			// naming it is only known once the save has landed.
+			const unused = availableRoles.filter((r) => removedIds.includes(r.id) && r.in_use === false)
+			let dropped = false
+			for (const role of unused) {
+				dropped =
+					(await offerUnusedRoleDrop({
+						role,
+						cluster: info?.cluster,
+						superadmin: !!$superadmin,
+						confirmationModal
+					})) || dropped
+			}
+			if (dropped) await load()
+			// The grants list the roles they can name, which the save just changed.
+			aclEditor?.refresh()
 			onSaved?.()
 		} catch (e) {
 			sendUserToast(e?.body ?? e?.message ?? String(e), true)
@@ -214,6 +291,17 @@
 		}
 	}
 
+	/** Whether the drawer may close: unsaved roles are only lost once the user says so. */
+	async function confirmDiscard(): Promise<boolean> {
+		if (!hasUnsavedChanges || !drawerOpen) return true
+		return await confirmationModal.ask({
+			title: 'Discard unsaved changes?',
+			children: `The roles of ${datatable} have changes that are not saved. Closing the drawer discards them.`,
+			confirmationText: 'Discard changes',
+			type: 'danger'
+		})
+	}
+
 	export function open() {
 		drawerOpen = true
 		load()
@@ -232,10 +320,12 @@
 	/>
 {/if}
 
-<Drawer bind:open={drawerOpen} size="900px">
+<Drawer bind:open={drawerOpen} size="900px" confirmClose={confirmDiscard}>
 	<DrawerContent
-		title="Roles — {datatable}"
-		on:close={() => (drawerOpen = false)}
+		title="Roles: {datatable}"
+		on:close={async () => {
+			if (await confirmDiscard()) drawerOpen = false
+		}}
 		tooltip="A data table role is a Postgres login. A job that names one connects as it, and Postgres decides what it may touch — grant it privileges under Access. Roles are defined for the whole instance; here you say who may use each one on this data table."
 	>
 		{#snippet titleExtra()}
@@ -253,7 +343,7 @@
 					options={{
 						right: 'Put this data table under roles',
 						rightTooltip:
-							'Off, every job connects as admin — the connection that owns every table. On, every job resolves to a role, and a caller no tenant covers is refused.'
+							'Off, every job connects as admin — the connection that owns every table. On, every job resolves to a role, and a caller no tenant covers is refused. It starts with admin open to everyone, so turning it on changes nothing until the roles are edited.'
 					}}
 				/>
 
@@ -293,10 +383,13 @@
 				{/if}
 
 				{#if permissioned}
-					{#if editable && availableRoles.length === 0}
-						<Alert type="warning" title="No role defined on this instance" size="xs">
-							Only <span class="font-mono">admin</span> can be used until a superadmin creates a data
-							table role. Type a name below to add one.
+					{#if editable && !$superadmin}
+						<Alert type="info" title="Only superadmins can create roles" size="xs">
+							A data table role is a Postgres login on {pgInstanceName}, so only a superadmin can
+							create one. Ask a superadmin for any role you need that is not listed.
+							{#if availableRoles.length === 0}
+								Until then, only <span class="font-mono">admin</span> can be used.
+							{/if}
 						</Alert>
 					{/if}
 
@@ -321,15 +414,17 @@
 								<Cell head>
 									Default
 									<Tooltip>
-										The role a job gets when it names none — no `-- role` annotation, no `?role=` in
-										the reference. Callers still have to be one of its tenants.
+										The role a job gets when it names none: no `-- role` annotation, no `?role=` in
+										the reference. There is always one choice: admin until changed, another role, or
+										none. Unless it is admin, the roles the person running the job is a tenant of
+										are added to it.
 									</Tooltip>
 								</Cell>
 								<Cell head last />
 							</tr>
 						</Head>
 						<tbody class="divide-y bg-surface-tertiary">
-							{#each roles as role (roleKey(role))}
+							{#each roles as role (role.id)}
 								{@const isAdmin = role.id === ADMIN_DATATABLE_ROLE}
 								<Row>
 									<Cell first class="w-56 align-top">
@@ -339,23 +434,6 @@
 												<span class="text-2xs text-secondary italic">
 													no longer defined on {clusterName}
 												</span>
-											{:else if role.id === undefined}
-												<Alert type="warning" title="This role does not exist yet" size="xs">
-													{#if $superadmin}
-														<div class="flex flex-col items-start gap-1">
-															<span>Create it on {clusterName} to use it here.</span>
-															<Button
-																unifiedSize="xs"
-																variant="default"
-																on:click={() => instanceRoles?.open(role.name)}
-															>
-																Create it
-															</Button>
-														</div>
-													{:else}
-														Only a superadmin can create it on {clusterName}.
-													{/if}
-												</Alert>
 											{/if}
 										</div>
 									</Cell>
@@ -371,11 +449,11 @@
 									<Cell class="w-20 align-top">
 										<div class="flex justify-center pt-2">
 											<Checkbox
-												checked={role.id !== undefined && defaultRoleId === role.id}
-												disabled={!editable || role.id === undefined}
+												checked={defaultRoleId === role.id}
+												disabled={!editable}
 												title="Use this role when a job names none"
 												onChange={() => {
-													if (role.id !== undefined) defaultRoleId = role.id
+													defaultRoleId = role.id
 												}}
 											/>
 										</div>
@@ -387,8 +465,31 @@
 									</Cell>
 								</Row>
 							{/each}
+							<Row>
+								<Cell first class="w-56 align-top">
+									<span class="text-xs text-secondary italic">No default role</span>
+								</Cell>
+								<Cell class="align-top">
+									<span class="text-xs text-secondary">
+										Jobs that name no role get only the roles of the person running them.
+									</span>
+								</Cell>
+								<Cell class="w-20 align-top">
+									<div class="flex justify-center">
+										<Checkbox
+											checked={hasNoDefault}
+											disabled={!editable}
+											title="Use no role when a job names none"
+											onChange={() => {
+												defaultRoleId = NO_DEFAULT_DATATABLE_ROLE
+											}}
+										/>
+									</div>
+								</Cell>
+								<Cell last class="w-10 align-top" />
+							</Row>
 							{#if editable}
-								<Row class="!border-0">
+								<Row>
 									<Cell colspan={4} class="pt-2 pb-2">
 										<div class="flex justify-center">
 											<Select
@@ -413,14 +514,78 @@
 							{/if}
 						</tbody>
 					</DataTable>
+
+					{#if adminOpenToEveryone}
+						<Alert type="warning" title="Everyone can connect as admin" size="xs">
+							Every member of the workspace may use admin{defaultsToAdmin
+								? ', and a job that names no role connects as it, exactly as with roles off'
+								: ' by naming it'}. admin owns every table: it reads every row and ignores grants
+							and row-level security. Once the other roles are set up, remove Everyone from admin's
+							tenants{defaultsToAdmin ? ' and choose another default, or none' : ''}.
+						</Alert>
+					{/if}
+					{#if defaultsToAdmin && hasOtherRoles && !adminOpenToEveryone}
+						<Alert type="warning" title="The default role is admin" size="xs">
+							A job that names no role connects as admin when it runs as a workspace admin or as one
+							of admin's tenants, which covers every viewer of an app an admin published. admin owns
+							every table: it reads every row and ignores grants and row-level security. Everyone
+							else's jobs that name no role are refused. Choose another default, or none, to have
+							the roles above apply to them.
+						</Alert>
+					{:else if !defaultsToAdmin}
+						<div class="flex flex-col gap-1 text-xs text-secondary">
+							{#if hasNoDefault}
+								<span>
+									A job that names no role connects with the roles here that the person running it
+									is a tenant of. It is refused when they have none, and so is a job with nobody
+									behind it: a schedule, a trigger, an anonymous app viewer.
+								</span>
+							{:else}
+								<span>
+									A job that names no role connects as
+									<span class="font-mono">{defaultRoleName}</span> when it may use it, plus every other
+									role here that the person running it is a tenant of. With neither, it is refused.
+								</span>
+							{/if}
+							<span>A job that names a role connects as that role alone.</span>
+							<span>
+								A table created over a connection that holds several roles belongs to that
+								combination of roles alone. Run <span class="font-mono">SET ROLE</span> to one role before
+								creating it, or name a role.
+							</span>
+						</div>
+					{/if}
 				{/if}
 			</div>
 
 			<!-- Grants only matter to a data table under roles: without them every job connects as the
 			default login, whatever is granted here. -->
-			{#if info?.supported && permissioned && !hasUnsavedChanges}
+			{#if info?.supported && permissioned}
 				<div class="mt-6 pt-6 border-t">
-					<PgAclEditor {workspace} {datatable} target={{ kind: 'database' }} />
+					<PgAclEditor
+						bind:this={aclEditor}
+						{workspace}
+						{datatable}
+						target={{ kind: 'database' }}
+						disabledReason={hasUnsavedChanges ? 'Save the new roles to continue' : undefined}
+					/>
+					<div class="mt-3">
+						<Button
+							unifiedSize="xs"
+							variant="subtle"
+							startIcon={{ icon: CircleHelp }}
+							on:click={() =>
+								confirmationModal.ask({
+									title: 'Permissions on schemas and tables',
+									children: `<p>In the database manager, click the <b>⋮</b> menu of a schema or a table, then <b>Access</b>, to add grants on it or change its owner.</p>`,
+									confirmationText: 'OK',
+									type: 'info',
+									hideCancel: true
+								})}
+						>
+							How to use permissions on schemas and tables?
+						</Button>
+					</div>
 				</div>
 			{/if}
 		{/if}
@@ -430,10 +595,7 @@
 				<Button
 					variant="accent"
 					unifiedSize="md"
-					disabled={!hasUnsavedChanges || loading || !!loadError || pendingRoles.length > 0}
-					title={pendingRoles.length > 0
-						? 'Create the roles that do not exist yet, or remove them'
-						: undefined}
+					disabled={!hasUnsavedChanges || loading || !!loadError}
 					loading={saving}
 					on:click={save}
 				>
@@ -444,11 +606,4 @@
 	</DrawerContent>
 </Drawer>
 
-{#if $superadmin}
-	<InstanceRolesButton
-		bind:this={instanceRoles}
-		hideTrigger
-		cluster={info?.cluster}
-		onChanged={refreshCatalog}
-	/>
-{/if}
+<ConfirmationModal {...confirmationModal.props} />
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte b/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
index 4997bafac7..2bb0567bf3 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
@@ -15,6 +15,7 @@
 	import { SettingService, type DatatableRoleCluster, type InstanceDatatableRole } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
+	import { handleRoleCreationError } from './datatableRoleModals'
 
 	let {
 		initialName = '',
@@ -134,14 +135,28 @@
 	async function create() {
 		const name = newName.trim()
 		if (!name) return
-		await run(
-			() =>
-				SettingService.createInstanceDatatableRole({
-					requestBody: { name, cluster }
-				}),
-			`Created the data table role ${name}`
-		)
-		newName = ''
+		busy = true
+		try {
+			await SettingService.createInstanceDatatableRole({ requestBody: { name, cluster } })
+			sendUserToast(`Created the data table role ${name}`)
+			newName = ''
+		} catch (e) {
+			const createdOn = cluster
+			handleRoleCreationError(e, {
+				name,
+				cluster: createdOn,
+				confirmationModal,
+				onTakenOver: async () => {
+					newName = ''
+					if (cluster === createdOn) await load()
+					onChanged?.()
+				}
+			})
+		} finally {
+			await load()
+			busy = false
+			onChanged?.()
+		}
 	}
 
 	async function remove(role: InstanceDatatableRole) {
diff --git a/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte b/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte
index 04c4bf7cc0..c56ce514c5 100644
--- a/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte
@@ -57,8 +57,9 @@
 </script>
 
 <script lang="ts">
-	import { Plus, Trash } from 'lucide-svelte'
+	import { Plus } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
+	import CloseButton from '../common/CloseButton.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
 	import ResourcePicker from '../ResourcePicker.svelte'
 	import DataTable from '../table/DataTable.svelte'
@@ -66,7 +67,7 @@
 	import Row from '../table/Row.svelte'
 	import Cell from '../table/Cell.svelte'
 	import SettingsFooter from './SettingsFooter.svelte'
-	import Description from '$lib/components/Description.svelte'
+	import SettingsPageHeader from '../settings/SettingsPageHeader.svelte'
 	import { WorkspaceService } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
@@ -105,20 +106,11 @@
 	}
 </script>
 
-<Description link="https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt">
-	Where dbt projects in this workspace run. A project names a warehouse by name in its descriptor (<span
-		class="font-mono">profile.warehouse</span
-	>) and reaches
-	<span class="font-mono">{DEFAULT_WAREHOUSE}</span> when it names none, so a project carries no
-	connection of its own. The name is also what its tables are keyed on in the asset graph (<span
-		class="font-mono">dbt://{DEFAULT_WAREHOUSE}/schema/table</span
-	>), so two projects on one warehouse share their nodes. Each entry points either at one of
-	Windmill's own connection resources, whose fields are translated into a dbt target, or at a
-	<span class="font-mono">dbt_profile</span> resource, which carries a
-	<span class="font-mono">profiles.yml</span> target as it is and so reaches any adapter dbt has. Configuring
-	one here is what makes it available: anyone who may run a dbt script builds with it and reads its models,
-	without being granted the resource, the same bargain workspace object storage makes.
-</Description>
+<SettingsPageHeader
+	title="dbt warehouses"
+	description={`Where dbt projects in this workspace run. A project picks a warehouse by name with <span class='font-mono'>profile.warehouse</span> in its descriptor, and gets <span class='font-mono'>${DEFAULT_WAREHOUSE}</span> when it names none. Point each warehouse at a Windmill connection resource, or at a <span class='font-mono'>dbt_profile</span> resource holding a <span class='font-mono'>profiles.yml</span> target for any other adapter. Anyone who can run a dbt script builds with these warehouses without being granted the resource.`}
+	link="https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt"
+/>
 
 <DataTable>
 	<Head>
@@ -154,14 +146,10 @@
 						class="min-w-24"
 					/>
 				</Cell>
-				<Cell last>
-					<Button
-						size="xs"
-						color="light"
-						variant="border"
-						startIcon={{ icon: Trash }}
-						iconOnly
-						on:click={() => {
+				<Cell last class="w-12">
+					<CloseButton
+						small
+						on:close={() => {
 							dbtSettings.warehouses = dbtSettings.warehouses.filter((_, j) => j !== i)
 						}}
 					/>
@@ -170,19 +158,21 @@
 		{/each}
 		<Row>
 			<Cell first colspan={4}>
-				<Button
-					size="sm"
-					btnClasses="max-w-fit"
-					variant="default"
-					on:click={() => {
-						dbtSettings.warehouses = [
-							...dbtSettings.warehouses,
-							{ name: dbtSettings.warehouses.length === 0 ? DEFAULT_WAREHOUSE : '' }
-						]
-					}}
-				>
-					<Plus /> New warehouse
-				</Button>
+				<div class="flex justify-center">
+					<Button
+						unifiedSize="md"
+						variant="default"
+						startIcon={{ icon: Plus }}
+						onclick={() => {
+							dbtSettings.warehouses = [
+								...dbtSettings.warehouses,
+								{ name: dbtSettings.warehouses.length === 0 ? DEFAULT_WAREHOUSE : '' }
+							]
+						}}
+					>
+						New warehouse
+					</Button>
+				</div>
 			</Cell>
 		</Row>
 	</tbody>
diff --git a/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte b/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
index f6929e0779..a01318d916 100644
--- a/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
@@ -91,7 +91,6 @@
 	import type { GetSettingsResponse } from '$lib/gen'
 
 	import { enterpriseLicense, superadmin, userWorkspaces, workspaceStore } from '$lib/stores'
-	import { base } from '$app/paths'
 	import Toggle from '../Toggle.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import ExploreAssetButton from '../ExploreAssetButton.svelte'
@@ -653,7 +652,7 @@
 											{/if}
 											{#if ducklakeSavedSettings.ducklakes.find((d) => d.name === ducklake.name)?.maintenance?.enabled}
 												<a
-													href={`${base}/runs/?schedule_path=${encodeURIComponent(
+													href={`/runs/?schedule_path=${encodeURIComponent(
 														`f/ducklake_maintenance/${ducklake.name}`
 													)}&job_kinds=previews`}
 													target="_blank"
diff --git a/frontend/src/lib/components/workspaceSettings/datatableRoleModals.ts b/frontend/src/lib/components/workspaceSettings/datatableRoleModals.ts
new file mode 100644
index 0000000000..66b5b2ecbc
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/datatableRoleModals.ts
@@ -0,0 +1,120 @@
+import { SettingService, type DatatableRoleCluster, type InstanceDatatableRole } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+import type { ConfirmationModalHandle } from '../common/confirmationModal/asyncConfirmationModal.svelte'
+
+export function pgInstanceName(cluster: DatatableRoleCluster | undefined): string {
+	return cluster === 'external_instance'
+		? 'the external Postgres instance'
+		: 'the Windmill Postgres instance'
+}
+
+function escapeHtml(text: string): string {
+	return text.replace(
+		/[&<>"']/g,
+		(c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]!
+	)
+}
+
+/** Reports a failed role creation. One refused because Postgres already has a role of that name
+ * (a 409) opens the offer to take that role over instead. `confirmationModal` must be closed: the
+ * offer takes it over. */
+export async function handleRoleCreationError(
+	e: any,
+	opts: {
+		name: string
+		cluster: DatatableRoleCluster | undefined
+		confirmationModal: ConfirmationModalHandle
+		onTakenOver: (role: InstanceDatatableRole) => void
+	}
+) {
+	if (e?.status !== 409) {
+		sendUserToast(e?.body ?? e?.message ?? String(e), true)
+		return
+	}
+	await offerTakeover(opts)
+}
+
+/** A role no data table names any more is still a login on its Postgres instance. A superadmin is
+ * offered to drop it; anyone else is told to ask one. Resolves to whether it was dropped. */
+export async function offerUnusedRoleDrop({
+	role,
+	cluster,
+	superadmin,
+	confirmationModal
+}: {
+	role: InstanceDatatableRole
+	cluster: DatatableRoleCluster | undefined
+	superadmin: boolean
+	confirmationModal: ConfirmationModalHandle
+}): Promise<boolean> {
+	const name = `<span class="font-mono">${escapeHtml(role.name)}</span>`
+	const instance = pgInstanceName(cluster)
+	if (!superadmin) {
+		await confirmationModal.ask({
+			title: `Role ${role.name} is no longer used`,
+			children: `<p>No data table uses the role ${name} any more, but its login still exists in ${instance}. Ask a superadmin to drop it there.</p>`,
+			confirmationText: 'OK',
+			type: 'info',
+			hideCancel: true
+		})
+		return false
+	}
+	let dropped = false
+	await confirmationModal.ask({
+		title: `Drop the role ${role.name}?`,
+		children: `<div class="flex flex-col gap-2">
+			<p>No data table uses the role ${name} any more, but its login still exists in ${instance}. Windmill can drop it.</p>
+			<p>Dropping it <b>deletes the login ${name}</b> from ${instance}: anything still connecting as it, such as a script with <span class="font-mono">-- role ${escapeHtml(role.name)}</span>, fails from then on. Everything it owns in the databases Windmill manages there is handed back to admin, and its grants are revoked. This cannot be undone.</p>
+			<p>Keep it if you plan to give it to a data table again.</p>
+		</div>`,
+		confirmationText: 'Drop role',
+		type: 'danger',
+		onConfirmed: async () => {
+			try {
+				await SettingService.deleteInstanceDatatableRole({ id: role.id })
+				dropped = true
+				sendUserToast(`Dropped the role ${role.name}`)
+			} catch (e) {
+				sendUserToast(e?.body ?? e?.message ?? String(e), true)
+			}
+		}
+	})
+	return dropped
+}
+
+async function offerTakeover({
+	name,
+	cluster,
+	confirmationModal,
+	onTakenOver
+}: {
+	name: string
+	cluster: DatatableRoleCluster | undefined
+	confirmationModal: ConfirmationModalHandle
+	onTakenOver: (role: InstanceDatatableRole) => void
+}) {
+	const role = `<span class="font-mono">${escapeHtml(name)}</span>`
+	let taken: InstanceDatatableRole | undefined
+	await confirmationModal.ask({
+		title: `Let Windmill take over the role ${name}?`,
+		children: `<div class="flex flex-col gap-2">
+			<p>A Postgres role named ${role} already exists in ${pgInstanceName(cluster)}, and Windmill did not create it. A data table role logs in with a password only Windmill knows, so Windmill has to manage it to use it.</p>
+			<p>Taking it over <b>replaces the password of ${role}</b> with a random one and lets it log in. Anything that logs in as ${role} today with its current password, such as another application, a person or another Windmill instance, will be locked out. The old password cannot be restored.</p>
+			<p>From then on Windmill manages ${role} like a role it created: deleting it in Windmill drops it from Postgres. A role that is a superuser, can create roles or databases, is a member of other roles or has members of its own is refused.</p>
+		</div>`,
+		confirmationText: 'Replace password and take over',
+		type: 'danger',
+		onConfirmed: async () => {
+			try {
+				taken = await SettingService.createInstanceDatatableRole({
+					requestBody: { name, cluster, take_over: true }
+				})
+			} catch (e) {
+				sendUserToast(e?.body ?? e?.message ?? String(e), true)
+			}
+		}
+	})
+	if (!taken) return
+	sendUserToast(`Windmill now manages the role ${name}`)
+	onTakenOver(taken)
+}
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
index c421553a7c..5a46f0a1b8 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -1,5 +1,4 @@
 import { untrack } from 'svelte'
-import { base } from '$lib/base'
 import {
 	AppService,
 	FlowService,
@@ -486,10 +485,10 @@ export class DeployToHubSession {
 
 	itemUrl(kind: ItemKind, path: string): string | undefined {
 		if (!path) return undefined
-		return `${base}/${ITEM_KIND_ROUTE[kind]}/${path}?workspace=${this.workspace}`
+		return `/${ITEM_KIND_ROUTE[kind]}/${path}?workspace=${this.workspace}`
 	}
 	triggerListUrl(kind: WorkspaceTriggerKind): string {
-		return `${base}/${TRIGGER_KINDS[kind].route}?workspace=${this.workspace}`
+		return `/${TRIGGER_KINDS[kind].route}?workspace=${this.workspace}`
 	}
 
 	#patchItem(key: string, patch: Partial<DeployItem>) {
diff --git a/frontend/src/lib/components/workspaceSettings/supabaseOauth.svelte.ts b/frontend/src/lib/components/workspaceSettings/supabaseOauth.svelte.ts
index 3e11ec2b9d..94c21cf591 100644
--- a/frontend/src/lib/components/workspaceSettings/supabaseOauth.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/supabaseOauth.svelte.ts
@@ -1,9 +1,8 @@
 import { fromStore } from 'svelte/store'
-import { base } from '$lib/base'
 import { oauthStore } from '$lib/stores'
 
 const OAUTH_WINDOW = 'windmill_supabase_oauth'
-const CONNECT_URL = `${base}/api/oauth/connect/supabase_wizard`
+const CONNECT_URL = '/api/oauth/connect/supabase_wizard'
 
 /**
  * The Supabase authorization leg, driven from a popup.
diff --git a/frontend/src/lib/components/workspaceSettings/supabaseProvisioning.ts b/frontend/src/lib/components/workspaceSettings/supabaseProvisioning.ts
index 5040b5ab38..ee91a0ba3c 100644
--- a/frontend/src/lib/components/workspaceSettings/supabaseProvisioning.ts
+++ b/frontend/src/lib/components/workspaceSettings/supabaseProvisioning.ts
@@ -7,7 +7,6 @@
  */
 
 import { DEFAULT_SSLMODE } from '$lib/utils/postgresConnectionString'
-import { base } from '$lib/base'
 import { oauthStore } from '$lib/stores'
 import { get } from 'svelte/store'
 
@@ -90,19 +89,19 @@ export function supabaseErrorMessage(body: string): string {
 }
 
 export async function listSupabaseOrgs(token: string): Promise<SupabaseOrg[]> {
-	const res = await fetch(`${base}/api/oauth/list_supabase_orgs`, { headers: headers(token) })
+	const res = await fetch('/api/oauth/list_supabase_orgs', { headers: headers(token) })
 	return unwrap(res, 'Could not list your Supabase organizations')
 }
 
 export async function listSupabaseProjects(token: string): Promise<SupabaseProject[]> {
-	const res = await fetch(`${base}/api/oauth/list_supabase`, { headers: headers(token) })
+	const res = await fetch('/api/oauth/list_supabase', { headers: headers(token) })
 	return unwrap(res, 'Could not list your Supabase projects')
 }
 
 /** Plan of one organization, which the list endpoint does not carry. */
 export async function getSupabaseOrgPlan(token: string, slug: string): Promise<string | undefined> {
 	try {
-		const res = await fetch(`${base}/api/oauth/get_supabase_org/${slug}`, {
+		const res = await fetch(`/api/oauth/get_supabase_org/${slug}`, {
 			headers: headers(token)
 		})
 		if (!res.ok) return undefined
@@ -132,7 +131,7 @@ export async function createSupabaseProject(
 	token: string,
 	args: { name: string; organizationSlug: string; region: string; dbPass: string }
 ): Promise<SupabaseProject> {
-	const res = await fetch(`${base}/api/oauth/create_supabase_project`, {
+	const res = await fetch('/api/oauth/create_supabase_project', {
 		method: 'POST',
 		headers: headers(token),
 		body: JSON.stringify({
@@ -185,7 +184,7 @@ export async function waitUntilSupabaseHealthy(
  * that landed on another one, and the resulting resource never connects.
  */
 export async function getSupabasePooler(token: string, projectId: string): Promise<SupabasePooler> {
-	const res = await fetch(`${base}/api/oauth/get_supabase_pooler/${projectId}`, {
+	const res = await fetch(`/api/oauth/get_supabase_pooler/${projectId}`, {
 		headers: headers(token)
 	})
 	const configs: SupabasePooler[] = await unwrap(res, 'Could not read the connection details')
diff --git a/frontend/src/lib/consts.ts b/frontend/src/lib/consts.ts
index 11d801543c..bfa1d845b2 100644
--- a/frontend/src/lib/consts.ts
+++ b/frontend/src/lib/consts.ts
@@ -47,6 +47,7 @@ export const DEFAULT_TAGS_PER_WORKSPACE_SETTING = 'default_tags_per_workspace'
 export const DEFAULT_TAGS_WORKSPACES_SETTING = 'default_tags_workspaces'
 export const FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING = 'fork_workspace_tag_append_fork_suffix'
 export const PREVIEW_TAGS_OVERRIDE_SETTING = 'preview_tags_override'
+export const DEPENDENCY_JOB_TAG_SETTING = 'dependency_job_tag'
 
 export const WORKSPACE_FAIRNESS_ENABLED_SETTING = 'workspace_fairness_enabled'
 export const WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING = 'workspace_fairness_max_percent'
@@ -178,14 +179,19 @@ export const BIGQUERY_TYPES = [
 ]
 
 export const SNOWFLAKE_TYPES = [
-	'varchar',
-	'binary',
-	'date',
-	'time',
-	'timestamp',
-	'int',
-	'float',
-	'boolean'
+	'VARCHAR',
+	'TEXT',
+	'BINARY',
+	'DATE',
+	'TIME',
+	'TIMESTAMP',
+	'TIMESTAMP_NTZ',
+	'TIMESTAMP_LTZ',
+	'TIMESTAMP_TZ',
+	'INT',
+	'NUMBER',
+	'FLOAT',
+	'BOOLEAN'
 ]
 
 export const MSSQL_TYPES = [
diff --git a/frontend/src/lib/draftAddRedirect.ts b/frontend/src/lib/draftAddRedirect.ts
index 242893f782..2c027ac1da 100644
--- a/frontend/src/lib/draftAddRedirect.ts
+++ b/frontend/src/lib/draftAddRedirect.ts
@@ -1,5 +1,4 @@
 import { redirect } from '@sveltejs/kit'
-import { base } from '$app/paths'
 import { mintDraftPath } from '$lib/mintDraftPath'
 
 /**
@@ -8,7 +7,7 @@ import { mintDraftPath } from '$lib/mintDraftPath'
  *
  * Mints a fresh `u/<username>/draft_<uuid>` path (via the shared `mintDraftPath`,
  * so the SDK builder wrappers stay in lockstep) and 307s to
- * `{base}/{editPrefix}/<path>?new_draft=true&<existing-params>`. `new_draft=true`
+ * `/{editPrefix}/<path>?new_draft=true&<existing-params>`. `new_draft=true`
  * tells the edit route to seed an empty editor instead of 404-ing. The hash is
  * carried over too — fork / handler-template buttons encode a payload into it
  * that the edit route's `new_draft` branch consumes.
@@ -23,6 +22,6 @@ export function makeDraftAddLoad(editPrefix: string) {
 		// points at the PREVIOUS page, but every hash-payload producer arrives
 		// as a full page load, so the hash is correct.
 		const hash = typeof window !== 'undefined' ? window.location.hash : ''
-		redirect(307, `${base}/${editPrefix}/${path}?${params.toString()}${hash}`)
+		redirect(307, `/${editPrefix}/${path}?${params.toString()}${hash}`)
 	}
 }
diff --git a/frontend/src/lib/editRights.test.ts b/frontend/src/lib/editRights.test.ts
new file mode 100644
index 0000000000..faa853e708
--- /dev/null
+++ b/frontend/src/lib/editRights.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import type { UserExt } from '$lib/stores'
+import { canEditItem, roleCanAuthor, roleCanDraft } from './editRights'
+
+function user(overrides: Partial<UserExt>): UserExt {
+	return {
+		email: 'op@windmill.dev',
+		username: 'op',
+		name: 'op',
+		is_admin: false,
+		is_super_admin: false,
+		created_at: '',
+		groups: [],
+		pgroups: [],
+		folders: [],
+		folders_owners: [],
+		folders_read: [],
+		operator: true,
+		...overrides
+	} as UserExt
+}
+
+describe('edit rights', () => {
+	it('lets a builder operator author flows and nothing else', () => {
+		const builder = { builder_flows: true }
+		expect(roleCanAuthor('flow', user({}), builder)).toBe(true)
+		expect(roleCanAuthor('script', user({}), builder)).toBe(false)
+		expect(roleCanAuthor('flow', user({}), undefined)).toBe(false)
+		expect(roleCanDraft('raw_app', user({}), builder)).toBe(false)
+		expect(roleCanDraft('raw_app', user({}), { builder_apps: true })).toBe(true)
+	})
+
+	// drafts.rs admits an admin before its operator branch; the item handlers do not.
+	it('lets an admin who is also an operator save drafts, but not author code', () => {
+		const adminOperator = user({ is_admin: true })
+		expect(roleCanDraft('script', adminOperator, undefined)).toBe(true)
+		expect(roleCanAuthor('script', adminOperator, undefined)).toBe(false)
+	})
+
+	// drafts.rs refuses an operator every draft but a builder flow, rights to write directly or not.
+	it('refuses an operator drafts of what they may write directly', () => {
+		expect(roleCanAuthor('trigger', user({}), undefined)).toBe(true)
+		expect(roleCanDraft('trigger', user({}), undefined)).toBe(false)
+		expect(roleCanDraft('resource', user({}), undefined)).toBe(false)
+	})
+
+	// The role alone is not enough: a builder still cannot edit a flow in a folder they only read.
+	it('requires write access to the item on top of the role', () => {
+		const builder = { builder_flows: true }
+		expect(canEditItem('flow', 'f/demo/sum', {}, user({}), builder)).toBe(false)
+		expect(canEditItem('flow', 'u/op/sum', {}, user({}), builder)).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/editRights.ts b/frontend/src/lib/editRights.ts
new file mode 100644
index 0000000000..9073a03d28
--- /dev/null
+++ b/frontend/src/lib/editRights.ts
@@ -0,0 +1,115 @@
+import type { OperatorSettings } from '$lib/gen'
+import type { UserExt } from '$lib/stores'
+import { canWrite } from '$lib/utils'
+
+/**
+ * The frontend's one copy of "may this user edit this item". The server decides — drafts.rs
+ * `require_can_write_path`, the item handlers' operator refusals, `gate_operator_writes`, and
+ * row-level security — and this mirrors it so a control the server would refuse is never
+ * offered. Check edits through `canEditItem` (or `useEditRights` in a component), never by
+ * pairing `canWrite` with an operator test of your own.
+ */
+
+/** Kinds whose role half differs. Any other kind is code an operator never authors. */
+export type EditKind =
+	| 'script'
+	| 'flow'
+	| 'app'
+	| 'raw_app'
+	| 'agent'
+	| 'pipeline'
+	| 'schedule'
+	| 'trigger'
+	| 'resource'
+	| 'variable'
+	| 'group'
+	| (string & {})
+
+type OperatorRights =
+	| Pick<
+			NonNullable<OperatorSettings>,
+			'builder_flows' | 'builder_apps' | 'manage_schedules' | 'manage_triggers'
+	  >
+	| null
+	| undefined
+
+/**
+ * Whether a user's role lets them author items of `kind` — create, edit, deploy or delete one —
+ * in a workspace with these `operator_settings`: the role half of every check against the item
+ * handlers. Saving a draft is `roleCanDraft`'s rule, and which items they may write is
+ * `canEditItem`'s other half. For an operator:
+ * - code (scripts, low-code apps, agents, pipelines): never;
+ * - flows and full-code apps: where the workspace grants `builder_flows` / `builder_apps`
+ *   (`check_operator_can_build`);
+ * - schedules and triggers: unless the workspace set `manage_*` to false — a withdrawable
+ *   right, so an unset key grants it (docs/operator-write-rights.md);
+ * - resources, variables and groups: always, their permissions alone decide.
+ */
+export function roleCanAuthor(
+	kind: EditKind,
+	user: Pick<UserExt, 'operator'> | undefined,
+	operatorSettings: OperatorRights
+): boolean {
+	if (!user?.operator) return true
+	switch (kind) {
+		case 'flow':
+		case 'raw_app':
+			return builderGrants(kind, operatorSettings)
+		case 'schedule':
+			return operatorSettings?.manage_schedules !== false
+		case 'trigger':
+			return operatorSettings?.manage_triggers !== false
+		case 'resource':
+		case 'variable':
+		case 'group':
+			return true
+		default:
+			return false
+	}
+}
+
+/**
+ * Whether the user may save drafts of `kind` — what every session editor writes. Mirrors drafts.rs
+ * `require_can_write_path`, which differs from the item handlers both ways: it admits an admin
+ * before its operator branch, and it refuses every operator draft but a flow or full-code app
+ * under its builder right — schedules, triggers, resources and variables included, though an operator may
+ * write those directly.
+ */
+export function roleCanDraft(
+	kind: EditKind,
+	user: Pick<UserExt, 'operator' | 'is_admin' | 'is_super_admin'> | undefined,
+	operatorSettings: OperatorRights
+): boolean {
+	if (user?.is_admin || user?.is_super_admin || !user?.operator) return true
+	return builderGrants(kind, operatorSettings)
+}
+
+function builderGrants(kind: EditKind, operatorSettings: OperatorRights): boolean {
+	return (
+		(kind === 'flow' && operatorSettings?.builder_flows === true) ||
+		(kind === 'raw_app' && operatorSettings?.builder_apps === true)
+	)
+}
+
+/** `roleCanDraft` for the item at `path`, with its own permissions as in `canEditItem`. */
+export function canDraftItem(
+	kind: EditKind,
+	path: string,
+	extraPerms: Record<string, boolean> | undefined,
+	user: UserExt | undefined,
+	operatorSettings: OperatorRights
+): boolean {
+	return roleCanDraft(kind, user, operatorSettings) && canWrite(path, extraPerms ?? {}, user)
+}
+
+/** Whether `user` may edit the item at `path`: their role authors `kind`, and the item's own
+ * permissions (`canWrite`: ownership, folder write, `extra_perms`) let them write it. */
+export function canEditItem(
+	kind: EditKind,
+	path: string,
+	extraPerms: Record<string, boolean> | undefined,
+	user: UserExt | undefined,
+	operatorSettings: OperatorRights
+): boolean {
+	return roleCanAuthor(kind, user, operatorSettings) && canWrite(path, extraPerms ?? {}, user)
+}
diff --git a/frontend/src/lib/githubApp.ts b/frontend/src/lib/githubApp.ts
index 666734546e..0c19cd8de2 100644
--- a/frontend/src/lib/githubApp.ts
+++ b/frontend/src/lib/githubApp.ts
@@ -4,7 +4,6 @@ import {
 	type GetGhesConfigResponse
 } from '$lib/gen'
 import { sendUserToast } from '$lib/toast'
-import { base } from '$lib/base'
 
 export interface GitHubAppState {
 	loadingGithubInstallations: boolean
@@ -137,7 +136,7 @@ export async function loadGithubInstallations(
 		const stateParam = encodeURIComponent(
 			JSON.stringify({
 				workspace_id: currentWorkspace,
-				base_url: window.location.origin + base
+				base_url: window.location.origin
 			})
 		)
 
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 2c46c48b2c..7e1f965c36 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28950/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28993/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/29150/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
diff --git a/frontend/src/lib/infer.ts b/frontend/src/lib/infer.ts
index 81458ebea9..9e9cddeb00 100644
--- a/frontend/src/lib/infer.ts
+++ b/frontend/src/lib/infer.ts
@@ -301,7 +301,7 @@ export async function inferAnsibleExecutionMode(code: string): Promise<any> {
 	}
 }
 
-const SQL_LANGUAGES = [
+export const SQL_LANGUAGES = [
 	'postgresql',
 	'mysql',
 	'bigquery',
@@ -571,7 +571,21 @@ export async function inferArgs(
 			schema.properties[arg.name].originalType = (arg as any).otyp
 		}
 
-		schema.properties[arg.name].default = arg.default
+		// Most languages cannot write a resource default in code, so one picked in the
+		// schema (`$res:` path) is kept while the code sets none and the arg is still that
+		// resource type; any code default wins.
+		const old = oldProperties[arg.name]
+		const format = schema.properties[arg.name].format
+		const keepResourceDefault =
+			arg.default == null &&
+			typeof old?.default == 'string' &&
+			old.default.startsWith('$res:') &&
+			schema.properties[arg.name].type == 'object' &&
+			format?.startsWith('resource-') &&
+			format == old.format
+		if (!keepResourceDefault) {
+			schema.properties[arg.name].default = arg.default
+		}
 
 		if (!arg.has_default && !schema.required.includes(arg.name)) {
 			schema.required.push(arg.name)
diff --git a/frontend/src/lib/instanceUi.ts b/frontend/src/lib/instanceUi.ts
index b9b87d139c..3a7bb1b99c 100644
--- a/frontend/src/lib/instanceUi.ts
+++ b/frontend/src/lib/instanceUi.ts
@@ -2,7 +2,8 @@ import { writable } from 'svelte/store'
 import type { GetInstanceUiResponse } from '$lib/gen'
 
 /**
- * The last `/settings/instance_ui` response: the announcement banner and accent color.
+ * The last `/settings/instance_ui` response: the announcement banner, accent color
+ * and API base url.
  * `undefined` until one lands, and left as is when a fetch fails, so a transient error
  * never retracts an announcement still in force. Written only by `InstanceUiSync`.
  */
diff --git a/frontend/src/lib/logout.test.ts b/frontend/src/lib/logout.test.ts
index 160bce9934..5bdc15bac3 100644
--- a/frontend/src/lib/logout.test.ts
+++ b/frontend/src/lib/logout.test.ts
@@ -12,9 +12,25 @@ import { clearUser } from './logout'
 describe('clearUser', () => {
 	beforeEach(() => {
 		sessionStorage.clear()
+		localStorage.clear()
 		vi.clearAllMocks()
 	})
 
+	it('drops credential-bearing localStorage entries and keeps preferences', async () => {
+		const credentialKeys = ['oauth-callback', 'mcp-oauth-callback', 'test_dev_token']
+		for (const key of credentialKeys) {
+			localStorage.setItem(key, 'a-token')
+		}
+		localStorage.setItem('dark-mode', 'true')
+
+		await clearUser()
+
+		for (const key of credentialKeys) {
+			expect(localStorage.getItem(key)).toBeNull()
+		}
+		expect(localStorage.getItem('dark-mode')).toBe('true')
+	})
+
 	// Logging out while impersonating must not leave the impersonator's own token behind.
 	it('drops the impersonation token backup', async () => {
 		sessionStorage.setItem('pre_impersonation_token', 'a-token')
diff --git a/frontend/src/lib/logout.ts b/frontend/src/lib/logout.ts
index 58fce16fe3..b4782badd3 100644
--- a/frontend/src/lib/logout.ts
+++ b/frontend/src/lib/logout.ts
@@ -6,15 +6,19 @@ import { clearStores } from './storeUtils'
 // Note: logout and logoutWithRedirect have been moved to logoutKit.ts
 // as they depend on SvelteKit navigation
 
-// The impersonation backup holds the impersonator's own auth token, so it must go on
-// logout too, not only when impersonation is ended from the banner — otherwise a usable
-// token stays readable for the lifetime of the tab.
-function clearImpersonationFromStorage(): void {
+// Every browser-storage entry that can hold a credential must go on logout. The impersonation
+// backup is the impersonator's own auth token; `oauth-callback` and `mcp-oauth-callback` carry a
+// connected account's token response when the OAuth popup had no opener to post it to;
+// `test_dev_token` is the session token of the /test_dev pages.
+function clearCredentialsFromStorage(): void {
 	try {
 		sessionStorage.removeItem('pre_impersonation_token')
 		sessionStorage.removeItem('pre_impersonation_email')
+		localStorage.removeItem('oauth-callback')
+		localStorage.removeItem('mcp-oauth-callback')
+		localStorage.removeItem('test_dev_token')
 	} catch (e) {
-		console.error('error interacting with session storage', e)
+		console.error('error interacting with browser storage', e)
 	}
 }
 
@@ -23,7 +27,7 @@ export async function clearUser() {
 		noteSessionEmail(undefined)
 		accountSetup.reset()
 		clearStores()
-		clearImpersonationFromStorage()
+		clearCredentialsFromStorage()
 		await UserService.logout()
 	} catch (error) {}
 }
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 2197998857..e0c29f4d7b 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -2028,7 +2028,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2041,7 +2041,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
@@ -2232,7 +2232,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                 },
                                 "exponential": {
                                         "type": "object",
-                                        "description": "Retry with exponential backoff (delay doubles each time)",
+                                        "description": "Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n",
                                         "properties": {
                                                 "attempts": {
                                                         "type": "integer",
@@ -2245,7 +2245,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                                 "seconds": {
                                                         "type": "integer",
                                                         "minimum": 1,
-                                                        "description": "Initial delay in seconds"
+                                                        "description": "Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"
                                                 },
                                                 "random_factor": {
                                                         "type": "integer",
diff --git a/frontend/src/lib/navigation.test.ts b/frontend/src/lib/navigation.test.ts
index f499ddf1f7..d7f503b4eb 100644
--- a/frontend/src/lib/navigation.test.ts
+++ b/frontend/src/lib/navigation.test.ts
@@ -2,11 +2,10 @@ import { describe, it, expect, vi } from 'vitest'
 
 const goto = vi.hoisted(() => vi.fn(async (_path: string) => {}))
 vi.mock('$app/navigation', () => ({ goto: (path: string) => goto(path) }))
-vi.mock('$app/paths', () => ({ base: '' }))
 
 import { buildFilterUrl, setQuery } from './navigation'
 
-// Parse the (un-based) app path the builder returns against a dummy origin so we can
+// Parse the app path the builder returns against a dummy origin so we can
 // assert on pathname / searchParams / hash without caring about ordering.
 function parse(appPath: string): URL {
 	return new URL(appPath, 'http://x')
diff --git a/frontend/src/lib/navigation.ts b/frontend/src/lib/navigation.ts
index db8b9f3a80..164b9402c1 100644
--- a/frontend/src/lib/navigation.ts
+++ b/frontend/src/lib/navigation.ts
@@ -1,23 +1,14 @@
-import { goto as svelteGoto } from '$app/navigation'
-import { base as svelteBase } from '$app/paths'
+import { goto } from '$app/navigation'
 import { serializeParam } from '$lib/utils/serializeParam'
 
-export function goto(path: string, options = {}) {
-	if (svelteBase == '' || path.startsWith('?')) {
-		return svelteGoto(path, options)
-	} else {
-		const fullPath = path.startsWith(svelteBase) ? path : `${svelteBase}${path}`
-		return svelteGoto(fullPath, options)
-	}
-}
+export { goto }
 
 /**
  * Build an in-app deep-link to `pathname` with query-param filters, encoded exactly
  * as the pages write them (via `serializeParam`) so `useUrlSyncedFilterInstance`
  * round-trips them back into filter state. Nullish/empty values are dropped; when
  * `validKeys` is provided, unknown keys are dropped too (structured output guarantees
- * shape, not truth). Returns an un-prefixed app path — pass it to `goto`, which adds
- * the SvelteKit base.
+ * shape, not truth). Returns an app path to pass to `goto`.
  */
 export function buildFilterUrl(
 	pathname: string,
diff --git a/frontend/src/lib/operatorWriteRights.ts b/frontend/src/lib/operatorWriteRights.ts
index 21a27d87f0..916e39dce6 100644
--- a/frontend/src/lib/operatorWriteRights.ts
+++ b/frontend/src/lib/operatorWriteRights.ts
@@ -1,48 +1,110 @@
-import { derived, type Readable } from 'svelte/store'
-import { userWorkspaces, workspaceStore } from '$lib/stores'
+import { derived, fromStore, get, readable, type Readable } from 'svelte/store'
+import { userWorkspaces, usersWorkspaceStore, workspaceStore } from '$lib/stores'
 import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+import { useActingUser } from '$lib/actingUser.svelte'
+import { canDraftItem, canEditItem, roleCanAuthor, roleCanDraft } from '$lib/editRights'
+
+/**
+ * The `editRights` rules (`roleCanAuthor` / `canEditItem` for the item handlers, `roleCanDraft` /
+ * `canDraftItem` for drafts) answered for the user acting in the operating workspace,
+ * with that workspace's `operator_settings` — or in `workspace`, for a component that is handed
+ * one rather than sitting under a host that declares it. Reads context and registers an effect:
+ * call during component initialisation.
+ */
+export function useEditRights(workspace?: () => string | undefined) {
+	const operating = fromStore(useOperatingWorkspace())
+	const ws = workspace ?? (() => operating.current)
+	const user = useActingUser(ws)
+	const workspaces = fromStore(userWorkspaces)
+	const settings = () => workspaces.current.find((w) => w.id === ws())?.operator_settings
+	return {
+		roleCanAuthor: (kind: string) => roleCanAuthor(kind, user.current, settings()),
+		canEditItem: (kind: string, path: string, extraPerms: Record<string, boolean> | undefined) =>
+			canEditItem(kind, path, extraPerms, user.current, settings()),
+		roleCanDraft: (kind: string) => roleCanDraft(kind, user.current, settings()),
+		canDraftItem: (kind: string, path: string, extraPerms: Record<string, boolean> | undefined) =>
+			canDraftItem(kind, path, extraPerms, user.current, settings()),
+		/** This hook looks the user up on its own, so an editor that retries a failed lookup on
+		 *  its acting user (`forgetFailures`) must retry this one too, or it stays read-only. */
+		forgetFailures: () => user.forgetFailures()
+	}
+}
 
 /**
  * Why writes of this kind are locked in the operating workspace, or `undefined` when they are not —
  * the shape `title` and `disabled` both want. See `docs/operator-write-rights.md`.
  *
- * Only `false` locks. A workspace that never configured the key and a non-operator (whose
- * `operator_settings` is null) both hold the right, so `=== true` here would disable the controls
- * for everyone.
+ * The role half of `roleCanAuthor`, phrased for the controls that explain it. `operator_settings`
+ * is non-null exactly for an operator (`isOperatorInWorkspace`), so it stands in for the user.
  */
-function writeLock(key: 'manage_schedules' | 'manage_triggers', noun: string) {
+function writeLock(kind: 'schedule' | 'trigger', noun: string) {
 	return derived([userWorkspaces, useOperatingWorkspace()], ([$userWorkspaces, $workspace]) => {
 		const settings = $userWorkspaces.find((w) => w.id === $workspace)?.operator_settings
 		// Worded as the server words its refusal of the same write.
-		return settings?.[key] === false
-			? `Operators cannot manage ${noun} in this workspace`
-			: undefined
+		return roleCanAuthor(kind, { operator: settings != null }, settings)
+			? undefined
+			: `Operators cannot manage ${noun} in this workspace`
 	})
 }
 
 /** Reads context: call during component initialisation. */
-export const useScheduleLock = () => writeLock('manage_schedules', 'schedules')
+export const useScheduleLock = () => writeLock('schedule', 'schedules')
 /** Reads context: call during component initialisation. */
-export const useTriggerLock = () => writeLock('manage_triggers', 'triggers')
+export const useTriggerLock = () => writeLock('trigger', 'triggers')
 
 /**
  * True when the user is an operator of `workspace` and it granted operators the right to compose
- * flows out of runnables that are already deployed. They still author no code, and everywhere else
- * `operator` keeps meaning read-only, so a gate on the operator role has to consult this before
+ * this kind out of runnables that are already deployed. They still author no code, and everywhere
+ * else `operator` keeps meaning read-only, so a gate on the operator role has to consult this before
  * refusing. `operator_settings` is null for a non-operator, so this is false for them.
+ *
+ * The two rights are granted independently: anything that authors one kind must gate on that
+ * kind, or a flows-only workspace offers app affordances the backend then refuses.
  */
-function builderFlows(workspace: Readable<string | undefined>): Readable<boolean> {
+function builderRight(
+	key: 'builder_flows' | 'builder_apps',
+	workspace: Readable<string | undefined>
+): Readable<boolean> {
 	return derived(
 		[userWorkspaces, workspace],
 		([$userWorkspaces, $workspace]) =>
-			$userWorkspaces.find((w) => w.id === $workspace)?.operator_settings?.builder_flows === true
+			$userWorkspaces.find((w) => w.id === $workspace)?.operator_settings?.[key] === true
+	)
+}
+
+/** Either right, only for surfaces that are not per-kind, such as the create menu's visibility. */
+function anyBuilderRight(workspace: Readable<string | undefined>): Readable<boolean> {
+	return derived(
+		[builderRight('builder_flows', workspace), builderRight('builder_apps', workspace)],
+		([flows, apps]) => flows || apps
 	)
 }
 
 /** Builder rights in the operating workspace. Reads context: call during component
  * initialisation. */
-export const useOperatorBuilderFlows = () => builderFlows(useOperatingWorkspace())
+export const useOperatorBuilderFlows = () => builderRight('builder_flows', useOperatingWorkspace())
+/** Reads context: call during component initialisation. */
+export const useOperatorBuilderApps = () => builderRight('builder_apps', useOperatingWorkspace())
+/** Reads context: call during component initialisation. */
+export const useOperatorBuilderRights = () => anyBuilderRight(useOperatingWorkspace())
 
 /** Builder rights in the navigation workspace, for code outside any component: the legacy AI
  * chat is one instance for the whole app and acts on the workspace the nav is on. */
-export const navigationOperatorBuilderFlows = builderFlows(workspaceStore)
+export const navigationOperatorBuilderFlows = builderRight('builder_flows', workspaceStore)
+export const navigationOperatorBuilderApps = builderRight('builder_apps', workspaceStore)
+export const navigationOperatorBuilderRights = anyBuilderRight(workspaceStore)
+
+/** The app builder right in a given workspace, read once: for code acting on an explicit
+ * workspace rather than the nav's, such as the global AI chat. */
+export const operatorBuilderAppsIn = (workspace: string | undefined) =>
+	get(builderRight('builder_apps', readable(workspace)))
+
+/** Resolves once the workspace list has loaded. Every builder right reads false until then, so
+ * code that picks what a builder starts with on a fresh page load has to wait for it. */
+export async function workspaceListLoaded(): Promise<void> {
+	let unsubscribe = () => {}
+	await new Promise<void>((resolve) => {
+		unsubscribe = usersWorkspaceStore.subscribe((list) => list && resolve())
+	})
+	unsubscribe()
+}
diff --git a/frontend/src/lib/pipelinePaths.ts b/frontend/src/lib/pipelinePaths.ts
index 534e691479..d12b162e06 100644
--- a/frontend/src/lib/pipelinePaths.ts
+++ b/frontend/src/lib/pipelinePaths.ts
@@ -9,6 +9,11 @@ export function pipelineBundlePath(folder: string): string {
 	return `f/${folder}/${PIPELINE_DRAFT_KIND}`
 }
 
+/** localStorage key of the editor's crash mirror of a folder's bundle. */
+export function pipelineLocalMirrorKey(folder: string): string {
+	return `pipeline-${folder}`
+}
+
 const BUNDLE_PATH_RE = new RegExp(`^f/([^/]+)/${PIPELINE_DRAFT_KIND}$`)
 
 /** The folder a pipeline bundle belongs to, or `undefined` if the path isn't one. */
diff --git a/frontend/src/lib/remoteDeploy.ts b/frontend/src/lib/remoteDeploy.ts
index ad887504fb..dbac372f94 100644
--- a/frontend/src/lib/remoteDeploy.ts
+++ b/frontend/src/lib/remoteDeploy.ts
@@ -1,4 +1,3 @@
-import { base } from '$lib/base'
 import type { RemoteDeployConnection, RemoteDeployTarget } from '$lib/gen'
 import { randomSecret } from '$lib/utils/uuid'
 
@@ -67,7 +66,7 @@ export function remoteDeployAuthorizeUrl(
 	localStorage.setItem(PENDING_PREFIX + state, JSON.stringify(pending))
 	const params = new URLSearchParams({
 		workspace: target.workspace_id,
-		callback: `${window.location.origin}${base}${CALLBACK_PATH}`,
+		callback: `${window.location.origin}${CALLBACK_PATH}`,
 		state
 	})
 	return `${target.base_url}/user/remote_deploy_authorize?${params}`
diff --git a/frontend/src/lib/script_helpers.ts b/frontend/src/lib/script_helpers.ts
index b028e9360d..b909aed43f 100644
--- a/frontend/src/lib/script_helpers.ts
+++ b/frontend/src/lib/script_helpers.ts
@@ -3,6 +3,7 @@ import { type Script } from './gen'
 import type { SupportedLanguage } from './common'
 
 import CLAUDE_SANDBOX_INIT_CODE from './templates/claude_sandbox.ts.template?raw'
+import PI_SANDBOX_INIT_CODE from './templates/pi_sandbox.ts.template?raw'
 import WAC_PYTHON_INIT_CODE from './templates/wac_python.py.template?raw'
 import WAC_TYPESCRIPT_INIT_CODE from './templates/wac_typescript.ts.template?raw'
 import CI_TEST_BUN_INIT_CODE from './templates/ci_test_bun.ts.template?raw'
@@ -15,6 +16,7 @@ def main(message: str, name: str, step_id: str):
     print("message", message)
     print("name", name)
     print("step_id", step_id)
+    # "recover": True ends the flow as a success instead of a failure
     return { "message": message, "flow_id": flow_id, "step_id": step_id, "recover": False }`
 
 const PYTHON_INIT_CODE_CLEAR = `# import wmill
@@ -243,6 +245,7 @@ export async function main(message: string, name: string, step_id: string) {
   console.log("message", message)
   console.log("name",name)
   console.log("step_id", step_id)
+  // recover: true ends the flow as a success instead of a failure
   return { message, flow_id, step_id, recover: false }
 }
 `
@@ -253,6 +256,7 @@ export async function main(message: string, name: string, step_id: string) {
   console.log("message", message)
   console.log("name",name)
   console.log("step_id", step_id)
+  // recover: true ends the flow as a success instead of a failure
   return { message, flow_id, step_id, recover: false }
 }
 `
@@ -1497,6 +1501,9 @@ export const INITIAL_CODE = {
 	claudesandbox: {
 		script: CLAUDE_SANDBOX_INIT_CODE
 	},
+	pisandbox: {
+		script: PI_SANDBOX_INIT_CODE
+	},
 	wac_python: {
 		script: WAC_PYTHON_INIT_CODE
 	},
@@ -1560,6 +1567,7 @@ export function initialCode(
 		| 'powershell'
 		| 'bunnative'
 		| 'claudesandbox'
+		| 'pisandbox'
 		| 'wac_python'
 		| 'wac_typescript'
 		| 'ci_test_bun'
@@ -1667,6 +1675,8 @@ export function initialCode(
 	} else if (language == 'bun' || language == 'bunnative') {
 		if (subkind === 'claudesandbox') {
 			return INITIAL_CODE.claudesandbox.script
+		} else if (subkind === 'pisandbox') {
+			return INITIAL_CODE.pisandbox.script
 		} else if (kind == 'trigger') {
 			return INITIAL_CODE.bun.trigger
 		} else if (language == 'bunnative' || subkind === 'bunnative') {
@@ -1708,6 +1718,7 @@ export function getResetCode(
 		| 'powershell'
 		| 'bunnative'
 		| 'claudesandbox'
+		| 'pisandbox'
 		| 'wac_python'
 		| 'wac_typescript'
 		| 'ci_test_bun'
diff --git a/frontend/src/lib/scripts.ts b/frontend/src/lib/scripts.ts
index 2d905d690a..f9f1fa775e 100644
--- a/frontend/src/lib/scripts.ts
+++ b/frontend/src/lib/scripts.ts
@@ -1,5 +1,4 @@
 import { get } from 'svelte/store'
-import { base } from '$lib/base'
 import type { Schema, SupportedLanguage } from './common'
 import { FlowService, type Script, ScriptService, ScheduleService } from './gen'
 import { hubBaseUrlStore, workspaceStore } from './stores'
@@ -136,7 +135,7 @@ export function scriptPathToHref(path: string, hubBaseUrl: string): string {
 	if (path.startsWith('hub/')) {
 		return hubBaseUrl + '/from_version/' + path.substring(4)
 	} else {
-		return `${base}/scripts/get/${path}?workspace=${get(workspaceStore)}`
+		return `/scripts/get/${path}?workspace=${get(workspaceStore)}`
 	}
 }
 
@@ -146,7 +145,7 @@ export function flowPathToHref(path: string, hubBaseUrl: string = get(hubBaseUrl
 		return hubFlowId ? `${hubBaseUrl}/flows/${hubFlowId}` : hubBaseUrl
 	}
 
-	return `${base}/flows/get/${path}?workspace=${get(workspaceStore)}`
+	return `/flows/get/${path}?workspace=${get(workspaceStore)}`
 }
 
 const scriptLanguagesArray: [SupportedLanguage | 'docker' | 'bunnative', string][] = [
@@ -175,8 +174,8 @@ const scriptLanguagesArray: [SupportedLanguage | 'docker' | 'bunnative', string]
 	['ruby', 'Ruby'],
 	['rlang', 'R'],
 	['dbt', 'dbt'],
-	// This array's order is the picker order. Deno is de-emphasized ahead of
-	// deprecation, so it stays last.
+	// Not offered for new scripts (see `processLangs`); listed for the label of
+	// existing ones.
 	['deno', 'Deno']
 	// for related places search: ADD_NEW_LANG
 ]
@@ -197,6 +196,12 @@ export function processInlineLangs(selected: string | undefined, langs: string[]
 }
 
 export function processLangs(selected: string | undefined, langs: string[]): string[] {
+	// Only a script already written in deno keeps the option, whether or not the
+	// workspace's saved order still carries it.
+	langs = langs.filter((lang) => lang !== 'deno')
+	if (selected === 'deno') {
+		langs = [...langs, 'deno']
+	}
 	if (selected === 'nativets') {
 		return langs
 	} else {
diff --git a/frontend/src/lib/templates/pi_sandbox.ts.template b/frontend/src/lib/templates/pi_sandbox.ts.template
new file mode 100644
index 0000000000..ce99d549f7
--- /dev/null
+++ b/frontend/src/lib/templates/pi_sandbox.ts.template
@@ -0,0 +1,74 @@
+// sandbox
+// volume: pi .pi
+
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { createModels } from "@earendil-works/pi-ai/models";
+import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { AssistantEntry, createRegistry, Harness, watchEvents } from "@earendil-works/pi-durable";
+import { NodeExecutionEnv } from "@earendil-works/pi-durable/env/node";
+import { openNodeJsonlStorage } from "@earendil-works/pi-durable/storage/jsonl/node";
+import { CodingTools } from "@earendil-works/pi-durable/tools";
+
+export async function main(anthropic: RT.Anthropic, instructions?: string) {
+  // Any pi-ai provider works: import it from "@earendil-works/pi-ai/providers/<name>",
+  // set the API key env var it reads, and name it in `model` below.
+  process.env.ANTHROPIC_API_KEY = anthropic.apiKey;
+  const models = createModels();
+  models.setProvider(anthropicProvider());
+  const model = { provider: "anthropic", modelId: "claude-opus-5-5" };
+
+  // read, write, edit and bash, running in this job's sandbox
+  const registry = createRegistry();
+  registry.install(CodingTools);
+
+  const context = BACKGROUND_CONTEXT;
+
+  // The conversation is stored in the volume, so each run continues the previous one.
+  const harness = await Harness.open(
+    await openNodeJsonlStorage(".pi/session", context),
+    { models, registry, env: ({ cwd }) => new NodeExecutionEnv({ cwd: cwd ?? process.cwd() }) },
+    context,
+  );
+
+  try {
+    const root = await harness.root(context);
+    await root.configure({ model, instructions: instructions ?? null }, context);
+
+    const isResume = (await root.viewState(context)).value.entries.length > 0;
+
+    // you can hardcode the prompt or pass it as input.
+    const prompt = !isResume ?
+      "What is the fastest OSS workflow engine?" :
+      "What did I ask you before?"
+
+    const events = await watchEvents(harness, root.id, context);
+    events.start(async (batch) => {
+      for (const event of batch) {
+        if (event.type === "tool_execution_start") {
+          console.log(`${event.toolName} ${JSON.stringify(event.args)}`);
+        }
+      }
+    });
+
+    const submission = await root.submit({ type: "input", content: prompt }, context);
+    const settled = await submission.wait(context);
+    if (settled.status !== "done" || settled.type !== "input") {
+      throw new Error(`Pi did not answer: ${JSON.stringify(settled)}`);
+    }
+
+    const answer = await root.commit((tx) => tx.entry(AssistantEntry, settled.answer), context);
+    const response = (answer?.model?.[0]?.content ?? [])
+      .filter((b: any) => b.type === "text")
+      .map((b: any) => b.text)
+      .join("");
+
+    return {
+      is_resume: isResume,
+      prompt,
+      response,
+      usage: (await harness.usage(context)).models,
+    };
+  } finally {
+    await harness.close(context);
+  }
+}
diff --git a/frontend/src/lib/user.ts b/frontend/src/lib/user.ts
index 006c2ab60c..12d6f237ba 100644
--- a/frontend/src/lib/user.ts
+++ b/frontend/src/lib/user.ts
@@ -1,5 +1,6 @@
-import { type User, UserService } from '$lib/gen'
+import { UserService } from '$lib/gen'
 import type { UserExt } from './stores.js'
+import { mapUserToUserExt } from './userExt'
 
 async function fetchUserExt(workspace: string): Promise<UserExt> {
 	return mapUserToUserExt(await UserService.whoami({ workspace }), workspace)
@@ -42,16 +43,3 @@ export function getWorkspaceRole(workspace: string): Promise<RoleLookup> {
 export function clearWorkspaceRoleCache(): void {
 	workspaceRoleCache.clear()
 }
-
-function mapUserToUserExt(user: User, workspace: string): UserExt {
-	const ext: UserExt = {
-		...user,
-		workspace_id: workspace,
-		groups: user.groups!,
-		pgroups: user.groups!.map((x) => `g/${x}`)
-	}
-	if (ext.is_service_account && sessionStorage.getItem('pre_impersonation_token')) {
-		ext.impersonating_email = sessionStorage.getItem('pre_impersonation_email') ?? undefined
-	}
-	return ext
-}
diff --git a/frontend/src/lib/userDraft.svelte.ts b/frontend/src/lib/userDraft.svelte.ts
index 57e911dd3c..4648201a3c 100644
--- a/frontend/src/lib/userDraft.svelte.ts
+++ b/frontend/src/lib/userDraft.svelte.ts
@@ -110,6 +110,8 @@ export type LiveEditorDraft = {
 	itemKind: UserDraftItemKind
 	storagePath: string
 	effectivePath?: string
+	/** An item the user just started from a new-item builder, still on its template. */
+	isNew?: boolean
 }
 
 export type LiveEditorDraftSpec = {
@@ -117,6 +119,7 @@ export type LiveEditorDraftSpec = {
 	storagePath: string
 	effectivePath?: string
 	workspace?: string
+	isNew?: boolean
 }
 
 export type ClearLiveEditorDraftOptions = UserDraftOptions & {
@@ -478,7 +481,8 @@ export const UserDraft = {
 			workspace: ws,
 			itemKind: spec.itemKind,
 			storagePath: spec.storagePath,
-			effectivePath: spec.effectivePath || undefined
+			effectivePath: spec.effectivePath || undefined,
+			isNew: spec.isNew || undefined
 		})
 	},
 
diff --git a/frontend/src/lib/userExt.ts b/frontend/src/lib/userExt.ts
new file mode 100644
index 0000000000..d06e1cd04d
--- /dev/null
+++ b/frontend/src/lib/userExt.ts
@@ -0,0 +1,15 @@
+import type { User } from '$lib/gen/types.gen'
+import type { UserExt } from './stores'
+
+export function mapUserToUserExt(user: User, workspace: string): UserExt {
+	const ext: UserExt = {
+		...user,
+		workspace_id: workspace,
+		groups: user.groups!,
+		pgroups: user.groups!.map((x) => `g/${x}`)
+	}
+	if (ext.is_service_account && sessionStorage.getItem('pre_impersonation_token')) {
+		ext.impersonating_email = sessionStorage.getItem('pre_impersonation_email') ?? undefined
+	}
+	return ext
+}
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index 23dbacea21..8540b964e8 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -629,6 +629,7 @@ export type InputCat =
 	| 'dynamic'
 	| 'json-schema'
 	| 'ai-provider'
+	| 'ai-decision-questions'
 
 export namespace DynamicInput {
 	const DYN_FORMAT_PREFIX = ['dynmultiselect-', 'dynselect-']
@@ -707,8 +708,10 @@ export function setInputCat(
 		return 'list'
 	} else if (type == 'object' && format?.startsWith('resource')) {
 		return 'resource-object'
-	} else if (type == 'object' && format == 'ai-provider') {
+	} else if (type == 'object' && (format == 'ai-provider' || format == 'ai-decision-provider')) {
 		return 'ai-provider'
+	} else if (type == 'object' && format == 'ai-decision-questions') {
+		return 'ai-decision-questions'
 	} else if (type == 'object' && DynamicInput.isDynInputFormat(format)) {
 		return 'dynamic'
 	} else if (!type || type == 'object' || type == 'array') {
@@ -1319,28 +1322,7 @@ export function isCodeInjection(expr: string | undefined): boolean {
 	return dynamicTemplateRegex.test(expr)
 }
 
-// Query params Windmill consumes internally and that should not be exposed to
-// app logic via the `query` context. Only params we actually own are listed
-// here — the `wm_` prefix is a naming convention, not a reserved namespace, so
-// we don't strip it wholesale (that would break apps reading their own `wm_*`
-// params). `wm_coep` is a transport flag for cross-origin isolation headers;
-// `wm_embed`/`wm_embedder_origin` are the opaque app viewer transport params
-// (see PublicAppFrame).
-export const WINDMILL_RESERVED_QUERY_PARAMS = new Set(['wm_coep', 'wm_embed', 'wm_embedder_origin'])
-
-export function urlParamsToObject(
-	params: URLSearchParams,
-	opts?: { stripReserved?: boolean }
-): Record<string, string> {
-	const result: Record<string, string> = {}
-	params.forEach((value, key) => {
-		if (opts?.stripReserved && WINDMILL_RESERVED_QUERY_PARAMS.has(key)) {
-			return
-		}
-		result[key] = value
-	})
-	return result
-}
+export { WINDMILL_RESERVED_QUERY_PARAMS, urlParamsToObject } from './utils/queryParams'
 
 export async function tryEvery({
 	tryCode,
@@ -1500,29 +1482,6 @@ export function orderedJsonStringify(obj: any, space?: string | number) {
 	return JSON.stringify(obj, (Array.from(allKeys) as string[]).sort(), space)
 }
 
-function evalJs(expr: string) {
-	let template = `
-return function (fields) {
-"use strict";
-return ${expr.startsWith('return ') ? expr.substring(7) : expr}
-}
-`
-	let functor = Function(template)
-	return functor()
-}
-export function computeShow(argName: string, expr: string | undefined, args: any) {
-	if (expr) {
-		try {
-			let r = evalJs(expr)(args ?? {})
-			return r
-		} catch (e) {
-			console.error(`Impossible to eval ${expr}:`, e)
-			return true
-		}
-	}
-	return true
-}
-
 function urlizeTokenInternal(token: string, formatter: 'html' | 'md'): string {
 	if (token.startsWith('http://') || token.startsWith('https://')) {
 		if (formatter == 'html') {
diff --git a/frontend/src/lib/utils/describeCron.test.ts b/frontend/src/lib/utils/describeCron.test.ts
new file mode 100644
index 0000000000..b24ac883b6
--- /dev/null
+++ b/frontend/src/lib/utils/describeCron.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { describeCron, describeSchedule } from './describeCron'
+
+describe('describeCron', () => {
+	it.each([
+		['*/30 * * * * *', 'Every 30 seconds'],
+		['0 * * * * *', 'Every minute'],
+		['0 */15 * * * *', 'Every 15 minutes'],
+		['0 0 * * * *', 'Every hour'],
+		['0 30 * * * *', 'Every hour at :30'],
+		['0 0 */6 * * *', 'Every 6 hours'],
+		['0 0 4 * * *', 'Every day at 4:00'],
+		// five fields are padded at the end, like the schedule editor saves them
+		['0 0 12 * *', 'Every day at 12:00'],
+		['0 30 9 * * 1-5', 'Every weekday at 9:30'],
+		['0 0 9 * * MON', 'Every Monday at 9:00'],
+		['0 0 18 * * 1,3,5', 'Every Monday, Wednesday and Friday at 18:00'],
+		['0 0 8 1 * *', 'Every month on the 1st at 8:00'],
+		['0 0 8 22 * *', 'Every month on the 22nd at 8:00']
+	])('%s → %s', (cron, text) => {
+		expect(describeCron(cron)).toBe(text)
+	})
+
+	it.each(['0 0 8 1 1 *', '15 0 4 * * *', '0 0 4-6 * * *', 'not a cron'])(
+		'leaves %s to be shown as is',
+		(cron) => {
+			expect(describeCron(cron)).toBeUndefined()
+		}
+	)
+})
+
+describe('describeSchedule', () => {
+	it('names the zone of a wall-clock time only', () => {
+		expect(describeSchedule('0 0 12 * * *', 'UTC')).toBe('Every day at 12:00 UTC')
+		expect(describeSchedule('0 0 * * * *', 'UTC')).toBe('Every hour')
+	})
+})
diff --git a/frontend/src/lib/utils/describeCron.ts b/frontend/src/lib/utils/describeCron.ts
new file mode 100644
index 0000000000..96debb2589
--- /dev/null
+++ b/frontend/src/lib/utils/describeCron.ts
@@ -0,0 +1,128 @@
+import { formatCron } from '$lib/utils'
+
+const DAY_NAMES = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday']
+const DAY_ALIASES: Record<string, number> = {
+	SUN: 0,
+	MON: 1,
+	TUE: 2,
+	WED: 3,
+	THU: 4,
+	FRI: 5,
+	SAT: 6
+}
+
+const isNum = (f: string) => /^\d+$/.test(f)
+const everyN = (f: string) => /^\*\/(\d+)$/.exec(f)?.[1]
+
+function time(hour: string, minute: string): string {
+	return `${Number(hour)}:${minute.padStart(2, '0')}`
+}
+
+function ordinal(n: number): string {
+	const rest = n % 100
+	if (rest >= 11 && rest <= 13) return `${n}th`
+	return `${n}${['th', 'st', 'nd', 'rd'][n % 10] ?? 'th'}`
+}
+
+function dayNumber(token: string): number | undefined {
+	const t = token.toUpperCase()
+	if (t in DAY_ALIASES) return DAY_ALIASES[t]
+	if (!isNum(t)) return undefined
+	const n = Number(t)
+	return n >= 0 && n <= 7 ? n % 7 : undefined
+}
+
+/** `1-5`, `MON-FRI`, `1,3,5`, `6` → sorted day numbers; undefined for anything else. */
+function days(field: string): number[] | undefined {
+	const out = new Set<number>()
+	for (const part of field.split(',')) {
+		const [from, to] = part.split('-')
+		const a = dayNumber(from)
+		if (a === undefined) return undefined
+		if (to === undefined) {
+			out.add(a)
+			continue
+		}
+		const b = dayNumber(to)
+		if (b === undefined || b < a) return undefined
+		for (let d = a; d <= b; d++) out.add(d)
+	}
+	return [...out].sort()
+}
+
+function listDays(ds: number[]): string {
+	if (ds.join() === '1,2,3,4,5') return 'weekday'
+	if (ds.join() === '0,6') return 'weekend day'
+	const names = ds.map((d) => DAY_NAMES[d])
+	return names.length === 1
+		? names[0]
+		: `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`
+}
+
+/**
+ * A plain-English reading of a Windmill cron expression — "Every hour",
+ * "Every day at 4:00", "Every Monday at 9:30" — or undefined when it is not one
+ * of the common shapes, so the caller can show the expression itself.
+ *
+ * Windmill crons have six fields, seconds first; a five-field entry is padded
+ * at the end the way the schedule editor saves it (`formatCron`).
+ */
+export function describeCron(cron: string): string | undefined {
+	const fields = formatCron(cron.trim()).split(/\s+/)
+	if (fields.length !== 6) return undefined
+	const [sec, min, hour, dom, month, dow] = fields
+	if (month !== '*') return undefined
+
+	const anyDay = dom === '*' && (dow === '*' || dow === '?')
+	if (anyDay && min === '*' && hour === '*') {
+		if (sec === '*') return 'Every second'
+		const n = everyN(sec)
+		if (n) return `Every ${n} seconds`
+	}
+	if (sec !== '0') return undefined
+
+	if (anyDay) {
+		if (hour === '*') {
+			if (min === '*') return 'Every minute'
+			const n = everyN(min)
+			if (n) return `Every ${n} minutes`
+			if (min === '0') return 'Every hour'
+			if (isNum(min)) return `Every hour at :${min.padStart(2, '0')}`
+			return undefined
+		}
+		const n = everyN(hour)
+		if (n && min === '0') return `Every ${n} hours`
+		if (isNum(hour) && isNum(min)) return `Every day at ${time(hour, min)}`
+		return undefined
+	}
+
+	if (!isNum(hour) || !isNum(min)) return undefined
+	if (dom === '*') {
+		const ds = days(dow)
+		return ds ? `Every ${listDays(ds)} at ${time(hour, min)}` : undefined
+	}
+	if (isNum(dom) && (dow === '*' || dow === '?')) {
+		return `Every month on the ${ordinal(Number(dom))} at ${time(hour, min)}`
+	}
+	return undefined
+}
+
+function shortZone(timezone: string): string {
+	try {
+		return (
+			new Intl.DateTimeFormat('en-US', { timeZone: timezone, timeZoneName: 'short' })
+				.formatToParts(new Date())
+				.find((p) => p.type === 'timeZoneName')?.value ?? timezone
+		)
+	} catch {
+		return timezone
+	}
+}
+
+/** `describeCron` of a schedule, naming its zone whenever the text states a
+ * wall-clock time: "Every day at 12:00 UTC". */
+export function describeSchedule(cron: string, timezone?: string): string | undefined {
+	const text = describeCron(cron)
+	if (!text || !timezone || !/ at \d/.test(text)) return text
+	return `${text} ${shortZone(timezone)}`
+}
diff --git a/frontend/src/lib/utils/editInFork.ts b/frontend/src/lib/utils/editInFork.ts
index ad2b700c9a..d43c3644c9 100644
--- a/frontend/src/lib/utils/editInFork.ts
+++ b/frontend/src/lib/utils/editInFork.ts
@@ -1,4 +1,3 @@
-import { base } from '$lib/base'
 import { get } from 'svelte/store'
 import {
 	userStore,
@@ -17,21 +16,19 @@ import { updateDevWorkspaceModal } from '$lib/utils/editInForkModal.svelte'
 export type ItemType = 'script' | 'flow' | 'app' | 'raw_app'
 
 /**
- * Whether to show the "edit in fork / dev workspace" affordance. Allowed when forking isn't disabled,
- * when the user can bypass the forking rule (workspace admins, mirroring `canCreateFork`), OR when the
- * current workspace has a canonical dev to route to — routing into an existing dev workspace creates
- * no fork, so it survives a locked prod that has `DisableWorkspaceForking` set. User identity is read
+ * Whether to show the "edit in fork / dev workspace" affordance. Allowed when the user may create a
+ * fork, OR when the current workspace has a canonical dev to route to — routing into an existing dev
+ * workspace creates no fork, so it survives a locked prod that has `DisableWorkspaceForking` set.
+ * Never for an operator, who has nothing to edit at the other end either way. User identity is read
  * non-reactively (it's stable within a session); reactivity comes from the workspace args.
  */
 export function editInForkAllowed(
 	currentWorkspaceId: string | undefined,
 	allWorkspaces: UserWorkspace[]
 ): boolean {
-	return (
-		!isRuleActive('DisableWorkspaceForking') ||
-		canUserBypassRuleKind('DisableWorkspaceForking', get(userStore)) ||
-		!!findCanonicalDevWorkspace(currentWorkspaceId, allWorkspaces)
-	)
+	const user = get(userStore)
+	if (user?.operator) return false
+	return canCreateFork(user) || !!findCanonicalDevWorkspace(currentWorkspaceId, allWorkspaces)
 }
 
 /** Label for the affordance: "Edit in <dev name>" when routed to a canonical dev, else "Edit in fork". */
@@ -57,11 +54,17 @@ export function editInForkDescription(
 }
 
 /**
- * Whether the user may CREATE a new fork of the current workspace: forking not disabled, or the user
- * can bypass the rule (workspace admins). Keeps the "Fork workspace" entry available to admins as the
- * last-resort escape hatch on a locked prod.
+ * Whether the user may CREATE a new fork of the current workspace: not an operator, and either
+ * forking isn't disabled or they can bypass the rule (workspace admins). Keeps the "Fork workspace"
+ * entry available to admins as the last-resort escape hatch on a locked prod.
+ *
+ * An operator is refused because a fork does not carry the role: the server writes the forker's
+ * membership row from the parent's `is_admin` and lets `operator` fall to its `false` default, so
+ * forking would hand an operator a full-rights copy of the workspace. The server does not refuse it
+ * — this hides the affordance, it does not enforce the rule.
  */
 export function canCreateFork(user: UserExt | undefined): boolean {
+	if (user?.operator) return false
 	return (
 		!isRuleActive('DisableWorkspaceForking') ||
 		canUserBypassRuleKind('DisableWorkspaceForking', user)
@@ -71,13 +74,13 @@ export function canCreateFork(user: UserExt | undefined): boolean {
 function editPathFor(itemType: ItemType, itemPath: string): string {
 	switch (itemType) {
 		case 'script':
-			return `${base}/scripts/edit/${itemPath}`
+			return `/scripts/edit/${itemPath}`
 		case 'flow':
-			return `${base}/flows/edit/${itemPath}`
+			return `/flows/edit/${itemPath}`
 		case 'app':
-			return `${base}/apps/edit/${itemPath}`
+			return `/apps/edit/${itemPath}`
 		case 'raw_app':
-			return `${base}/apps_raw/edit/${itemPath}`
+			return `/apps_raw/edit/${itemPath}`
 	}
 }
 
@@ -97,7 +100,7 @@ export function buildForkEditUrl(
  * workspace the page loads in, so a caller acting on another one names it. */
 export function forkWorkspaceUrl(itemType: ItemType, itemPath: string, workspace?: string): string {
 	const from = workspace ? `&workspace=${encodeURIComponent(workspace)}` : ''
-	return `${base}/user/fork_workspace?rd=${encodeURIComponent(editPathFor(itemType, itemPath))}${from}`
+	return `/user/fork_workspace?rd=${encodeURIComponent(editPathFor(itemType, itemPath))}${from}`
 }
 
 /** The item's editor in the dev workspace — the target `buildForkEditUrl` produces when a dev exists. */
diff --git a/frontend/src/lib/utils/forkColor.ts b/frontend/src/lib/utils/forkColor.ts
index 232acbbe90..5839bb13de 100644
--- a/frontend/src/lib/utils/forkColor.ts
+++ b/frontend/src/lib/utils/forkColor.ts
@@ -2,6 +2,17 @@
 // blue's light/dark bg+text profile, re-hued. Lightness is fixed per role so
 // any picked hue stays readable; saturation follows the user color within a
 // safe band so grayish picks yield grayish chips.
+//
+// The badge filled with the hue is the exception, because white is written on
+// it and a fixed lightness cannot carry white across the wheel: HSL lightness
+// is not perceived brightness, so a yellow and a purple at the same L differ by
+// several stops of luminance. Its lightness is solved instead — the lightest
+// shade of the hue that still holds white at WCAG AA.
+
+/** WCAG AA for small text: the badge's own label is what is being read. */
+const TEXT_MIN_CONTRAST = 4.5
+/** White, which the badge's label is written in. */
+const WHITE_LUMINANCE = 1
 
 function hexToHsl(hex: string): { h: number; s: number; l: number } | undefined {
 	const m = /^#?([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(hex.trim())
@@ -32,12 +43,84 @@ function hsl(h: number, s: number, l: number): string {
 	return `hsl(${Math.round(h)}, ${Math.round(s * 100)}%, ${Math.round(l * 100)}%)`
 }
 
+/** The same string with lightness floored: a solved lightness is the lightest value that clears
+ *  its contrast target, so rounding the whole percent up would spend the margin just bought. */
+function hslFloorL(h: number, s: number, l: number): string {
+	return `hsl(${Math.round(h)}, ${Math.round(s * 100)}%, ${Math.floor(l * 100)}%)`
+}
+
+function hslToRgb(h: number, s: number, l: number): [number, number, number] {
+	const c = (1 - Math.abs(2 * l - 1)) * s
+	const hp = (((h % 360) + 360) % 360) / 60
+	const x = c * (1 - Math.abs((hp % 2) - 1))
+	const [r, g, b] =
+		hp < 1
+			? [c, x, 0]
+			: hp < 2
+				? [x, c, 0]
+				: hp < 3
+					? [0, c, x]
+					: hp < 4
+						? [0, x, c]
+						: hp < 5
+							? [x, 0, c]
+							: [c, 0, x]
+	const m = l - c / 2
+	return [r + m, g + m, b + m]
+}
+
+function relativeLuminance(r: number, g: number, b: number): number {
+	const f = (x: number) => (x <= 0.03928 ? x / 12.92 : ((x + 0.055) / 1.055) ** 2.4)
+	return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b)
+}
+
+function contrast(a: number, b: number): number {
+	return (Math.max(a, b) + 0.05) / (Math.min(a, b) + 0.05)
+}
+
+/** Luminance of what the browser paints, which is neither the exact numbers nor the `hsl()` string
+ *  alone: the string carries whole percents, and the channels it resolves to are 8-bit. Solving
+ *  against the unrounded channels leaves the chosen lightness up to 0.025 short of the target once
+ *  painted, which is enough to miss AA on a hue like #993388. */
+function paintedLuminance(h: number, s: number, l: number): number {
+	const [r, g, b] = hslToRgb(Math.round(h), Math.round(s * 100) / 100, Math.floor(l * 100) / 100)
+	const q = (x: number) => Math.round(x * 255) / 255
+	return relativeLuminance(q(r), q(g), q(b))
+}
+
 /**
- * Inline-style string setting the four `--fork-accent-*` custom properties a
- * colored fork chip consumes (see WorkspaceScopeTrigger). Returns undefined
- * for an unparsable color, letting the chip fall back to the default accent.
+ * The lightest L in [0, hi] whose color contrasts at least `target` against `against`. Luminance
+ * rises with L at a fixed hue and saturation, so the predicate flips once and a bisection finds
+ * the edge; 12 steps put it within 0.03 of a percent, finer than the whole percent the string
+ * carries.
  */
-export function forkAccentStyle(color: string | undefined): string | undefined {
+function lightestAtContrast(
+	h: number,
+	s: number,
+	hi: number,
+	against: number,
+	target: number
+): number {
+	let lo = 0
+	let best = 0
+	for (let i = 0; i < 12; i++) {
+		const mid = (lo + hi) / 2
+		if (contrast(paintedLuminance(h, s, mid), against) >= target) {
+			best = mid
+			lo = mid
+		} else {
+			hi = mid
+		}
+	}
+	return best
+}
+
+/**
+ * Inline-style string setting the `--fork-accent-*` custom properties a colored
+ * fork chip consumes (see WorkspaceScopeTrigger). Returns undefined for an
+ * unparsable color, letting the chip fall back to the default accent.
+ */
+export function forkAccentStyle(color: string | null | undefined): string | undefined {
 	if (!color) return undefined
 	const parsed = hexToHsl(color)
 	if (!parsed) return undefined
@@ -46,5 +129,14 @@ export function forkAccentStyle(color: string | undefined): string | undefined {
 	const lightText = hsl(h, clamp(s, 0.3, 0.8), 0.42)
 	const darkBg = hsl(h, clamp(s * 0.35, 0.08, 0.25), 0.26)
 	const darkText = hsl(h, clamp(s, 0.3, 0.9), 0.86)
-	return `--fork-accent-bg: ${lightBg}; --fork-accent-text: ${lightText}; --fork-accent-bg-dark: ${darkBg}; --fork-accent-text-dark: ${darkText};`
+	// The filled badge inside the chip: the hue at near-full strength, as light as it can be while
+	// white still reads on it. Same in both themes — it is the one thing on the line that is a
+	// block of color rather than a tint, so it needs no second version.
+	const badgeSat = clamp(s, 0.35, 0.9)
+	const badge = hslFloorL(
+		h,
+		badgeSat,
+		lightestAtContrast(h, badgeSat, 0.7, WHITE_LUMINANCE, TEXT_MIN_CONTRAST)
+	)
+	return `--fork-accent-bg: ${lightBg}; --fork-accent-text: ${lightText}; --fork-accent-badge: ${badge}; --fork-accent-bg-dark: ${darkBg}; --fork-accent-text-dark: ${darkText};`
 }
diff --git a/frontend/src/lib/utils/queryParams.ts b/frontend/src/lib/utils/queryParams.ts
new file mode 100644
index 0000000000..ffefc47eea
--- /dev/null
+++ b/frontend/src/lib/utils/queryParams.ts
@@ -0,0 +1,22 @@
+// Query params Windmill consumes internally and that should not be exposed to
+// app logic via the `query` context. Only params we actually own are listed
+// here — the `wm_` prefix is a naming convention, not a reserved namespace, so
+// we don't strip it wholesale (that would break apps reading their own `wm_*`
+// params). `wm_coep` is a transport flag for cross-origin isolation headers;
+// `wm_embed`/`wm_embedder_origin` are the opaque app viewer transport params
+// (see PublicAppFrame).
+export const WINDMILL_RESERVED_QUERY_PARAMS = new Set(['wm_coep', 'wm_embed', 'wm_embedder_origin'])
+
+export function urlParamsToObject(
+	params: URLSearchParams,
+	opts?: { stripReserved?: boolean }
+): Record<string, string> {
+	const result: Record<string, string> = {}
+	params.forEach((value, key) => {
+		if (opts?.stripReserved && WINDMILL_RESERVED_QUERY_PARAMS.has(key)) {
+			return
+		}
+		result[key] = value
+	})
+	return result
+}
diff --git a/frontend/src/lib/utils/quickjsEval.svelte.ts b/frontend/src/lib/utils/quickjsEval.svelte.ts
new file mode 100644
index 0000000000..d7ae2002af
--- /dev/null
+++ b/frontend/src/lib/utils/quickjsEval.svelte.ts
@@ -0,0 +1,249 @@
+/**
+ * Runs the JS expressions a schema or flow carries (a field's `showExpr`, a step input's test
+ * prefill). They are written by whoever can edit the item but run in the browser of whoever
+ * opens it, so they must not run in the page: there they would act with the viewer's session.
+ *
+ * They run in QuickJS compiled to WebAssembly, a separate engine with no page, storage, cookie or
+ * network to reach. Each evaluation gets a fresh runtime, bounded in time and memory. Values cross
+ * as JSON both ways.
+ */
+import type { QuickJSWASMModule } from 'quickjs-emscripten-core'
+
+const TIMEOUT_MS = 1000
+// WebAssembly memory never shrinks, so one greedy expression would keep the engine's peak forever.
+const MEMORY_LIMIT = 256 * 1024 * 1024
+// The engine runs on the page's own stack. Past this, it raises a catchable "stack overflow";
+// without it, the page's stack overflows mid-step and leaves the runtime unfreeable. 192 KB already
+// lets deeply nested JSON through to the page's limit.
+const STACK_LIMIT = 128 * 1024
+
+let engine = $state.raw<QuickJSWASMModule>()
+let failed = $state(false)
+let loading: Promise<unknown> | undefined
+
+/** Resolves once expressions can be evaluated; starts loading the engine on first call. */
+export function quickjsReady(): Promise<unknown> {
+	loading ??= Promise.all([
+		import('quickjs-emscripten-core'),
+		import('@jitl/quickjs-wasmfile-release-sync'),
+		import('@jitl/quickjs-wasmfile-release-sync/wasm?url')
+	])
+		.then(([core, variant, wasm]) =>
+			core.newQuickJSWASMModuleFromVariant(
+				// Outside a browser (tests) the URL is not fetchable; the variant reads its own file.
+				import.meta.env.SSR
+					? variant.default
+					: core.newVariant(variant.default, { wasmLocation: wasm.default })
+			)
+		)
+		.then(
+			(m) => (engine = m),
+			(e) => {
+				console.error('Could not load the expression engine', e)
+				failed = true
+			}
+		)
+	return loading
+}
+
+/** Whether `evalSandboxed` can answer; reactive. Starts no load: `quickjsReady` does. */
+export function quickjsSettled(): boolean {
+	return engine !== undefined || failed
+}
+
+// Copying into the engine costs about 10ms per MB on the page thread, on every evaluation.
+const MAX_TEXT = 1024 * 1024
+const MAX_COPY = 5 * 1024 * 1024
+
+const IDENT = '[A-Za-z_$][\\w$]*'
+// Only escapes JSON accepts: `literal` reads the match with `JSON.parse`, and `"\x41"` is left to
+// the engine.
+const STRING = String.raw`(?:"(?:[^"\\\u0000-\u001f]|\\["\\/bfnrt]|\\u[0-9a-fA-F]{4})*"|'(?:[^'\\\u0000-\u001f]|\\['"\\/bfnrt]|\\u[0-9a-fA-F]{4})*')`
+const KEY = `\\s*(?:\\.\\s*(${IDENT})|\\[\\s*(${STRING})\\s*\\])`
+const ANY_KEY = `\\s*(?:\\.\\s*${IDENT}|\\[\\s*${STRING}\\s*\\])`
+const LOOKUP = new RegExp(
+	`^\\s*(${IDENT})((?:${ANY_KEY})*)\\s*` +
+		`(?:(===|!==|==|!=)\\s*(${STRING}|-?(?:0|[1-9]\\d*)(?:\\.\\d+)?|true|false|null)\\s*)?;?\\s*$`
+)
+
+/** What `expr` returns. A leading line break would otherwise follow `return` and end the
+ *  statement, while `LOOKUP` skips it: the two paths would disagree. */
+function bodyOf(expr: string): string {
+	return (expr.startsWith('return ') ? expr.slice(7) : expr).trimStart()
+}
+
+/** A literal `LOOKUP` matched; a single-quoted string is rewritten as JSON first. */
+function literal(text: string): unknown {
+	if (text[0] !== "'") return JSON.parse(text)
+	const body = text
+		.slice(1, -1)
+		.replace(/\\'|\\.|"/g, (m) => (m === "\\'" ? "'" : m === '"' ? '\\"' : m))
+	return JSON.parse(`"${body}"`)
+}
+
+/**
+ * Answers `name.key["key"]…`, optionally compared to a JSON literal, straight from `scope`: reading
+ * data and comparing it to a constant runs no code, so it needs no sandbox and copies nothing.
+ * Anything else, including a key that is not the data's own, is left to the engine.
+ */
+function cheapAnswer(body: string, scope: Record<string, unknown>): { value: unknown } | undefined {
+	// `LOOKUP` backtracks quadratically on long malformed input, and runs before the engine's time
+	// limit: an author could freeze the viewer's page. Real conditions are far shorter.
+	if (body.length > 1000) return undefined
+	const m = LOOKUP.exec(body)
+	if (!m || !Object.hasOwn(scope, m[1])) return undefined
+	let value = scope[m[1]]
+	for (const k of m[2].matchAll(new RegExp(KEY, 'g'))) {
+		const key = k[1] ?? (literal(k[2]) as string)
+		if (value === null || typeof value !== 'object' || !Object.hasOwn(value, key)) return undefined
+		value = value[key]
+	}
+	if (!m[3]) return { value }
+	if (value !== null && typeof value === 'object') return undefined
+	const other = literal(m[4])
+	const equal = m[3].length === 3 ? value === other : value == other
+	return { value: m[3].startsWith('=') ? equal : !equal }
+}
+
+/** Text over `MAX_TEXT`, such as an uploaded file, crosses as this instead of its content. */
+function tooLarge(text: string) {
+	return { tooLarge: true, length: text.length, size: `${(text.length / 2 ** 20).toFixed(1)} MB` }
+}
+
+/** What is left of `budget` once `value` is copied in; stops counting below zero. */
+function remaining(value: unknown, budget: number, placeholders: boolean): number {
+	if (typeof value === 'string') {
+		return budget - (placeholders && value.length > MAX_TEXT ? 64 : value.length + 2)
+	}
+	if (value === null || typeof value !== 'object') return budget - 8
+	for (const key in value) {
+		budget = remaining(value[key], budget - key.length - 4, placeholders)
+		if (budget < 0) break
+	}
+	return budget
+}
+
+/** `value` as JSON for the engine, refused past `MAX_COPY`. */
+function copyIn(value: unknown, name: string, placeholders: boolean): string {
+	if (remaining(value, MAX_COPY, placeholders) < 0) {
+		throw new Error(`${name} is over 5 MB, too large to evaluate in the browser: enter it by hand`)
+	}
+	return (
+		JSON.stringify(value, (_, v) =>
+			placeholders && typeof v === 'string' && v.length > MAX_TEXT ? tooLarge(v) : v
+		) ?? 'undefined'
+	)
+}
+
+// Each name an object holds becomes a read-only shell that copies an entry in when it is read, as
+// the backend's `results` proxy does: a large step result or upload costs only the expressions
+// that read it, and what an expression reads is never guessed from its text.
+const SHELLS = `"use strict"
+// JSON has no undefined, so the host sends it as this word.
+const __decode = (json) => (json === 'undefined' ? undefined : JSON.parse(json))
+function __shell(name) {
+	const keys = JSON.parse(__keys(name))
+	if (keys === null) return __decode(__whole(name))
+	const loaded = new Map()
+	const read = (k) => {
+		if (!loaded.has(k)) loaded.set(k, __decode(__entry(name, k)))
+		return loaded.get(k)
+	}
+	return new Proxy({}, {
+		get: (_, k) => (typeof k === 'string' && keys.includes(k) ? read(k) : Object.prototype[k]),
+		has: (_, k) => keys.includes(k) || k in Object.prototype,
+		ownKeys: () => keys,
+		getOwnPropertyDescriptor: (_, k) =>
+			keys.includes(k) ? { get: () => read(k), enumerable: true, configurable: true } : undefined,
+		set: () => false,
+		defineProperty: () => false,
+		deleteProperty: () => false
+	})
+}
+`
+
+/**
+ * Evaluates `expr` with the keys of `scope` as its only names. Throws on any error, and while the
+ * engine is loading: read it in an effect, which re-runs once the engine is in. `placeholders`
+ * swaps text over 1 MB for its size, for callers that only take the answer's truthiness: a step
+ * input would keep the placeholder as its value.
+ */
+export function evalSandboxed(
+	expr: string,
+	scope: Record<string, unknown>,
+	placeholders = false
+): any {
+	const body = bodyOf(expr)
+	const cheap = cheapAnswer(body, scope)
+	if (cheap) return cheap.value
+	quickjsReady()
+	if (!engine) {
+		throw new Error(`The expression engine ${failed ? 'failed to load' : 'is still loading'}`)
+	}
+	const rt = engine.newRuntime()
+	rt.setMemoryLimit(MEMORY_LIMIT)
+	rt.setMaxStackSize(STACK_LIMIT)
+	const deadline = Date.now() + TIMEOUT_MS
+	rt.setInterruptHandler(() => Date.now() > deadline)
+	const vm = rt.newContext()
+	try {
+		const host: Record<string, (...args: string[]) => string> = {
+			__keys: (name: string) => {
+				const v = scope[name]
+				return v && typeof v === 'object' && !Array.isArray(v)
+					? JSON.stringify(Object.keys(v))
+					: 'null'
+			},
+			__whole: (name: string) => copyIn(scope[name], name, placeholders),
+			__entry: (name: string, key: string) =>
+				copyIn((scope[name] as Record<string, unknown>)[key], `${name}.${key}`, placeholders)
+		}
+		for (const [fnName, fn] of Object.entries(host)) {
+			// The interrupt handler runs only between engine steps, not during these copies.
+			const handle = vm.newFunction(fnName, (...args) => {
+				if (Date.now() > deadline) throw new Error('Interrupted')
+				return vm.newString(fn(...args.map((a) => vm.getString(a))))
+			})
+			vm.setProp(vm.global, fnName, handle)
+			handle.dispose()
+		}
+		const names = Object.keys(scope)
+		const code = `${SHELLS}
+${names.map((n) => `const ${n} = __shell(${JSON.stringify(n)})`).join('\n')}
+;(() => {
+return ${body}
+})()`
+		const result = vm.unwrapResult(vm.evalCode(code))
+		try {
+			return vm.dump(result)
+		} finally {
+			result.dispose()
+		}
+	} finally {
+		// A runtime interrupted by the page's own stack overflow fails its leak check here, and that
+		// error would replace the one the expression raised. Its memory is lost either way.
+		try {
+			vm.dispose()
+			rt.dispose()
+		} catch {}
+	}
+}
+
+/**
+ * Whether a field with `expr` as its `showExpr` is shown for `args`, or undefined while the engine
+ * loads. Undefined means decide nothing: hiding a field deletes its value.
+ */
+export function computeShow(expr: string | undefined, args: any): boolean | undefined {
+	if (!expr) return true
+	const scope = { fields: args ?? {} }
+	const cheap = cheapAnswer(bodyOf(expr), scope)
+	if (cheap) return Boolean(cheap.value)
+	quickjsReady()
+	if (!quickjsSettled()) return undefined
+	try {
+		return Boolean(evalSandboxed(expr, scope, true))
+	} catch (e) {
+		console.error(`Impossible to eval ${expr}:`, e)
+		return true
+	}
+}
diff --git a/frontend/src/lib/utils/quickjsEval.test.ts b/frontend/src/lib/utils/quickjsEval.test.ts
new file mode 100644
index 0000000000..505ecc1b6e
--- /dev/null
+++ b/frontend/src/lib/utils/quickjsEval.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest'
+import { computeShow, evalSandboxed, quickjsReady } from './quickjsEval.svelte'
+
+describe('quickjsEval', () => {
+	it('answers plain lookups and comparisons without the engine', () => {
+		const results = { 'my step': { rows: [1, 2] }, a: { mode: 'x' } }
+		expect(computeShow('fields.mode === "advanced"', { mode: 'advanced' })).toBe(true)
+		expect(computeShow('return fields.n != 0', { n: 0 })).toBe(false)
+		expect(evalSandboxed('results["my step"].rows', { results })).toBe(results['my step'].rows)
+		expect(evalSandboxed('results.a.mode == "x"', { results })).toBe(true)
+		expect(computeShow("fields.output_type !== 'image'", { output_type: 'image' })).toBe(false)
+		expect(computeShow(`fields['q'] === 'it\\'s "x"'`, { q: `it's "x"` })).toBe(true)
+		const started = performance.now()
+		expect(computeShow('fields' + ' '.repeat(30_000) + '!', {})).toBeUndefined()
+		expect(performance.now() - started).toBeLessThan(50)
+	})
+
+	it('decides nothing until the engine is in', async () => {
+		expect(computeShow('fields.a + 1 === 2', { a: 1 })).toBeUndefined()
+		expect(computeShow('fields.constructor', { a: 1 })).toBeUndefined()
+		await quickjsReady()
+		expect(computeShow('fields.a + 1 === 2', { a: 1 })).toBe(true)
+		expect(computeShow('\nfields.a + 1 === 2', { a: 1 })).toBe(true)
+		expect(computeShow('fields.x === "\\x41"', { x: 'A' })).toBe(true)
+		expect(computeShow('fields["\\x41"] === 1', { A: 1 })).toBe(true)
+		expect(computeShow('fields.', {})).toBe(true)
+		expect(computeShow('fields.n === 01', { n: 2 })).toBe(true)
+	})
+
+	it('reaches nothing of the page and stops runaway expressions', async () => {
+		await quickjsReady()
+		const scope = { fields: {} }
+		expect(evalSandboxed('typeof window + typeof document + typeof fetch', scope)).toBe(
+			'undefinedundefinedundefined'
+		)
+		expect(() => evalSandboxed('(() => { while (true) {} })()', scope)).toThrow()
+		expect(evalSandboxed('1 + 1', scope)).toBe(2)
+		expect(evalSandboxed('1 + 1', {})).toBe(2)
+		expect(() =>
+			evalSandboxed('(() => { function f() { return f() } return f() })()', scope)
+		).toThrow(/stack overflow/)
+		const rows = Array.from({ length: 110_000 }, (_, i) => `item-${i}-xxxxxx`)
+		const started = performance.now()
+		expect(() =>
+			evalSandboxed('(() => { for (let i = 0; i < 300; i++) __entry("r", "rows") })()', {
+				r: { rows }
+			})
+		).toThrow()
+		expect(performance.now() - started).toBeLessThan(3000)
+	})
+
+	it('copies in only the entries an expression reads', async () => {
+		await quickjsReady()
+		const results = {
+			a: { x: 1 },
+			b: { y: 2 },
+			big: { rows: Array.from({ length: 300_000 }, (_, i) => ({ i, s: 'xxxxxxxxxx' })) }
+		}
+		expect(evalSandboxed('`${results.a.x}`', { results })).toBe('1')
+		expect(evalSandboxed('((k) => results[k].y)("b")', { results })).toBe(2)
+		expect(evalSandboxed('Object.keys(results).length', { results })).toBe(3)
+		expect(evalSandboxed('({ ...small }).b.y', { small: { a: results.a, b: results.b } })).toBe(2)
+		expect(evalSandboxed('results.hasOwnProperty("a") && "a" in results', { results })).toBe(true)
+		expect(evalSandboxed('JSON.stringify({ a: results.a, b: results.b })', { results })).toBe(
+			'{"a":{"x":1},"b":{"y":2}}'
+		)
+		expect(() => evalSandboxed('results.big.rows.length + 0', { results })).toThrow(
+			/results.big is over 5 MB/
+		)
+		expect(() => evalSandboxed('(results.a = 1)', { results })).toThrow()
+		expect(evalSandboxed('"gpt-" + 4', { flow_input: undefined, results: undefined })).toBe('gpt-4')
+		expect(
+			evalSandboxed('fields.optional ?? "fallback"', { fields: { optional: undefined } })
+		).toBe('fallback')
+	})
+
+	it('stands in for large text only where the answer is a yes or no', async () => {
+		await quickjsReady()
+		const file = 'x'.repeat(2 * 2 ** 20)
+		expect(computeShow('fields.file.tooLarge && fields.file.length > 0', { file })).toBe(true)
+		expect(evalSandboxed('flow_input.file || ""', { flow_input: { file } })).toBe(file)
+		const huge = 'x'.repeat(6 * 2 ** 20)
+		expect(() => evalSandboxed('flow_input.file || ""', { flow_input: { file: huge } })).toThrow(
+			/flow_input.file is over 5 MB/
+		)
+	})
+})
diff --git a/frontend/src/lib/utils_deployable.ts b/frontend/src/lib/utils_deployable.ts
index 63ea88adcb..e3f7fa83ed 100644
--- a/frontend/src/lib/utils_deployable.ts
+++ b/frontend/src/lib/utils_deployable.ts
@@ -16,7 +16,7 @@ import {
 	type WorkspaceDeployUISettings
 } from './gen'
 import type { TriggerKind } from './components/triggers'
-import { base } from './base'
+import { apiBaseUrl } from './apiBaseUrl.svelte'
 
 type DeployUIType = 'script' | 'flow' | 'app' | 'resource' | 'variable' | 'secret' | 'trigger'
 
@@ -250,9 +250,7 @@ export async function getTriggersDeployData(
 			...gcpTrigger,
 			delivery_config: gcpTrigger.delivery_config ?? undefined,
 			base_endpoint:
-				gcpTrigger.delivery_type === 'push'
-					? (targetBaseUrl ?? `${window.location.origin}${base}`)
-					: undefined,
+				gcpTrigger.delivery_type === 'push' ? (targetBaseUrl ?? apiBaseUrl()) : undefined,
 			permissioned_as: onBehalfOf,
 			preserve_permissioned_as: preservePermissionedAs
 		}
@@ -320,7 +318,7 @@ export async function getTriggersDeployData(
 				base_endpoint:
 					azureTrigger.azure_mode === 'namespace_pull'
 						? undefined
-						: (targetBaseUrl ?? `${window.location.origin}${base}`),
+						: (targetBaseUrl ?? apiBaseUrl()),
 				permissioned_as: onBehalfOf,
 				preserve_permissioned_as: preservePermissionedAs
 			},
diff --git a/frontend/src/lib/utils_draft_deploy.ts b/frontend/src/lib/utils_draft_deploy.ts
index 31b973f9a5..df04bb383a 100644
--- a/frontend/src/lib/utils_draft_deploy.ts
+++ b/frontend/src/lib/utils_draft_deploy.ts
@@ -510,6 +510,7 @@ export async function deployDraft(
 				// deploying user without this flag, gated by can_preserve_on_behalf_of.
 				preserve_on_behalf_of: d.on_behalf_of_email ? true : undefined,
 				labels: d.labels,
+				job_token_scopes: d.job_token_scopes,
 				deployment_message: deploymentMessage
 			}
 			// Draft-only flows have NO flow row (they live solely in the
diff --git a/frontend/src/lib/utils_workspace_deploy.ts b/frontend/src/lib/utils_workspace_deploy.ts
index ba1f293678..fa50805e3a 100644
--- a/frontend/src/lib/utils_workspace_deploy.ts
+++ b/frontend/src/lib/utils_workspace_deploy.ts
@@ -314,7 +314,7 @@ function makeProvider(
 		existsTriggerByKind: (kind, p) => triggerServiceFor(kind).exists(p),
 		getTriggerForDeploy: async (kind, p) => {
 			// Reuses the existing per-kind transform map (e.g. GCP wipes
-			// subscription_id and computes base_endpoint from window.location).
+			// subscription_id and computes base_endpoint for this instance).
 			// Operational-state strip is applied by the shared `deployItem`
 			// after this returns.
 			const { data } = await getTriggersDeployData(
@@ -779,7 +779,8 @@ const KIND_GATED_BY_DEPLOY_RULES: Record<Kind, boolean> = {
 	email_trigger: false,
 	datatable_migration: false,
 	trigger: false,
-	data_pipeline: false
+	// Deploying a pipeline deploys its scripts.
+	data_pipeline: true
 }
 
 // Every gated kind is spelled identically in `Kind` and `UserDraftItemKind`, so one lookup serves
diff --git a/frontend/src/lib/workspaceCreation.ts b/frontend/src/lib/workspaceCreation.ts
index 34c1644462..0a31d66a96 100644
--- a/frontend/src/lib/workspaceCreation.ts
+++ b/frontend/src/lib/workspaceCreation.ts
@@ -13,7 +13,6 @@ import { SettingService, UserService, WorkspaceService } from '$lib/gen'
 import { usersWorkspaceStore } from '$lib/stores'
 import { switchWorkspace } from '$lib/storeUtils'
 import { isCloudHosted } from '$lib/cloud'
-import { base } from '$lib/base'
 import { WORKSPACE_NAME_MAX_LENGTH } from '$lib/utils/workspaceId'
 
 /**
@@ -30,7 +29,7 @@ import { WORKSPACE_NAME_MAX_LENGTH } from '$lib/utils/workspaceId'
 export async function canCreateWorkspace(isSuperadmin: boolean): Promise<boolean> {
 	if (isSuperadmin || isCloudHosted()) return true
 	try {
-		const r = await fetch(base + '/api/workspaces/create_workspace_require_superadmin')
+		const r = await fetch('/api/workspaces/create_workspace_require_superadmin')
 		if ((await r.text()) != 'true') return true
 		return !!(await UserService.globalWhoami()).super_admin
 	} catch {
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index e6d834c816..5edf490220 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -12,10 +12,13 @@
 		UserService,
 		WorkspaceService
 	} from '$lib/gen'
-	import { capitalize, classNames, getModifierKey, sendUserToast } from '$lib/utils'
+	import { capitalize, classNames, debounce, getModifierKey, sendUserToast } from '$lib/utils'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
-	import { isSessionPreviewFrame } from '$lib/components/sessions/sessionMode.svelte'
-	import WorkspaceMenu from '$lib/components/sidebar/WorkspaceMenu.svelte'
+	import {
+		isMenuHidden,
+		isSessionPreviewFrame,
+		rememberMenuHidden
+	} from '$lib/components/sessions/sessionMode.svelte'
 	import SidebarContent from '$lib/components/sidebar/SidebarContent.svelte'
 	import SettingsMenu from '$lib/components/sidebar/SettingsMenu.svelte'
 	import SidebarUsage from '$lib/components/sidebar/SidebarUsage.svelte'
@@ -65,17 +68,27 @@
 		getFavoriteHref,
 		getFavoriteLabel
 	} from '$lib/components/sidebar/FavoriteMenu.svelte'
-	import {
-		parseSuperadminSettingsHash,
-		USER_SETTINGS_HASH
-	} from '$lib/components/sidebar/settings'
+	import { parseSuperadminSettingsHash, USER_SETTINGS_HASH } from '$lib/components/sidebar/settings'
 	import { isCloudHosted } from '$lib/cloud'
-	import { PanelLeftClose, PanelLeftOpen, Home, Play, Search, WandSparkles } from 'lucide-svelte'
+	import {
+		PanelLeft,
+		PanelLeftClose,
+		PanelLeftDashed,
+		PanelLeftOpen,
+		Home,
+		Play,
+		Search,
+		WandSparkles
+	} from 'lucide-svelte'
 	import { getUserExt } from '$lib/user'
 	import { confirmPendingLoginMethod } from '$lib/lastLoginMethod'
 	import { deepEqual } from 'fast-equals'
 	import { twMerge } from 'tailwind-merge'
-	import OperatorMenu from '$lib/components/sidebar/OperatorMenu.svelte'
+	import { navDetached } from '$lib/components/sidebar/navDetached.svelte'
+	import { navHandleSlot } from '$lib/components/sidebar/navHandlePlacement.svelte'
+	import PageHeaderBar from '$lib/components/PageHeaderBar.svelte'
+	import { BAR_HEIGHT_PX, pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
+	import { sidebarPageAllowed } from '$lib/components/sidebar/operatorRoutes'
 	import type GlobalSearchModal from '$lib/components/search/GlobalSearchModal.svelte'
 	import MenuButton from '$lib/components/sidebar/MenuButton.svelte'
 	import MenuLink from '$lib/components/sidebar/MenuLink.svelte'
@@ -88,24 +101,23 @@
 	import InstanceBanner from '$lib/components/InstanceBanner.svelte'
 	import InstanceUiSync from '$lib/components/InstanceUiSync.svelte'
 	import { onDestroy, setContext, untrack } from 'svelte'
-	import { base } from '$app/paths'
-	import { Menubar } from '$lib/components/meltComponents'
+	import { cubicOut } from 'svelte/easing'
+	import { Menubar, Tooltip } from '$lib/components/meltComponents'
 	import { aiChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
 	import AiChatLayout from '$lib/components/copilot/chat/AiChatLayout.svelte'
 	import SessionPicker from '$lib/components/sessions/SessionPicker.svelte'
 	import SessionModeSwitch from '$lib/components/sessions/SessionModeSwitch.svelte'
-	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	import { isGlobalAiEnabled, sessionsAllowedFor } from '$lib/components/copilot/chat/global/gate'
 	import { copilotInfo } from '$lib/aiStore'
 	import {
 		isPageItemListPath,
 		parsePreviewItemRoute,
-		stripBase
+		barePath
 	} from '$lib/components/sessions/previewPaths'
 	import { rememberNavRoute } from '$lib/components/sessions/sessionSwitch.svelte'
 	import { sessionState } from '$lib/components/sessions/sessionState.svelte'
 	import { restoreSessionBackups } from '$lib/components/sessions/sessionMirror.svelte'
 	import { currentWorkspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
-	import WorkspaceScopeHeader from '$lib/components/sidebar/WorkspaceScopeHeader.svelte'
 	import { DEFAULT_HUB_BASE_URL } from '$lib/hub'
 	import S3FilePicker from '$lib/components/S3FilePicker.svelte'
 	import { useIsDarkMode } from '$lib/components/DarkModeObserver.svelte'
@@ -143,10 +155,13 @@
 	// Persisted nav-rail collapse preference. A deliberate collapse writes to it —
 	// the manual toggle and a drag past the collapse threshold. The contextual
 	// auto-collapse (app-mode routes, narrow widths) mutates the in-memory
-	// `isCollapsed` without persisting, so it stays transient and never gets
+	// `collapsedState` without persisting, so it stays transient and never gets
 	// "stuck" collapsed across reloads.
 	const collapsePref = useLocalStorageValue<boolean>('nav_menu_collapsed', false, 'boolean')
-	let isCollapsed = $state(collapsePref.val)
+	let collapsedState = $state(collapsePref.val)
+	// Operators never get the icon-only rail: their docked sidebar is always expanded (a sidebar
+	// they want out of the way is what detaching is for).
+	let isCollapsed = $derived(collapsedState && !$userStore?.operator)
 
 	// Resizable desktop rail, sized in REM so it scales with the root font-size the
 	// same way the old `w-52`/`w-12` classes did — `:root` jumps to 18px on screens
@@ -188,6 +203,15 @@
 	let sidebarTransitionClass = $derived(
 		resizingSidebar && !sidebarSnapping ? '' : 'transition-all duration-200 ease-in-out'
 	)
+	// The band spans two edges that different things move. Its left follows the rail, so it
+	// eases with it; its right follows a splitter the page owns (a session's side panel),
+	// which tracks the pointer. Easing that one leaves the band lying over the panel it is
+	// meant to stop beside — an empty strip across that panel's own header until it catches up.
+	let bandTransitionClass = $derived(
+		resizingSidebar && !sidebarSnapping
+			? ''
+			: 'transition-[left,padding-left] duration-200 ease-in-out'
+	)
 	// Set while a drag is live so it can be torn down if the layout unmounts
 	// mid-drag (otherwise the window listeners would leak).
 	let stopSidebarResize: (() => void) | null = null
@@ -207,15 +231,25 @@
 		resizingSidebar = true
 		// Re-expanding a snap-collapsed rail restores the width it had before the drag.
 		const widthAtStart = sidebarWidth
-		const collapsedAtStart = isCollapsed
+		const collapsedAtStart = collapsedState
 		// The rail is fixed at left:0, so the pointer's clientX is the width — in px.
 		// Convert to rem (the unit the rail is sized in) via the root font-size. The
 		// rail clamps at the min like a wall, until the pointer reaches the snap zone.
 		const onMove = (ev: PointerEvent) => {
 			const x = ev.clientX / rootFontPx()
 			const collapse = x < SIDEBAR_SNAP_COLLAPSE_REM
-			if (collapse !== isCollapsed) {
-				isCollapsed = collapse
+			// Operators have no icon-only rail to snap to, so the same gesture detaches
+			// instead: dragging the sidebar off the left edge puts it behind the handle.
+			// Detaching is not a resize, so the width the drag started from is what gets
+			// persisted — re-attaching restores the sidebar at the size it had.
+			if (collapse && $userStore?.operator) {
+				sidebarWidth = widthAtStart
+				stop()
+				setDetached(true)
+				return
+			}
+			if (collapse !== collapsedState) {
+				collapsedState = collapse
 				sidebarSnapping = true
 				clearTimeout(sidebarSnapTimer)
 				sidebarSnapTimer = setTimeout(() => (sidebarSnapping = false), 200)
@@ -231,7 +265,7 @@
 			clearTimeout(sidebarSnapTimer)
 			sidebarSnapping = false
 			widthPref.val = sidebarWidth
-			if (isCollapsed !== collapsedAtStart) collapsePref.val = isCollapsed
+			if (collapsedState !== collapsedAtStart) collapsePref.val = collapsedState
 			window.removeEventListener('pointermove', onMove)
 			window.removeEventListener('pointerup', stop)
 			window.removeEventListener('pointercancel', stop)
@@ -265,7 +299,10 @@
 	// Session mode is route-derived: the rail shows the sessions sidebar on the
 	// /sessions page and the workspace navigation everywhere else. The switch
 	// (SessionModeSwitch) just navigates in and out of that route.
-	let sessionMode = $derived(page.url.pathname.startsWith(base + '/sessions'))
+	// An operator without the opt-in (`gate.ts`) is refused by /sessions, so their sidebar is not
+	// handed over to a session list the page behind it declines, and they keep the docked chat.
+	const sessionsAllowed = $derived(sessionsAllowedFor($userStore?.operator))
+	let sessionMode = $derived(page.url.pathname.startsWith('/sessions') && sessionsAllowed)
 	// Session mode points the bottom settings entry at the open session's own
 	// workspace. An unsent draft hasn't committed one yet, so it falls back to
 	// the family root.
@@ -286,8 +323,12 @@
 	const globalAiEnabled = isGlobalAiEnabled()
 	// A workspace that hid the assistant (`ai_config.copilot_disabled`) loses both entry
 	// points: the Workspace ⇄ Sessions switch and the legacy Ask-AI button.
-	const sessionsSwitchShown = $derived(globalAiEnabled && !$copilotInfo.workspaceDisabled)
-	const askAiShown = $derived(!globalAiEnabled && !$copilotInfo.workspaceDisabled)
+	const sessionsSwitchShown = $derived(
+		globalAiEnabled && sessionsAllowed && !$copilotInfo.workspaceDisabled
+	)
+	const askAiShown = $derived(
+		(!globalAiEnabled || !sessionsAllowed) && !$copilotInfo.workspaceDisabled
+	)
 
 	if (page.status == 404) {
 		goto('/user/login')
@@ -314,27 +355,10 @@
 			$workspaceStore = queryWorkspace
 		}
 
-		// When this window is an iframe (e.g. the sessions preview), keep the menu
-		// hidden once `nomenubar` has been requested: navigating inside the preview
-		// drops the query param (both client-side routing and full-document loads),
-		// and we don't want the global nav to pop back in. Stickiness is stored in
-		// sessionStorage so it survives full reloads within the iframe's browsing
-		// context. The top window is unaffected (embedded is false there), so the
-		// oauth-callback case and ordinary navigation still toggle normally.
-		const embedded = typeof window !== 'undefined' && window.self !== window.top
-		const requested = page.url.searchParams.get('nomenubar') === 'true'
-		if (embedded && requested) {
-			try {
-				sessionStorage.setItem('nomenubar_embedded', 'true')
-			} catch {}
-		}
-		let stickyEmbedded = false
-		if (embedded) {
-			try {
-				stickyEmbedded = sessionStorage.getItem('nomenubar_embedded') === 'true'
-			} catch {}
-		}
-		menuHidden = requested || page.url.pathname.startsWith('/oauth/callback/') || stickyEmbedded
+		// Pages read the same rule (a page whose only control lives in the band has to carry it
+		// itself where there is no band), so it is defined once in sessionMode.
+		rememberMenuHidden(page.url)
+		menuHidden = isMenuHidden(page.url)
 	}
 
 	async function updateUserStore(workspace: string | undefined) {
@@ -443,7 +467,7 @@
 			}
 			// A list page mounts in process too, where its rows open as tabs of their own.
 			const listUrl = navigation.to?.url
-			if (listUrl && isPageItemListPath(stripBase(listUrl.pathname))) {
+			if (listUrl && isPageItemListPath(barePath(listUrl.pathname))) {
 				navigation.cancel()
 				const u = new URL(listUrl.href)
 				u.searchParams.delete('nomenubar')
@@ -471,6 +495,79 @@
 	})
 
 	let innerWidth = $state(BROWSER ? window.innerWidth : 2000)
+	// The sidebar leaves the layout and becomes a card under the band's handle when it is
+	// detached, and below 768px, where a 13rem rail would take a third of the screen. One
+	// presentation for both: a phone gets the card the handle already opens, not a modal.
+	let useDrawer = $derived(innerWidth < 768 || navDetached.val)
+	// Hover opened the card, so the pointer leaving closes it — where there is a pointer to
+	// leave. A tap opened it on a touch screen, and it stays until it is dismissed.
+	const hoverPointer = BROWSER && window.matchMedia('(hover: hover)').matches
+	const peeksOnHover = $derived(useDrawer && hoverPointer)
+	// The peek card is a hover affordance, so it goes away when the pointer does — off the handle
+	// and off the card both. The delay is what lets the pointer cross the gap between them: they
+	// do not touch, and the leave of the one fires before the enter of the other.
+	const PEEK_CLOSE_DELAY_MS = 200
+	// Both the card and the band open menus, and a menu portals to `body` (overlayPortalTarget),
+	// so the pointer moving into one leaves the surface that opened it. A surface has to outlive
+	// its own menus or it slides out from under the one being read: hold while the pointer is in a
+	// menu, and take the close from the leave of that instead.
+	function pointerInMenu(): boolean {
+		return !!document.querySelector('[role="menu"]:hover')
+	}
+	const { debounced: schedulePeekClose, clearDebounce: cancelPeekClose } = debounce(() => {
+		if (!peeksOnHover) return
+		if (pointerInMenu()) {
+			schedulePeekClose()
+			return
+		}
+		menuOpen = false
+	}, PEEK_CLOSE_DELAY_MS)
+
+	// A page that owns the right edge from the top — a session's side panel — makes the band float
+	// and stop where that column starts, instead of running over it.
+	const floatBand = $derived(pageHeader.content?.barRightInset != null)
+
+	// The handle and the edge band both open the card this layout owns.
+	navHandleSlot.setOpener(() => (menuOpen = true), {
+		schedule: schedulePeekClose,
+		cancel: cancelPeekClose
+	})
+
+	// Set once the user docks or detaches, so the rail that mounts from then on skips its
+	// app-entry animation (`wm-sidebar-in`) and only plays `railMorph`.
+	let dockToggled = $state(false)
+	function setDetached(detached: boolean) {
+		dockToggled = true
+		menuOpen = false
+		navDetached.val = detached
+	}
+	// Docking and detaching move and resize the rail itself between its docked box and the detached
+	// card's (top at the band's bottom edge, bottom and left insets, rounded corners); detaching
+	// also slides it off the left edge, where the closed card lives. No opacity: the rail never
+	// fades.
+	// The footer's icon buttons wear the rail's own row box — 32px square, 16px glyph — so the
+	// pair that hides and collapses the sidebar lines up with the links above them, collapsed or
+	// not. Padding alone drifted: two different paddings, two icon sizes and a negative margin.
+	const SIDEBAR_ICON_BUTTON =
+		'h-8 w-8 flex items-center justify-center rounded hover:bg-surface-hover flex-shrink-0'
+
+	const RAIL_MORPH_MS = 200
+	function railMorph(_node: HTMLElement, { offscreen }: { offscreen: boolean }) {
+		const reduced = window.matchMedia('(prefers-reduced-motion: reduce)').matches
+		// The card is always the default width; a rail the user widened resizes to or from it.
+		const docked = railWidth
+		return {
+			duration: reduced ? 0 : RAIL_MORPH_MS,
+			easing: cubicOut,
+			css: (t: number, u: number) =>
+				`top:${u * BAR_HEIGHT_PX}px; bottom:${u * 8}px; left:${u * 4}px; border-radius:${u * 8}px; overflow:hidden;` +
+				`width:${SIDEBAR_MIN_REM + (docked - SIDEBAR_MIN_REM) * t}rem;` +
+				(offscreen ? `transform:translateX(calc(${-u} * (100% + 0.5rem)));` : '')
+		}
+	}
+	// Matches the edge band's `duration-200`, so the drawer opens as the tint finishes.
+	const EDGE_OPEN_DELAY_MS = 200
+	let edgeOpenTimer: ReturnType<typeof setTimeout> | undefined
 
 	function onLoad() {
 		loadFavorites()
@@ -621,18 +718,22 @@
 		// Remember the last navigation-mode route so exiting session mode returns
 		// the user where they were rather than to the home page.
 		const to = n.to?.url
-		if (to && !to.pathname.startsWith(base + '/sessions')) {
+		if (to && !to.pathname.startsWith('/sessions')) {
 			rememberNavRoute(to.pathname + to.search)
 		}
 	})
 
+	// Narrow enough that the rail is in the way: collapse it, transiently (see `collapsedState`).
+	// The drawer widths below 768 are included — there the sidebar is a modal panel over the page,
+	// and a window that has been that narrow should come back to the icon rail rather than to a
+	// 13rem one it no longer has room for.
 	function changeCollapsed() {
-		if (innerWidth < 1248 && innerWidth >= 768 && !isCollapsed) {
-			isCollapsed = true
+		if (innerWidth < 1248 && !collapsedState) {
+			collapsedState = true
 		}
 	}
 
-	let devOnly = $derived(page.url.pathname.startsWith(base + '/scripts/dev'))
+	let devOnly = $derived(page.url.pathname.startsWith('/scripts/dev'))
 
 	async function loadDefaultScripts(workspace: string, user: UserExt | undefined) {
 		if (!user?.operator) {
@@ -741,7 +842,15 @@
 			workspace,
 			skipSubscriptionFetch: true // won't load subscription status from stripe but only the past due status from db
 		})
-		if (premiumInfo.is_past_due) {
+		if (premiumInfo.is_canceled) {
+			// Its last month runs on a cap too, but nothing is unpaid: only speak up once it bites
+			if ((premiumInfo.usage ?? 0) > (premiumInfo.max_tolerated_executions ?? 0)) {
+				sendUserToast(
+					"Your team plan was canceled and this month's paid executions are used up. Jobs can run again on the free plan from the 1st, or subscribe again in the workspace settings.",
+					true
+				)
+			}
+		} else if (premiumInfo.is_past_due) {
 			if (
 				premiumInfo.max_tolerated_executions === undefined ||
 				(premiumInfo.usage ?? 0) > premiumInfo.max_tolerated_executions
@@ -778,7 +887,7 @@
 	$effect(() => {
 		const ws = $workspaceStore
 		const ready = sessionState.hydrated && $usersWorkspaceStore !== undefined
-		if (globalAiEnabled && ready && ws && !$userStore?.operator) {
+		if (globalAiEnabled && sessionsAllowed && ready && ws) {
 			untrack(() => restoreSessionBackups(ws))
 		}
 	})
@@ -884,11 +993,6 @@
 	$effect(() => {
 		$workspaceStore && $userStore && untrack(() => loadDefaultScripts($workspaceStore!, $userStore))
 	})
-	$effect(() => {
-		if (isCollapsed && $userStore?.operator) {
-			isCollapsed = false
-		}
-	})
 	$effect(() => {
 		if (
 			$enterpriseLicense &&
@@ -946,7 +1050,7 @@
 	<MenuLink
 		class="!text-xs"
 		label="Home"
-		href={`${base}/`}
+		href="/"
 		icon={Home}
 		isCollapsed={collapsed}
 		aiId="sidebar-menu-link-home"
@@ -955,8 +1059,13 @@
 	<MenuLink
 		class="!text-xs"
 		label="Runs"
-		href={`${base}/runs`}
+		href="/runs"
 		icon={Play}
+		disabled={!sidebarPageAllowed(
+			$userStore?.operator,
+			$userWorkspaces?.find((w) => w.id === $workspaceStore),
+			'runs'
+		)}
 		isCollapsed={collapsed}
 		aiId="sidebar-menu-link-runs"
 		aiDescription="Button to navigate to runs"
@@ -982,6 +1091,30 @@
 
 <!-- Windmill brand mark anchoring the sidebar bottom (the header slot is taken
      by the workspace picker). -->
+<!-- Detaching is the operator's control: they have no icon-only rail to collapse to, so hiding the
+     sidebar is how they give the page its width back. A developer collapses instead, and never
+     detaches — but one who detached before this was so keeps the way back, or they would be stuck
+     with a sidebar they cannot return. -->
+{#snippet sidebarToggle()}
+	{@const hidden = navDetached.val}
+	{#if hidden || $userStore?.operator}
+		<Tooltip class="flex" placement="bottom" small>
+			<button
+				class={SIDEBAR_ICON_BUTTON}
+				aria-label={hidden ? 'Show sidebar' : 'Hide sidebar'}
+				onclick={() => setDetached(!hidden)}
+			>
+				{#if hidden}
+					<PanelLeft size={16} class="flex-shrink-0 text-hint" />
+				{:else}
+					<PanelLeftDashed size={16} class="flex-shrink-0 text-hint" />
+				{/if}
+			</button>
+			{#snippet text()}{hidden ? 'Show sidebar' : 'Hide sidebar'}{/snippet}
+		</Tooltip>
+	{/if}
+{/snippet}
+
 {#snippet brandMark(collapsed: boolean)}
 	<div class="flex items-center gap-x-1.5 text-xs font-semibold text-emphasis">
 		<WindmillIcon white={darkMode} height="16px" width="16px" />
@@ -1006,6 +1139,164 @@
 	</div>
 {/snippet}
 
+<!-- The sidebar's one column, rendered in whichever shell the width calls for: the rail docked
+     at the left edge, or the same column as a panel over the page (`panel`) below 768px and
+     whenever the nav is detached. The shells differ, the sections do not, so a change to the
+     rail cannot miss the panel. -->
+{#snippet sidebarColumn(panel: boolean)}
+	{@const collapsed = panel ? false : isCollapsed}
+	<div
+		class={twMerge(
+			'flex flex-col',
+			panel
+				? 'h-full w-52'
+				: 'flex-1 min-h-0 shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151] [html.github-dark_&]:shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))]'
+		)}
+		style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
+	>
+		{#if !panel}
+			<!-- Resize handle straddling the right edge: drag to resize, into the
+			     left snap zone to collapse, or out of it to expand. -->
+			<div
+				role="separator"
+				aria-orientation="vertical"
+				aria-label="Resize sidebar"
+				title="Drag to resize"
+				class={classNames(
+					'absolute inset-y-0 -right-0.5 w-1.5 cursor-col-resize z-50 transition-colors',
+					resizingSidebar ? '' : 'hover:bg-surface-hover'
+				)}
+				onpointerdown={startSidebarResize}
+			></div>
+		{/if}
+		<!-- Top row: the workspace ⇄ sessions switch, level with the page header's own
+		     row so the two read as one band. The workspace picker itself lives in that
+		     header, which is why nothing names the workspace here. -->
+		{#if !embedded && sessionsSwitchShown}
+			<div
+				class="flex-shrink-0 px-2 gap-1 flex {collapsed
+					? 'flex-col items-center py-2'
+					: 'h-12 items-center'}"
+			>
+				<div class="min-w-0 flex-1">
+					<SessionModeSwitch
+						mode={sessionMode ? 'session' : 'nav'}
+						isCollapsed={collapsed}
+						onToggle={panel ? () => (preserveMenuOnNextNav = true) : undefined}
+					/>
+				</div>
+			</div>
+		{/if}
+
+		{#if sessionMode}
+			<!-- Session mode: the session list owns the column. Workspace nav moves
+			     into the preview side panel (the iframe renders its own nav). -->
+			<div class="px-2 py-2 flex flex-col gap-1 flex-1 min-h-0 overflow-y-auto">
+				<SessionPicker isCollapsed={collapsed} embedded collapsible={false} />
+			</div>
+			{@render settingsMenu(collapsed)}
+		{:else}
+			<!-- Navigation mode: Home → Settings scroll as ONE block with an
+			     overflow fade hint. The three sections (Home/Runs + Favorites +
+			     Search / workspace items / instance settings) are spaced by the
+			     scroll area's gap rather than each scrolling on its own. -->
+			<SidebarScrollArea color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
+				<!-- Section 1: Home/Runs + Favorites + Search -->
+				<div class="px-2 pt-1 flex flex-col gap-1">
+					{@render quickLinks(collapsed)}
+					<Menubar class="flex flex-col gap-1">
+						{#snippet children({ createMenu })}
+							<FavoriteMenu
+								{createMenu}
+								favoriteLinks={favoriteManager.current}
+								isCollapsed={collapsed}
+							/>
+						{/snippet}
+					</Menubar>
+					<MenuButton
+						stopPropagationOnClick={true}
+						on:click={() => openSearchModal()}
+						isCollapsed={collapsed}
+						icon={Search}
+						label="Search"
+						class="!text-xs"
+						shortcut={`${getModifierKey()}k`}
+					/>
+					{#if askAiShown}
+						<!-- Legacy Ask-AI pane, shown only when the user opted out of the
+						     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
+						<MenuButton
+							stopPropagationOnClick={true}
+							on:click={() => aiChatManager.toggleOpen()}
+							isCollapsed={collapsed}
+							icon={WandSparkles}
+							iconProps={{ forceDarkMode: true }}
+							label="Ask AI"
+							class="!text-xs"
+							iconClasses="!text-ai"
+							shortcut={`${getModifierKey()}L`}
+						/>
+					{/if}
+				</div>
+
+				<!-- Section 2: workspace items -->
+				<SidebarContent
+					isCollapsed={collapsed}
+					showSecondary={false}
+					excludeMainLabels={['Home', 'Runs']}
+					numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
+						? 0
+						: numUnacknowledgedCriticalAlerts}
+				/>
+
+				<!-- Section 3: instance settings — mt-auto drops it to the bottom
+				     when the column has spare room, and collapses back to the normal
+				     inter-section gap once the content overflows and scrolls. -->
+				<div class="mt-auto">
+					{@render settingsMenu(collapsed)}
+				</div>
+			</SidebarScrollArea>
+		{/if}
+
+		<div class="flex-shrink-0">
+			{@render accountSetupBanner(collapsed)}
+			<SidebarUsage isCollapsed={collapsed} />
+		</div>
+
+		<div
+			class="flex-shrink-0 flex pt-3 pb-3.5 {collapsed
+				? 'flex-col items-center gap-3'
+				: 'items-center justify-between px-4'}"
+		>
+			{@render brandMark(collapsed)}
+			<div class="flex {collapsed ? 'flex-col gap-3' : 'gap-3'}">
+				{#if !panel || navDetached.val}
+					{@render sidebarToggle()}
+				{/if}
+				<!-- Collapsing belongs to the rail: the panel is over the page already, and the way
+				     out of it is the handle in the band or a click outside. -->
+				{#if !panel && !$userStore?.operator}
+					<button
+						class={SIDEBAR_ICON_BUTTON}
+						title={collapsed ? 'Expand sidebar' : 'Collapse sidebar'}
+						onclick={() => {
+							collapsedState = !collapsedState
+							// Manual toggle is the persisted preference (auto-collapse isn't).
+							collapsePref.val = collapsedState
+						}}
+					>
+						{#if collapsed}
+							<PanelLeftOpen size={16} class="flex-shrink-0 text-hint" />
+						{:else}
+							<PanelLeftClose size={16} class="flex-shrink-0 text-hint" />
+						{/if}
+					</button>
+				{/if}
+			</div>
+		</div>
+	</div>
+{/snippet}
+
 <!-- The drawers and modals below are dynamic imports mounted on first open: this layout
      wraps every workspace page, so a static import gates first paint, and a load on mount
      competes with the page for bandwidth (several of them reach monaco). -->
@@ -1045,431 +1336,112 @@
 			<div class="fixed inset-0 z-50 cursor-col-resize select-none"></div>
 		{/if}
 		{#if !menuHidden}
-			{#if !$userStore?.operator}
-				{#if innerWidth < 768}
+			{#if navDetached.val && hoverPointer && !menuOpen && !devOnly}
+				<!-- Edge band: the other way to reach a detached sidebar. It opens only once its
+				     tint has faded in, so a pointer brushing the screen edge does not open it. -->
+				<div
+					class="fixed inset-y-0 left-0 w-2 z-[4999] transition-colors duration-200 ease-out hover:bg-surface-accent-selected"
+					aria-hidden="true"
+					onmouseenter={() => {
+						clearTimeout(edgeOpenTimer)
+						edgeOpenTimer = setTimeout(() => navHandleSlot.open(), EDGE_OPEN_DELAY_MS)
+					}}
+					onmouseleave={() => {
+						clearTimeout(edgeOpenTimer)
+						schedulePeekClose()
+					}}
+				></div>
+			{/if}
+			{#if useDrawer}
+				<!-- `inert` while closed, not only `pointer-events-none`: the card stays mounted so it
+				     can slide rather than pop, and a card parked off the left edge still holds every
+				     one of its links in the tab order. -->
+				<div
+					class={classNames(
+						'relative',
+						menuOpen ? 'z-40' : 'pointer-events-none',
+						devOnly ? 'hidden' : ''
+					)}
+					inert={!menuOpen}
+					role="dialog"
+				>
+					<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+					<!-- The card floats over the page, inset and rounded. Over an app it is not: the app
+					     owns the window, and the sidebar revealed beside it reads as the panel the header
+					     sits on — flush to the left and bottom edges, square, with one border down its
+					     right side. -->
+					<!-- This outside-click catcher starts where the card does rather than at the top of
+					     the viewport: it would otherwise cover the header's toggle, whose hover opened the
+					     card, and swallow the click meant to put the sidebar back. -->
 					<div
-						class={classNames(
-							'relative',
-							menuOpen ? 'z-40' : 'pointer-events-none',
-							devOnly ? 'hidden' : ''
-						)}
-						role="dialog"
-						aria-modal="true"
+						class={classNames('fixed left-0 right-0 bottom-0 flex z-40', 'pl-1 pb-2')}
+						style:top="{navHandleSlot.cardTop}px"
+						onclick={(e) => {
+							if (e.target === e.currentTarget) menuOpen = false
+						}}
 					>
+						<!-- svelte-ignore a11y_no_static_element_interactions -->
 						<div
+							data-nav-card
+							onmouseenter={() => {
+								cancelPeekClose()
+							}}
+							onmouseleave={() => {
+								schedulePeekClose()
+							}}
 							class={classNames(
-								'fixed inset-0 bg-black/50 transition-opacity ease-linear duration-300 z-40',
-
-								menuOpen ? 'opacity-100' : 'opacity-0'
+								'relative flex-1 flex flex-col max-w-min w-full bg-surface transition ease-in-out duration-300 transform shadow-lg overflow-hidden rounded-lg border',
+								menuOpen ? 'translate-x-0' : '-translate-x-[calc(100%+0.5rem)]'
 							)}
-						></div>
-
-						<div class="fixed inset-0 flex z-40">
-							<div
-								class={classNames(
-									'relative flex-1 flex flex-col max-w-min w-full bg-surface transition ease-in-out duration-300 transform',
-									menuOpen ? 'translate-x-0' : '-translate-x-full'
-								)}
-							>
-								<div
-									class={classNames(
-										'absolute top-0 right-4 -mr-12 pt-2 ease-in-out duration-300',
-										menuOpen ? 'opacity-100' : 'opacity-0'
-									)}
-								>
-									<button
-										type="button"
-										onclick={() => {
-											menuOpen = !menuOpen
-										}}
-										class="ml-1 flex items-center justify-center h-6 w-6 rounded-full focus:outline-none focus:ring-2 focus:ring-inset focus:ring-white border border-white"
-										aria-label="Close"
-									>
-										<svg
-											class="h-4 w-4 text-white"
-											xmlns="http://www.w3.org/2000/svg"
-											fill="none"
-											viewBox="0 0 24 24"
-											stroke-width="2"
-											stroke="currentColor"
-											aria-hidden="true"
-										>
-											<path
-												stroke-linecap="round"
-												stroke-linejoin="round"
-												d="M6 18L18 6M6 6l12 12"
-											/>
-										</svg>
-									</button>
-								</div>
-								<div
-									class="h-full flex flex-col"
-									style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
-								>
-									<!-- Workspace picker as the drawer header (replaces the Windmill logo). -->
-									<div class="flex-shrink-0 px-2 h-12 w-52 flex items-center">
-										<Menubar class="w-full">
-											{#snippet children({ createMenu })}
-												<WorkspaceMenu {createMenu} />
-											{/snippet}
-										</Menubar>
-									</div>
-
-									{#if !embedded && sessionsSwitchShown}
-										<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
-										<div class="px-2 pb-1 w-52">
-											<SessionModeSwitch
-												mode={sessionMode ? 'session' : 'nav'}
-												onToggle={() => (preserveMenuOnNextNav = true)}
-											/>
-										</div>
-									{/if}
-
-									{#if !sessionMode}
-										<!-- Workspace scope (fork picker): part of the top workspace group. -->
-										<div class="pb-1 w-52 {sessionsSwitchShown ? '' : '-mt-1'}">
-											<WorkspaceScopeHeader isCollapsed={false} />
-										</div>
-									{/if}
-
-									{#if sessionMode}
-										<!-- Session mode: the session list owns the rail.
-										     w-52 cap (matches the desktop sidebar width): the drawer is
-										     max-w-min, and long session titles (nowrap before truncation)
-										     would otherwise inflate its min-content width to the full
-										     text width. -->
-										<div class="px-2 py-2 w-52">
-											<SessionPicker isCollapsed={false} embedded collapsible={false} />
-										</div>
-										{@render settingsMenu(false)}
-									{:else}
-										<!-- Navigation mode: Home → Settings scroll as ONE block with an
-										     overflow fade hint (same treatment as the desktop rail). -->
-										<SidebarScrollArea color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
-											<!-- Section 1: Home/Runs + Favorites + Search -->
-											<div class="px-2 pt-1 w-52 flex flex-col gap-1">
-												{@render quickLinks(false)}
-												<Menubar>
-													{#snippet children({ createMenu })}
-														<FavoriteMenu {createMenu} favoriteLinks={favoriteManager.current} />
-													{/snippet}
-												</Menubar>
-												<MenuButton
-													stopPropagationOnClick={true}
-													on:click={() => openSearchModal()}
-													isCollapsed={false}
-													icon={Search}
-													label="Search"
-													class="!text-xs"
-													shortcut={`${getModifierKey()}k`}
-												/>
-												{#if askAiShown}
-													<!-- Legacy Ask-AI pane, shown only when the user opted out of the
-													     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
-													<MenuButton
-														stopPropagationOnClick={true}
-														on:click={() => aiChatManager.toggleOpen()}
-														isCollapsed={false}
-														icon={WandSparkles}
-														iconProps={{ forceDarkMode: true }}
-														label="Ask AI"
-														class="!text-xs"
-														iconClasses="!text-ai"
-														shortcut={`${getModifierKey()}L`}
-													/>
-												{/if}
-											</div>
-
-											<!-- Section 2: workspace items -->
-											<SidebarContent
-												isCollapsed={false}
-												showSecondary={false}
-												excludeMainLabels={['Home', 'Runs']}
-												numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
-													? 0
-													: numUnacknowledgedCriticalAlerts}
-											/>
-
-											<!-- Section 3: instance settings — mt-auto drops it to the bottom
-											     when there is spare room (see the desktop rail for the rationale). -->
-											<div class="mt-auto">
-												{@render settingsMenu(false)}
-											</div>
-										</SidebarScrollArea>
-									{/if}
-
-									<div class="w-52">
-										{@render accountSetupBanner(false)}
-										<SidebarUsage isCollapsed={false} />
-									</div>
-
-									<div class="px-4 pt-3 pb-3.5 w-52">
-										{@render brandMark(false)}
-									</div>
-								</div>
-							</div>
-						</div>
-					</div>
-				{:else}
-					<div
-						id="sidebar"
-						class={classNames(
-							'wm-sidebar-in flex flex-col fixed inset-y-0 z-40 ',
-							sidebarTransitionClass,
-							devOnly ? '!hidden' : ''
-						)}
-						style:width="{railWidth}rem"
-					>
-						<div
-							class="flex-1 flex flex-col min-h-0 h-screen shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151] [html.github-dark_&]:shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))]"
-							style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
 						>
-							<!-- Resize handle straddling the right edge: drag to resize, into the
-							     left snap zone to collapse, or out of it to expand. -->
-							<div
-								role="separator"
-								aria-orientation="vertical"
-								aria-label="Resize sidebar"
-								title="Drag to resize"
-								class={classNames(
-									'absolute inset-y-0 -right-0.5 w-1.5 cursor-col-resize z-50 transition-colors',
-									resizingSidebar ? '' : 'hover:bg-surface-hover'
-								)}
-								onpointerdown={startSidebarResize}
-							></div>
-							<!-- Workspace picker as the sidebar header (replaces the Windmill logo).
-							     Kept in both modes: it scopes which workspace family's sessions
-							     the sessions sidebar shows. -->
-							<div class="flex-shrink-0 px-2 h-12 flex items-center">
-								<Menubar class="w-full">
-									{#snippet children({ createMenu })}
-										<WorkspaceMenu {createMenu} {isCollapsed} />
-									{/snippet}
-								</Menubar>
-							</div>
-
-							{#if !embedded && sessionsSwitchShown}
-								<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
-								<div class="px-2 pb-1 {isCollapsed ? 'flex justify-center' : ''}">
-									<SessionModeSwitch mode={sessionMode ? 'session' : 'nav'} {isCollapsed} />
-								</div>
-							{/if}
-
-							{#if !sessionMode}
-								<!-- Workspace scope (fork picker): part of the top workspace group,
-								     together with the family menu and the mode switch above. Without
-								     the switch, pull it up so the group still reads as one block. -->
-								<div class="pb-1 {sessionsSwitchShown ? '' : '-mt-1'}">
-									<WorkspaceScopeHeader {isCollapsed} />
-								</div>
-							{/if}
-
-							{#if sessionMode}
-								<!-- Session mode: the session list owns the rail. Workspace nav moves
-								     into the preview side panel (the iframe renders its own nav). -->
-								<div class="px-2 py-2 flex flex-col gap-1 flex-1 min-h-0 overflow-y-auto">
-									<SessionPicker {isCollapsed} embedded collapsible={false} />
-								</div>
-								{@render settingsMenu(isCollapsed)}
-							{:else}
-								<!-- Navigation mode: Home → Settings scroll as ONE block with an
-								     overflow fade hint. The three sections (Home/Runs + Favorites +
-								     Search / workspace items / instance settings) are spaced by the
-								     scroll area's gap rather than each scrolling on its own. -->
-								<SidebarScrollArea color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
-									<!-- Section 1: Home/Runs + Favorites + Search -->
-									<div class="px-2 pt-1 flex flex-col gap-1">
-										{@render quickLinks(isCollapsed)}
-										<Menubar class="flex flex-col gap-1">
-											{#snippet children({ createMenu })}
-												<FavoriteMenu
-													{createMenu}
-													favoriteLinks={favoriteManager.current}
-													{isCollapsed}
-												/>
-											{/snippet}
-										</Menubar>
-										<MenuButton
-											stopPropagationOnClick={true}
-											on:click={() => openSearchModal()}
-											{isCollapsed}
-											icon={Search}
-											label="Search"
-											class="!text-xs"
-											shortcut={`${getModifierKey()}k`}
-										/>
-										{#if askAiShown}
-											<!-- Legacy Ask-AI pane, shown only when the user opted out of the
-											     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
-											<MenuButton
-												stopPropagationOnClick={true}
-												on:click={() => aiChatManager.toggleOpen()}
-												{isCollapsed}
-												icon={WandSparkles}
-												iconProps={{ forceDarkMode: true }}
-												label="Ask AI"
-												class="!text-xs"
-												iconClasses="!text-ai"
-												shortcut={`${getModifierKey()}L`}
-											/>
-										{/if}
-									</div>
-
-									<!-- Section 2: workspace items -->
-									<SidebarContent
-										{isCollapsed}
-										showSecondary={false}
-										excludeMainLabels={['Home', 'Runs']}
-										numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
-											? 0
-											: numUnacknowledgedCriticalAlerts}
-									/>
-
-									<!-- Section 3: instance settings — mt-auto drops it to the bottom
-									     when the column has spare room, and collapses back to the normal
-									     inter-section gap once the content overflows and scrolls. -->
-									<div class="mt-auto">
-										{@render settingsMenu(isCollapsed)}
-									</div>
-								</SidebarScrollArea>
-							{/if}
-
-							<div class="flex-shrink-0">
-								{@render accountSetupBanner(isCollapsed)}
-								<SidebarUsage {isCollapsed} />
-							</div>
-
-							<div
-								class="flex-shrink-0 flex pt-3 pb-3.5 {isCollapsed
-									? 'flex-col items-center gap-3'
-									: 'items-center justify-between px-4'}"
-							>
-								{@render brandMark(isCollapsed)}
-								<!-- p-2/-m-2 widens the hit area to ~32px without moving the icon. -->
-								<button
-									class="p-2 -m-2 rounded hover:bg-surface-hover"
-									title={isCollapsed ? 'Expand sidebar' : 'Collapse sidebar'}
-									onclick={() => {
-										isCollapsed = !isCollapsed
-										// Manual toggle is the persisted preference (auto-collapse isn't).
-										collapsePref.val = isCollapsed
-									}}
-								>
-									{#if isCollapsed}
-										<PanelLeftOpen size={14} class="flex-shrink-0 h-3.5 w-3.5 text-hint" />
-									{:else}
-										<PanelLeftClose size={14} class="flex-shrink-0 h-3.5 w-3.5 text-hint" />
-									{/if}
-								</button>
-							</div>
+							{@render sidebarColumn(true)}
 						</div>
 					</div>
-				{/if}
+				</div>
 			{:else}
-				<div class="absolute top-1 left-1 z5000">
-					<OperatorMenu favoriteLinks={favoriteManager.current} />
+				<div
+					id="sidebar"
+					class={classNames(
+						dockToggled ? '' : 'wm-sidebar-in',
+						// The rail owns the full height of the left edge; the band starts to its right.
+						'flex flex-col fixed inset-y-0 z-40 ',
+						sidebarTransitionClass,
+						devOnly ? '!hidden' : ''
+					)}
+					style:width="{railWidth}rem"
+					in:railMorph={{ offscreen: false }}
+					out:railMorph={{ offscreen: true }}
+				>
+					{@render sidebarColumn(false)}
 				</div>
 			{/if}
-			<!-- Legacy menu -->
-			<div
-				class={classNames(
-					'fixed inset-0 bg-black/50 transition-opacity ease-linear duration-300',
-					'opacity-0 pointer-events-none'
-				)}
-			>
-				<div class={twMerge('fixed inset-0 flex ', '-z-0')}>
-					<div
-						class={classNames(
-							'relative flex-1 flex flex-col max-w-min w-full bg-surface transition ease-in-out duration-100 transform',
-							'-translate-x-full'
-						)}
-					>
-						<div
-							class={classNames(
-								'absolute top-0 right-0 -mr-12 pt-2 ease-in-out duration-100',
-								'opacity-0'
-							)}
-						>
-							<button
-								type="button"
-								onclick={() => {
-									// menuSlide = !menuSlide
-								}}
-								aria-label="Close"
-								class="ml-1 flex items-center justify-center h-8 w-8 rounded-full focus:outline-none focus:ring-2 focus:ring-inset focus:ring-white border border-white"
-							>
-								<svg
-									class="h-6 w-6 text-white"
-									xmlns="http://www.w3.org/2000/svg"
-									fill="none"
-									viewBox="0 0 24 24"
-									stroke-width="2"
-									stroke="currentColor"
-									aria-hidden="true"
-								>
-									<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
-								</svg>
-							</button>
-						</div>
-						<div class="h-full" style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}>
-							<div
-								class="flex gap-x-2 flex-shrink-0 p-4 font-semibold text-emphasis w-10"
-								class:w-40={!isCollapsed}
-							>
-								<WindmillIcon white={darkMode} height="20px" width="20px" />
-								{#if !isCollapsed}{#if $whitelabelNameStore}{capitalize(
-											$whitelabelNameStore
-										)}{:else}Windmill{/if}{/if}
-							</div>
-
-							<div class="px-2 py-4 space-y-2 border-y border-light dark:border-gray-700">
-								<Menubar>
-									{#snippet children({ createMenu })}
-										<WorkspaceMenu {createMenu} />
-										<FavoriteMenu {createMenu} favoriteLinks={favoriteManager.current} />
-									{/snippet}
-								</Menubar>
-								<MenuButton
-									stopPropagationOnClick={true}
-									on:click={() => openSearchModal()}
-									{isCollapsed}
-									icon={Search}
-									label="Search"
-									class="!text-xs"
-									shortcut={`${getModifierKey()}k`}
-								/>
-								{#if !$copilotInfo.workspaceDisabled}
-									<MenuButton
-										stopPropagationOnClick={true}
-										on:click={() => aiChatManager.toggleOpen()}
-										{isCollapsed}
-										icon={WandSparkles}
-										iconProps={{
-											forceDarkMode: true
-										}}
-										label="Ask AI"
-										class="!text-xs"
-										iconClasses="!text-ai"
-										shortcut={`${getModifierKey()}L`}
-									/>
-								{/if}
-							</div>
-
-							<SidebarContent
-								{isCollapsed}
-								numUnacknowledgedCriticalAlerts={isCriticalAlertsUiMuted
-									? 0
-									: numUnacknowledgedCriticalAlerts}
-							/>
-						</div>
-					</div>
-				</div>
-			</div>
 		{/if}
-		<div class="flex flex-col h-full w-full">
+		<div class="flex flex-col h-full w-full relative">
 			<!-- Not gated on `$enterpriseLicense`: it paints the cached accent before the license
 			     resolves, and checks the license itself. -->
 			<InstanceUiSync />
+			<!-- `menuHidden` hides the workspace navigation, not the page: an embedded Runs or detail
+			     page keeps its own controls, which now live in this band and nowhere else. The band
+			     renders without its breadcrumb there, so the embed gains no workspace nav. -->
+			{#if !devOnly && (!menuHidden || pageHeader.actions.length > 0)}
+				{@const rightInset = pageHeader.content?.barRightInset}
+				{@const leftInset = useDrawer || menuHidden ? 0 : railWidth}
+				<!-- One element for every placement, styled rather than branched: a page registers its
+				     inset on mount, and swapping between two `{#if}` arms would destroy the band and
+				     build another one a frame later — a blink of no header, with the content sliding
+				     up into the gap and the workspace menu losing the trigger it hangs from.
+				     In flow, the band spans the content beside the rail. With an inset, a page owns
+				     the right edge from the top (a session's side panel): the band floats, stopping
+				     where that column starts, and the page pads its own content to clear it. -->
+				<div
+					class={classNames(floatBand ? 'absolute top-0 z-30' : 'shrink-0', bandTransitionClass)}
+					style:left={floatBand ? `${leftInset}rem` : undefined}
+					style:right={floatBand ? `${rightInset ?? 0}px` : undefined}
+					style:padding-left={floatBand ? undefined : `${leftInset}rem`}
+				>
+					<PageHeaderBar navHidden={menuHidden} panelled={useDrawer} />
+				</div>
+			{/if}
 			{#if $enterpriseLicense && !menuHidden}
 				<!-- Announcements are an EE feature, so the component never mounts on CE. Also
 				     skipped when the menu is hidden — that is an embed or an OAuth callback,
@@ -1509,21 +1481,15 @@
 					</button>
 				</div>
 			{/if}
-			<!-- Operators are exempt from the sessions beta: their minimal sidebar has
-			     no Workspace ⇄ Sessions switch, so disabling the docked chat would leave
-			     their "Ask AI" button toggling an unmounted pane. -->
 			<AiChatLayout
 				{children}
 				noPadding={devOnly || menuHidden}
-				disableAi={globalAiEnabled && !$userStore?.operator ? true : sessionMode}
+				disableAi={globalAiEnabled && sessionsAllowed ? true : sessionMode}
 				loadAiConfig={!sessionMode}
-				showSessionsBetaBanner={!$userStore?.operator}
+				showSessionsBetaBanner={sessionsAllowed}
 				sidebarWidth={railWidth}
 				transitionClass={sidebarTransitionClass}
-				isMobile={innerWidth < 768}
-				onMenuOpen={() => {
-					menuOpen = true
-				}}
+				isMobile={useDrawer}
 			/>
 		</div>
 	</div>
diff --git a/frontend/src/routes/(root)/(logged)/+page.svelte b/frontend/src/routes/(root)/(logged)/+page.svelte
index d6c29c53e3..c20698fae0 100644
--- a/frontend/src/routes/(root)/(logged)/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/+page.svelte
@@ -12,18 +12,19 @@
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
 	import { ExternalLink, GitFork, Globe2, Loader2, Code, LayoutDashboard } from 'lucide-svelte'
 	import { hubBaseUrlStore } from '$lib/stores'
-	import { base } from '$lib/base'
 
 	import ItemsList from '$lib/components/home/ItemsList.svelte'
 	import PickHubApp from '$lib/components/flows/pickers/PickHubApp.svelte'
 	import { writable } from 'svelte/store'
 	import type { EditorBreakpoint } from '$lib/components/apps/types'
 	import { setQuery } from '$lib/navigation'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
 	import { page } from '$app/state'
 	import { goto, replaceState } from '$app/navigation'
 	import ForkWorkspaceBanner from '$lib/components/ForkWorkspaceBanner.svelte'
 	import WorkspaceDraftsBanner from '$lib/components/WorkspaceDraftsBanner.svelte'
 	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import { useSearchParams } from '$lib/svelte5UtilsKit.svelte'
 	import { z } from 'zod'
 	import HomeAIChat from '$lib/components/home/HomeAIChat.svelte'
@@ -92,6 +93,22 @@
 
 	let showCreateButtons = $state(false)
 
+	// A workspace switch keeps this page mounted and swaps its contents under the reader, which
+	// the mount animation below never covers. Replay it by hand instead of keying the page on the
+	// workspace: a remount would drop the list's own state and refetch what it is already loading.
+	let pageEl: HTMLDivElement | undefined = $state(undefined)
+	const reducedMotion = useReducedMotion()
+	let animatedWorkspace = $workspaceStore
+	$effect(() => {
+		const ws = $workspaceStore
+		if (ws === animatedWorkspace) return
+		animatedWorkspace = ws
+		untrack(() => {
+			if (!pageEl || reducedMotion.val) return
+			pageEl.animate([{ opacity: 0 }, { opacity: 1 }], { duration: 500, easing: 'ease-out' })
+		})
+	})
+
 	let operatorTour: OperatorTour | undefined = $state(undefined)
 
 	// Delayed so the tabs the first steps point at exist. `runTutorial` refuses while a tour is
@@ -145,7 +162,7 @@
 				</div>
 			</Button>
 			<Button
-				href="{base}/scripts/add?hub={encodeURIComponent(codeViewerObj?.path ?? '')}"
+				href="/scripts/add?hub={encodeURIComponent(codeViewerObj?.path ?? '')}"
 				startIcon={{ icon: GitFork }}
 				variant="accent"
 				size="xs"
@@ -182,7 +199,7 @@
 			</Button>
 
 			<Button
-				href="{base}/flows/add?hub={flowViewerFlow?.flow?.id}"
+				href="/flows/add?hub={flowViewerFlow?.flow?.id}"
 				startIcon={{ icon: GitFork }}
 				variant="accent"
 				size="xs"
@@ -224,7 +241,7 @@
 			</Button>
 
 			<Button
-				href="{base}/apps/add?hub={appViewerApp?.app?.id}"
+				href="/apps/add?hub={appViewerApp?.app?.id}"
 				startIcon={{ icon: GitFork }}
 				variant="accent"
 				disabled={appViewerApp == undefined}
@@ -262,16 +279,25 @@
 	</DrawerContent>
 </Drawer>
 
+{#snippet editRuleBadge()}
+	<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
+{/snippet}
+
 <div
+	bind:this={pageEl}
 	class="wm-page-in flex flex-col w-full h-full overflow-y-auto items-center"
 	style="scrollbar-gutter: stable both-edges;"
 >
+	<!-- Where edits to this workspace are made is a fact about the workspace, so it sits in the
+	     header with the workspace's own name rather than above the list. -->
+	<PageHeaderContent actions={editRuleBadge} />
+
 	<ForkWorkspaceBanner />
 	<WorkspaceDraftsBanner />
 	<div class="max-w-7xl px-4 sm:px-8 md:px-8 h-fit w-full mb-6">
 		<!-- HomeAIChat carries both the AI composer and the AI-independent CLI/MCP connect row,
-		     so it shows whenever the sessions beta is on; the composer itself is gated on operator
-		     status and on the workspace inside the component, which owns its own vertical spacing
+		     so it shows whenever the sessions beta is on; the composer itself is gated on the
+		     workspace inside the component, which owns its own vertical spacing
 		     because the hero and the bare connect row want different amounts of it. -->
 		{#if isGlobalAiEnabled()}
 			<HomeAIChat />
@@ -285,8 +311,6 @@
 			<div class="my-4"></div>
 		{/if}
 
-		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
-
 		{#if tab == 'hub'}
 			<div class="flex flex-col gap-y-16">
 				<div class="flex flex-col pb-8">
diff --git a/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte
index b4539d0a8e..a67ba2dcfa 100644
--- a/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/agents/edit/[...path]/+page.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { untrack } from 'svelte'
 	import { page } from '$app/state'
-	import { base } from '$lib/base'
 	import { goto } from '$lib/navigation'
 	import { copilotInfo } from '$lib/aiStore'
 	import AgentEditorModal from '$lib/components/flows/content/AgentEditorModal.svelte'
@@ -17,15 +16,15 @@
 	})
 </script>
 
-<div class="h-screen w-full">
+<div class="h-full w-full">
 	<AgentEditorModal
 		layout="page"
 		enableAi={$copilotInfo.enabled}
 		owns={(t) => t.host === undefined}
-		onClose={(deployed) => goto(deployed ? `${base}/agents/get/${path}` : `${base}/?kind=agent`)}
+		onClose={(deployed) => goto(deployed ? `/agents/get/${path}` : `/?kind=agent`)}
 		onDeployed={(saved) =>
 			// Replaced, not pushed, when this URL stopped naming what it opens: Back would otherwise
 			// reopen `new_draft` on an agent that now exists, or a path a rename just moved away from.
-			goto(`${base}/agents/get/${saved}`, { replaceState: isNew || saved !== path })}
+			goto(`/agents/get/${saved}`, { replaceState: isNew || saved !== path })}
 	/>
 </div>
diff --git a/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte
index f6de4c078e..ceb37c0a10 100644
--- a/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte
@@ -2,7 +2,6 @@
 	import { page } from '$app/state'
 	import { FlaskConical, FormInput, MessageSquare, Pen } from 'lucide-svelte'
 	import { resource } from 'runed'
-	import { base } from '$lib/base'
 	import { goto } from '$lib/navigation'
 	import { copilotInfo } from '$lib/aiStore'
 	import AgentEvalsModal from '$lib/components/flows/content/AgentEvalsModal.svelte'
@@ -15,10 +14,12 @@
 	import AgentEditorHost from '$lib/components/flows/content/AgentEditorHost.svelte'
 	import AgentConfigModal from '$lib/components/flows/content/AgentConfigModal.svelte'
 	import RunForm from '$lib/components/RunForm.svelte'
+	import { Alert } from '$lib/components/common'
 	import { keepsManagedMemory } from '$lib/components/flows/agentFormFields'
 	import { agentMenuItems, deleteAgent } from '$lib/components/flows/agentActions'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
 
 	/**
 	 * The deployed agent, as a flow's or a script's page shows theirs: a way to run it, a chat when
@@ -27,6 +28,8 @@
 	let path = $derived(page.params.path ?? '')
 	let ws = $derived($workspaceStore)
 
+	/** Bumped to read the agent again after it was renamed in place. */
+	let reloaded = $state(0)
 	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
 	let agent = $derived(host?.draftHandle())
 	let testPane = $derived(host?.testPaneHandle())
@@ -39,9 +42,24 @@
 	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state(undefined)
 	let deleteOpen = $state(false)
 	let evalsModal: AgentEvalsModal | undefined = $state(undefined)
+	let runForm: RunForm | undefined = $state(undefined)
+	let isValid = $state(true)
+
+	// Cmd/Ctrl+Enter runs the form, as on a script's or a flow's page. The form stays mounted, hidden,
+	// while the chat shows, and the chat's composer owns the key then.
+	function onKeyDown(event: KeyboardEvent) {
+		if (event.defaultPrevented || event.key !== 'Enter' || !(event.ctrlKey || event.metaKey)) return
+		if (!runForm || testPane?.mode === 'chat') return
+		if (isValid) {
+			event.preventDefault()
+			runForm.run()
+		} else {
+			sendUserToast('Please fix errors before running', true)
+		}
+	}
 
 	async function remove() {
-		if (ws && (await deleteAgent(ws, path))) await goto(`${base}/?kind=agent`)
+		if (ws && (await deleteAgent(ws, path))) await goto('/?kind=agent')
 	}
 
 	// The workspace's, so a path change never waits on it and a menu never outlives its path.
@@ -86,11 +104,27 @@
 	<span>Every flow that links {path} will fail at its agent step once it is deleted.</span>
 </ConfirmationModal>
 
-<main class="h-screen w-full flex flex-col">
+<svelte:window onkeydown={onKeyDown} />
+
+<main class="h-full w-full flex flex-col">
+	<!-- `labels`: the pen saves every field it shows in one write, so the labels it shows have to be
+	     the ones the resource carries. Handed none, it would offer an empty list, and the first
+	     label added there would replace the agent's own. -->
 	<DetailPageHeader
+		ownsPageHeader
+		itemKind="agent"
 		summary={config ? agent?.state?.description : undefined}
+		labels={agent?.state?.labels}
 		{path}
 		{menuItems}
+		onSaved={canEdit
+			? async (newPath) => {
+					// A rename moves the page; a summary saved in place has to be read again, since
+					// what is shown here came from the load this page keys on.
+					if (newPath !== path) await goto(`/agents/get/${newPath}`)
+					else reloaded++
+				}
+			: undefined}
 		mainButtons={[
 			// Evaluating an agent builds datasets and runs against it: authoring, as editing is.
 			...(canEdit
@@ -111,7 +145,7 @@
 								variant: 'accent',
 								unifiedSize: 'md',
 								startIcon: Pen,
-								href: `${base}/agents/edit/${path}`
+								href: `/agents/edit/${path}`
 							}
 						}
 					]
@@ -154,7 +188,7 @@
 		{/snippet}
 	</DetailPageHeader>
 	<div class="flex-1 min-h-0">
-		{#key `${ws}:${path}`}
+		{#key `${ws}:${path}:${reloaded}`}
 			<AgentEditorHost
 				bind:this={host}
 				{path}
@@ -164,6 +198,14 @@
 				onOpenConfig={() => configModal?.open()}
 			>
 				{#snippet viewForm({ schema, run, loading, actions })}
+					{#if config && !chatAvailable}
+						<Alert type="info" size="xs" title="Managed memory is off" class="mb-4">
+							Each run is answered on its own inputs, so this agent has no chat. That suits reusing
+							it as a step in a flow.{canEdit
+								? ' Turn on managed memory in its configuration to chat with it.'
+								: ''}
+						</Alert>
+					{/if}
 					<RunForm
 						runnable={{ schema, path }}
 						runAction={run}
@@ -172,6 +214,8 @@
 						autofocus
 						{loading}
 						{actions}
+						bind:isValid
+						bind:this={runForm}
 					/>
 				{/snippet}
 			</AgentEditorHost>
diff --git a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
index e81dfb9e90..974d1c7f64 100644
--- a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
@@ -468,8 +468,9 @@
 
 {#key redraw}
 	{#if app}
-		<div class="h-screen">
+		<div class="h-full">
 			<AppEditor
+				ownsPageHeader
 				{fromHub}
 				onSavedNewAppPath={(url) => {
 					goto(`/apps/edit/${url}`)
diff --git a/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte
index 4ff8670cda..c911a8a64c 100644
--- a/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/get/[...path]/+page.svelte
@@ -24,7 +24,7 @@
 	     must fully remount — otherwise the previous app (and in sandbox mode its
 	     path-scoped token) sticks around. -->
 	{#key `${workspace}/${path}`}
-		<InWorkspaceAppViewer {workspace} {path} />
+		<InWorkspaceAppViewer {workspace} {path} ownsPageHeader />
 	{/key}
 {:else}
 	<Skeleton layout={[10]} />
diff --git a/frontend/src/routes/(root)/(logged)/apps/get_raw/[version]/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/get_raw/[version]/[...path]/+page.svelte
index dbba9ce790..edc0c2d918 100644
--- a/frontend/src/routes/(root)/(logged)/apps/get_raw/[version]/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/get_raw/[version]/[...path]/+page.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { goto } from '$app/navigation'
-	import { base } from '$app/paths'
 	import { page } from '$app/state'
 	import { onMount } from 'svelte'
 
@@ -12,6 +11,6 @@
 	// component (not a load redirect) because `url.hash` is unavailable in `load`.
 	onMount(() => {
 		const path = page.params.path ?? ''
-		goto(`${base}/apps_raw/get/${path}${page.url.search}${page.url.hash}`, { replaceState: true })
+		goto(`/apps_raw/get/${path}${page.url.search}${page.url.hash}`, { replaceState: true })
 	})
 </script>
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.ts b/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.ts
index ea96e67846..8bd1ba1ba3 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.ts
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.ts
@@ -1,6 +1,42 @@
+import { redirect } from '@sveltejs/kit'
+import { get } from 'svelte/store'
 import { makeDraftAddLoad } from '$lib/draftAddRedirect'
+import { mintDraftPath } from '$lib/mintDraftPath'
+import { userStore, workspaceStore } from '$lib/stores'
+import { copilotInfo, copilotWorkspace } from '$lib/aiStore'
+import { loadCopilot } from '$lib/components/copilot/loadCopilot'
+import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
+import { editorSessionHref } from '$lib/components/sessions/sessionSwitch.svelte'
+import { importStore } from '$lib/components/apps/store'
 import type { PageLoad } from './$types'
 
 export const prerender = false
 
-export const load: PageLoad = makeDraftAddLoad('apps_raw/edit')
+const openInEditor = makeDraftAddLoad('apps_raw/edit')
+
+/** A blank new app is set up in an AI session, the recommended way to build one, whenever
+ * the user has sessions and AI to build with. Anything that arrives with content of its
+ * own (an import, a seeded path) is an editor hand-off and stays one. */
+async function newAppSessionHref(url: URL): Promise<string | undefined> {
+	let hasOwnParams = false
+	url.searchParams.forEach((_, k) => (hasOwnParams ||= k !== 'workspace'))
+	if (hasOwnParams || get(importStore) || sessionStorage.getItem('rawAppImport')) {
+		return undefined
+	}
+	const user = get(userStore)
+	const workspace = get(workspaceStore)
+	// Neither is known yet on a cold load of this URL, which then opens the editor.
+	if (!user || !workspace || !prefersSessionHandoff(user.operator)) return undefined
+	if ((url.searchParams.get('workspace') ?? workspace) !== workspace) return undefined
+	if (get(copilotWorkspace) !== workspace) await loadCopilot(workspace)
+	if (get(copilotWorkspace) !== workspace || !get(copilotInfo).enabled) return undefined
+	return editorSessionHref({ kind: 'raw_app', path: mintDraftPath() }, workspace, {
+		new_draft: 'true'
+	})
+}
+
+export const load: PageLoad = async (event) => {
+	const href = await newAppSessionHref(event.url)
+	if (href) redirect(307, href)
+	return openInEditor(event)
+}
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
index 7ecd115c4e..ee2bb8fdf7 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
-	import { onDestroy, untrack } from 'svelte'
+	import { onDestroy, tick, untrack } from 'svelte'
 	import { stripNewDraftFlag, stripNewDraftFlagOnSave, shouldSeedNewDraft } from '$lib/newDraftFlag'
 
 	import { AppService } from '$lib/gen'
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { useOperatorBuilderApps, workspaceListLoaded } from '$lib/operatorWriteRights'
+	import { conformBuilderAppPolicy } from '$lib/components/raw_apps/builderAppPolicy'
 	import { readFieldsRecursively } from '$lib/utils'
 	import { goto } from '$lib/navigation'
 	import { sendUserToast } from '$lib/toast'
@@ -11,6 +13,7 @@
 	import type { HiddenRunnable } from '$lib/components/apps/types'
 	import RawAppEditor from '$lib/components/raw_apps/RawAppEditor.svelte'
 	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
+	import { openEditorInSession } from '$lib/components/sessions/sessionSwitch.svelte'
 	import { stateSnapshot } from '$lib/svelte5Utils.svelte'
 	import { page } from '$app/state'
 	import {
@@ -28,9 +31,14 @@
 	import UnsavedConfirmationModal from '$lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte'
 	import { type OtherDraftUser } from '$lib/components/common/confirmationModal/OtherUsersDraftsModal.svelte'
 	import RawAppTemplatePicker, {
+		type RawAppBuildMode,
 		type RawAppTemplatePickerResult
 	} from '$lib/components/raw_apps/RawAppTemplatePicker.svelte'
-	import { react19Template, STARTER_RUNNABLES } from '$lib/components/raw_apps/templates'
+	import {
+		BUILDER_FRAMEWORK_TEMPLATES,
+		react19Template,
+		STARTER_RUNNABLES
+	} from '$lib/components/raw_apps/templates'
 	import { aiChatManager, AIMode } from '$lib/components/copilot/chat/AIChatManager.svelte'
 
 	type RawAppDraft = {
@@ -78,8 +86,8 @@
 		| undefined = $state(undefined)
 	let redraw = $state(0)
 	let path = page.params.path ?? ''
-	/** Opens the framework picker on a brand-new draft (`new_draft=true`):
-	 * React/Svelte + data config + optional AI prompt before the editor goes live. */
+	/** Opens the new-app picker on a brand-new draft (`new_draft=true`): build with AI, or pick
+	 * React/Svelte + data config before the editor goes live. */
 	let templatePicker = $state(false)
 
 	/** Deployed raw-app bundle this load, the baseline the autosave `discardIf`
@@ -95,6 +103,8 @@
 	// edits to the just-deployed app autosaved to a dead key (autosave appeared
 	// broken). See /scripts/edit, which derives its draft path the same way.
 	// effectivePath omitted: the live-editor-draft entry is owned by RawAppEditor.
+	const operatorBuilderApps = useOperatorBuilderApps()
+
 	const draftSync = usePageDraftSync<RawAppDraft>({
 		itemKind: 'raw_app',
 		path: () => page.params.path ?? '',
@@ -186,6 +196,8 @@
 		// `?new_draft` loads the saved draft instead of blanking it — see
 		// shouldSeedNewDraft.
 		if (shouldSeedNewDraft(page.url.searchParams, $workspaceStore, 'raw_app', path)) {
+			await workspaceListLoaded()
+			if (tok !== loadAppToken) return
 			isNewApp = true
 			// Page reused across same-route nav: clear the previous path's
 			// draft-presence state so it doesn't bleed onto the fresh draft.
@@ -268,8 +280,10 @@
 			}
 			// Seed the React 19 template so the editor has a usable state even if the
 			// user dismisses the picker without selecting.
-			const seedFiles = { ...react19Template }
-			const seedRunnables = structuredClone(STARTER_RUNNABLES)
+			const seedFiles = {
+				...($operatorBuilderApps ? BUILDER_FRAMEWORK_TEMPLATES.react19 : react19Template)
+			}
+			const seedRunnables = starterRunnables()
 			savedApp = {
 				summary: '',
 				value: { files: seedFiles as any, runnables: seedRunnables as any },
@@ -518,12 +532,56 @@
 
 	let rawAppEditor: RawAppEditor | undefined = $state()
 
-	function onTemplatePickerStart(result: RawAppTemplatePickerResult, withPrompt: boolean) {
-		files = { ...result.files }
-		runnables = { ...result.runnables, ...structuredClone(STARTER_RUNNABLES) }
-		data = result.data
-		summary = result.summary
-		policy = result.policy
+	// The starter runnables are inline scripts, which the backend refuses from an operator with
+	// builder rights: seeding them would make their very first deploy fail.
+	function starterRunnables() {
+		return $operatorBuilderApps ? {} : structuredClone(STARTER_RUNNABLES)
+	}
+
+	// The deploy panel cannot switch Viewer mode off, nor drop the identity an app another user
+	// deployed carries, so the editor conforms the policy as soon as it opens.
+	$effect(() => {
+		if ($operatorBuilderApps && policy) conformBuilderAppPolicy(policy, $userStore)
+	})
+
+	async function onTemplatePickerStart(result: RawAppTemplatePickerResult, mode: RawAppBuildMode) {
+		const picked = {
+			files: { ...result.files },
+			runnables: { ...result.runnables, ...starterRunnables() },
+			data: result.data,
+			summary: '',
+			policy: result.policy
+		}
+		const workspace = $workspaceStore
+		if (mode === 'ai' && prefersSessionHandoff($userStore?.operator) && workspace) {
+			// The session loads the app by path, so the picked setup is saved before it
+			// opens. `new_draft` tells it the app is still the starter template.
+			try {
+				draftSync.draft = {
+					...picked,
+					...(pendingDraftPath ? { draft_path: pendingDraftPath } : {})
+				} as RawAppDraft
+				// The autosave this write queues would otherwise land after the session has
+				// read the draft, leaving it a baseline older than the row.
+				await tick()
+				await UserDraftDbSyncer.flush({ workspace, itemKind: 'raw_app', path })
+				await UserDraft.forcePersist('raw_app', path, { workspace })
+				// A failed save is recorded, not thrown, and the session would open on nothing.
+				const saved = UserDraftDbSyncer.getState({ workspace, itemKind: 'raw_app', path })
+				if (saved.state === 'failed') {
+					throw new Error(saved.failureMessage ?? 'the app could not be saved')
+				}
+				await openEditorInSession({ kind: 'raw_app', path }, workspace, { new_draft: 'true' })
+				return
+			} catch (e) {
+				sendUserToast(`Could not open the AI session: ${e?.body ?? e?.message ?? e}`, true)
+			}
+		}
+		files = picked.files
+		runnables = picked.runnables
+		data = picked.data
+		summary = picked.summary
+		policy = picked.policy
 		// Remount RawAppEditor so the iframe picks up the new files.
 		redraw++
 		// Sync to aiChatManager so its prompts respect the picked data config.
@@ -533,22 +591,9 @@
 			schema: result.data.schema,
 			roles: result.data.roles
 		}
-		if (withPrompt && result.prompt) {
-			const prompt = result.prompt
-			// The delay lets the remount above settle: the session hand-off persists
-			// the draft the preview loads, and the docked path needs the editor to
-			// have registered its app helpers.
-			setTimeout(async () => {
-				// Falls through when the hand-off has no path to open, so the click
-				// still reaches the legacy path (or its toast) instead of vanishing.
-				if (prefersSessionHandoff($userStore?.operator)) {
-					if (await rawAppEditor?.openInSession(prompt)) return
-				}
-				aiChatManager.changeMode(AIMode.APP)
-				if (!aiChatManager.open) aiChatManager.toggleOpen()
-				aiChatManager.instructions = prompt
-				aiChatManager.sendRequest()
-			}, 500)
+		if (mode === 'ai') {
+			aiChatManager.changeMode(AIMode.APP)
+			if (!aiChatManager.open) aiChatManager.toggleOpen()
 		}
 	}
 </script>
@@ -603,9 +648,11 @@
 
 {#if files}
 	{#key redraw}
-		<div class="h-screen">
+		<div class="h-full">
 			<RawAppEditor
 				bind:this={rawAppEditor}
+				ownsPageHeader
+				onDetails={(e) => goto(`/apps_raw/get/${e.path}?workspace=${$workspaceStore}`)}
 				onSavedNewAppPath={(savedPath) => {
 					draftSync.remove()
 					goto(`/apps_raw/edit/${savedPath}`)
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte
index 79c8145731..672b0f9feb 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/get/[...path]/+page.svelte
@@ -18,7 +18,7 @@
 	<!-- Key by target: SvelteKit reuses this page component on in-route
 	     navigation, so the viewer must fully remount (see /apps/get). -->
 	{#key `${workspace}/${path}`}
-		<InWorkspaceAppViewer {workspace} {path} />
+		<InWorkspaceAppViewer {workspace} {path} ownsPageHeader />
 	{/key}
 {:else}
 	<Skeleton layout={[10]} />
diff --git a/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte b/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte
index 6f2917dcd1..42d8ff996e 100644
--- a/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/audit_logs/+page.svelte
@@ -7,9 +7,11 @@
 	import AuditLogsTable from '$lib/components/auditLogs/AuditLogsTable.svelte'
 	import AuditLogMobileFilters from '$lib/components/auditLogs/AuditLogMobileFilters.svelte'
 	import { Alert, DrawerContent, Skeleton } from '$lib/components/common'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
-	import SplitPanesWrapper from '$lib/components/splitPanes/SplitPanesWrapper.svelte'
+	import AnimatedPane from '$lib/components/splitPanes/AnimatedPane.svelte'
 
 	import type { AuditLog } from '$lib/gen'
 	import { AuditService } from '$lib/gen'
@@ -19,7 +21,6 @@
 	import { useAuditLogsLoader } from '$lib/components/auditLogs/useAuditLogsLoader.svelte'
 
 	let username: string = $state(page.url.searchParams.get('username') ?? 'all')
-	let pageIndex: number | undefined = $state(Number(page.url.searchParams.get('page')) || 1)
 	let before: string | undefined = $state(page.url.searchParams.get('before') ?? undefined)
 	let after: string | undefined = $state(page.url.searchParams.get('after') ?? undefined)
 	let perPage: number | undefined = $state(Number(page.url.searchParams.get('perPage')) || 100)
@@ -42,25 +43,50 @@
 		actionKind,
 		before,
 		after,
-		pageIndex: pageIndex ?? 1,
 		perPage: perPage ?? 100
 	}))
 	let logs: AuditLog[] | undefined = $derived(auditLogsLoader.logs)
 	let batchProgress = $derived(auditLogsLoader.batchProgress)
 
 	// Regrouping the timeline can fire extra requests to fill in missing job spans, so it gets the
-	// result of a batched load once it settles rather than every intermediate batch.
+	// result of a batched load or load-more once it settles rather than every intermediate batch.
 	let timelineLogs: AuditLog[] | undefined = $state()
 	$effect(() => {
-		const settledLogs = batchProgress ? undefined : auditLogsLoader.logs
+		const settledLogs =
+			batchProgress || auditLogsLoader.loadingExtra ? undefined : auditLogsLoader.logs
 		if (settledLogs) {
 			timelineLogs = settledLogs
 		}
 	})
 
 	let selectedId: number | undefined = $state(undefined)
+	// A selection the loaded rows no longer contain (a filter change or reload) closes the pane.
+	let detailOpen = $derived(
+		selectedId !== undefined && !!logs?.some((log) => log.id === selectedId)
+	)
 	let auditLogDrawer: Drawer | undefined = $state()
 
+	// The inline filters show only when their one-line width fits the bar. The row is measured, so
+	// the sidebar, side panels, zoom and the filters' own values are all accounted for; what it is
+	// measured against is the bar, not the box it sits in. That box is the band's action area,
+	// whose width is its own content's — measuring the row against it would ask whether the row
+	// fits inside itself, which it always does, and the filters would never fold.
+	let filtersRowWidth = $state(0)
+	/** What the breadcrumb takes before the filters get any: the workspace disc and name, the
+	 *  page's name and the hint beside it. Measured at 361-398px across bar widths. */
+	const BREADCRUMB_WIDTH = 400
+	/** Clear space held between the breadcrumb and the first filter. The breadcrumb yields width
+	 *  grudgingly and the filter row not at all, so when the two are sized to just meet they
+	 *  overlap instead of compressing — and mid-resize, before the breadcrumb has settled, the
+	 *  tooltip at the end of it lands on the timeframe button. Measured without this: the gap
+	 *  reached 4px across a 1600->1200 sweep. */
+	const BREADCRUMB_GAP = 48
+	let inlineFilters = $derived(
+		filtersRowWidth > 0 &&
+			pageHeader.barWidth > 0 &&
+			filtersRowWidth <= pageHeader.barWidth - BREADCRUMB_WIDTH - BREADCRUMB_GAP
+	)
+
 	// Function to fetch missing job execution audit logs
 	async function fetchMissingJobSpan(jobId: string, jobLogs: AuditLog[]): Promise<AuditLog[]> {
 		if (jobLogs.length === 0) return []
@@ -108,17 +134,30 @@
 		<p>Page not available for operators</p>
 	</div>
 {:else}
-	<div class="flex flex-col w-full h-screen">
-		<div class="flex items-center space-x-2 flex-row justify-between">
-			<div class="flex flex-row flex-wrap justify-between py-2 my-4 px-4 gap-1 items-center">
-				<h1 class="text-2xl font-semibold text-emphasis">Audit logs</h1>
-				<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/audit_logs">
-					You can only see your own audit logs unless you are an admin.
-				</Tooltip>
-			</div>
-			<div class="flex flex-row flex-wrap justify-between py-2 my-2 px-4 gap-1 items-center">
-				<div class="hidden 2xl:block">
+	<!-- `h-full`, not `h-screen`: the band sits above this box, so a viewport floor would overhang
+	     the content box by the band's height. -->
+	<div class="flex flex-col w-full h-full">
+		<!-- `afterName`, not an action: the hint explains what audit logs are, so it belongs beside
+		     the page's name rather than at the far end of the bar with the filters. -->
+		<PageHeaderContent afterName={auditHint} actions={auditActions} actionsFlexible />
+
+		{#snippet auditHint()}
+			<Tooltip documentationLink="https://www.windmill.dev/docs/core_concepts/audit_logs">
+				You can only see your own audit logs unless you are an admin.
+			</Tooltip>
+		{/snippet}
+
+		{#snippet auditActions()}
+			<div class="relative flex flex-row min-w-0 justify-end items-center">
+				<!-- Kept laid out (invisible, out of flow) while unused, so its width stays measurable. -->
+				<div
+					class={inlineFilters
+						? 'w-max shrink-0'
+						: 'w-max shrink-0 invisible absolute right-0 pointer-events-none'}
+					bind:clientWidth={filtersRowWidth}
+				>
 					<AuditLogsFilters
+						inline
 						{logs}
 						bind:username
 						bind:before
@@ -126,14 +165,13 @@
 						bind:actionKind
 						bind:operation
 						bind:resource
-						bind:pageIndex
 						bind:perPage
 						bind:scope
 						loading={auditLogsLoader.loading}
 						onRefresh={() => auditLogsLoader.reload()}
 					/>
 				</div>
-				<div class="2xl:hidden">
+				<div class:hidden={inlineFilters}>
 					<AuditLogMobileFilters>
 						{#snippet filters()}
 							<AuditLogsFilters
@@ -152,8 +190,16 @@
 					</AuditLogMobileFilters>
 				</div>
 			</div>
-		</div>
-		<div class="h-2/6">
+		{/snippet}
+		{#if !$enterpriseLicense || $enterpriseLicense.endsWith('_pro')}
+			<div class="mx-4 mb-2">
+				<Alert title="Redacted audit logs" type="warning">
+					You need an enterprise license to see unredacted audit logs.
+				</Alert>
+			</div>
+		{/if}
+
+		<div class="h-2/6 shrink-0 p-2 px-4 bg-surface-tertiary mx-4 border rounded-md">
 			{#if timelineLogs}
 				<AuditLogsTimeline
 					logs={timelineLogs}
@@ -162,73 +208,82 @@
 					onZoom={({ min, max }) => {
 						before = max.toISOString()
 						after = min.toISOString()
-						console.log('zoom!')
 					}}
 					onMissingJobSpan={fetchMissingJobSpan}
 					onLogSelected={(log) => {
-						console.log('selected log ')
 						selectedId = log.id
 					}}
 				/>
 			{/if}
 		</div>
-		<div class="flex-grow w-full min-h-0">
-			<div class="px-2">
-				{#if !$enterpriseLicense || $enterpriseLicense.endsWith('_pro')}
-					<Alert title="Redacted audit logs" type="warning">
-						You need an enterprise license to see unredacted audit logs.
-					</Alert>
-					<div class="py-2"></div>
-				{/if}
-			</div>
-			<SplitPanesWrapper>
-				<Splitpanes>
-					<Pane size={70} minSize={50}>
-						<!-- Also while a batched load has yet to return its first rows: the table footer
-						     carries the progress row and its Stop button. -->
-						{#if logs || batchProgress}
-							<AuditLogsTable
-								loading={auditLogsLoader.loading}
-								{logs}
-								{selectedId}
-								bind:pageIndex
-								bind:perPage
-								bind:actionKind
-								bind:operation
-								bind:usernameFilter={username}
-								bind:resourceFilter={resource}
-								hasMore={auditLogsLoader.hasMore}
-								{batchProgress}
-								batchSize={auditLogsLoader.currentBatchSize}
-								onBatchSizeChange={(size) => auditLogsLoader.restreamWithBatchSize(size)}
-								onStopLoading={() => auditLogsLoader.stopBatchLoading()}
-								showWorkspace={scope === 'instance' || scope === 'all_workspaces'}
-								onselect={(id) => {
-									selectedId = id
-								}}
-							/>
-						{:else}
-							<div class="gap-1 flex flex-col">
-								{#each new Array(8) as _}
-									<Skeleton layout={[[3]]} />
-								{/each}
-							</div>
-						{/if}
-					</Pane>
-					<Pane size={30} minSize={15}>
-						{#if logs}
-							<AuditLogDetails {logs} {selectedId} />
-						{/if}
-					</Pane>
-				</Splitpanes>
-			</SplitPanesWrapper>
 
-			<div class="md:hidden">
+		<div
+			class="hidden md:block grow min-h-0 [&_.splitpanes\_\_splitter]:!bg-transparent [&_.splitpanes\_\_splitter]:!border-none"
+		>
+			<Splitpanes>
+				<Pane minSize={40}>
+					<div class="h-full flex flex-col p-4 pr-2">
+						<div class="grow min-h-0 overflow-y-hidden overflow-x-auto">
+							<!-- Also while a batched load has yet to return its first rows: the table footer
+							     carries the progress row and its Stop button. -->
+							{#if logs || batchProgress}
+								<AuditLogsTable
+									loading={auditLogsLoader.loading}
+									{logs}
+									{selectedId}
+									bind:perPage
+									bind:actionKind
+									bind:operation
+									bind:usernameFilter={username}
+									bind:resourceFilter={resource}
+									hasMore={auditLogsLoader.hasMore}
+									loadingExtra={auditLogsLoader.loadingExtra}
+									onLoadMore={() => auditLogsLoader.loadMore()}
+									{batchProgress}
+									batchSize={auditLogsLoader.currentBatchSize}
+									onBatchSizeChange={(size) => auditLogsLoader.restreamWithBatchSize(size)}
+									onStopLoading={() => auditLogsLoader.stopBatchLoading()}
+									showWorkspace={scope === 'instance' || scope === 'all_workspaces'}
+									onselect={(id) => {
+										selectedId = selectedId === id ? undefined : id
+									}}
+								/>
+							{:else}
+								<div class="gap-1 flex flex-col p-2">
+									{#each new Array(8) as _}
+										<Skeleton layout={[[3]]} />
+									{/each}
+								</div>
+							{/if}
+						</div>
+					</div>
+				</Pane>
+				<AnimatedPane size={40} minSize={15} opened={detailOpen}>
+					<div class="h-full flex flex-col p-4 pl-2">
+						<div class="flex-1 min-h-0 mt-8 overflow-y-auto border rounded-md bg-surface-tertiary">
+							{#if logs}
+								<AuditLogDetails
+									{logs}
+									{selectedId}
+									onClose={() => {
+										selectedId = undefined
+									}}
+								/>
+							{/if}
+						</div>
+					</div>
+				</AnimatedPane>
+			</Splitpanes>
+		</div>
+
+		<div class="md:hidden grow min-h-0 flex flex-col p-4">
+			<div class="grow min-h-0 overflow-y-hidden overflow-x-auto">
 				<AuditLogsTable
 					{logs}
 					loading={auditLogsLoader.loading}
 					hasMore={auditLogsLoader.hasMore}
-					bind:pageIndex
+					loadingExtra={auditLogsLoader.loadingExtra}
+					onLoadMore={() => auditLogsLoader.loadMore()}
 					bind:perPage
 					bind:actionKind
 					bind:operation
diff --git a/frontend/src/routes/(root)/(logged)/concurrency_groups/+page.svelte b/frontend/src/routes/(root)/(logged)/concurrency_groups/+page.svelte
index 2272449e0f..9e58c633e7 100644
--- a/frontend/src/routes/(root)/(logged)/concurrency_groups/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/concurrency_groups/+page.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import type { ConcurrencyGroup } from '$lib/gen'
 	import { ConcurrencyGroupsService } from '$lib/gen'
-	import { base } from '$lib/base'
 
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
 	import { Button } from '$lib/components/common'
@@ -91,7 +90,7 @@
 							<tr>
 								<td>
 									<a
-										href={`${base}/runs/?job_kinds=all&graph=ConcurrencyChart&concurrency_key=${concurrency_key}`}
+										href={`/runs/?job_kinds=all&graph=ConcurrencyChart&concurrency_key=${concurrency_key}`}
 										>{concurrency_key}
 									</a>
 								</td>
diff --git a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
index 835735c0c8..d724c4873d 100644
--- a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
@@ -557,6 +557,7 @@
 	</div>
 {:else if renderEditor}
 	<FlowBuilder
+		ownsPageHeader
 		onTakeLatest={draftBaseVersion
 			? async (shown?: string) => {
 					// The version the drawer showed as head; see /scripts/edit.
diff --git a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
index a21fa36835..aa158d2f11 100644
--- a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import CompareWorkspaces from '$lib/components/CompareWorkspaces.svelte'
 	import CompareDrafts from '$lib/components/CompareDrafts.svelte'
 	import { WorkspaceService, type WorkspaceComparison } from '$lib/gen'
@@ -31,10 +32,22 @@
 
 	type CompareMode = 'fork' | 'draft'
 
-	let comparison: WorkspaceComparison | undefined = $state(undefined)
+	/** The last comparison that came back, with the pair it describes. Kept together: a comparison
+	 *  is only an answer about the two workspaces it was asked about. */
+	let comparisonResult = $state<{ pair: string; value: WorkspaceComparison } | undefined>(undefined)
 
-	let currentWorkspaceId: string | undefined = $state(
-		page.url.searchParams.get('workspace_id') ?? $workspaceStore ?? undefined
+	// Which workspace this page compares, read rather than followed. The URL answers it when it
+	// names one: `?workspace=` is a switch already made, which the root layout applies to the
+	// store, and `?workspace_id=` is the workspace a link asked to compare — a session's Review
+	// button passes the fork it committed to while deliberately leaving the navigation workspace
+	// alone (SessionChangesBar), as does the prod→dev link in UpdateDevWorkspaceModal, so it has
+	// to outrank the store. With neither param the store is the answer, and a switch in the trail
+	// moves the page because `fixupUrlAfterWorkspaceSwitch` rewrites whichever param is there.
+	const currentWorkspaceId = $derived(
+		page.url.searchParams.get('workspace') ??
+			page.url.searchParams.get('workspace_id') ??
+			$workspaceStore ??
+			undefined
 	)
 
 	let currentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === currentWorkspaceId))
@@ -44,8 +57,21 @@
 	// one-off migration the lineage cannot express. It is one-way (current →
 	// target): nothing tallies such a pair, so a cold diff has no deploy history
 	// telling which side a change came from.
+	//
+	// Read whatever the URL holds, including on a page opened with no workspace param at all —
+	// which is how the migration starts, from "Merge into another workspace" in the workspace
+	// settings, and where the picker below is the only thing that sets this.
 	const targetParam = $derived(page.url.searchParams.get('target') ?? undefined)
 	const compareTargetId = $derived(targetParam ?? parentWorkspaceId ?? undefined)
+	/** The pair on screen, as one value: what a comparison has to describe to be about it. */
+	const pairKey = $derived(`${currentWorkspaceId}->${compareTargetId}`)
+	/** The comparison, but only while it describes the pair on screen. A switch changes the pair
+	 *  during render and the card is remounted in that same render, so a comparison handed over
+	 *  without this check would be the previous pair's — and the card would fetch that pair's item
+	 *  paths from the new workspace, where every one of them is a 404 by construction. */
+	const comparison = $derived(
+		comparisonResult?.pair === pairKey ? comparisonResult.value : undefined
+	)
 	const isArbitraryTarget = $derived(!!compareTargetId && compareTargetId !== parentWorkspaceId)
 	// Fork/dev workspaces are identified by their parent link, not the `wm-fork-` id
 	// prefix. Distinct from having a compare target: a root workspace has no parent
@@ -229,27 +255,40 @@
 			return
 		}
 		const seq = ++comparisonReq
+		// The pair this request is about, read before the await: by the time it answers the page
+		// may be on another one, and the answer belongs to the pair that was asked.
+		const pair = pairKey
+		comparisonLoading = true
 
 		try {
 			const result = await fetchWorkspaceComparison(compareTargetId, currentWorkspaceId)
 			if (seq !== comparisonReq) return
-			comparison = result
+			comparisonResult = { pair, value: result }
 			comparisonError = undefined
 		} catch (e: any) {
 			if (seq !== comparisonReq) return
 			comparisonError = e?.body ?? e?.message ?? String(e)
 			console.error('Failed to compare workspaces:', e)
+		} finally {
+			// Only the request still being waited on clears the flag: an older one landing late
+			// would otherwise report the newer pair as answered.
+			if (seq === comparisonReq) comparisonLoading = false
 		}
 	}
 
 	let comparisonError = $state<string | undefined>(undefined)
+	/** Tracked rather than inferred from an absent comparison: a failed one is also absent, and a
+	 *  spinner that never stops is worse than a message. */
+	let comparisonLoading = $state(false)
 
 	$effect(() => {
 		;[currentWorkspaceId, compareTargetId]
 
 		untrack(() => {
-			comparison = undefined
 			comparisonError = undefined
+			// The flag belongs to `checkForChanges`, which raises it per request and lowers it for
+			// the one still being waited on. Raising it here too left it stuck on the pair that
+			// function refuses — no workspace, or no target yet.
 			checkForChanges()
 		})
 	})
@@ -257,33 +296,48 @@
 	// Seeding the candidate set is what makes an arbitrary pair comparable at all;
 	// the comparison that follows is the expensive part, since it evaluates every
 	// candidate. Both are driven from here so the button reports the whole wait.
-	let scanning = $state(false)
+	/** The pair being scanned, so the button reports the wait for the pair it belongs to and not
+	 *  for whichever one the trail moved to meanwhile. */
+	let scanningPair = $state<string | undefined>(undefined)
+	const scanning = $derived(scanningPair === pairKey)
 	async function computeFullScan() {
 		if (!currentWorkspaceId || !compareTargetId) return
-		scanning = true
+		// Captured before the await, and used afterwards in place of the live values: the scan
+		// seeded this pair, so this is the pair to invalidate, re-compare and name in the toast.
+		const scanWorkspace = currentWorkspaceId
+		const scanTarget = compareTargetId
+		const pair = pairKey
+		scanningPair = pair
 		comparisonError = undefined
 		try {
 			const res = await WorkspaceService.seedFullDiffScan({
-				workspace: currentWorkspaceId,
-				targetWorkspaceId: compareTargetId
+				workspace: scanWorkspace,
+				targetWorkspaceId: scanTarget
 			})
-			invalidateWorkspaceComparison(compareTargetId)
-			await checkForChanges()
-			// The seed succeeded but the comparison that reads it may not have. Saying
-			// "compared" then would be a lie, and the seeded candidates are still there
-			// for the retry the card offers.
-			if (comparisonError) {
+			invalidateWorkspaceComparison(scanTarget)
+			// Only worth re-asking while the page is still on the pair that was scanned; it asks
+			// for the pair it moved to on its own.
+			if (pairKey === pair) await checkForChanges()
+			// Each outcome says what actually happened. Off the scanned pair nothing was compared —
+			// the re-ask above is skipped — so only the seed can be reported; `comparisonError`
+			// there belongs to another pair and says nothing about this one. On it, the seed can
+			// still have succeeded while the comparison reading it failed, and claiming "compared"
+			// would be a lie with the seeded candidates sitting there for the retry the card offers.
+			if (pairKey !== pair) {
+				sendUserToast(`Seeded ${res.candidates} items for ${scanTarget}`)
+			} else if (comparisonError) {
 				sendUserToast(
 					`Seeded ${res.candidates} items but the comparison failed: ${comparisonError}`,
 					true
 				)
 			} else {
-				sendUserToast(`Compared ${res.candidates} items with ${compareTargetId}`)
+				sendUserToast(`Compared ${res.candidates} items with ${scanTarget}`)
 			}
 		} catch (e: any) {
 			sendUserToast(`Failed to compute the diff: ${e?.body ?? e}`, true)
 		} finally {
-			scanning = false
+			// Only the scan still being waited on stops the button; a later one owns it now.
+			if (scanningPair === pair) scanningPair = undefined
 		}
 	}
 
@@ -390,6 +444,17 @@
 	}
 </script>
 
+<!-- Named here rather than left to the route: the breadcrumb's fallback reads the first segment,
+     which would call this page "Forks" — the thing it compares, not what it is.
+     `actingWorkspaceId` only when the page is comparing a workspace other than the one the app is
+     pointed at, which is how a session's Review button and the prod→dev link open it: the trail
+     would otherwise name the parent while the page compares the fork, and its home link would
+     lead somewhere the page is not. -->
+<PageHeaderContent
+	section={{ label: 'Compare' }}
+	actingWorkspaceId={currentWorkspaceId !== $workspaceStore ? currentWorkspaceId : undefined}
+/>
+
 <CenteredPage>
 	<PageHeader title="Compare & Deploy">
 		<div class="flex flex-row gap-2 items-center">
@@ -440,10 +505,12 @@
 			onModeSelected={selectMode}
 		/>
 	{:else if compareTargetId}
-		<!-- Remount on a target change: the merge card owns a selection, a deploy
-		     direction and per-item deployment statuses, none of which carry over to a
-		     different destination. -->
-		{#key compareTargetId}
+		<!-- Remount on either side of the pair changing: the merge card owns a selection, a deploy
+		     direction, per-item deployment statuses, item summaries, pinned rows, deploy
+		     permissions and CI results — none of which carry over to a different pair. Keyed on
+		     the target alone, two forks of one parent shared a mount, since the target is the
+		     parent they have in common. -->
+		{#key pairKey}
 			<CompareWorkspaces
 				{currentWorkspaceId}
 				parentWorkspaceId={compareTargetId}
@@ -456,6 +523,7 @@
 				onSelectTarget={selectTarget}
 				{comparison}
 				{comparisonError}
+				{comparisonLoading}
 				initialMergeIntoParent={forkDirection === 'deploy_to'}
 				{deployCount}
 				{updateCount}
diff --git a/frontend/src/routes/(root)/(logged)/groups/+page.svelte b/frontend/src/routes/(root)/(logged)/groups/+page.svelte
index ce8c6a8db0..c17c6c188e 100644
--- a/frontend/src/routes/(root)/(logged)/groups/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/groups/+page.svelte
@@ -12,7 +12,7 @@
 	import PageHeader from '$lib/components/PageHeader.svelte'
 	import SharedBadge from '$lib/components/SharedBadge.svelte'
 	import { userStore, workspaceStore, userWorkspaces } from '$lib/stores'
-	import { canWrite } from '$lib/utils'
+	import { useEditRights } from '$lib/operatorWriteRights'
 	import { Pen, Plus, Trash } from 'lucide-svelte'
 	import DataTable from '$lib/components/table/DataTable.svelte'
 	import Head from '$lib/components/table/Head.svelte'
@@ -24,6 +24,8 @@
 
 	type GroupW = Group & { canWrite: boolean }
 
+	const editRights = useEditRights()
+
 	let restricted = $derived(
 		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
 	)
@@ -34,7 +36,7 @@
 
 	async function loadGroups(): Promise<void> {
 		groups = (await GroupService.listGroups({ workspace: $workspaceStore! })).map((x) => {
-			return { canWrite: canWrite(x.name, x.extra_perms ?? {}, $userStore), ...x }
+			return { canWrite: editRights.canEditItem('group', x.name, x.extra_perms), ...x }
 		})
 	}
 
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
index 1515040f18..d7972d3ef1 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
@@ -3,8 +3,9 @@
 	import PipelineFolderList from '$lib/components/assets/AssetGraph/PipelineFolderList.svelte'
 	import PipelineSetupSignpost from '$lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte'
 	import PipelineAlphaAckModal from '$lib/components/assets/AssetGraph/PipelineAlphaAckModal.svelte'
-	import PipelineDbtSignpost from '$lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte'
-	import { BookOpen, NetworkIcon } from 'lucide-svelte'
+	import { BookOpen } from 'lucide-svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import { onMount } from 'svelte'
 
 	const ACK_STORAGE_KEY = 'pipeline-alpha-ack'
@@ -36,39 +37,27 @@
 	<title>Pipelines — Windmill</title>
 </svelte:head>
 
-<div class="flex flex-col h-full">
-	<div
-		class="border-b flex flex-row justify-between gap-2 px-2 py-1 items-center min-h-10 shrink-0 whitespace-nowrap"
-	>
-		<div class="flex flex-row items-center gap-2">
-			<NetworkIcon size={16} class="text-tertiary shrink-0" />
-			<h1 class="text-sm font-semibold">Pipelines</h1>
-			<span
-				class="text-2xs px-1.5 py-0.5 rounded font-semibold bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300"
-			>
-				Alpha
-			</span>
-		</div>
-	</div>
+<!-- No title row of its own: the band already names this page, and the badge that sat beside the
+     title rides after that name. -->
+<PageHeaderContent section={{ label: 'Pipelines' }} afterName={alphaBadge} separator="always" />
 
+{#snippet alphaBadge()}
+	<Badge color="green">Alpha</Badge>
+{/snippet}
+
+<div class="flex flex-col h-full">
 	<div class="flex-1 min-h-0 overflow-y-auto bg-surface-secondary">
 		<div class="max-w-2xl mx-auto flex flex-col gap-6 px-4 py-8">
 			<div class="flex flex-col gap-2">
-				<h2 class="text-lg font-semibold">Data pipelines</h2>
-				<p class="text-sm text-tertiary">
+				<h2 class="text-lg font-semibold text-emphasis">Data pipelines</h2>
+				<p class="text-xs text-secondary">
 					Chain ingestion, transformation and materialization steps into an asset-aware graph.
-					{#if !$userStore?.operator}
-						Each pipeline lives in a folder: open one below, or pick a folder to start a new
-						pipeline.
-					{:else}
-						Open a pipeline below to view its graph and runs.
-					{/if}
 				</p>
 				<a
 					href="https://www.windmill.dev/docs/pipelines"
 					target="_blank"
 					rel="noreferrer"
-					class="text-xs text-blue-500 hover:underline inline-flex items-center gap-1"
+					class="text-xs text-accent hover:underline inline-flex items-center gap-1 w-fit"
 				>
 					<BookOpen size={12} />
 					Pipelines documentation
@@ -79,14 +68,8 @@
 				<PipelineSetupSignpost workspace={$workspaceStore} />
 			{/if}
 
-			<PipelineFolderList />
-
-			<!-- Below the pipeline content on purpose: dbt is a separate runtime, not a
-			     way of building a pipeline, and reads as one when it sits in the flow
-			     that defines what a pipeline is. -->
-			{#if !$userStore?.operator}
-				<PipelineDbtSignpost />
-			{/if}
+			<!-- Operators cannot pick an arbitrary folder, so the list is their only way in. -->
+			<PipelineFolderList hideExisting={!$userStore?.operator} />
 		</div>
 	</div>
 </div>
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
index b4ddb8350c..f5833527b0 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
+	import pLimit from 'p-limit'
 	import { workspaceStore, userStore } from '$lib/stores'
 	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
-	import { base } from '$lib/base'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import { page } from '$app/state'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
@@ -18,16 +19,13 @@
 	import { usePipelineHistory } from '$lib/components/assets/AssetGraph/pipelineHistory.svelte'
 	import PipelineActivityPanel from '$lib/components/assets/AssetGraph/PipelineActivityPanel.svelte'
 	import PipelinePickerModal from '$lib/components/assets/AssetGraph/PipelinePickerModal.svelte'
-	import {
-		extractWrites,
-		extractReads,
-		type AssetWithAltAccessType
-	} from '$lib/components/assets/lib'
 	import type {
 		AssetGraphResponse,
 		AssetGraphSelection,
 		NativeTriggerKind,
-		PipelineMode
+		PipelineMode,
+		PipelineTriggerDraft,
+		PipelineTriggerDraftKind
 	} from '$lib/components/assets/AssetGraph/types'
 	import PipelineModeToggle from '$lib/components/assets/AssetGraph/PipelineModeToggle.svelte'
 	import MacroExplorerDrawer from '$lib/components/assets/AssetGraph/MacroExplorerDrawer.svelte'
@@ -40,9 +38,13 @@
 		mergeColumnGraphs
 	} from '$lib/components/assets/AssetGraph/columnLineageGraph'
 	import { useDbtColumnLineage } from '$lib/components/assets/AssetGraph/dbtColumnLineage.svelte'
-	import { resolveGraph } from '$lib/components/assets/AssetGraph/resolveGraph'
+	import {
+		pipelineNodeErrors,
+		resolveGraph
+	} from '$lib/components/assets/AssetGraph/resolveGraph'
 	import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 	import { hideDbtRunnables } from '$lib/components/assets/AssetGraph/hideDbtRunnables'
+	import { usePipelineDataUploads } from '$lib/components/assets/AssetGraph/pipelineDataUploads.svelte'
 	import { buildSchemaContractContext } from '$lib/components/assets/AssetGraph/schemaContracts'
 	import {
 		computeDownstreamClosure,
@@ -79,18 +81,50 @@
 		createPipelineAiHelpers,
 		type PipelineDraft
 	} from '$lib/components/assets/AssetGraph/pipelineAiHelpers'
-	import { PipelineEditorState } from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+	import {
+		PipelineEditorState
+	} from '$lib/components/assets/AssetGraph/pipelineEditorState.svelte'
+	import {
+		defaultTriggerPath,
+		isDraftableTriggerKind,
+		triggerDraftKey
+	} from '$lib/components/assets/AssetGraph/pipelineTriggerDrafts'
+	import { deleteTriggerRow } from '$lib/components/assets/AssetGraph/pipelineTriggerDraftDeploy'
+	import {
+		deployPipelineDrafts,
+		deployPipelineScript
+	} from '$lib/components/assets/AssetGraph/pipelineDeploy.svelte'
+	import type { AssetUpstreamDelete } from '$lib/components/assets/AssetGraph/assetsOnlyView'
+	import type { NodeFixSpec } from '$lib/components/assets/AssetGraph/NodeFixButton.svelte'
+	import { TRIGGER_NODE_STYLE } from '$lib/components/assets/AssetGraph/TriggerNode.svelte'
+	import {
+		addTriggerDirective,
+		assetRef,
+		listenToAsset,
+		removeTriggerDirective,
+		stopListeningChangeText,
+		stopListeningToAsset
+	} from '$lib/components/assets/AssetGraph/pipelineAnnotationEdits'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import type { PipelineInsertOptions } from '$lib/components/assets/AssetGraph/PipelineInsertMenu.svelte'
 	import {
 		createPipelineRecording,
 		finalizePipelineRecording
 	} from '$lib/components/recording/pipelineRecording.svelte'
 	import type { PipelineRecording } from '$lib/components/recording/types'
 	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
+	import { usePipelineAssetPrefetch } from '$lib/components/assets/AssetGraph/pipelineAssetPrefetch.svelte'
+	import PipelineDeployErrors from '$lib/components/assets/AssetGraph/PipelineDeployErrors.svelte'
+	import PipelineDeployTriggersModal from '$lib/components/assets/AssetGraph/PipelineDeployTriggersModal.svelte'
 	import { onMount, tick, untrack } from 'svelte'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import OpenInSessionButton, {
+		type OpenInSessionSource
+	} from '$lib/components/sessions/OpenInSessionButton.svelte'
+	import { setOpenInSessionHandoff } from '$lib/components/sessions/openInSessionContext'
 	import { aiChatManager } from '$lib/components/copilot/chat/AIChatManager.svelte'
 	import {
 		AlertTriangle,
-		ArrowLeft,
 		ChevronDown,
 		Circle,
 		Download,
@@ -111,18 +145,15 @@
 		OpenAPI,
 		ScheduleService,
 		ScriptService,
+		AssetService,
 		type AssetKind,
 		type Script,
 		type ScriptLang
 	} from '$lib/gen'
 	import { resource } from 'runed'
 	import { emptySchema, sendUserToast, type Item } from '$lib/utils'
-	import type { Schema } from '$lib/common'
 	import { beforeNavigate, goto } from '$app/navigation'
 	import { fade } from 'svelte/transition'
-	import { twMerge } from 'tailwind-merge'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
-	import { inferArgs, inferAssets } from '$lib/infer'
 	import PipelineTriggerEditors from '$lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte'
 
 	// Variables and resources are declarative config, not pipeline assets —
@@ -130,7 +161,15 @@
 	// layout without adding lineage information.
 	const DATA_KINDS = DATA_ASSET_KINDS
 
-	let folder = $derived(normalizePipelineFolder(page.params.folder as string))
+	// The route param is gone for a moment while the page tears down on leaving; the
+	// folder keeps its last value so nothing keyed on it (draft autosave, graph
+	// fetch) sees a different folder in that window.
+	let lastFolder = ''
+	let folder = $derived.by(() => {
+		const param = page.params.folder
+		if (param !== undefined) lastFolder = normalizePipelineFolder(param)
+		return lastFolder
+	})
 
 	// Externalized editor state (drafts, live overlays, selection), shared with
 	// the in-session pipeline preview via PipelineEditorState. Referenced as
@@ -148,6 +187,8 @@
 			if (pe.folder !== f) {
 				if (pe.folder !== undefined) {
 					pe.reset()
+					// The set-aside edit pane belongs to the folder being left.
+					editPane = undefined
 					// Re-scope the Global chat's pipeline prompt to the new folder. The
 					// helper methods already read the reactive folder, but the system
 					// message string was built for the old one and is only rebuilt when
@@ -166,21 +207,45 @@
 	let isOperator = $derived($userStore?.operator ?? false)
 	let urlMode = $derived(page.url.searchParams.get('mode'))
 	let mode = $derived<PipelineMode>(isOperator ? 'view' : urlMode === 'edit' ? 'edit' : 'view')
+	// The edit-mode pane, set aside while View shows the activity feed, so coming
+	// back to Edit reopens it.
+	let editPane:
+		| { selection: typeof pe.selection; activeDraftPath: string | undefined; hidden: boolean }
+		| undefined = undefined
 	function setMode(m: PipelineMode, opts?: { replace?: boolean }) {
 		// Switching edit→view re-surfaces the activity feed: drop the edit-mode
 		// selection / open draft / hidden-pane state so view opens on Activity
 		// rather than a stale details pane (mirrors toggleActivity's show path).
 		if (m === 'view' && mode === 'edit') {
+			editPane = {
+				selection: pe.selection,
+				activeDraftPath: pe.activeDraftPath,
+				hidden: panelHidden
+			}
 			pe.selection = undefined
 			pe.activeDraftPath = undefined
 			panelHidden = false
 			pe.liveAnnotations = EMPTY_LIVE_ANNOTATIONS
 		}
+		// View→edit keeps what was opened in View; with only the activity feed
+		// (or nothing) showing, it reopens the pane Edit had.
+		if (m === 'edit' && mode === 'view') {
+			const openedInView = pe.selection != undefined || pe.activeDraftPath != undefined
+			if (!openedInView && editPane) {
+				const draft = editPane.activeDraftPath
+				pe.activeDraftPath = draft && pe.drafts.has(draft) ? draft : undefined
+				pe.selection = pe.activeDraftPath ? undefined : editPane.selection
+				panelHidden = editPane.hidden
+			} else if (openedInView) {
+				panelHidden = false
+			}
+			editPane = undefined
+		}
 		const url = new URL(page.url)
 		if (m === 'view') url.searchParams.delete('mode')
 		else url.searchParams.set('mode', m)
 		// Same-pathname navigation — the drafts leave-guard skips it.
-		goto(url, { replaceState: opts?.replace ?? false, keepFocus: true, noScroll: true })
+		return goto(url, { replaceState: opts?.replace ?? false, keepFocus: true, noScroll: true })
 	}
 	// View-mode drafts overlay: "what View will show once the drafts are
 	// deployed". A view variant rather than a third mode — ephemeral (not
@@ -188,17 +253,6 @@
 	// shared link couldn't reproduce it anyway).
 	let includeDrafts = $state(false)
 
-	// Asset-kind → syntax-prefix for `// on <ref>` reconstruction. Mirrors
-	// ASSET_KINDS in backend/parsers/windmill-parser/src/asset_parser.rs.
-	const ASSET_PREFIX: Record<AssetKind, string> = {
-		s3object: 's3://',
-		resource: '$res:',
-		ducklake: 'ducklake://',
-		datatable: 'datatable://',
-		volume: 'volume://',
-		dbt: 'dbt://'
-	}
-
 	// Path-input split for the insert menu: a read-only `f/<folder>/` chip
 	// on the left the user can't delete, plus an editable suffix seeded
 	// with a placeholder name.
@@ -254,7 +308,7 @@
 			panelHidden = false
 			focusPipelineNode(`script:${path}`)
 		} else {
-			window.open(`${base}/scripts/get/${path}`, '_blank')
+			window.open(`/scripts/get/${path}`, '_blank')
 		}
 	}
 
@@ -281,75 +335,16 @@
 		}
 	}
 
-	// Only-add cache of (script_path → body content) populated lazily by
-	// `bodyFetchEffect` for every script in the current folder. We never
-	// remove entries: stale keys (renamed-away, deleted) are simply ignored
-	// at read time because the derived maps below only iterate paths that
-	// appear in the current `g.runnables`. That self-cleaning property is
-	// the whole reason for the refactor — no rename/delete cleanup needed.
-	let bodiesByPath = $state<Map<string, string>>(new Map())
-	// Sibling cache: the parsed asset usages from `inferAssets` (wasm), one
-	// pass per body. Same only-add semantics as `bodiesByPath`.
-	let inferredAssetsByPath = $state<Map<string, AssetWithAltAccessType[]>>(new Map())
-	// Bumped on folder change so an in-flight prefetch sweep stops before
-	// writing into the new folder's state.
-	let bodyFetchGen = 0
-
-	// Inferred write/read edges per script-in-graph. Derived from
-	//   (a) the open pane's live overlay (`liveBodyAssets`) — current
-	//       keystrokes for the script the user is editing right now, and
-	//   (b) the prefetched assets cache for everyone else.
-	// Iteration is gated on `graphRes.current.runnables`, so a path that
-	// gets renamed / deleted disappears from the derived map as soon as
-	// the refetch lands — no manual rekey, no phantom edges.
-	// Single pass over the graph's scripts producing both the write- and
-	// read-asset maps (they only differ by extractWrites vs extractReads over
-	// the same `liveBodyAssets`-vs-cache asset source). Split into two derives
-	// below so consumers can depend on one without invalidating on the other.
-	let inferredAssetEdges = $derived.by(() => {
-		const writes = new Map<string, Array<{ kind: AssetKind; path: string }>>()
-		const reads = new Map<string, Array<{ kind: AssetKind; path: string }>>()
-		const g = graphRes.current
-		if (!g) return { writes, reads }
-		const liveAssetsForPath = (path: string) =>
-			pe.liveBodyAssets.scriptPath === path
-				? pe.liveBodyAssets.assets
-				: inferredAssetsByPath.get(path)
-		for (const r of g.runnables) {
-			if (r.usage_kind !== 'script') continue
-			const assets = liveAssetsForPath(r.path)
-			if (!assets) continue
-			const w = extractWrites(assets)
-			if (w.length > 0) writes.set(r.path, w)
-			const rd = extractReads(assets)
-			if (rd.length > 0) reads.set(r.path, rd)
-		}
-		return { writes, reads }
-	})
-	let inferredWritesByPath = $derived(inferredAssetEdges.writes)
-	let inferredReadsByPath = $derived(inferredAssetEdges.reads)
-	// Same derived shape for `// on kafka` etc. annotations. Live buffer
-	// wins for the open script; everyone else is parsed from the
-	// prefetched body content.
-	let annotatedNativeKindsByPath = $derived.by(() => {
-		const out = new Map<string, Set<NativeTriggerKind>>()
-		const g = graphRes.current
-		if (!g) return out
-		const livePath = pe.liveAnnotations.scriptPath
-		for (const r of g.runnables) {
-			if (r.usage_kind !== 'script') continue
-			let kinds: Set<NativeTriggerKind>
-			if (r.path === livePath) {
-				kinds = new Set(pe.liveAnnotations.annotations.nativeTriggers.map((n) => n.kind))
-			} else {
-				const body = bodiesByPath.get(r.path)
-				if (!body) continue
-				kinds = new Set(parsePipelineAnnotations(body).nativeTriggers.map((n) => n.kind))
-			}
-			if (kinds.size > 0) out.set(r.path, kinds)
-		}
-		return out
+	// Bodies, inferred asset edges and `// on` annotations of every deployed
+	// script in the folder, so the graph shows the edges of scripts never opened.
+	const assetPrefetch = usePipelineAssetPrefetch({
+		getWorkspace: () => $workspaceStore,
+		getGraph: () => graphRes.current,
+		editor: pe
 	})
+	let inferredWritesByPath = $derived(assetPrefetch.inferredWritesByPath)
+	let inferredReadsByPath = $derived(assetPrefetch.inferredReadsByPath)
+	let annotatedNativeKindsByPath = $derived(assetPrefetch.annotatedNativeKindsByPath)
 
 	// Build a runnable Script from picked language / triggers / output.
 	// Delegates to the shared template generator (pipelineTemplates.ts) so
@@ -412,9 +407,10 @@
 		triggers: DraftTriggerSource[],
 		outputKind: PipelineOutputKind,
 		input?: { kind: AssetKind; path: string },
-		aiPrompt?: string
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
 	) {
-		const out = autoOutputAsset(outputKind, folder, language)
+		const out = options?.outputAsset ?? autoOutputAsset(outputKind, folder, language)
 		const script = buildDraft(language, scriptPath, triggers, outputKind, out, input)
 		// Write the new draft into the map (structural update so Svelte
 		// re-derives graphWithDraft) and focus it in the details pane. When
@@ -429,6 +425,19 @@
 		pe.drafts = next
 		pe.activeDraftPath = scriptPath
 		pe.selection = undefined
+		if (options?.schedule) {
+			const path = options.schedule.path || defaultTriggerPath(scriptPath, 'schedule')
+			const saved = pe.setTriggerDraft({
+				kind: 'schedule',
+				config: { ...options.schedule, path, script_path: scriptPath }
+			})
+			if (!saved) {
+				sendUserToast(
+					`Another draft schedule already uses the path ${path}; the new script has no schedule`,
+					true
+				)
+			}
+		}
 
 		// Follow the new node with a smooth pan. The id matches the runnable
 		// node the canvas builds for a draft script (`script:<path>`).
@@ -488,10 +497,16 @@
 		getFolder: () => folder,
 		getWorkspace: () => $workspaceStore,
 		getResolvedGraph: () => graphWithDraft,
+		hasTriggerDrafts: () => pe.triggerDrafts.size > 0,
+		getTriggerDrafts: () => pe.triggerDrafts,
+		setTriggerDraft: pe.setTriggerDraft,
 		getDrafts: () => pe.drafts,
 		setDrafts: (next) => (pe.drafts = next),
 		newDraftLocalId: pe.newDraftLocalId,
-		onForgetPath: (path) => forgetPath(path),
+		onForgetPath: (path) => {
+			forgetPath(path)
+			pe.discardTriggerDraftsFor(path)
+		},
 		onShowDrafts: () => (includeDrafts = true),
 		onProposeNode: (path) => focusPipelineNode(`script:${path}`),
 		ensureEditable: () => {
@@ -513,6 +528,42 @@
 
 	onMount(() => aiChatManager.setPipelineHelpers(pipelineAiHelpers))
 
+	// The session's preview hydrates this folder's drafts from its DB bundle, so the
+	// autosave still inside its debounce has to land first.
+	async function persistDraftsForSession(): Promise<void> {
+		const workspace = $workspaceStore
+		if (!workspace) return
+		await tick()
+		const draft = { workspace, itemKind: PIPELINE_DRAFT_KIND, path: pipelineDraftPath }
+		await UserDraftDbSyncer.flush(draft)
+		// A flush resolves even when the save failed or conflicted, and the session
+		// would then open on the older drafts the server holds: stay here instead.
+		if (UserDraftDbSyncer.getConflict(draft).conflict) {
+			throw new Error('The pipeline drafts conflict with a newer version — resolve that first.')
+		}
+		const sync = UserDraftDbSyncer.getState(draft)
+		if (sync.state === 'failed') {
+			throw new Error(
+				`The pipeline drafts could not be saved: ${sync.failureMessage ?? 'unknown error'}`
+			)
+		}
+		// The drafts go with the pipeline into the session, so leaving for it is
+		// not leaving them behind.
+		bypassNavigationGuard = true
+	}
+
+	const sessionOpen: OpenInSessionSource | undefined = $derived(
+		isOperator
+			? undefined
+			: {
+					target: { kind: 'pipeline', path: folder },
+					workspaceId: $workspaceStore ?? undefined,
+					beforeOpen: persistDraftsForSession
+				}
+	)
+	// Lets the navigation rail's session switch open this pipeline, with its drafts.
+	setOpenInSessionHandoff({ source: () => sessionOpen })
+
 	// Navigation guard state. `pendingNavigationUrl` holds the URL the user
 	// tried to leave to so we can complete the navigation after they pick
 	// "Save all" or "Discard all"; `bypassNavigationGuard` is the standard
@@ -528,7 +579,7 @@
 			bypassNavigationGuard = false
 			return
 		}
-		if (pe.drafts.size === 0) return
+		if (pendingCount === 0) return
 		// `leave` covers tab close / hard reload / cross-origin nav. SvelteKit
 		// turns a cancelled leave into a browser-native "Leave site?" prompt,
 		// which we explicitly don't want — match the rest of the editors and
@@ -563,7 +614,11 @@
 		// stale active path don't bleed into the next page. localStorage
 		// is overwritten by the persist effect on the next tick.
 		pe.drafts = new Map()
+		pe.triggerDrafts = new Map()
 		pe.activeDraftPath = undefined
+		// The open pane's buffer is autosaved as a draft of the deployed script it
+		// edits, so it has to go with the drafts.
+		pe.clearLiveOverlays()
 		saveErrors = new Map()
 		const target = pendingNavigationUrl
 		leaveModalOpen = false
@@ -574,7 +629,20 @@
 		}
 	}
 
+	// Triggers start running once deployed, so leaving through "Save all" asks
+	// first, like the toolbar button, and navigates once confirmed.
+	let leaveAfterTriggerConfirm = $state(false)
 	async function leaveModalSaveAll() {
+		if (pe.triggerDrafts.size > 0) {
+			leaveModalOpen = false
+			leaveAfterTriggerConfirm = true
+			confirmTriggerDeployOpen = true
+			return
+		}
+		await saveAllAndLeave()
+	}
+
+	async function saveAllAndLeave() {
 		leaveSaving = true
 		await saveAllDrafts()
 		leaveSaving = false
@@ -582,7 +650,7 @@
 		// page so they can deal with the failures via the bar's error
 		// popover. Otherwise resume the navigation that triggered the
 		// guard.
-		if (pe.drafts.size === 0) {
+		if (pendingCount === 0) {
 			const target = pendingNavigationUrl
 			leaveModalOpen = false
 			pendingNavigationUrl = undefined
@@ -601,6 +669,8 @@
 	// are removed from the drafts map as they land.
 	let savingAll = $state(false)
 	let saveErrors = $state<Map<string, string>>(new Map())
+	// Opened by a save that fails, so the reason is on screen without a click.
+	let saveErrorsOpen = $state(false)
 
 	// Post-deploy verification: capture the cascade-relevant facts (writes +
 	// `// on` subscriptions) the resolved draft graph promises for `paths`.
@@ -620,134 +690,38 @@
 		if (msg) sendUserToast(msg, true)
 	}
 
-	async function saveDraft(path: string, draft: Draft, ws: string): Promise<void> {
-		const script = structuredClone($state.snapshot(draft.script) as Script)
-		script.schema = script.schema ?? emptySchema()
-		try {
-			const result = await inferArgs(script.language, script.content, script.schema as Schema)
-			;(script as any).auto_kind = result?.auto_kind || undefined
-			script.has_preprocessor = result?.has_preprocessor ?? false
-		} catch {
-			// Inference failures don't block deploys (the same fallback the
-			// per-pane save uses). The createScript call is the real
-			// validation gate — if the body is broken it'll reject there.
-		}
-		// Re-infer the asset lineage from the CURRENT body. The draft's
-		// `script.assets` is a snapshot that isn't refreshed on edit, so without
-		// this a renamed/removed output (e.g. an old `CREATE TABLE foo`) would
-		// be re-deployed as a phantom write edge and linger as an orphan asset.
-		// Mirrors the per-pane save, which sends live-inferred assets.
-		let assets: AssetWithAltAccessType[] = []
-		try {
-			const inferred = await inferAssets(script.language, script.content)
-			if (inferred?.status !== 'error')
-				assets = (inferred?.assets ?? []) as AssetWithAltAccessType[]
-		} catch {
-			// Same fallback as above — an unparsable body deploys with no
-			// lineage rather than the stale snapshot.
-		}
-		await ScriptService.createScript({
-			workspace: ws,
-			requestBody: {
-				...script,
-				language: script.language,
-				description: script.description ?? '',
-				// Brand-new drafts have no parent (buildDraft seeds hash as ''
-				// — treat any falsy hash as parentless, the backend rejects
-				// an empty hex string); a draft promoted from unsaved edits
-				// to a deployed script carries that script's hash and must
-				// chain off it (createScript rejects a parentless deploy to
-				// an occupied path).
-				parent_hash: script.hash ? String(script.hash) : undefined,
-				is_template: false,
-				tag: script.tag,
-				kind: script.kind as Script['kind'] | undefined,
-				lock: undefined,
-				// Freshly inferred above — overrides the stale snapshot carried
-				// by `...script`, so the deployed lineage matches the body.
-				assets: assets as any
-			}
-		})
+	// Scripts plus trigger drafts: what "Save all" deploys.
+	let pendingCount = $derived(
+		pe.drafts.size + pe.triggerDrafts.size + (pe.liveEditPath != undefined ? 1 : 0)
+	)
+	let confirmTriggerDeployOpen = $state(false)
+
+	function requestSaveAll() {
+		if (pe.triggerDrafts.size > 0) confirmTriggerDeployOpen = true
+		else void saveAllDrafts()
 	}
 
 	async function saveAllDrafts() {
-		if (!$workspaceStore || pe.drafts.size === 0 || savingAll) return
+		if (!$workspaceStore || pendingCount === 0 || savingAll) return
 		savingAll = true
-		const ws = $workspaceStore
-		// The open pane's keystrokes live in `pe.liveContent` until the pane is
-		// torn down — the drafts Map still holds the pre-edit snapshot. Deploy
-		// what the user sees: fold the live buffer into its draft (same merge
-		// the autosave bundle applies before persisting).
-		const liveContentPath =
-			pe.liveContent.scriptPath != undefined && pe.drafts.has(pe.liveContent.scriptPath)
-				? pe.liveContent.scriptPath
-				: undefined
-		const entries = [...pe.drafts.entries()].map(([path, d]) => {
-			if (path !== liveContentPath || d.script.content === pe.liveContent.content)
-				return [path, d] as [string, Draft]
-			return [path, { ...d, script: { ...d.script, content: pe.liveContent.content } }] as [
-				string,
-				Draft
-			]
-		})
 		// Snapshot what the preview promises for every draft before anything
 		// deploys — used to verify the persisted graph below.
-		const predicted = predictCascadeFacts(entries.map(([p]) => p))
-		const errors = new Map<string, string>()
-		const savedPaths: string[] = []
-		// Parallel — every createScript is independent. The backend handles
-		// its own ordering for any cross-script lock writes; we just want
-		// failures isolated per script so one bad body doesn't block the
-		// other deploys.
-		const results = await Promise.allSettled(
-			entries.map(async ([path, d]) => {
-				await saveDraft(path, d, ws)
-				return path
-			})
-		)
-		for (let i = 0; i < results.length; i++) {
-			const r = results[i]
-			const [path] = entries[i]
-			if (r.status === 'fulfilled') {
-				savedPaths.push(path)
-			} else {
-				const e: any = r.reason
-				errors.set(path, e?.body ?? e?.message ?? String(e))
-			}
-		}
-		// Drop the saved drafts from the map; failed ones stay so the user
-		// can fix them and retry. Build the new map from the still-failing
-		// entries to keep insertion order stable.
-		if (savedPaths.length > 0) {
-			const next = new Map<string, Draft>()
-			for (const [k, v] of pe.drafts) {
-				if (!savedPaths.includes(k)) next.set(k, v)
-			}
-			pe.drafts = next
-			// If the open draft just got deployed, transfer the focus to
-			// its now-persisted runnable so the pane stays on the same
-			// script the user was editing — otherwise the pane closes,
-			// the canvas re-fits, and the user has to re-find their
-			// script after every save.
-			if (pe.activeDraftPath && savedPaths.includes(pe.activeDraftPath)) {
-				pe.selection = {
-					kind: 'runnable',
-					runnable_kind: 'script',
-					path: pe.activeDraftPath
-				}
-				pe.activeDraftPath = undefined
-			}
+		const predicted = predictCascadeFacts([...pe.drafts.keys()])
+		const { savedPaths, savedTriggers, errors } = await deployPipelineDrafts(pe, $workspaceStore)
+		if (savedPaths.length > 0 || savedTriggers.length > 0) {
 			await graphRes.refetch()
 			// Verify only what actually deployed — failed drafts would
 			// otherwise false-positive as "missing" rows.
 			reportDeployDrift(new Map([...predicted].filter(([p]) => savedPaths.includes(p))))
 		}
 		saveErrors = errors
+		if (errors.size > 0) saveErrorsOpen = true
 		savingAll = false
-		if (savedPaths.length > 0 && errors.size === 0) {
-			sendUserToast(`Saved ${savedPaths.length} draft${savedPaths.length === 1 ? '' : 's'}`)
-		} else if (savedPaths.length > 0 && errors.size > 0) {
-			sendUserToast(`Saved ${savedPaths.length}, ${errors.size} failed — see details`, true)
+		const savedCount = savedPaths.length + savedTriggers.length
+		if (savedCount > 0 && errors.size === 0) {
+			sendUserToast(`Saved ${savedCount} draft${savedCount === 1 ? '' : 's'}`)
+		} else if (savedCount > 0 && errors.size > 0) {
+			sendUserToast(`Saved ${savedCount}, ${errors.size} failed — see details`, true)
 		} else if (errors.size > 0) {
 			sendUserToast(`${errors.size} draft${errors.size === 1 ? '' : 's'} failed to save`, true)
 		}
@@ -759,6 +733,7 @@
 		next.delete(path)
 		pe.drafts = next
 		forgetPath(path)
+		pe.discardTriggerDraftsFor(path)
 	}
 
 	function clearSaveError(path: string) {
@@ -768,13 +743,13 @@
 		saveErrors = next
 	}
 
-	// "This path is gone" cleanup. The three big inferred-* / annotated-*
-	// maps used to live here too, but they're now derived from
-	// `bodiesByPath` × `g.runnables` — entries for missing paths drop out
-	// implicitly when `g.runnables` no longer mentions them, so the only
-	// things left to flush are the live overlays for the open pane + the
-	// selection + per-path save errors. `bodiesByPath` keeps its entry
-	// (only-add cache, harmless if stale).
+	function forgetScriptCache(...paths: string[]) {
+		assetPrefetch.forget(...paths)
+	}
+
+	// "This path is gone" cleanup: the live overlays for the open pane, the
+	// selection and per-path save errors. The prefetched edge maps need nothing,
+	// being derived over the current graph's scripts.
 	function forgetPath(path: string) {
 		if (pe.activeDraftPath === path) pe.activeDraftPath = undefined
 		if (pe.selection?.kind === 'runnable' && pe.selection.path === path) {
@@ -801,6 +776,8 @@
 		const draft = pe.drafts.get(oldPath)
 		if (!draft) return 'Draft not found'
 		if (pe.drafts.has(newPath)) return 'Another draft already uses this path'
+		const clash = pe.retargetTriggerDrafts(oldPath, newPath)
+		if (clash) return `Its draft trigger would be renamed to ${clash}, which another draft uses`
 		const next = new Map<string, Draft>()
 		// Preserve insertion order: replace the entry at its original
 		// position so the canvas / lists don't reshuffle on rename.
@@ -902,7 +879,7 @@
 				const draft = pe.drafts.get(path)
 				if (!draft) break
 				try {
-					await saveDraft(path, draft, $workspaceStore)
+					await deployPipelineScript(draft, $workspaceStore)
 					// Archive the previously-deployed intermediate path (if
 					// any) — a double-rename otherwise leaves it as an
 					// orphan script visible on the canvas as a "deployed"
@@ -952,6 +929,7 @@
 					const nextErrors = new Map(saveErrors)
 					nextErrors.set(path, msg)
 					saveErrors = nextErrors
+					saveErrorsOpen = true
 				}
 				// Pick up the next queued rename, if any.
 				const next = state.queuedPath
@@ -1019,6 +997,7 @@
 	// template can gate them per-mode with simple ternaries — the canvas
 	// hides each affordance when its callback is undefined.
 	function handleCanvasSelect(s: AssetGraphSelection | undefined) {
+		uploadInputsPath = undefined
 		// Clicking a node while the pane is explicitly hidden is a request
 		// to see that node — unhide. Background clicks (s == undefined)
 		// keep the hidden state.
@@ -1050,9 +1029,10 @@
 		language: ScriptLang,
 		scriptPath: string,
 		outputKind: PipelineOutputKind,
-		aiPrompt?: string
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
 	) {
-		const ref = `${ASSET_PREFIX[asset.kind]}${asset.path}`
+		const ref = assetRef(asset)
 		openMaterializerDraft(
 			language,
 			scriptPath,
@@ -1062,7 +1042,8 @@
 				kind: asset.kind,
 				path: asset.path
 			},
-			aiPrompt
+			aiPrompt,
+			options
 		)
 	}
 	function handleAddPipelineScript(
@@ -1070,10 +1051,307 @@
 		scriptPath: string,
 		source: { kind: NativeTriggerKind; path: string | undefined },
 		outputKind: PipelineOutputKind,
-		aiPrompt?: string
+		aiPrompt?: string,
+		options?: PipelineInsertOptions
 	) {
-		openMaterializerDraft(language, scriptPath, [source], outputKind, undefined, aiPrompt)
+		openMaterializerDraft(language, scriptPath, [source], outputKind, undefined, aiPrompt, options)
+		// A schedule was configured by the wizard itself; other row-backed kinds
+		// are configured in their own editor, as a draft of the new script.
+		if (source.kind !== 'schedule' && isDraftableTriggerKind(source.kind)) {
+			openTriggerDraft(source.kind, scriptPath)
+		}
 	}
+	// Assets-only "Delete N items": one confirmation, then the trigger and the
+	// script, each discarded if it is a draft and deleted if it is deployed.
+	let assetDeleteTarget = $state<AssetUpstreamDelete | undefined>(undefined)
+	let assetDeleteLoading = $state(false)
+	// Permanent script deletion is admin-only, as in the pane's own remove modal;
+	// everyone else archives it.
+	let canHardDeleteScripts = $derived(!!($userStore?.is_admin || $userStore?.is_super_admin))
+	async function confirmAssetUpstreamDelete() {
+		const target = assetDeleteTarget
+		const ws = $workspaceStore
+		if (!target || !ws) return
+		assetDeleteLoading = true
+		const { script, trigger } = target
+		const n = (script ? 1 : 0) + (trigger ? 1 : 0)
+		try {
+			// The script first: when it is refused, nothing else has changed.
+			if (script) await removeScript(script, ws)
+		} catch (e: any) {
+			sendUserToast(`Could not remove ${script?.path}: ${e?.body ?? e?.message ?? String(e)}`, true)
+			assetDeleteLoading = false
+			return
+		}
+		try {
+			if (trigger) {
+				const key = triggerDraftKey(trigger.kind, trigger.path)
+				if (pe.triggerDrafts.has(key)) pe.discardTriggerDraft(key)
+				if (!trigger.draft) await deleteTriggerRow(trigger.kind, trigger.path, ws)
+			}
+			sendUserToast(`Removed ${n} item${n === 1 ? '' : 's'}`)
+		} catch (e: any) {
+			sendUserToast(
+				`${script ? `Removed ${script.path}, but not its` : 'Could not remove the'} ${trigger?.kind} trigger ${trigger?.path}: ${e?.body ?? e?.message ?? String(e)}`,
+				true
+			)
+		} finally {
+			assetDeleteTarget = undefined
+			assetDeleteLoading = false
+			await graphRes.refetch()
+		}
+	}
+	async function removeScript(script: { path: string }, ws: string) {
+		const deployed = graphRes.current?.runnables.some(
+			(r) => r.path === script.path && !r.unsaved
+		)
+		if (deployed) {
+			if (canHardDeleteScripts) {
+				await ScriptService.deleteScriptByPath({ workspace: ws, path: script.path })
+			} else {
+				await ScriptService.archiveScriptByPath({ workspace: ws, path: script.path })
+			}
+		}
+		if (pe.drafts.has(script.path)) discardDraft(script.path)
+		if (deployed) {
+			pe.discardTriggerDraftsFor(script.path)
+			forgetPath(script.path)
+			forgetScriptCache(script.path)
+		}
+	}
+
+	// ===================== Fixes for misconfigured nodes =====================
+	// Rewrites a script's annotation header and keeps the result as a draft, opened
+	// so the change is in view. The pane closes first and its buffer is saved back
+	// before the content is read: saved back after the edit, it would overwrite it.
+	async function editScriptHeader(
+		path: string,
+		apply: (content: string) => string,
+		done: string
+	): Promise<boolean> {
+		const ws = $workspaceStore
+		if (!ws) return false
+		// Wait for Edit: the switch reopens Edit's set-aside pane when it lands, which
+		// would take the place of the draft opened below.
+		if (mode !== 'edit') await setMode('edit')
+		pe.selection = undefined
+		pe.activeDraftPath = undefined
+		await tick()
+		await new Promise<void>((r) => queueMicrotask(r))
+		const draft = pe.drafts.get(path)
+		let script: Script
+		try {
+			script = draft
+				? draft.script
+				: await ScriptService.getScriptByPath({ workspace: ws, path })
+		} catch (e: any) {
+			sendUserToast(`Could not open ${path}: ${e?.body ?? e?.message ?? String(e)}`, true)
+			return false
+		}
+		panelHidden = false
+		const content = apply(script.content ?? '')
+		if (content === script.content) {
+			pe.activeDraftPath = draft ? path : undefined
+			if (!draft) pe.selection = { kind: 'runnable', runnable_kind: 'script', path }
+			sendUserToast(`${path} already does that`)
+			return true
+		}
+		const next = new Map(pe.drafts)
+		next.set(path, {
+			...(draft ?? { localId: pe.promotedDraftLocalId(path) }),
+			script: { ...script, content }
+		})
+		pe.drafts = next
+		pe.activeDraftPath = path
+		sendUserToast(`${done} in ${path}. It is a draft until you save.`)
+		return true
+	}
+
+	// Edits several scripts' headers at once, after the user has seen the list: a
+	// change to one edge or node must not silently rewrite scripts they didn't pick.
+	let multiEdit = $state<{ scripts: string[]; what: string; run: () => Promise<void> } | undefined>(
+		undefined
+	)
+	function editScripts(
+		scripts: string[],
+		what: string,
+		apply: (script: string) => (content: string) => string
+	) {
+		const run = async () => {
+			for (const s of scripts) await editScriptHeader(s, apply(s), what)
+		}
+		if (scripts.length > 1) multiEdit = { scripts, what, run }
+		else void run()
+	}
+
+	const scriptName = (p: string) => p.split('/').pop() ?? p
+
+	const readsAsset = (script: string, asset: { kind: AssetKind; path: string }) =>
+		shownGraph.edges.some(
+			(e) =>
+				e.runnable_path === script &&
+				e.asset_kind === asset.kind &&
+				e.asset_path === asset.path &&
+				(e.access_type === 'r' || e.access_type === 'rw')
+		)
+	const selectScript = (path: string) => {
+		pe.activeDraftPath = pe.drafts.has(path) ? path : undefined
+		pe.selection = pe.drafts.has(path)
+			? undefined
+			: { kind: 'runnable', runnable_kind: 'script', path }
+	}
+	const selectAsset = (asset: { kind: AssetKind; path: string }) => {
+		pe.activeDraftPath = undefined
+		pe.selection = { kind: 'asset', asset_kind: asset.kind, path: asset.path }
+	}
+	const scriptLink = (path: string) => ({ text: path, onClick: () => selectScript(path) })
+	const assetLink = (asset: { kind: AssetKind; path: string }) => ({
+		text: asset.path,
+		onClick: () => selectAsset(asset)
+	})
+
+	let nodeFixes = $derived.by(() => {
+		const fixes = new Map<string, NodeFixSpec>()
+		if (isOperator) return fixes
+		for (const [path, asset] of nodeErrors.waitsOn) {
+			fixes.set(`script:${path}`, {
+				explainer: [
+					'Runs after each write to ',
+					// Not drawn when only this subscription names it: nothing to select.
+					shownGraph.edges.some(
+						(e) => e.asset_kind === asset.kind && e.asset_path === asset.path
+					)
+						? assetLink(asset)
+						: asset.path,
+					', but nothing writes it, so it never runs.'
+				],
+				actions: [
+					{
+						label: `Remove \`on ${assetRef(asset)}\``,
+						detail: `${stopListeningChangeText(asset, readsAsset(path, asset))} in ${path}; only the annotation header changes. Saved as a draft.`,
+						run: () =>
+							editScriptHeader(
+								path,
+								(c) => stopListeningToAsset(c, asset, readsAsset(path, asset)),
+								`Removed \`on ${assetRef(asset)}\``
+							)
+					},
+					{
+						label: 'Open script',
+						run: () => {
+							pe.activeDraftPath = pe.drafts.has(path) ? path : undefined
+							pe.selection = pe.drafts.has(path)
+								? undefined
+								: { kind: 'runnable', runnable_kind: 'script', path }
+						}
+					}
+				]
+			})
+		}
+		for (const [path, why] of nodeErrors.untriggered) {
+			const unsaved = displayGraph.runnables.some((r) => r.path === path && r.unsaved)
+			fixes.set(`script:${path}`, {
+				explainer: [
+					'Nothing starts ',
+					scriptLink(path),
+					why === 'no-trigger'
+						? ': it has no trigger, so it only runs by hand.'
+						: ': it only runs after writes to tables it reads, and nothing writes them, so it only runs by hand.'
+				],
+				actions: [
+					{
+						label: 'Run it on a schedule',
+						detail: `Opens the schedule setup. On create: adds \`on schedule\` in ${path}, with the schedule as a draft.`,
+						scheduleFor: {
+							script: path,
+							onSchedule: async (schedule) => {
+								// Checked first: a header saying `on schedule` with no schedule
+								// behind it would be a new error, not a fix.
+								if (pe.triggerDrafts.has(triggerDraftKey('schedule', schedule.path))) {
+									sendUserToast(
+										`Another draft schedule already uses the path ${schedule.path}`,
+										true
+									)
+									return
+								}
+								const ok = await editScriptHeader(
+									path,
+									(c) => addTriggerDirective(c, 'schedule'),
+									'Added a schedule'
+								)
+								if (!ok) return
+								if (!pe.setTriggerDraft({ kind: 'schedule', config: { ...schedule, script_path: path } })) {
+									sendUserToast(
+										`Another draft schedule already uses the path ${schedule.path}; ${path} has no schedule yet`,
+										true
+									)
+								}
+							}
+						}
+					},
+					{
+						label: 'Run it from a webhook',
+						detail: `Adds \`on webhook\` in ${path}: it runs when its webhook URL is called. Saved as a draft.`,
+						run: () =>
+							editScriptHeader(path, (c) => addTriggerDirective(c, 'webhook'), 'Added a webhook')
+					},
+					{
+						label: unsaved ? 'Discard it' : 'Remove it',
+						detail: unsaved
+							? 'Drops the draft.'
+							: 'Opens its archive or delete confirmation.',
+						run: async () => {
+							if (mode !== 'edit') await setMode('edit')
+							// The pane takes the remove request only once it is open on the
+							// script: a request made as it mounts is its starting point.
+							if (!unsaved) {
+								panelHidden = false
+								pe.activeDraftPath = undefined
+								pe.selection = { kind: 'runnable', runnable_kind: 'script', path }
+								await tick()
+							}
+							handleRunnableMenuRemove({ runnable_kind: 'script', path, unsaved })
+						}
+					}
+				]
+			})
+		}
+		for (const t of displayGraph.triggers) {
+			if (t.trigger_kind === 'asset' || !t.missing) continue
+			if (t.trigger_kind === 'webhook' || t.trigger_kind === 'data_upload') continue
+			const kind = t.trigger_kind
+			const script = t.runnable_path
+			const label = TRIGGER_NODE_STYLE[kind]?.label ?? kind
+			fixes.set(`trigger:${kind}:missing:${script}`, {
+				explainer: [
+					scriptLink(script),
+					` declares \`on ${kind}\`, but no ${label} trigger points at it, so nothing starts it that way.`
+				],
+				actions: [
+					{
+						label: `Create the ${label} trigger`,
+						detail: 'Opens its editor. It is created when you save the pipeline.',
+						run: () => {
+							if (mode !== 'edit') setMode('edit')
+							openMissingTriggerDrawer(kind, script)
+						}
+					},
+					{
+						label: `Remove \`on ${kind}\` from ${scriptName(script)}`,
+						detail: `Edits ${script}. Saved as a draft.`,
+						run: () =>
+							editScriptHeader(
+								script,
+								(c) => removeTriggerDirective(c, kind),
+								`Removed \`on ${kind}\``
+							)
+					}
+				]
+			})
+		}
+		return fixes
+	})
+
 	function handleRunnableMenuRemove(info: {
 		runnable_kind: 'script' | 'flow'
 		path: string
@@ -1227,7 +1505,8 @@
 			liveAnnotations: pe.liveAnnotations,
 			inferredWritesByPath,
 			inferredReadsByPath,
-			annotatedNativeKindsByPath
+			annotatedNativeKindsByPath,
+			triggerDrafts: pe.triggerDrafts.values()
 		})
 	)
 
@@ -1250,7 +1529,166 @@
 	// What the canvas renders: drafts merged in edit, deployed-only in view —
 	// unless the "show drafts" chip is on, which overlays the drafts onto the
 	// view (what View will show once they're deployed).
-	let displayGraph = $derived(mode === 'edit' || includeDrafts ? graphWithDraft : deployedGraph)
+	let shownGraph = $derived(mode === 'edit' || includeDrafts ? graphWithDraft : deployedGraph)
+	// Each script's explicit `// on <asset>` subscriptions, from its live buffer,
+	// draft or deployed body.
+	let explicitOnByPath = $derived.by(() => {
+		const showDrafts = mode === 'edit' || includeDrafts
+		const out = new Map<string, Array<{ kind: AssetKind; path: string }>>()
+		for (const r of shownGraph.runnables) {
+			if (r.usage_kind !== 'script') continue
+			const live =
+				showDrafts && pe.liveAnnotations.scriptPath === r.path ? pe.liveAnnotations : undefined
+			const content = showDrafts ? pe.drafts.get(r.path)?.script.content : undefined
+			const body = content ?? assetPrefetch.bodies.get(r.path)
+			const refs = live
+				? live.annotations.triggerAssets
+				: body !== undefined
+					? parsePipelineAnnotations(body).triggerAssets
+					: []
+			if (refs.length > 0) out.set(r.path, refs)
+		}
+		return out
+	})
+	// Assets an asset trigger waits on (explicit `on`, or an auto-triggering read)
+	// that nothing in the pipeline writes, checked against the whole workspace: an
+	// asset trigger fires on a write from anywhere.
+	// Every other asset nothing in the pipeline writes is looked up too, so an
+	// asset nothing writes anywhere can go without the "add downstream step" +.
+	let writtenInPipeline = $derived(
+		new Set(
+			shownGraph.edges
+				.filter(
+					(e) =>
+						e.runnable_kind === 'script' && (e.access_type === 'w' || e.access_type === 'rw')
+				)
+				.map((e) => `${e.asset_kind}:${e.asset_path}`)
+		)
+	)
+	// dbt builds its models; its sources come from elsewhere, like any other asset.
+	const dbtBuilt = (a: { dbt?: { resource_type?: string } | null }) =>
+		!!a.dbt && a.dbt.resource_type !== 'source'
+	let unwrittenInPipeline = $derived(
+		[
+			...new Set([
+				...pipelineNodeErrors(shownGraph, explicitOnByPath).unwrittenTriggerAssets,
+				...shownGraph.assets
+					.filter((a) => !dbtBuilt(a) && !writtenInPipeline.has(`${a.kind}:${a.path}`))
+					.map((a) => `${a.kind}:${a.path}`)
+			])
+		]
+			.sort()
+			.join('\n')
+	)
+	// Whether a script outside the pipeline writes each asset (a flow's write fires
+	// no asset trigger). One lookup per asset, bounded, and remembered per
+	// `kind:path` so editing the graph only asks about assets it has not seen.
+	const writerLookups = new Map<string, Promise<boolean | undefined>>()
+	const writerLimit = pLimit(6)
+	function writtenInWorkspace(ws: string, key: string): Promise<boolean | undefined> {
+		const cacheKey = `${ws}\n${key}`
+		let p = writerLookups.get(cacheKey)
+		if (!p) {
+			const i = key.indexOf(':')
+			const kind = key.slice(0, i)
+			const path = key.slice(i + 1)
+			p = writerLimit(async () => {
+				try {
+					const res = await AssetService.listAssets({ workspace: ws, path, assetKinds: kind })
+					return res.assets.some((a) =>
+						a.usages.some(
+							(u) => u.kind === 'script' && (u.access_type === 'w' || u.access_type === 'rw')
+						)
+					)
+				} catch {
+					// Unknown: the node stays flagged, and the next graph change asks again.
+					writerLookups.delete(cacheKey)
+					return undefined
+				}
+			})
+			writerLookups.set(cacheKey, p)
+		}
+		return p
+	}
+	let writtenElsewhere = resource(
+		[() => $workspaceStore, () => unwrittenInPipeline],
+		async ([ws, keys]) => {
+			const out = new Set<string>()
+			if (!ws || !keys) return out
+			const list = keys.split('\n')
+			const found = await Promise.all(list.map((key) => writtenInWorkspace(ws, key)))
+			list.forEach((key, i) => found[i] && out.add(key))
+			return out
+		}
+	)
+	// Until the lookup answers for the assets it is asking about, they count as
+	// written: a node turns red only once nothing is known to write them, never
+	// for the moment the answer is in flight.
+	let nodeErrors = $derived.by(() => {
+		const errors = pipelineNodeErrors(
+			shownGraph,
+			explicitOnByPath,
+			writtenElsewhere.loading || !writtenElsewhere.current
+				? new Set([...(writtenElsewhere.current ?? []), ...unwrittenInPipeline.split('\n')])
+				: writtenElsewhere.current
+		)
+		// A webhook or data upload trigger is read from the script's body, which loads
+		// after the graph: until it has, "nothing starts it" may only mean "not read yet".
+		for (const path of [...errors.untriggered.keys()]) {
+			if (pe.drafts.has(path) || assetPrefetch.bodies.has(path)) continue
+			errors.untriggered.delete(path)
+			errors.scripts.delete(path)
+		}
+		return errors
+	})
+	let displayGraph = $derived(withSummaries(shownGraph))
+	// Adds what the canvas shows but the resolved graph does not carry: script
+	// summaries and languages, schedule crons, and which nodes are misconfigured.
+	function withSummaries(g: AssetGraphResponse): AssetGraphResponse {
+		const showDrafts = mode === 'edit' || includeDrafts
+		const errors = nodeErrors
+		const schedules = scheduleInfo.current
+		// An asset drawn only because a script subscribes to it, which nothing ever
+		// writes, stands for nothing: it is left out, and the subscriber carries the
+		// error. One a script reads or writes stays.
+		const used = new Set(g.edges.map((e) => `${e.asset_kind}:${e.asset_path}`))
+		const phantom = new Set([...errors.unwritten.keys()].filter((k) => !used.has(k)))
+		const triggers = g.triggers.filter(
+			(t) => t.trigger_kind !== 'asset' || !phantom.has(`${t.asset_kind}:${t.asset_path}`)
+		)
+		return {
+			...g,
+			triggers: schedules?.size
+				? triggers.map((t) =>
+						t.trigger_kind === 'schedule' && t.path && !t.draft && schedules.has(t.path)
+							? { ...t, ...schedules.get(t.path) }
+							: t
+					)
+				: triggers,
+			assets: g.assets
+				.filter((a) => !phantom.has(`${a.kind}:${a.path}`))
+				.map((a) => {
+					const key = `${a.kind}:${a.path}`
+					const error = errors.assets.get(key)
+					// Only once the workspace lookup has answered: before, it is unknown.
+					const never_written =
+						!dbtBuilt(a) &&
+						!writtenInPipeline.has(key) &&
+						!!writtenElsewhere.current &&
+						!writtenElsewhere.loading &&
+						!writtenElsewhere.current.has(key)
+					return error || never_written ? { ...a, error, never_written } : a
+				}),
+			runnables: g.runnables.map((r) => {
+				const draft = showDrafts ? pe.drafts.get(r.path)?.script : undefined
+				const meta = assetPrefetch.scriptMeta.get(r.path)
+				const summary = draft?.summary || meta?.summary
+				const language = draft?.language ?? meta?.language
+				const error = r.usage_kind === 'script' ? errors.scripts.get(r.path) : undefined
+				return summary || language || error ? { ...r, summary, language, error } : r
+			})
+		}
+	}
 
 	// Leaving edit mode: drop the live editor overlays — they substitute the
 	// last keystroke buffer for one script inside inferredWritesByPath /
@@ -1486,7 +1924,7 @@
 	// data_upload) receives its input from the live event or request at dispatch
 	// time — a message, an HTTP body, an uploaded file — which doesn't exist
 	// during a manual run, so there's nothing to default and those scripts run
-	// empty (data_upload being fed its staged file instead, see dataUploadArgs).
+	// empty (data_upload being fed its staged file instead, see dataUploads).
 	// Resolved on demand right before a run (schedule args aren't in the graph
 	// response); fail-safe — a schedule we can't fetch just contributes nothing.
 	let scheduleArgsByPath: Record<string, Record<string, any>> = {}
@@ -1532,7 +1970,7 @@
 		// data-upload entry's staged file override. runWholePipeline already
 		// refused to start unless every data-upload entry is staged, so this is
 		// always the intended input.
-		const staged = { ...(scheduleArgsByPath[path] ?? {}), ...(dataUploadArgs[path]?.args ?? {}) }
+		const staged = { ...(scheduleArgsByPath[path] ?? {}), ...(dataUploads.argsFor(path) ?? {}) }
 		const draft = mode === 'edit' || includeDrafts ? pe.drafts.get(path) : undefined
 		if (draft) {
 			if (!draft.script.content || !draft.script.language) {
@@ -1848,70 +2286,8 @@
 		}
 	}
 
-	// Staged run-form input for data-upload entry scripts, keyed by path. Lifted
-	// out of the (transient, per-selection) run form so the uploaded/entered data
-	// persists across selection changes — it drives each entry node's green
-	// "ready" state and seeds the whole-pipeline run with that input. `valid` is
-	// the run form's full-schema validity (all required fields satisfied).
-	let dataUploadArgs = $state<Record<string, { args: Record<string, any>; valid: boolean }>>({})
-
-	// An S3Object-shaped value (the file picker writes `{ s3: '<path>' }`).
-	function isS3Object(v: any): boolean {
-		return !!v && typeof v === 'object' && !Array.isArray(v) && 's3' in v
-	}
-	// Whether a staged value carries actual data. Covers the two shapes a
-	// data-upload entry takes: an S3Object (file picker → `{ s3: '<path>' }`) and
-	// a plain required input (e.g. a JSON array pasted into the run form).
-	function hasMeaningfulValue(v: any): boolean {
-		if (v == null) return false
-		if (typeof v === 'string') return v.length > 0
-		if (Array.isArray(v)) return v.length > 0
-		if (typeof v === 'object')
-			return isS3Object(v) ? typeof v.s3 === 'string' && v.s3.length > 0 : Object.keys(v).length > 0
-		return true // numbers / booleans count as provided
-	}
-	// A data-upload entry is ready once the user actually provided its data, not
-	// just opened the form. Two guards: the form's own full-schema `valid` (every
-	// required field — including non-file ones — is satisfied), AND that any
-	// declared S3Object file field actually carries a file (the picker can leave
-	// an empty `{ s3: '' }` on a non-required file field, which `valid` alone
-	// wouldn't catch).
-	function dataUploadReady(path: string): boolean {
-		const staged = dataUploadArgs[path]
-		if (!staged || !staged.valid) return false
-		const values = Object.values(staged.args)
-		const s3s = values.filter(isS3Object)
-		if (s3s.length > 0) return s3s.every(hasMeaningfulValue)
-		return values.some(hasMeaningfulValue)
-	}
-	// Persist the run form's args + validity, but only for data-upload entries —
-	// other run forms (partitioned producers) run their own way and must not be
-	// mistaken for a staged upload. Idempotent: the run form re-emits on every
-	// keystroke/validation pass, so bail when the value is unchanged — otherwise
-	// each emit would reassign `dataUploadArgs`, giving `readyDataUploadPaths` a
-	// fresh Set identity that re-syncs the canvas and re-fires the form's emit
-	// effect (effect_update_depth_exceeded).
-	function stageRunFormArgs(path: string, args: Record<string, any>, valid: boolean) {
-		if (!dataUploadEntryPaths.has(path)) return
-		const prev = dataUploadArgs[path]
-		if (prev && prev.valid === valid && JSON.stringify(prev.args) === JSON.stringify(args)) return
-		dataUploadArgs = { ...dataUploadArgs, [path]: { args, valid } }
-	}
-	// Pipeline scripts that are data-upload entry points (a `data_upload` trigger
-	// in the displayed graph). They can't auto-run — they need an uploaded file
-	// before the pipeline can go (see runWholePipeline's gate + the node's green
-	// state).
-	let dataUploadEntryPaths = $derived(
-		new Set(
-			displayGraph.triggers
-				.filter((t) => t.trigger_kind === 'data_upload' && t.runnable_kind === 'script')
-				.map((t) => t.runnable_path)
-		)
-	)
-	// Of those, the ones with a staged file — drives the green node treatment.
-	let readyDataUploadPaths = $derived(
-		new Set([...dataUploadEntryPaths].filter((p) => dataUploadReady(p)))
-	)
+	// Data-upload entries' staged input; see usePipelineDataUploads.
+	const dataUploads = usePipelineDataUploads(() => displayGraph)
 
 	// Every pipeline-member script, for the always-visible header "Run pipeline"
 	// control. Per-node runs are hover/select-gated on the canvas; this
@@ -1934,7 +2310,7 @@
 		// point the user at the first unready node instead of launching a doomed
 		// run.
 		const unready = allPipelineScripts.filter(
-			(p) => dataUploadEntryPaths.has(p) && !dataUploadReady(p)
+			(p) => dataUploads.entryPaths.has(p) && !dataUploads.isReady(p)
 		)
 		if (unready.length > 0) {
 			sendUserToast(
@@ -2141,7 +2517,52 @@
 	// auto-generated run form (the script declares an `S3Object` input, so the
 	// form renders the S3 picker) lets the user upload a file and run the
 	// pipeline. Drafts open in-place too so the user can fill the body first.
+	// A data-upload click opens the node on its inputs alone; any other selection
+	// (or "Open script") goes back to the script.
+	let uploadInputsPath = $state<string | undefined>(undefined)
+	// Runs the open node with its form inputs: a draft previews its own content, a
+	// deployed script runs for real (in view mode, cascading like any legit run).
+	// `live` is the pane's buffer when it differs from what is stored (a draft, or a
+	// deployed node edited before switching to the inputs view): it is previewed.
+	async function runUploadInputs(
+		path: string,
+		args: Record<string, any>,
+		live?: { content: string; language: ScriptLang }
+	): Promise<string | undefined> {
+		const draft = mode === 'edit' ? pe.drafts.get(path) : undefined
+		const body =
+			mode === 'edit'
+				? (live ?? (draft && { content: draft.script.content, language: draft.script.language }))
+				: undefined
+		if (!body) return mode === 'edit' ? runDeployedWithArgs(path, args) : runByPathLegit(path, args)
+		if (!$workspaceStore || !body.content || !body.language) return undefined
+		activeRunnables.arm(`script:${path}`)
+		try {
+			const jobId = await JobService.runScriptPreview({
+				workspace: $workspaceStore,
+				requestBody: {
+					content: body.content,
+					language: body.language,
+					path,
+					args: { ...args, _wmill_skip_asset_dispatch: true }
+				}
+			})
+			runsPendingJobId = jobId
+			runsRefreshKey++
+			activeRunnable = { kind: 'script', path }
+			activeRunnableJobId = jobId
+			return jobId
+		} catch (e: any) {
+			sendUserToast(`Run failed: ${e?.body ?? e?.message ?? e}`, true)
+			return undefined
+		}
+	}
+	// Same as a canvas run of a deployed node in edit mode: this step only.
+	function runDeployedWithArgs(path: string, args: Record<string, any>) {
+		return runByPathLegit(path, { ...args, _wmill_skip_asset_dispatch: true })
+	}
 	function openDataUploadRun(scriptPath: string) {
+		uploadInputsPath = scriptPath
 		// Opening the run form is meaningless while the pane is hidden —
 		// unhide first, same as a plain node click.
 		panelHidden = false
@@ -2168,6 +2589,12 @@
 		// time or silently bind to nothing. Surface that as a toast and
 		// keep the drawer closed; the user needs to save the script first
 		// (which also creates it under the new path if they renamed it).
+		// Kinds with a trigger row can instead wait as a pipeline draft and
+		// deploy with the pipeline, after the script.
+		if (isDraftableTriggerKind(kind) && pe.drafts.has(scriptPath)) {
+			openTriggerDraft(kind, scriptPath)
+			return
+		}
 		if (pe.drafts.has(scriptPath)) {
 			sendUserToast(
 				`Save the script "${scriptPath}" first — triggers can only be attached to deployed scripts.`,
@@ -2183,13 +2610,42 @@
 	// can still be edited everywhere else (TriggersPanel, etc.) where the
 	// picker stays editable.
 	function deleteAttachedTrigger(kind: NativeTriggerKind, triggerPath: string) {
+		const key = triggerDraftKey(kind, triggerPath)
+		if (pe.triggerDrafts.has(key)) {
+			pe.discardTriggerDraft(key)
+			return
+		}
 		triggerEditors?.requestDelete(kind, triggerPath)
 	}
 
 	function openEditTriggerDrawer(kind: NativeTriggerKind, triggerPath: string, scriptPath: string) {
+		const draft = pe.triggerDrafts.get(triggerDraftKey(kind, triggerPath))
+		if (draft) {
+			openTriggerDraft(draft.kind, scriptPath, draft)
+			return
+		}
 		triggerEditors?.openEdit(kind, triggerPath, scriptPath)
 	}
 
+	/** The kind's editor over a new draft, or over `draft` when re-editing one. */
+	function openTriggerDraft(
+		kind: PipelineTriggerDraftKind,
+		scriptPath: string,
+		draft?: PipelineTriggerDraft
+	) {
+		const defaults = { path: defaultTriggerPath(scriptPath, kind) }
+		triggerEditors?.openTriggerDraft(kind, scriptPath, defaults, draft?.config, (cfg) => {
+			const { extra_perms: _, ...config } = cfg
+			const saved = pe.setTriggerDraft(
+				{ kind, config: { ...config, path: cfg.path, script_path: scriptPath, is_flow: false } },
+				// The editor's Path field can rename it; drafts are keyed by path.
+				draft ? triggerDraftKey(kind, draft.config.path) : undefined
+			)
+			if (!saved) sendUserToast(`Another draft trigger already uses the path ${cfg.path}`, true)
+			return saved
+		})
+	}
+
 	// Reuse the empty AssetGraphResponse so we can still render the canvas
 	// (layout, controls, mini-map) on a fresh pipeline.
 	const EMPTY_GRAPH: AssetGraphResponse = {
@@ -2230,7 +2686,7 @@
 			displayName: `f/${p.folder}`,
 			icon: Folder,
 			disabled: false,
-			action: () => goto(`${base}/pipeline/${encodeURIComponent(p.folder)}${modeQuery}`)
+			action: () => goto(`/pipeline/${encodeURIComponent(p.folder)}${modeQuery}`)
 		}))
 		items.push({
 			displayName: 'Choose another folder…',
@@ -2277,6 +2733,35 @@
 		}
 	)
 
+	// Cron, zone and summary of the deployed schedules on the graph, for their nodes'
+	// labels. Re-read with every graph load, so an edit in the schedule drawer shows.
+	let scheduleInfo = resource(
+		[() => $workspaceStore, () => graphRes.current],
+		async ([ws, g]) => {
+			const info = new Map<string, { schedule: string; timezone: string; summary?: string }>()
+			if (!ws || !g) return info
+			const paths = new Set<string>()
+			for (const t of g.triggers) {
+				if (t.trigger_kind === 'schedule' && t.path && !t.missing) paths.add(t.path)
+			}
+			await Promise.all(
+				[...paths].map(async (path) => {
+					try {
+						const s = await ScheduleService.getSchedule({ workspace: ws, path })
+						info.set(path, {
+							schedule: s.schedule,
+							timezone: s.timezone,
+							summary: s.summary || undefined
+						})
+					} catch {
+						// Unreadable schedule: its node keeps the plain "Schedule" label.
+					}
+				})
+			)
+			return info
+		}
+	)
+
 	// Folder whose graph is actually rendered. `graphRes.current` is stale-
 	// while-revalidate on an in-place folder switch, so keying the canvas's
 	// one-shot initial fit on the route param would fire the new folder's fit
@@ -2287,64 +2772,6 @@
 		if (graphRes.current) untrack(() => (viewportFitFolder = folder))
 	})
 
-	// Body / inferred-assets prefetch sweep. Watches `g.runnables`; for any
-	// non-draft path we haven't fetched yet, fetches `getScriptByPath` and
-	// `inferAssets`, and stores both in their respective only-add caches.
-	// All three previously-sticky maps (`inferredWritesByPath`,
-	// `inferredReadsByPath`, `annotatedNativeKindsByPath`) are now derived
-	// from these caches × the current graph, so rename / delete cleanup
-	// happens implicitly when `g.runnables` changes — no per-mutation
-	// cache surgery needed. A generation counter cancels in-flight work on
-	// folder change so the previous folder's results never leak into the
-	// new one.
-	let prefetchingAssets = $state(false)
-	$effect(() => {
-		const ws = $workspaceStore
-		const g = graphRes.current
-		if (!ws || !g) return
-		const gen = ++bodyFetchGen
-		const targets = untrack(() =>
-			g.runnables
-				.filter((r) => r.usage_kind === 'script')
-				.map((r) => r.path)
-				.filter((p) => !pe.drafts.has(p) && !bodiesByPath.has(p))
-		)
-		if (targets.length === 0) return
-		let i = 0
-		const POOL = 6
-		const worker = async () => {
-			while (i < targets.length && gen === bodyFetchGen) {
-				const path = targets[i++]
-				try {
-					const s = await ScriptService.getScriptByPath({ workspace: ws, path })
-					if (gen !== bodyFetchGen) return
-					const content = s.content ?? ''
-					const res = await inferAssets(s.language, content)
-					if (gen !== bodyFetchGen) return
-					const inferred = (res?.assets ?? []) as AssetWithAltAccessType[]
-					untrack(() => {
-						if (!bodiesByPath.has(path)) {
-							const nextBodies = new Map(bodiesByPath)
-							nextBodies.set(path, content)
-							bodiesByPath = nextBodies
-						}
-						if (!inferredAssetsByPath.has(path)) {
-							const nextAssets = new Map(inferredAssetsByPath)
-							nextAssets.set(path, inferred)
-							inferredAssetsByPath = nextAssets
-						}
-					})
-				} catch {
-					// Skip — that node just falls back to base-graph edges.
-				}
-			}
-		}
-		prefetchingAssets = true
-		const pool = Array.from({ length: Math.min(POOL, targets.length) }, () => worker())
-		void Promise.all(pool).then(() => {
-			if (gen === bodyFetchGen) prefetchingAssets = false
-		})
-	})
 
 	function pluralize(n: number, singular: string): string {
 		return `${n} ${singular}${n === 1 ? '' : 's'}`
@@ -2386,81 +2813,92 @@
 	<title>Pipeline · {folder} — Windmill</title>
 </svelte:head>
 
-<div class="flex flex-col h-full">
+<PageHeaderContent
+	section={{ label: 'Pipelines', content: pipelineCrumb }}
+	actions={pipelineActions}
+	actionsFlexible
+/>
+
+{#snippet pipelineCrumb()}
+	<a
+		href="/pipeline"
+		class="flex items-center gap-1 px-1 py-0.5 rounded text-xs text-primary hover:bg-surface-hover hover:text-emphasis transition-colors"
+	>
+		<NetworkIcon size={14} class="shrink-0 text-tertiary" />
+		Pipelines
+	</a>
+	<span class="shrink-0 text-hint/40 text-xs" aria-hidden="true">/</span>
+	{#snippet folderSegment()}
+		<span
+			class="flex items-center gap-1 px-1 py-0.5 rounded text-xs text-primary hover:bg-surface-hover hover:text-emphasis transition-colors"
+			title="Switch pipeline folder"
+		>
+			<Folder size={14} class="shrink-0 text-tertiary" />
+			<span class="truncate font-normal">{folder}</span>
+			<ChevronDown size={14} class="shrink-0 text-tertiary" />
+		</span>
+	{/snippet}
+	{#if otherPipelineFolders.length === 0}
+		<button type="button" onclick={() => (pickerModalOpen = true)}>
+			{@render folderSegment()}
+		</button>
+	{:else}
+		<DropdownV2 size="sm" items={folderSwitcherItems}>
+			{#snippet buttonReplacement()}
+				{@render folderSegment()}
+			{/snippet}
+		</DropdownV2>
+	{/if}
+	{#if summary.length > 0}
+		<span class="text-2xs text-secondary truncate">{summary.join(' · ')}</span>
+	{/if}
+	{#if mode === 'edit' && $workspaceStore}
+		<!-- Draft sync for the whole pipeline bundle, beside its name like a flow's.
+		     Distinct from "Save all", which deploys the drafts. -->
+		<AutosaveIndicator
+			workspace={$workspaceStore}
+			itemKind={PIPELINE_DRAFT_KIND}
+			path={pipelineDraftPath}
+			draftOnly
+			loadedFromDraft={pe.loadedFromDbDraft}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet pipelineActions()}
+	<!-- This page carries more actions than any other in the band, so the set scrolls rather than
+	     being pushed off the end. `actionsFlexible` on the registration is what lets this box
+	     shrink far enough for that to matter. -->
 	<div
-		class="border-b flex flex-row justify-between gap-2 px-2 py-1 items-center overflow-y-visible overflow-x-auto min-h-12 shrink-0 whitespace-nowrap"
+		class="flex flex-row items-center gap-2 min-w-0 overflow-x-auto scrollbar-hidden whitespace-nowrap"
 	>
-		<div class="flex flex-row items-center gap-2 flex-1 min-w-0">
-			<Button
-				variant="subtle"
-				unifiedSize="sm"
-				href="{base}/pipeline"
-				startIcon={{ icon: ArrowLeft }}
-				iconOnly
-				title="Back to pipelines"
-			/>
-			<NetworkIcon size={16} class="text-tertiary shrink-0" />
-			<h1 class="text-sm font-semibold">{mode === 'edit' ? 'Pipeline editor' : 'Pipeline'}</h1>
-			<span class="text-tertiary text-sm">·</span>
-			{#if otherPipelineFolders.length === 0}
-				<button
-					type="button"
-					onclick={() => (pickerModalOpen = true)}
-					class="flex items-center gap-1.5 px-2.5 py-1 rounded-md border border-gray-300 dark:border-gray-600 bg-surface hover:bg-surface-hover transition-colors"
-					title="Switch pipeline folder"
-				>
-					<Folder size={14} class="text-tertiary shrink-0" />
-					<span class="text-sm font-mono font-medium text-emphasis">f/{folder}</span>
-					<ChevronDown size={12} class="text-tertiary" />
-				</button>
-			{:else}
-				<DropdownV2 size="sm" items={folderSwitcherItems}>
-					{#snippet buttonReplacement()}
-						<span
-							class="flex items-center gap-1.5 px-2.5 py-1 rounded-md border border-gray-300 dark:border-gray-600 bg-surface hover:bg-surface-hover transition-colors"
-							title="Switch pipeline folder"
-						>
-							<Folder size={14} class="text-tertiary shrink-0" />
-							<span class="text-sm font-mono font-medium text-emphasis">f/{folder}</span>
-							<ChevronDown size={12} class="text-tertiary" />
-						</span>
-					{/snippet}
-				</DropdownV2>
-			{/if}
-			{#if summary.length > 0}
-				<span class="text-xs text-tertiary">· {summary.join(' · ')}</span>
-			{/if}
-		</div>
 		{#if !isOperator}
 			<!-- Center group: the mode toggle is the page's primary control —
 			     anchored between the two flex-1 side groups so it stays
 			     centered, with breathing room on both sides. -->
-			<div class="flex flex-row items-center gap-2 shrink-0 px-6">
-				<PipelineModeToggle {mode} draftCount={pe.drafts.size} onModeChange={(m) => setMode(m)} />
-				{#if mode === 'view' && pe.drafts.size > 0}
+			<div class="flex flex-row items-center gap-2 shrink-0">
+				<PipelineModeToggle {mode} draftCount={pendingCount} onModeChange={(m) => setMode(m)} />
+				{#if mode === 'view' && pendingCount > 0}
 					<!-- View variant: overlay the unsaved drafts onto the deployed
 					     graph — "what View will show once they're deployed". -->
-					<button
-						type="button"
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						startIcon={{ icon: Telescope }}
 						onclick={() => (includeDrafts = !includeDrafts)}
-						class={twMerge(
-							'flex items-center gap-1.5 px-2.5 py-1 rounded-md border text-xs font-medium transition-colors',
-							includeDrafts
-								? 'bg-amber-50 dark:bg-amber-900/30 border-amber-300 dark:border-amber-700 text-amber-700 dark:text-amber-400'
-								: 'bg-surface border-gray-300 dark:border-gray-600 text-secondary hover:bg-surface-hover'
-						)}
+						btnClasses={includeDrafts
+							? '!bg-amber-50 dark:!bg-amber-900/30 !border-amber-300 dark:!border-amber-700 !text-amber-700 dark:!text-amber-400'
+							: undefined}
 						title={includeDrafts
 							? 'Showing undeployed drafts overlaid on the deployed pipeline — click to hide them'
 							: 'Overlay your undeployed drafts to see what the pipeline will look like once deployed'}
 					>
-						<Telescope size={14} />
 						{includeDrafts ? 'Showing' : 'Show'}
-						{pe.drafts.size} draft{pe.drafts.size === 1 ? '' : 's'}
-					</button>
+						{pendingCount} draft{pendingCount === 1 ? '' : 's'}
+					</Button>
 				{/if}
 			</div>
 		{/if}
-		<div class="flex flex-row items-center gap-2 flex-1 justify-end">
 			{#if !isOperator && allPipelineScripts.length > 0}
 				<!-- Only the armed state surfaces on the bar (arming lives in the ⋮
 				     menu) — a compact disarm pill. -->
@@ -2500,61 +2938,18 @@
 				</Button>
 			{/if}
 			{#if mode === 'edit' && saveErrors.size > 0}
-				<!-- Compact errors popover anchored next to Save all so users
-				     can see exactly which drafts failed and why without losing
-				     the editor context. Drafts that succeed disappear from
-				     the map; the ones still listed here are the unresolved
-				     failures. -->
-				<Popover placement="bottom-end" contentClasses="p-3 max-w-[480px]" usePointerDownOutside>
-					{#snippet trigger()}
-						<button
-							type="button"
-							class="flex items-center gap-1.5 px-2 py-1 rounded-md text-red-600 dark:text-red-400 bg-red-50 dark:bg-red-900/30 hover:bg-red-100 dark:hover:bg-red-900/50 transition-colors text-xs font-medium"
-							title="View save errors"
-						>
-							<AlertTriangle size={14} />
-							<span>{saveErrors.size} failed</span>
-						</button>
-					{/snippet}
-					{#snippet content()}
-						<div class="flex flex-col gap-2">
-							<span class="text-xs font-semibold text-emphasis">Save errors</span>
-							<div class="flex flex-col gap-2 max-h-72 overflow-y-auto">
-								{#each [...saveErrors.entries()] as [path, message]}
-									<div class="flex flex-col gap-0.5 border-l-2 border-red-400 pl-2">
-										<span class="text-2xs font-mono text-emphasis">{path}</span>
-										<span class="text-2xs text-red-600 dark:text-red-400 break-words">
-											{message}
-										</span>
-									</div>
-								{/each}
-							</div>
-						</div>
-					{/snippet}
-				</Popover>
+				<PipelineDeployErrors errors={saveErrors} bind:open={saveErrorsOpen} />
 			{/if}
-			{#if mode === 'edit' && pe.drafts.size > 0}
-				<!-- Draft autosave status for the whole pipeline bundle. Distinct
-				     from "Save all", which DEPLOYS the drafts — this only reflects
-				     that in-flight edits are persisted to the per-user server draft. -->
-				{#if $workspaceStore}
-					<AutosaveIndicator
-						workspace={$workspaceStore}
-						itemKind={PIPELINE_DRAFT_KIND}
-						path={pipelineDraftPath}
-						draftOnly
-						loadedFromDraft={pe.loadedFromDbDraft}
-					/>
-				{/if}
+			{#if mode === 'edit' && pendingCount > 0}
 				<Button
 					variant="accent"
 					unifiedSize="sm"
 					startIcon={{ icon: savingAll ? Loader2 : Save }}
-					onclick={saveAllDrafts}
+					onclick={requestSaveAll}
 					disabled={savingAll}
-					title={savingAll ? 'Saving drafts…' : `Deploy all ${pe.drafts.size} drafts`}
+					title={savingAll ? 'Saving drafts…' : `Deploy all ${pendingCount} drafts`}
 				>
-					{savingAll ? 'Saving…' : `Save all (${pe.drafts.size})`}
+					{savingAll ? 'Saving…' : `Save all (${pendingCount})`}
 				</Button>
 			{/if}
 			{#if mode === 'view'}
@@ -2570,6 +2965,7 @@
 					Activity
 				</Button>
 			{/if}
+			<OpenInSessionButton source={sessionOpen} />
 			<Button
 				variant="subtle"
 				unifiedSize="sm"
@@ -2580,9 +2976,10 @@
 				title="Refresh"
 			/>
 			<DropdownV2 size="sm" items={overflowMenuItems} />
-		</div>
 	</div>
+{/snippet}
 
+<div class="flex flex-col h-full">
 	<div class="flex-1 min-h-0">
 		{#if graphRes.loading && !graphRes.current}
 			<div class="h-full flex items-center justify-center gap-2 text-tertiary">
@@ -2606,7 +3003,7 @@
 				defaultPathSuffix={DEFAULT_PATH_SUFFIX}
 				{panelHidden}
 				onTogglePanelHidden={() => (panelHidden = !panelHidden)}
-				{prefetchingAssets}
+				prefetchingAssets={assetPrefetch.prefetching}
 				hoveredPaths={activityHoverPaths}
 				selectedRunPaths={activitySelectPaths}
 				{activeRunnable}
@@ -2625,13 +3022,59 @@
 				onDeleteTrigger={mode === 'edit' ? deleteAttachedTrigger : undefined}
 				onOpenWebhook={openWebhookDrawer}
 				onOpenDataUpload={openDataUploadRun}
-				{readyDataUploadPaths}
-				runFormInitialArgs={openScriptPath ? dataUploadArgs[openScriptPath]?.args : undefined}
-				onRunFormArgsChange={stageRunFormArgs}
+				readyDataUploadPaths={dataUploads.readyPaths}
+				runFormInitialArgs={openScriptPath ? dataUploads.argsFor(openScriptPath) : undefined}
+				onRunFormArgsChange={dataUploads.stage}
+				inputsOnly={uploadInputsPath !== undefined &&
+					(openScriptPath === undefined || uploadInputsPath === openScriptPath)}
+				onRunInputs={runUploadInputs}
+				onShowScript={() => (uploadInputsPath = undefined)}
 				onSelect={handleCanvasSelect}
 				onAddScriptForAsset={mode === 'edit' ? handleAddScriptForAsset : undefined}
 				onAddPipelineScript={mode === 'edit' ? handleAddPipelineScript : undefined}
 				onRunnableMenuRemove={mode === 'edit' ? handleRunnableMenuRemove : undefined}
+				onDeleteAssetUpstream={isOperator ? undefined : (t) => (assetDeleteTarget = t)}
+				{nodeFixes}
+				assetDeleteVerb={canHardDeleteScripts ? 'Delete' : 'Archive'}
+				onEdgeAction={isOperator
+					? undefined
+					: ({
+							action,
+							targets
+						}: {
+							action: 'listen' | 'stop'
+							targets: Array<{
+								script: string
+								asset: { kind: AssetKind; path: string }
+								reads: boolean
+							}>
+						}) => {
+							const byScript = new Map(targets.map((t) => [t.script, t] as const))
+							editScripts(
+								[...byScript.keys()],
+								action === 'listen' ? 'Now reruns on each write' : 'Stopped rerunning on writes',
+								(s) => (c) => {
+									const t = byScript.get(s)!
+									return action === 'listen'
+										? listenToAsset(c, t.asset, t.reads)
+										: stopListeningToAsset(c, t.asset, t.reads)
+								}
+							)
+						}}
+				onAddAssetTrigger={isOperator || mode !== 'edit'
+					? undefined
+					: ({
+							scripts,
+							asset
+						}: {
+							scripts: Array<{ script: string; reads: boolean }>
+							asset: { kind: AssetKind; path: string }
+						}) => {
+							const reads = new Map(scripts.map((s) => [s.script, s.reads] as const))
+							editScripts([...reads.keys()], 'Now reruns on each write', (s) => (c) =>
+								listenToAsset(c, asset, reads.get(s) ?? false)
+							)
+						}}
 				onRunProducer={mode === 'edit' ? handleRunProducer : undefined}
 				onRequestEdit={isOperator ? undefined : () => setMode('edit')}
 				canRunByPath={openScriptHasDataUpload}
@@ -2693,6 +3136,7 @@
 				}}
 				onPersistedSaved={async (savedPath) => {
 					const predicted = predictCascadeFacts([savedPath])
+					forgetScriptCache(savedPath)
 					await graphRes.refetch()
 					reportDeployDrift(predicted)
 				}}
@@ -2700,6 +3144,7 @@
 					if (pe.selection?.kind === 'runnable' && pe.selection.path === oldPath) {
 						pe.selection = { ...pe.selection, path: newPath }
 					}
+					forgetScriptCache(oldPath, newPath)
 					await graphRes.refetch()
 				}}
 				onScriptRemoved={async (removedPath) => {
@@ -2759,6 +3204,102 @@
 <!-- Native trigger drawer wiring: create/edit/delete drawers (edit-mode
      only) + the always-mounted webhook drawer. Driven imperatively from the
      page via `triggerEditors`. -->
+<ConfirmationModal
+	open={multiEdit != undefined}
+	title={`Edit ${multiEdit?.scripts.length ?? 0} scripts?`}
+	confirmationText="Edit scripts"
+	type="info"
+	onConfirmed={() => {
+		const m = multiEdit
+		multiEdit = undefined
+		void m?.run()
+	}}
+	onCanceled={() => (multiEdit = undefined)}
+>
+	{#if multiEdit}
+		<div class="flex flex-col gap-2 text-xs text-secondary">
+			<p>This will edit the annotation header of the following scripts. Each is saved as a draft.</p>
+			<ul class="flex flex-col gap-1">
+				{#each multiEdit.scripts as s (s)}
+					<li class="text-emphasis truncate">{s}</li>
+				{/each}
+			</ul>
+		</div>
+	{/if}
+</ConfirmationModal>
+
+<ConfirmationModal
+	open={assetDeleteTarget != undefined}
+	loading={assetDeleteLoading}
+	title={assetDeleteTarget?.script && assetDeleteTarget.trigger
+		? 'Delete 2 items?'
+		: assetDeleteTarget?.script
+			? `${canHardDeleteScripts ? 'Delete' : 'Archive'} script?`
+			: 'Delete trigger?'}
+	confirmationText={assetDeleteTarget?.script && !canHardDeleteScripts
+		? assetDeleteTarget.trigger
+			? 'Archive and delete'
+			: 'Archive'
+		: 'Delete'}
+	onConfirmed={confirmAssetUpstreamDelete}
+	onCanceled={() => {
+		if (!assetDeleteLoading) assetDeleteTarget = undefined
+	}}
+>
+	{#if assetDeleteTarget}
+		{@const t = assetDeleteTarget}
+		<div class="flex flex-col gap-2 text-xs text-secondary">
+			<p>
+				{#if t.script}
+					{canHardDeleteScripts
+						? 'The script is deleted, with every version'
+						: 'The script is archived'}{t.trigger ? ', and its trigger deleted' : ''}. The tables
+					it wrote stay.
+				{:else}
+					The trigger is deleted: its script stays, and no longer runs this way.
+				{/if}
+			</p>
+			<ul class="flex flex-col gap-1">
+				{#if t.script}
+					<li class="flex flex-col">
+						<span class="text-emphasis truncate">{t.script.path}</span>
+						<span class="text-2xs text-hint">Script{t.script.unsaved ? ' · draft' : ''}</span>
+					</li>
+				{/if}
+				{#if t.trigger}
+					<li class="flex flex-col">
+						<span class="text-emphasis truncate">{t.trigger.path}</span>
+						<span class="text-2xs text-hint"
+							>{t.trigger.kind} trigger{t.trigger.draft ? ' · draft' : ''}</span
+						>
+					</li>
+				{/if}
+			</ul>
+		</div>
+	{/if}
+</ConfirmationModal>
+
+<PipelineDeployTriggersModal
+	open={confirmTriggerDeployOpen}
+	triggerDrafts={pe.triggerDrafts}
+	onConfirmed={() => {
+		confirmTriggerDeployOpen = false
+		if (leaveAfterTriggerConfirm) {
+			leaveAfterTriggerConfirm = false
+			void saveAllAndLeave()
+		} else {
+			void saveAllDrafts()
+		}
+	}}
+	onCanceled={() => {
+		confirmTriggerDeployOpen = false
+		if (leaveAfterTriggerConfirm) {
+			leaveAfterTriggerConfirm = false
+			pendingNavigationUrl = undefined
+		}
+	}}
+/>
+
 <PipelineTriggerEditors
 	bind:this={triggerEditors}
 	mountTriggerEditors={mode === 'edit'}
@@ -2790,18 +3331,18 @@
 						</div>
 						<div class="ml-4 flex-1">
 							<h3 class="text-lg font-medium text-primary">
-								{pe.drafts.size === 1 ? 'Unsaved draft' : `${pe.drafts.size} unsaved drafts`}
+								{pendingCount === 1 ? 'Unsaved draft' : `${pendingCount} unsaved drafts`}
 							</h3>
 							<div class="mt-2 text-sm text-secondary flex flex-col gap-2">
 								<p>
-									You have {pe.drafts.size === 1
-										? 'a draft pipeline script'
-										: `${pe.drafts.size} draft pipeline scripts`} that {pe.drafts.size === 1
+									You have {pendingCount === 1
+										? 'a pipeline draft'
+										: `${pendingCount} pipeline drafts`} that {pendingCount === 1
 										? 'has'
 										: 'have'} not been deployed yet. What would you like to do?
 								</p>
 								<ul class="text-2xs font-mono pl-4 max-h-40 overflow-y-auto flex flex-col gap-0.5">
-									{#each [...pe.drafts.keys()] as p}
+									{#each [...pe.drafts.keys(), ...[...pe.triggerDrafts.values()].map((d) => d.config.path)] as p}
 										<li class="truncate text-tertiary">{p}</li>
 									{/each}
 								</ul>
@@ -2817,7 +3358,7 @@
 							startIcon={{ icon: leaveSaving ? Loader2 : Save }}
 						>
 							<span class="min-w-20"
-								>{leaveSaving ? 'Saving…' : `Save all (${pe.drafts.size})`}</span
+								>{leaveSaving ? 'Saving…' : `Save all (${pendingCount})`}</span
 							>
 						</Button>
 						<Button
diff --git a/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte b/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
index 31f48f2ff7..c358efb51b 100644
--- a/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
+++ b/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { page } from '$app/stores'
-	import { base } from '$app/paths'
 	import { goto } from '$lib/navigation'
 	import { Button } from '$lib/components/common'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
@@ -282,7 +281,7 @@
 					·
 					<a
 						class="text-accent hover:underline"
-						href="{base}/user/logout?rd={encodeURIComponent(logoutReturnTo)}"
+						href="/user/logout?rd={encodeURIComponent(logoutReturnTo)}"
 					>
 						Switch account
 					</a>
diff --git a/frontend/src/routes/(root)/(logged)/projects/install/+page.ts b/frontend/src/routes/(root)/(logged)/projects/install/+page.ts
index 718b624bd4..e779f7bfab 100644
--- a/frontend/src/routes/(root)/(logged)/projects/install/+page.ts
+++ b/frontend/src/routes/(root)/(logged)/projects/install/+page.ts
@@ -1,5 +1,4 @@
 import { redirect } from '@sveltejs/kit'
-import { base } from '$app/paths'
 import type { PageLoad } from './$types'
 
 /**
@@ -9,5 +8,5 @@ import type { PageLoad } from './$types'
  * entry point forwards to the wizard rather than 404ing, query string intact.
  */
 export const load: PageLoad = ({ url }) => {
-	redirect(307, `${base}/projects/import${url.search}`)
+	redirect(307, `/projects/import${url.search}`)
 }
diff --git a/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte b/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
index c702f66471..58739ee36a 100644
--- a/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
@@ -58,7 +58,7 @@
 	})
 </script>
 
-<CenteredModal title="Connecting to the remote instance">
+<CenteredModal title="Connecting to the remote instance" inPage>
 	{#if status === 'connecting'}
 		<div class="flex justify-center py-6"><Loader2 class="animate-spin" /></div>
 	{:else if status === 'connected'}
diff --git a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
index 183d10a003..48931c7871 100644
--- a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$lib/base'
 	import {
 		JobService,
 		type Job,
@@ -13,7 +12,6 @@
 		type ScriptArgs
 	} from '$lib/gen'
 	import {
-		canWrite,
 		computeSharableHash,
 		copyToClipboard,
 		encodeState,
@@ -70,7 +68,9 @@
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
 	import JobLoader from '$lib/components/JobLoader.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
-	import { ActionRow, Button, Skeleton, Tab, Alert, DrawerContent } from '$lib/components/common'
+	import { Button, Skeleton, Tab, Alert, DrawerContent } from '$lib/components/common'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { pageHeader } from '$lib/components/pageHeaderRegistry.svelte'
 	import JobDetailHeader from '$lib/components/runs/JobDetailHeader.svelte'
 	import ScriptRetryChain from '$lib/components/runs/ScriptRetryChain.svelte'
 	import FlowExecutionStatus from '$lib/components/runs/FlowExecutionStatus.svelte'
@@ -122,6 +122,9 @@
 		onEditInForkClick
 	} from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
+	import { useEditRights } from '$lib/operatorWriteRights'
+	import { AGENT_STEP_ID } from '$lib/components/flows/conversations/agentEditorChat'
+	const editRights = useEditRights()
 	let job: (Job & { result?: any; result_stream?: string }) | undefined = $state()
 	let jobUpdateLastFetch: Date | undefined = $state()
 
@@ -240,7 +243,7 @@
 			// key, and the logged layout only switches `$workspaceStore` when the URL
 			// carries `workspace=`. Without it a recipient whose active workspace
 			// differs would open the run (and validate the token) against the wrong one.
-			const url = `${window.location.origin}${base}/run/${id}?workspace=${encodeURIComponent(
+			const url = `${window.location.origin}/run/${id}?workspace=${encodeURIComponent(
 				workspace
 			)}&view_token=${encodeURIComponent(token)}`
 			copyToClipboard(url)
@@ -256,7 +259,7 @@
 			const token = (await JobService.getJobPublicViewToken({ workspace, id })).trim()
 			// The workspace is a path segment here: the public run page is outside the
 			// logged layout and has no workspace store to fall back on.
-			const url = `${window.location.origin}${base}/public_run/${encodeURIComponent(
+			const url = `${window.location.origin}/public_run/${encodeURIComponent(
 				workspace
 			)}/${id}?view_token=${encodeURIComponent(token)}`
 			copyToClipboard(url)
@@ -648,6 +651,10 @@
 		}
 	})
 	onDestroy(resetFavicon)
+
+	// The bar shares its row with the breadcrumb, and this page's name is a uuid that gives way
+	// grudgingly, so the buttons drop their labels rather than push each other off the end.
+	const compactBar = $derived(pageHeader.barWidth > 0 && pageHeader.barWidth < 1150)
 </script>
 
 <HighlightTheme />
@@ -749,7 +756,7 @@
 				</div>
 			</Alert>
 			<div class="mt-4">
-				<Button href="{base}/runs" unifiedSize="md" variant="accent">Go to runs page</Button>
+				<Button href="/runs" unifiedSize="md" variant="accent">Go to runs page</Button>
 			</div>
 		</div>
 	</div>
@@ -797,7 +804,7 @@
 		{/if}
 
 		<div class="mt-6 flex justify-center">
-			<Button href="{base}/runs" unifiedSize="md" variant="default">Go to runs page</Button>
+			<Button href="/runs" unifiedSize="md" variant="default">Go to runs page</Button>
 		</div>
 	</div>
 {:else}
@@ -805,289 +812,305 @@
 		class="max-w-7xl p-4 mx-auto w-full"
 		loading={!job}
 		layout={[
-			// 1. Top Action Bar (buttons on right side)
-			[
-				{ h: 2.5, w: 60 },
-				{ h: 2.5, w: 40 }
-			],
-			1,
-			// 2. Job Header
+			// 1. Job Header
 			[{ h: 12, w: 100 }],
 			1,
-			// 3. Progress Bar
+			// 2. Progress Bar
 			[{ h: 2, w: 100 }],
 			1.5
 		]}
 	/>
-	<ActionRow class="max-w-7xl px-4 mx-auto w-full">
-		{#snippet left()}
-			<h1 class="text-sm font-semibold text-primary">run/{page.params.run}</h1>
-		{/snippet}
-		{#snippet right()}
-			{@const isScript = job?.job_kind === 'script'}
-			{@const isHubFlowPreview = isFlowPreview(job?.job_kind) && isHubFlowPath(job?.script_path)}
-			{@const runsHref = `/runs/${job?.script_path}${!isScript ? '?jobKind=flow' : ''}`}
-			{#if job && 'deleted' in job && !job?.deleted && ($superadmin || ($userStore?.is_admin ?? false))}
-				<Dropdown
-					items={[
-						{
-							displayName: 'Delete result, logs and args (admin only)',
-							action: () => {
-								job?.id && deleteCompletedJob(job.id)
-							},
-							type: 'delete'
-						}
-					]}
-				>
-					{#snippet buttonReplacement()}
-						<Button
-							nonCaptureEvent
-							variant="default"
-							unifiedSize="sm"
-							startIcon={{ icon: Trash }}
-						/>
-					{/snippet}
-				</Dropdown>
-				{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
-					<Button href={runsHref} variant="default" unifiedSize="sm" startIcon={{ icon: List }}>
-						View runs
-					</Button>
-				{/if}
-			{/if}
-			{#if job}
-				<Dropdown
-					customWidth={280}
-					items={[
-						{
-							displayName: 'Copy link for members',
-							icon: Users,
-							tooltip:
-								'Read-only link to this run for another member of this workspace. They must be logged in.',
-							action: () => job && shareReadLink(job.id)
+	<!-- `section`, not an item: a run is not a workspace item the picker can open, so the trail
+	     ends with its id as a plain name. -->
+	<PageHeaderContent section={{ label: `run/${page.params.run}` }} actions={runActions} />
+
+	{#snippet runActions()}
+		{@const isScript = job?.job_kind === 'script'}
+		{@const isHubFlowPreview = isFlowPreview(job?.job_kind) && isHubFlowPath(job?.script_path)}
+		{@const runsHref = `/runs/${job?.script_path}${!isScript ? '?jobKind=flow' : ''}`}
+		{#if job && 'deleted' in job && !job?.deleted && ($superadmin || ($userStore?.is_admin ?? false))}
+			<Dropdown
+				items={[
+					{
+						displayName: 'Delete result, logs and args (admin only)',
+						action: () => {
+							job?.id && deleteCompletedJob(job.id)
 						},
+						type: 'delete'
+					}
+				]}
+			>
+				{#snippet buttonReplacement()}
+					<Button nonCaptureEvent variant="default" unifiedSize="sm" startIcon={{ icon: Trash }} />
+				{/snippet}
+			</Dropdown>
+			{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
+				<Button
+					href={runsHref}
+					variant="default"
+					unifiedSize="sm"
+					iconOnly={compactBar}
+					title="View runs"
+					startIcon={{ icon: List }}
+				>
+					View runs
+				</Button>
+			{/if}
+		{/if}
+		{#if job}
+			<Dropdown
+				customWidth={280}
+				items={[
+					{
+						displayName: 'Copy link for members',
+						icon: Users,
+						tooltip:
+							'Read-only link to this run for another member of this workspace. They must be logged in.',
+						action: () => job && shareReadLink(job.id)
+					},
+					{
+						displayName: 'Copy public link',
+						icon: Globe,
+						disabled: !canSharePublicly,
+						tooltip: canSharePublicly
+							? "Read-only link that anyone on the internet can open, without logging in. It shows a minimal version of this page: this run's inputs, result and logs, and for a flow its graph plus every step's inputs, result, logs and code. The link cannot be revoked."
+							: 'Sharing a run publicly is restricted in this workspace. Ask an admin to share it, or to grant you a bypass on the ruleset.',
+						action: () => job && sharePublicLink(job.id)
+					}
+				]}
+			>
+				{#snippet buttonReplacement()}
+					<Button
+						nonCaptureEvent
+						variant="default"
+						unifiedSize="sm"
+						iconOnly={compactBar}
+						title="Share"
+						startIcon={{ icon: Share2 }}
+					>
+						Share
+					</Button>
+				{/snippet}
+			</Dropdown>
+		{/if}
+		{@const stem = job?.job_kind === 'script_hub' ? '/scripts' : `/${job?.job_kind}s`}
+		{@const viewHref = `${stem}/get/${isScript ? job?.script_hash : job?.script_path}`}
+		{#if (job?.job_kind == 'flow' || isFlowPreview(job?.job_kind)) && job?.['running'] && job?.parent_job == undefined}
+			<div class="inline">
+				<Dropdown
+					items={[
 						{
-							displayName: 'Copy public link',
-							icon: Globe,
-							disabled: !canSharePublicly,
-							tooltip: canSharePublicly
-								? "Read-only link that anyone on the internet can open, without logging in. It shows a minimal version of this page: this run's inputs, result and logs, and for a flow its graph plus every step's inputs, result, logs and code. The link cannot be revoked."
-								: 'Sharing a run publicly is restricted in this workspace. Ask an admin to share it, or to grant you a bypass on the ruleset.',
-							action: () => job && sharePublicLink(job.id)
+							displayName: 'Show Flow Debug Info',
+							action: () => {
+								debugInfo()
+							}
 						}
 					]}
+					class="h-auto"
 				>
 					{#snippet buttonReplacement()}
-						<Button nonCaptureEvent variant="default" unifiedSize="sm" startIcon={{ icon: Share2 }}>
-							Share
+						<Button nonCaptureEvent unifiedSize="sm" variant="subtle">
+							<div class="flex flex-row items-center">
+								<EllipsisVertical size={14} />
+							</div>
 						</Button>
 					{/snippet}
 				</Dropdown>
-			{/if}
-			{@const stem = job?.job_kind === 'script_hub' ? '/scripts' : `/${job?.job_kind}s`}
-			{@const viewHref = `${stem}/get/${isScript ? job?.script_hash : job?.script_path}`}
-			{#if (job?.job_kind == 'flow' || isFlowPreview(job?.job_kind)) && job?.['running'] && job?.parent_job == undefined}
-				<div class="inline">
-					<Dropdown
-						items={[
-							{
-								displayName: 'Show Flow Debug Info',
-								action: () => {
-									debugInfo()
-								}
-							}
-						]}
-						class="h-auto"
-					>
-						{#snippet buttonReplacement()}
-							<Button nonCaptureEvent unifiedSize="sm" variant="subtle">
-								<div class="flex flex-row items-center">
-									<EllipsisVertical size={14} />
-								</div>
-							</Button>
-						{/snippet}
-					</Dropdown>
-				</div>
-			{/if}
-			{#if isFlowPreview(job?.job_kind) || isScriptPreview(job?.job_kind)}
+			</div>
+		{/if}
+		{#if isFlowPreview(job?.job_kind) || isScriptPreview(job?.job_kind)}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				iconOnly={compactBar}
+				title={isHubFlowPreview
+					? 'Fork flow into workspace'
+					: `Fork ${isFlowPreview(job?.job_kind) ? 'flow' : 'code'} preview`}
+				startIcon={{ icon: GitBranch }}
+				on:click={forkPreview}
+			>
+				{isHubFlowPreview
+					? 'Fork flow into workspace'
+					: `Fork ${isFlowPreview(job?.job_kind) ? 'flow' : 'code'} preview`}
+			</Button>
+		{/if}
+		{#if persistentScriptDefinition !== undefined}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				iconOnly={compactBar}
+				title="Current runs"
+				startIcon={{ icon: Activity }}
+				on:click={() => {
+					persistentScriptDrawer?.open?.(persistentScriptDefinition)
+				}}
+			>
+				Current runs
+			</Button>
+		{/if}
+		{#if canRunNow}
+			<Button
+				unifiedSize="md"
+				variant="default"
+				startIcon={{ icon: Play }}
+				on:click={() => job?.id && runJobNow(job.id)}
+				title="Start this job now instead of at its scheduled time, skipping any remaining delay or sleep. It keeps the same id, and a concurrency limit is still enforced."
+			>
+				Run now
+			</Button>
+		{/if}
+		{#if job && job?.type != 'CompletedJob' && (!job?.schedule_path || job?.['running'] == true)}
+			{#if !forceCancel}
 				<Button
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: GitBranch }}
-					on:click={forkPreview}
-				>
-					{isHubFlowPreview
-						? 'Fork flow into workspace'
-						: `Fork ${isFlowPreview(job?.job_kind) ? 'flow' : 'code'} preview`}
-				</Button>
-			{/if}
-			{#if persistentScriptDefinition !== undefined}
-				<Button
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: Activity }}
-					on:click={() => {
-						persistentScriptDrawer?.open?.(persistentScriptDefinition)
-					}}
-				>
-					Current runs
-				</Button>
-			{/if}
-			{#if canRunNow}
-				<Button
-					unifiedSize="md"
-					variant="default"
-					startIcon={{ icon: Play }}
-					on:click={() => job?.id && runJobNow(job.id)}
-					title="Start this job now instead of at its scheduled time, skipping any remaining delay or sleep. It keeps the same id, and a concurrency limit is still enforced."
-				>
-					Run now
-				</Button>
-			{/if}
-			{#if job && job?.type != 'CompletedJob' && (!job?.schedule_path || job?.['running'] == true)}
-				{#if !forceCancel}
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						destructive
-						startIcon={{ icon: TimerOff }}
-						on:click|once={() => {
-							if (job?.id) {
-								cancelJob(job?.id)
-								setTimeout(() => {
-									forceCancel = true
-								}, 3001)
-							}
-						}}
-						title={`Cancel the ${job?.job_kind === 'script' ? 'script' : job?.job_kind === 'flow' ? 'flow' : 'job'}`}
-					>
-						Cancel
-					</Button>
-				{:else}
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						destructive
-						startIcon={{ icon: TimerOff }}
-						on:click|once={() => {
-							if (job?.id) {
-								cancelJob(job?.id)
-							}
-						}}
-					>
-						Force Cancel
-					</Button>
-				{/if}
-			{/if}
-			{#if job?.schedule_path}
-				<Button
-					unifiedSize="sm"
-					variant="default"
-					on:click={() => {
-						if (!job || !job.schedule_path) {
-							return
-						}
-						scheduleEditor?.openEdit(job.schedule_path, job.job_kind == 'flow')
-					}}
-					startIcon={{ icon: Calendar }}>Edit schedule</Button
-				>
-			{/if}
-			{#if restartStep !== undefined && canRestart(restart)}
-				{@render flowRestartButton(restart, restartStep, 'button')}
-			{/if}
-			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
-				<Button
-					on:click|once={async () => {
-						// The form this lands on rebuilds the whole project. When resuming
-						// THIS run is the cheaper thing to do, name it so the form can
-						// offer that in one click rather than leaving the reader to know.
-						const from = dbtResumable ? `?dbt_retry_from=${job?.id}` : ''
-						goto(
-							viewHref +
-								from +
-								`#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
-						)
-					}}
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: RefreshCw }}
-					loading={runImmediatelyLoading}
-					dropdownItems={[
-						// A failed dbt run's cheap next step is resuming its failed and skipped
-						// nodes rather than rebuilding the project, and `dbt_command` is the
-						// only argument that differs. Offered first, and only while the saved
-						// failure is still this run — which is what `dbtResumable` answers.
-						...(dbtResumable ? [{ label: 'dbt retry with same args', onClick: resumeDbtRun }] : []),
-						{
-							label: 'Run immediately with same args',
-							onClick: () => runImmediately()
-						}
-					]}
-				>
-					Run again
-				</Button>
-			{/if}
-			{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
-				{#if !$userStore?.operator}
-					{#if canWrite(job?.script_path ?? '', {}, $userStore)}
-						<Button
-							href={`${stem}/edit/${job?.script_path}?workspace=${$workspaceStore}`}
-							on:click={() => {
-								$initialArgsStore = job?.args
-							}}
-							unifiedSize="sm"
-							variant="default"
-							disabled={!showEditButton}
-							startIcon={{ icon: Pen }}>Edit</Button
-						>
-						{#if showEditButton}
-							<!-- Opens the deployed runnable at this job's path, like Edit — unlike
-							     "View script", which pins the hash this run executed. Same gate as
-							     Edit: where direct deployment is off, the way in is "Edit in fork". -->
-							<OpenInSessionButton
-								source={{
-									target: { kind: isScript ? 'script' : 'flow', path: job?.script_path ?? '' },
-									workspaceId: $workspaceStore ?? undefined
-								}}
-								btnProps={{ unifiedSize: 'sm' }}
-							/>
-						{/if}
-					{/if}
-					{#if !showEditButton && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces)}
-						<Button
-							href={buildForkEditUrl(isScript ? 'script' : 'flow', job?.script_path ?? '')}
-							onClick={(e) =>
-								onEditInForkClick(e, isScript ? 'script' : 'flow', job?.script_path ?? '', {
-									hasHref: true
-								})}
-							unifiedSize="sm"
-							variant="default"
-							startIcon={{ icon: Pen }}>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
-						>
-					{/if}
-				{/if}
-			{/if}
-			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
-				<Button
-					href={viewHref}
 					unifiedSize="sm"
 					variant="accent"
-					startIcon={{
-						icon:
-							job?.job_kind === 'script' || job?.job_kind === 'script_hub'
-								? Code2
-								: job?.job_kind === 'flow'
-									? BarsStaggered
-									: Code2
+					destructive
+					startIcon={{ icon: TimerOff }}
+					on:click|once={() => {
+						if (job?.id) {
+							cancelJob(job?.id)
+							setTimeout(() => {
+								forceCancel = true
+							}, 3001)
+						}
+					}}
+					title={`Cancel the ${job?.job_kind === 'script' ? 'script' : job?.job_kind === 'flow' ? 'flow' : 'job'}`}
+				>
+					Cancel
+				</Button>
+			{:else}
+				<Button
+					unifiedSize="sm"
+					variant="accent"
+					destructive
+					startIcon={{ icon: TimerOff }}
+					on:click|once={() => {
+						if (job?.id) {
+							cancelJob(job?.id)
+						}
 					}}
 				>
-					View {job?.job_kind === 'script_hub' ? 'script' : job?.job_kind}
+					Force Cancel
 				</Button>
 			{/if}
-		{/snippet}
-	</ActionRow>
+		{/if}
+		{#if job?.schedule_path}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				on:click={() => {
+					if (!job || !job.schedule_path) {
+						return
+					}
+					scheduleEditor?.openEdit(job.schedule_path, job.job_kind == 'flow')
+				}}
+				startIcon={{ icon: Calendar }}>Edit schedule</Button
+			>
+		{/if}
+		{#if restartStep !== undefined && canRestart(restart)}
+			{@render flowRestartButton(restart, restartStep, 'button')}
+		{/if}
+		{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
+			<Button
+				on:click|once={async () => {
+					// The form this lands on rebuilds the whole project. When resuming
+					// THIS run is the cheaper thing to do, name it so the form can
+					// offer that in one click rather than leaving the reader to know.
+					const from = dbtResumable ? `?dbt_retry_from=${job?.id}` : ''
+					goto(
+						viewHref +
+							from +
+							`#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
+					)
+				}}
+				unifiedSize="sm"
+				variant="default"
+				iconOnly={compactBar}
+				title="Run again"
+				startIcon={{ icon: RefreshCw }}
+				loading={runImmediatelyLoading}
+				dropdownItems={[
+					// A failed dbt run's cheap next step is resuming its failed and skipped
+					// nodes rather than rebuilding the project, and `dbt_command` is the
+					// only argument that differs. Offered first, and only while the saved
+					// failure is still this run — which is what `dbtResumable` answers.
+					...(dbtResumable ? [{ label: 'dbt retry with same args', onClick: resumeDbtRun }] : []),
+					{
+						label: 'Run immediately with same args',
+						onClick: () => runImmediately()
+					}
+				]}
+			>
+				Run again
+			</Button>
+		{/if}
+		{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
+			{#if !$userStore?.operator}
+				{#if editRights.canEditItem(isScript ? 'script' : 'flow', job?.script_path ?? '', {})}
+					<Button
+						href={`${stem}/edit/${job?.script_path}?workspace=${$workspaceStore}`}
+						on:click={() => {
+							$initialArgsStore = job?.args
+						}}
+						unifiedSize="sm"
+						variant="default"
+						disabled={!showEditButton}
+						iconOnly={compactBar}
+						title="Edit"
+						startIcon={{ icon: Pen }}>Edit</Button
+					>
+					{#if showEditButton}
+						<!-- Opens the deployed runnable at this job's path, like Edit — unlike
+							     "View script", which pins the hash this run executed. Same gate as
+							     Edit: where direct deployment is off, the way in is "Edit in fork". -->
+						<OpenInSessionButton
+							source={{
+								target: { kind: isScript ? 'script' : 'flow', path: job?.script_path ?? '' },
+								workspaceId: $workspaceStore ?? undefined
+							}}
+							btnProps={{ unifiedSize: 'sm' }}
+						/>
+					{/if}
+				{/if}
+				{#if !showEditButton && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces)}
+					<Button
+						href={buildForkEditUrl(isScript ? 'script' : 'flow', job?.script_path ?? '')}
+						onClick={(e) =>
+							onEditInForkClick(e, isScript ? 'script' : 'flow', job?.script_path ?? '', {
+								hasHref: true
+							})}
+						unifiedSize="sm"
+						variant="default"
+						iconOnly={compactBar}
+						title={editInForkLabel($workspaceStore, $userWorkspaces)}
+						startIcon={{ icon: Pen }}>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
+					>
+				{/if}
+			{/if}
+		{/if}
+		{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
+			<Button
+				href={viewHref}
+				unifiedSize="sm"
+				variant="accent"
+				iconOnly={compactBar}
+				title="View {job?.job_kind === 'script_hub' ? 'script' : job?.job_kind}"
+				startIcon={{
+					icon:
+						job?.job_kind === 'script' || job?.job_kind === 'script_hub'
+							? Code2
+							: job?.job_kind === 'flow'
+								? BarsStaggered
+								: Code2
+				}}
+			>
+				View {job?.job_kind === 'script_hub' ? 'script' : job?.job_kind}
+			</Button>
+		{/if}
+	{/snippet}
 	<div class={twMerge('w-full', isNotFlow(job?.job_kind) && 'pb-8')}>
 		<!-- Flow Detail Header Card -->
-		<div class="max-w-7xl mx-auto px-4 py-0">
+		<div class="max-w-7xl mx-auto px-4 pt-4">
 			<Skeleton loading={!job} layout={[[24]]} />
 			{#if job}
 				<JobDetailHeader
@@ -1122,7 +1145,8 @@
 					showStepId
 				>
 					{#snippet errorAction()}
-						{#if failedTopLevelStep}
+						<!-- A saved agent's run is its one step: naming it adds nothing. -->
+						{#if failedTopLevelStep && failedTopLevelStep !== AGENT_STEP_ID}
 							<span>at step {failedTopLevelStep}</span>
 							{#if $enterpriseLicense && canRestart(failedRestart)}
 								<span>·</span>
diff --git a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
index 49ad076d23..6110af0fef 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
@@ -541,6 +541,7 @@
 {#if draftSync.draft && renderEditor}
 	<ScriptBuilder
 		bind:this={scriptBuilder}
+		ownsPageHeader
 		{initialPath}
 		userDraftPath={draftPath}
 		{draftBaseHash}
diff --git a/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte b/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte
index cab2a14790..124390aabe 100644
--- a/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/service_logs/+page.svelte
@@ -1,72 +1,25 @@
 <script lang="ts">
 	import { page } from '$app/state'
 	import { Alert } from '$lib/components/common'
-	import Popover from '$lib/components/Popover.svelte'
 	import ServiceLogsInner from '$lib/components/ServiceLogsInner.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { devopsRole } from '$lib/stores'
-	import { Search, AlertTriangle } from 'lucide-svelte'
 
-	let searchTerm = $state(page.url.searchParams.get('query') ?? '')
-	let queryParseErrors: string[] | undefined = $state(undefined)
+	// `query` is what the global search links with; `searchTerm` is what the page writes back.
+	let searchTerm = $state(
+		page.url.searchParams.get('searchTerm') ?? page.url.searchParams.get('query') ?? ''
+	)
 </script>
 
-<div class="flex flex-col w-full h-screen max-h-screen max-w-screen px-2">
-	<div class="px-2">
-		<div class="flex items-center space-x-2 flex-row justify-between">
-			<div class="flex flex-row flex-wrap justify-between py-2 my-4 px-4 gap-1 items-center">
-				<h1 class="!text-2xl font-semibold leading-6 tracking-tight">Service logs</h1>
-				<Tooltip>Explore and search Windmill service logs from within Windmill!</Tooltip>
-			</div>
-		</div>
-	</div>
-
+<!-- `h-full`, not `h-screen`: the page header band sits above this box, so a viewport floor here
+     would overhang the content box by the band's height. -->
+<div class="flex flex-col w-full min-w-0 h-full max-h-full px-4">
 	{#if $devopsRole == false}
-		<Alert title="Service logs are only available to superadmins" type="warning">
-			Service logs are only available to superadmins (or devops)
-		</Alert>
-	{:else}
-		<div class="m-1 px-2 flex flex-row gap-1 items-center border-2 rounded-lg">
-			<Search size="16" />
-			<!-- svelte-ignore a11y_autofocus -->
-			<input
-				id="quickSearchInput"
-				type="text"
-				class="quick-search-input !bg-surface"
-				bind:value={searchTerm}
-				autocomplete="off"
-				autofocus
-			/>
-			{#if searchTerm !== '' && queryParseErrors && queryParseErrors.length > 0}
-				<Popover notClickable placement="bottom-start">
-					<AlertTriangle size={16} class="text-yellow-500" />
-					{#snippet text()}
-						Some of your search terms have been ignored because one or more parse errors:<br /><br
-						/>
-						{#if queryParseErrors}
-							<ul>
-								{#each queryParseErrors as msg}
-									<li>- {msg}</li>
-								{/each}
-							</ul>
-						{/if}
-					{/snippet}
-				</Popover>
-			{/if}
+		<div class="flex flex-col gap-2 pt-4">
+			<Alert title="Service logs are only available to superadmins and devops users" type="warning">
+				Ask one of them to look at the logs, or to grant you the devops role.
+			</Alert>
 		</div>
-
-		<ServiceLogsInner {searchTerm} bind:queryParseErrors />
+	{:else}
+		<ServiceLogsInner bind:searchTerm />
 	{/if}
 </div>
-
-<style>
-	.quick-search-input {
-		outline: none;
-		border: none !important;
-		box-shadow: none !important;
-	}
-
-	.quick-search-input:focus-visible {
-		outline: none !important;
-	}
-</style>
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 1662c15d79..114c6554aa 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -1,21 +1,25 @@
 <script lang="ts">
-	import { onMount, tick, untrack } from 'svelte'
+	import { onDestroy, onMount, tick, untrack } from 'svelte'
 	import { SvelteSet } from 'svelte/reactivity'
 	import { page } from '$app/state'
 	import {
 		Plus,
 		Maximize2,
-		Minimize2,
 		ExternalLink,
 		PanelRightClose,
 		PanelRightOpen,
+		Minimize2,
 		ChevronDown,
 		MonitorPlay,
 		Loader2
 	} from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
+	import { BAR_TOP_PAD } from '$lib/components/pageHeaderRegistry.svelte'
 	import { Button } from '$lib/components/common'
 	import DraggableTabs, { type TabItem } from '$lib/components/common/tabs/DraggableTabs.svelte'
+	import { cubicOut } from 'svelte/easing'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import PreviewRouterPicker, {
 		type Scope
@@ -50,12 +54,12 @@
 	import { markSessionRecovered } from '$lib/components/sessions/sessionRecoveryNotice.svelte'
 	import {
 		isGlobalAiEnabled,
-		clearSessionsBetaOptOut
+		clearSessionsBetaOptOut,
+		sessionsAllowedFor
 	} from '$lib/components/copilot/chat/global/gate'
 	import { setToolCompletionListener } from '$lib/components/copilot/chat/shared'
 	import { registerToolDisplayActionHandler } from '$lib/components/copilot/chat/createdResourceActions.svelte'
 	import { previewTargetForSessionTarget } from '$lib/components/sessions/sessionPreviewTabs.svelte'
-	import { base } from '$lib/base'
 	import {
 		artifactKey,
 		itemDisplayName,
@@ -76,7 +80,7 @@
 		tabsToReload,
 		viewerTabsToReload
 	} from '$lib/components/sessions/previewReload'
-	import { isPageItemListPath, stripBase } from '$lib/components/sessions/previewPaths'
+	import { isPageItemListPath, barePath } from '$lib/components/sessions/previewPaths'
 	import {
 		leafKeyFor,
 		loadKind,
@@ -201,7 +205,7 @@
 	// load. `recovering` also guards re-entry: recovery mutates the session list
 	// this effect tracks, while the URL that would stop it only updates on `goto`.
 	$effect(() => {
-		if (embedded || !globalEnabled || $userStore?.operator) return
+		if (embedded || !globalEnabled || !sessionsAllowedFor($userStore?.operator)) return
 		if (!sessionState.hydrated || recovering) return
 		// A deliberate delete removes the open session ahead of its own navigation.
 		// Claiming that gap would take over the URL and tell the user the session
@@ -448,6 +452,55 @@
 	let emptyStateNewTabOpen = $state(false)
 
 	let fullscreen = $state(false)
+
+	// Going full screen is the preview panel expanding to the left: the chat column shrinks to
+	// nothing and the panel takes its place. Animating that is what carries the switch, so the
+	// panel is never unmounted — it is resized, like a collapse — and the tab strips, which live
+	// in two different trees (the panel's own card, and the band), only fade.
+	const reducedMotion = useReducedMotion()
+	const PANES_MOVE_MS = 240
+	/** Panes transition their width only while a full-screen switch is in flight. Left on, every
+	 *  splitter drag would lag 240ms behind the pointer. */
+	let panesAnimating = $state(false)
+	let panesAnimationTimer: ReturnType<typeof setTimeout> | undefined = undefined
+	function toggleFullscreen() {
+		fullscreen = !fullscreen
+		if (reducedMotion.val) return
+		panesAnimating = true
+		clearTimeout(panesAnimationTimer)
+		panesAnimationTimer = setTimeout(() => (panesAnimating = false), PANES_MOVE_MS)
+	}
+	onDestroy(() => clearTimeout(panesAnimationTimer))
+	/** The arriving strip fades in over the expansion; the leaving one goes quickly, so the two
+	 *  are never both legible at once — they stand in different places, and a slow dissolve would
+	 *  read as two tab rows rather than one changing place. */
+	function stripArrive(_node: Element) {
+		return reducedMotion.val
+			? { duration: 0 }
+			: { duration: 180, delay: 60, easing: cubicOut, css: (t: number) => `opacity: ${t}` }
+	}
+	function stripLeave(_node: Element) {
+		return reducedMotion.val
+			? { duration: 0 }
+			: { duration: 80, easing: cubicOut, css: (t: number) => `opacity: ${t}` }
+	}
+	// Width of the preview panel, so the band can stop where it starts.
+	let previewWidth = $state(0)
+	/** Width of the row the panes share, so the panel can be remembered as a share of it. */
+	let contentWidth = $state(0)
+	/** What share of that row the panel takes, sampled only while it is standing still. The band's
+	 *  inset is read from this for the length of a full-screen switch: fed the live measurement,
+	 *  the bar would be sized against a panel that has not arrived yet, and on the way back from
+	 *  full screen it starts at 146px — narrow enough that the bar wraps to two rows before the
+	 *  panel settles. A share rather than a width, so a window resized while full screen still
+	 *  gives the right inset on the way out. */
+	let panelShare = $state(0)
+	const bandInset = $derived.by(() => {
+		if (fullscreen) return 0
+		if (panesAnimating && panelShare > 0 && contentWidth > 0)
+			return Math.round(panelShare * contentWidth)
+		return previewCollapsed || previewWidth === 0 ? undefined : previewWidth
+	})
 	// Fullscreen is page state, not per-session, so it outlives a session switch —
 	// tell the incoming session's model, whose own collapsed flag it overrides, or
 	// re-opening the item plainly on screen would be judged invisible and not flash.
@@ -501,9 +554,10 @@
 				lastExpandedPreviewSize = previewPaneSize
 			}
 			if (full) {
-				// Chat pane is unmounted: the preview is the only pane and must own
-				// the full width, not its remembered split share.
+				// The preview owns the full width, not its remembered split share. The chat pane
+				// stays mounted at zero, so it has to be driven to 0 in the same pass.
 				previewPaneSize = 100
+				chatPaneSize = 0
 			} else if (collapsed) {
 				previewPaneSize = 0
 				chatPaneSize = 100
@@ -539,10 +593,10 @@
 
 	// Page path shown after the workspace breadcrumb — the active tab's observed
 	// location, so the breadcrumb tracks where the user browses inside the tab.
-	const displayPath = $derived(owner?.activeTab?.loc ?? owner?.activeTab?.url ?? `${base}/`)
+	const displayPath = $derived(owner?.activeTab?.loc ?? owner?.activeTab?.url ?? '/')
 	const activeArtifact = $derived(owner?.activeTab ? parseArtifactRoute(owner.activeTab.url) : null)
 	const activeWorkspaceHref = $derived(
-		owner?.activeTab ? workspacePageHref(owner.activeTab.loc || owner.activeTab.url) : `${base}/`
+		owner?.activeTab ? workspacePageHref(owner.activeTab.loc || owner.activeTab.url) : '/'
 	)
 	// The active session's artifacts, surfaced as an "Artifacts" branch in the
 	// preview pickers.
@@ -604,7 +658,7 @@
 	const tabHosts: Record<string, PreviewTabHost | undefined> = {}
 
 	let reloadHandle: ReturnType<typeof setTimeout> | undefined
-	// Per workspace a chat round touched since the last flush: base-stripped list-page paths
+	// Per workspace a chat round touched since the last flush: list-page paths
 	// (e.g. `/schedules`, see toolReloadEffect), the page items its tools named, as tab urls,
 	// and the item paths whose deployed version changed. By workspace because a path names an
 	// item only within one: a write in one fork must not remount the same path's editor in a
@@ -835,7 +889,7 @@
 			// Leaving the preview for the standalone editor — carry the session
 			// workspace so the app opens in the fork the session acts on, not the
 			// navigation workspace.
-			goto(withWorkspaceParam(`${base}/apps/edit/${item.path}`, previewWorkspace))
+			goto(withWorkspaceParam(`/apps/edit/${item.path}`, previewWorkspace))
 			return
 		}
 		owner?.navigate({ type: 'item', item })
@@ -874,7 +928,7 @@
 			// A preview frame navigating to a list page: re-point the active tab to the list
 			// mounted in process, whose rows open as tabs of their own.
 			if (d.type === 'wm.session.openList') {
-				if (typeof d.href !== 'string' || !isPageItemListPath(stripBase(d.href))) return
+				if (typeof d.href !== 'string' || !isPageItemListPath(barePath(d.href))) return
 				owner?.navigate({ type: 'page', href: d.href, label: previewLocationLabel(d.href) })
 				return
 			}
@@ -904,6 +958,52 @@
 	}}
 />
 
+<!-- The session showing fills the band's breadcrumb. The band is the layout's, but it stops
+     where the preview panel starts so that panel can run from the top of the viewport. -->
+<!-- In full screen the band carries the session's name and, as one filling surface, the preview's
+     own strip and controls. The name here is only what shows until the active session's
+     SessionWrapper has mounted: it registers after this does, and the registry merges later-wins,
+     so from then on the name comes from there, with its pen and its menu. -->
+<PageHeaderContent
+	barRightInset={bandInset}
+	section={fullscreen ? { label: activeSession?.summary ?? 'Untitled session' } : undefined}
+	actions={fullscreen ? fullscreenBand : sessionPageActions}
+	actionsFill={fullscreen}
+	separator={fullscreen ? 'always' : 'none'}
+/>
+
+{#snippet fullscreenBand()}
+	<!-- The band is split in two: the breadcrumb on the page's own surface, and from there to the
+	     right edge one filled panel carrying the tabs and the preview's controls. It takes the bar's
+	     full height, and the bar's bottom border runs underneath it, so the line between header and
+	     content is unbroken. -->
+	<div
+		class="flex-1 min-w-0 self-stretch flex items-center gap-1 pl-2.5 pr-2 bg-surface-secondary/50"
+	>
+		{@render previewTabStrip(true)}
+		<div class="flex-1 min-w-4"></div>
+		<div class="flex items-center gap-0.5 shrink-0">
+			{@render previewControls()}
+		</div>
+	</div>
+{/snippet}
+
+{#snippet sessionPageActions()}
+	{#if previewCollapsed && !fullscreen}
+		<!-- Collapsed preview: the way back to the side panel, in the band with the session's own
+		     controls rather than floating over the chat. -->
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			startIcon={{ icon: PanelRightOpen }}
+			title="Open side panel"
+			onclick={() => owner?.setCollapsed(false)}
+		>
+			Open side panel
+		</Button>
+	{/if}
+{/snippet}
+
 <div class="h-full flex flex-col min-h-0">
 	{#if embedded}
 		<!-- Rendered inside a preview iframe — opening the sessions UI here would
@@ -921,19 +1021,19 @@
 				}}>Open sessions</Button
 			>
 		</div>
-	{:else if $userStore?.operator}
-		<!-- Operators are exempt from the sessions beta (the layout keeps their
-		     legacy docked chat); a direct URL must not bypass that. -->
+	{:else if !sessionsAllowedFor($userStore?.operator)}
+		<!-- Operators without the opt-in keep the legacy docked chat (see `gate.ts`); a direct
+		     URL must not bypass that. -->
 		<div class="p-8 flex flex-col items-start gap-3 text-secondary text-sm">
 			<p class="text-primary font-medium">AI Sessions are not available for operators</p>
 			<p>Use the Ask AI chat instead.</p>
 			<Button
-				size="xs"
+				unifiedSize="xs"
 				onclick={() => {
 					try {
 						localStorage.setItem('ai-chat-open', 'true')
 					} catch {}
-					window.location.href = `${base}/`
+					window.location.href = '/'
 				}}
 			>
 				Open Ask AI chat
@@ -945,7 +1045,7 @@
 		<div class="p-8 flex flex-col items-start gap-3 text-secondary text-sm">
 			<p class="text-primary font-medium">AI Sessions are deactivated</p>
 			<p>You switched back to the legacy chat. Activate AI Sessions (beta) to open this page.</p>
-			<Button unifiedSize="sm" onclick={() => clearSessionsBetaOptOut(`${base}/sessions`)}>
+			<Button unifiedSize="sm" onclick={() => clearSessionsBetaOptOut('/sessions')}>
 				Activate AI Sessions
 			</Button>
 		</div>
@@ -970,33 +1070,58 @@
 		     switch, and a verdict still loading would otherwise tear them down on every
 		     one. The covered stack is inert so nothing under the overlay takes focus. -->
 		<div class="flex-1 min-h-0 flex flex-col relative">
+			<!-- Leaving full screen, the panel travels back to the right across ground the band has
+			     already claimed: the band is pinned to the width the panel will end at, so under it
+			     the bar would show through as a white patch over the panel's left edge and the left
+			     end of its tab strip. z-[31] — one above the band — puts the panel over it for the
+			     length of the move instead, uncovering it as it settles. Entering full screen needs
+			     none of this: the band is full width from the first frame and the panel stays below. -->
 			<div
-				class="flex-1 min-h-0 flex flex-row relative z-0"
+				bind:clientWidth={contentWidth}
+				class="flex-1 min-h-0 flex flex-row relative {panesAnimating && !fullscreen
+					? 'z-[31]'
+					: 'z-0'}"
 				use:splitterPointerCapture
 				inert={aiHiddenVerdict !== false}
 			>
 				<Splitpanes
 					horizontal={false}
-					class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
+					style="--panes-move: {PANES_MOVE_MS}ms"
+					class="flex-1 min-h-0 session-splitter {previewCollapsed || fullscreen
+						? 'splitter-off'
+						: ''} {panesAnimating ? 'panes-animating' : ''}"
 				>
-					{#if !fullscreen}
-						<!-- Chat column. Recently visited sessions stay mounted (stacked,
+					<!-- Chat column. Recently visited sessions stay mounted (stacked,
 					     visibility-toggled) — see mountChat. -->
-						<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
-							<div class="relative flex-1 min-h-0">
-								{#each mountedChatSessions as s (s.id)}
-									<div
-										class="absolute inset-0 flex flex-col {s.id === activeSession?.id
-											? 'z-10 opacity-100 pointer-events-auto'
-											: 'z-0 opacity-0 pointer-events-none'}"
-										aria-hidden={s.id !== activeSession?.id}
-									>
-										<SessionWrapper sessionId={s.id} />
-									</div>
-								{/each}
-							</div>
-						</Pane>
-					{/if}
+					<!-- The band floats over this column's top strip while a panel is beside it, so the
+					     column starts below it. The offset belongs on the pane, not on the stack's
+					     container: the session stacks are `absolute inset-0` and would ignore padding. -->
+					<!-- Full screen resizes this column to nothing rather than unmounting it, so the
+					     panel can be seen taking its place — and so a toggle doesn't tear down every
+					     mounted chat and rebuild it on the way back. -->
+					<Pane
+						bind:size={chatPaneSize}
+						minSize={fullscreen ? 0 : 25}
+						class="flex flex-col min-h-0 {previewCollapsed ? '' : BAR_TOP_PAD} {panesAnimating &&
+						!fullscreen
+							? '!bg-transparent'
+							: ''}"
+					>
+						<!-- Zero-width but still in the document, so its composer and buttons are taken
+						     out of the tab order while the panel is full screen. -->
+						<div class="relative flex-1 min-h-0" inert={fullscreen}>
+							{#each mountedChatSessions as s (s.id)}
+								<div
+									class="absolute inset-0 flex flex-col {s.id === activeSession?.id
+										? 'z-10 opacity-100 pointer-events-auto'
+										: 'z-0 opacity-0 pointer-events-none'}"
+									aria-hidden={s.id !== activeSession?.id}
+								>
+									<SessionWrapper sessionId={s.id} headerInPage={s.id === activeSession?.id} />
+								</div>
+							{/each}
+						</div>
+					</Pane>
 
 					<!-- Preview panel: the live Windmill page, framed like the editor pane.
 				     Always mounted (collapse resizes it to 0 — see previewPaneSize) so
@@ -1007,7 +1132,19 @@
 						maxSize={previewCollapsed ? 0 : 100}
 						class="flex flex-col min-h-0"
 					>
-						<div class="flex-1 min-h-0 flex flex-col {fullscreen ? 'p-0' : 'p-2 pl-0'}">
+						<!-- The band floats over this column too in full screen (it holds the tab strip
+						     there), so the panel clears it with the same offset the chat column uses. -->
+						<div
+							bind:clientWidth={
+								() => previewWidth,
+								(w) => {
+									previewWidth = w
+									if (!fullscreen && !panesAnimating && contentWidth > 0)
+										panelShare = w / contentWidth
+								}
+							}
+							class="flex-1 min-h-0 flex flex-col {fullscreen ? `p-0 ${BAR_TOP_PAD}` : 'p-2 pl-0'}"
+						>
 							<!-- The action controls float over the tab strip, so the strip has to reserve
 							     their width or tabs slide underneath them. Measured rather than guessed:
 							     the set changes with the tab (an artifact has no "Open in workspace", a
@@ -1033,141 +1170,22 @@
 									</button>
 								{/if}
 
-								<!-- Open-in-full-page + full-screen toggle, floating over the top-right
-								     corner to mirror the collapse control. -->
-								<!-- Spans the tab strip's own height and centres within it, rather than
-							     being pinned a fixed distance from the top, so these controls sit on
-							     the same axis as the collapse button opposite. Its width is measured
-							     so the strip can reserve room and its tabs never scroll underneath. -->
-								<div
-									bind:clientWidth={previewActionsWidth}
-									class="absolute top-0 right-1 z-30 flex h-8 items-center gap-0.5"
-								>
-									{#if activeWorkspaceHref}
-										<a
-											href={withWorkspaceParam(activeWorkspaceHref, previewWorkspace)}
-											title="Open in workspace"
-											aria-label="Open in workspace"
-											class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-										>
-											<ExternalLink size={14} />
-										</a>
-									{/if}
-									<button
-										type="button"
-										onclick={() => (fullscreen = !fullscreen)}
-										title={fullscreen ? 'Exit full screen' : 'Full screen'}
-										aria-label={fullscreen ? 'Exit full screen' : 'Full screen'}
-										class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+								<!-- In full screen the strip and these controls move into the page header band,
+								     which is empty there and has the width for them; the pane below keeps only
+								     the content. -->
+								{#if !fullscreen}
+									<!-- Open-in-full-page + full-screen toggle, floating over the top-right
+									     corner to mirror the collapse control. Its width is measured so the strip
+									     can reserve room and its tabs never scroll underneath. -->
+									<div
+										bind:clientWidth={previewActionsWidth}
+										class="absolute top-0 right-1 z-30 flex h-8 items-center gap-0.5"
 									>
-										{#if fullscreen}
-											<Minimize2 size={14} />
-										{:else}
-											<Maximize2 size={14} />
-										{/if}
-									</button>
-								</div>
+										{@render previewControls()}
+									</div>
 
-								<!-- Tab strip: open preview pages, shared with the raw-app editor
-								     (DraggableTabs). Clicking the active tab (label or accessory chevron)
-								     toggles its breadcrumb picker; the "+" trailing opens the router picker.
-								     Left/right padding clears the floating collapse/fullscreen buttons. -->
-								<DraggableTabs
-									tabs={previewTabItems}
-									activeId={owner?.activeId ?? ''}
-									onSelect={selectTab}
-									onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
-									onClose={closeTab}
-									onReorder={reorderTabs}
-									class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
-										? 'pl-1.5'
-										: 'pl-9'} pr-[var(--preview-actions-w,4rem)]"
-								>
-									{#snippet tabAccessory(_tab, isActive)}
-										{#if isActive}
-											<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
-										     is excluded from pointerdown-outside so toggle doesn't race close.
-										     The trigger is an inert whole-tab overlay (anchor only — clickable
-										     would break dnd reorder); the chevron is purely visual. -->
-											<Popover
-												placement="bottom-start"
-												usePointerDownOutside
-												excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
-												disableFocusTrap
-												closeOnOtherPopoverOpen
-												enableFlyTransition
-												bind:isOpen={activeTabPickerOpen}
-												openFocus="[data-workspace-picker-search]"
-												contentClasses="flex flex-col overflow-hidden"
-												class="absolute inset-0 pointer-events-none"
-												triggerAttrs={{
-													'aria-label': 'Change preview',
-													tabindex: -1,
-													// The inert trigger only ever receives focus from melt's
-													// close-time restore; hand it straight to the tab so
-													// arrow/Delete tab shortcuts keep working.
-													onfocus: (e: FocusEvent) =>
-														(e.currentTarget as HTMLElement)
-															.closest<HTMLElement>('[role="tab"]')
-															?.focus()
-												}}
-											>
-												{#snippet content()}
-													<!-- The picker snapshots its scope at mount, but `friendlyPath` is
-												     stamped async once the editor cell loads — a picker opened
-												     before the stamp is scoped to the `draft_<uuid>` storage
-												     folder while the tree groups the draft under its friendly
-												     folder. Remount on the scope dir so it re-lands on the item. -->
-													{#key activePickerScope?.dir ?? ''}
-														<PreviewRouterPicker
-															initialScope={activePickerScope}
-															initialHighlight={activePickerHighlight}
-															{currentItem}
-															workspaceId={previewWorkspace}
-															artifacts={sessionArtifacts}
-															onPick={(t) => {
-																activeTabPickerOpen = false
-																navigatePreviewTo(t)
-															}}
-														/>
-													{/key}
-												{/snippet}
-											</Popover>
-											<ChevronDown
-												size={12}
-												class="shrink-0 text-tertiary group-hover:text-primary"
-											/>
-										{/if}
-									{/snippet}
-									{#snippet afterTabs()}
-										<Popover
-											placement="bottom-start"
-											usePointerDownOutside
-											excludeSelectors=".drawer"
-											disableFocusTrap
-											closeOnOtherPopoverOpen
-											bind:isOpen={newTabOpen}
-											enableFlyTransition
-											openFocus="[data-workspace-picker-search]"
-											contentClasses="flex flex-col overflow-hidden"
-											class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
-										>
-											{#snippet trigger()}
-												<Plus size={14} />
-											{/snippet}
-											{#snippet content()}
-												<PreviewRouterPicker
-													workspaceId={previewWorkspace}
-													artifacts={sessionArtifacts}
-													onPick={(t) => {
-														newTabOpen = false
-														openInNewTab(t)
-													}}
-												/>
-											{/snippet}
-										</Popover>
-									{/snippet}
-								</DraggableTabs>
+									{@render previewTabStrip(false)}
+								{/if}
 
 								<!-- One host per tab of every warm session, stacked and
 								     visibility-toggled so switching tabs or sessions never reloads
@@ -1250,21 +1268,6 @@
 						</div>
 					</Pane>
 				</Splitpanes>
-				{#if previewCollapsed && !fullscreen}
-					<!-- Collapsed preview: no rail — a floating launcher in the top-right to
-				     reopen the side panel. -->
-					<div class="absolute top-2 right-3 z-50">
-						<Button
-							variant="subtle"
-							unifiedSize="sm"
-							startIcon={{ icon: PanelRightOpen }}
-							title="Open side panel"
-							onclick={() => owner?.setCollapsed(false)}
-						>
-							Open side panel
-						</Button>
-					</div>
-				{/if}
 			</div>
 			{#if aiHiddenVerdict === undefined}
 				<div class="absolute inset-0 z-20 flex items-center justify-center bg-surface">
@@ -1285,6 +1288,149 @@
 	{/if}
 </div>
 
+<!-- The strip and the preview's own controls render in two places: in the panel, where they
+     are a row above the pane; and in full screen, inside the band's filling surface. Written
+     once so the two cannot drift. -->
+{#snippet previewControls()}
+	{#if activeWorkspaceHref}
+		<a
+			href={withWorkspaceParam(activeWorkspaceHref, previewWorkspace)}
+			title="Open in workspace"
+			aria-label="Open in workspace"
+			class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+		>
+			<ExternalLink size={14} />
+		</a>
+	{/if}
+	{#if fullscreen}
+		<!-- Named rather than an icon alone: full screen hid the chat, and what the user wants back
+		     is the chat, not a window size. The band has the room for the word. -->
+		<button
+			type="button"
+			onclick={toggleFullscreen}
+			title="Back to chat"
+			class="inline-flex items-center gap-1.5 h-6 pl-1.5 pr-2 rounded text-xs text-tertiary hover:text-primary hover:bg-surface-hover"
+		>
+			<Minimize2 size={14} />
+			Chat
+		</button>
+	{:else}
+		<button
+			type="button"
+			onclick={toggleFullscreen}
+			title="Full screen"
+			aria-label="Full screen"
+			class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+		>
+			<Maximize2 size={14} />
+		</button>
+	{/if}
+{/snippet}
+
+{#snippet previewTabStrip(inBand: boolean)}
+	<!-- Both layouts render this one snippet, so the strip is described once. The wrapper is here to
+	     own its fade: the two strips stand in different places, and what carries the switch is the
+	     panel moving under them, not the strip travelling. -->
+	<div
+		class={inBand ? 'flex items-center h-full min-w-0' : 'shrink-0'}
+		in:stripArrive
+		out:stripLeave
+	>
+		<DraggableTabs
+			tabs={previewTabItems}
+			activeId={owner?.activeId ?? ''}
+			onSelect={selectTab}
+			onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
+			onClose={closeTab}
+			onReorder={reorderTabs}
+			size={inBand ? 'md' : 'sm'}
+			class={inBand
+				? 'session-preview-tab-strip h-full bg-transparent min-w-0'
+				: 'session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 pl-9 pr-[var(--preview-actions-w,4rem)]'}
+		>
+			{#snippet tabAccessory(_tab, isActive)}
+				{#if isActive}
+					<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
+				     is excluded from pointerdown-outside so toggle doesn't race close.
+				     The trigger is an inert whole-tab overlay (anchor only — clickable
+				     would break dnd reorder); the chevron is purely visual. -->
+					<Popover
+						placement="bottom-start"
+						usePointerDownOutside
+						excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
+						disableFocusTrap
+						closeOnOtherPopoverOpen
+						enableFlyTransition
+						bind:isOpen={activeTabPickerOpen}
+						openFocus="[data-workspace-picker-search]"
+						contentClasses="flex flex-col overflow-hidden"
+						class="absolute inset-0 pointer-events-none"
+						triggerAttrs={{
+							'aria-label': 'Change preview',
+							tabindex: -1,
+							// The inert trigger only ever receives focus from melt's
+							// close-time restore; hand it straight to the tab so
+							// arrow/Delete tab shortcuts keep working.
+							onfocus: (e: FocusEvent) =>
+								(e.currentTarget as HTMLElement).closest<HTMLElement>('[role="tab"]')?.focus()
+						}}
+					>
+						{#snippet content()}
+							<!-- The picker snapshots its scope at mount, but `friendlyPath` is
+						     stamped async once the editor cell loads — a picker opened
+						     before the stamp is scoped to the `draft_<uuid>` storage
+						     folder while the tree groups the draft under its friendly
+						     folder. Remount on the scope dir so it re-lands on the item. -->
+							{#key activePickerScope?.dir ?? ''}
+								<PreviewRouterPicker
+									initialScope={activePickerScope}
+									initialHighlight={activePickerHighlight}
+									{currentItem}
+									workspaceId={previewWorkspace}
+									artifacts={sessionArtifacts}
+									onPick={(t) => {
+										activeTabPickerOpen = false
+										navigatePreviewTo(t)
+									}}
+								/>
+							{/key}
+						{/snippet}
+					</Popover>
+					<ChevronDown size={12} class="shrink-0 text-tertiary group-hover:text-primary" />
+				{/if}
+			{/snippet}
+			{#snippet afterTabs()}
+				<Popover
+					placement="bottom-start"
+					usePointerDownOutside
+					excludeSelectors=".drawer"
+					disableFocusTrap
+					closeOnOtherPopoverOpen
+					bind:isOpen={newTabOpen}
+					enableFlyTransition
+					openFocus="[data-workspace-picker-search]"
+					contentClasses="flex flex-col overflow-hidden"
+					class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
+				>
+					{#snippet trigger()}
+						<Plus size={14} />
+					{/snippet}
+					{#snippet content()}
+						<PreviewRouterPicker
+							workspaceId={previewWorkspace}
+							artifacts={sessionArtifacts}
+							onPick={(t) => {
+								newTabOpen = false
+								openInNewTab(t)
+							}}
+						/>
+					{/snippet}
+				</Popover>
+			{/snippet}
+		</DraggableTabs>
+	</div>
+{/snippet}
+
 <style>
 	/* Draggable gutter between the chat and the preview: a real (layout-occupying)
 	   10px-wide grab zone, no overlap tricks that could cover the chat's scrollbar
@@ -1307,6 +1453,16 @@
 		border-radius: 9999px !important;
 	}
 
+	/* The full-screen switch is the preview panel expanding to the left over the chat column, so
+	   the panes' widths are animated — but only while that switch is in flight (`panes-animating`),
+	   since a splitter drag sets the same inline width and would trail the pointer. */
+	:global(.splitpanes--vertical.panes-animating) > :global(.splitpanes__pane) {
+		/* The duration comes from PANES_MOVE_MS, which also times how long the class stays on.
+		   `!important` to beat app.css's blanket `transition: none !important` on vertical panes,
+		   which is there so a splitter drag tracks the pointer exactly. */
+		transition: width var(--panes-move) cubic-bezier(0.33, 1, 0.68, 1) !important;
+	}
+
 	/* Collapsed preview: the pane is resized to 0 but stays mounted, so remove
 	   the gutter entirely — it would otherwise leave a dead 10px drag zone on the
 	   chat's right edge. */
diff --git a/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte b/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte
index d4ac558cb8..212696782b 100644
--- a/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte
+++ b/frontend/src/routes/(root)/(logged)/svix/create-webhook/+page@(root).svelte
@@ -4,6 +4,8 @@
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 	import { Button } from '$lib/components/common'
 	import { page } from '$app/stores'
+	import { apiBaseUrl } from '$lib/apiBaseUrl.svelte'
+	import InstanceUiSync from '$lib/components/InstanceUiSync.svelte'
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import UserSettings from '$lib/components/UserSettings.svelte'
@@ -26,11 +28,11 @@
 			let webhook: string
 			switch (kind) {
 				case 'script':
-					webhook = `${$page.url.origin}/api/w/${$workspaceStore}/jobs/run/p/${path}`
+					webhook = `${apiBaseUrl()}/api/w/${$workspaceStore}/jobs/run/p/${path}`
 					redirectSuccess(webhook, token)
 					break
 				case 'flow':
-					webhook = `${$page.url.origin}/api/w/${$workspaceStore}/jobs/run/f/${path}`
+					webhook = `${apiBaseUrl()}/api/w/${$workspaceStore}/jobs/run/f/${path}`
 					redirectSuccess(webhook, token)
 					break
 				default:
@@ -72,6 +74,8 @@
 	})
 </script>
 
+<!-- This page skips the logged layout, which is what normally loads the API base url. -->
+<InstanceUiSync />
 <UserSettings
 	bind:this={userSettings}
 	on:tokenCreated={(e) => {
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/accept_invite/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/accept_invite/+page.svelte
index e14a2113cb..6b731a4833 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/accept_invite/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/accept_invite/+page.svelte
@@ -2,7 +2,6 @@
 	import { run } from 'svelte/legacy';
 
 	import { goto } from '$lib/navigation'
-	import { base } from '$lib/base'
 
 	import { SettingService, UserService, WorkspaceService } from '$lib/gen'
 	import { validateUsername } from '$lib/utils'
@@ -84,7 +83,7 @@
 		</label>
 	{/if}
 	<div class="flex flex-row justify-between pt-4 gap-x-1">
-		<Button variant="default" unifiedSize="md" href="{base}/user/workspaces"
+		<Button variant="default" unifiedSize="md" href="/user/workspaces"
 			>&leftarrow; Back to workspaces</Button
 		>
 		<Button
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte
index c98509f3db..3be417202c 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/fork_workspace/+page.svelte
@@ -1,5 +1,17 @@
 <script lang="ts">
-	import CreateWorkspace from "$lib/components/workspaceSettings/CreateWorkspace.svelte"
+	import CreateWorkspace from '$lib/components/workspaceSettings/CreateWorkspace.svelte'
+	import { Alert } from '$lib/components/common'
+	import { userStore } from '$lib/stores'
 </script>
 
-<CreateWorkspace isFork={true}/>
+<!-- The form is reachable by URL whatever the pickers show, and forking is what turns an operator
+     into a full member of the copy (the fork's membership row carries `is_admin` but not
+     `operator`). The server still accepts the call — this refuses the page, it does not enforce
+     the rule; see docs/operator-write-rights.md. -->
+{#if $userStore?.operator}
+	<div class="p-4 mt-12">
+		<Alert type="error" title="Unauthorized">Page not available for operators</Alert>
+	</div>
+{:else}
+	<CreateWorkspace isFork={true} />
+{/if}
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/instance_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/instance_settings/+page.svelte
index d74059dca6..d863eb7848 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/instance_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/instance_settings/+page.svelte
@@ -11,14 +11,16 @@
 		tabToAuthSubTab,
 		categoryToTabMap,
 		buildSearchableSettingItems,
+		listedNavigationGroups,
+		usesExternalOidcSigner,
 		type SearchableSettingItem
 	} from '$lib/components/instanceSettings'
 	import SettingsSearchInput from '$lib/components/instanceSettings/SettingsSearchInput.svelte'
 	import Breadcrumb from '$lib/components/common/breadcrumb/Breadcrumb.svelte'
 	import { ChevronRight, ArrowLeft } from 'lucide-svelte'
-	import { superadmin } from '$lib/stores'
+	import { enterpriseLicense, superadmin } from '$lib/stores'
 	import { onDestroy, tick } from 'svelte'
-	import { UserService, JobService } from '$lib/gen'
+	import { SettingService, UserService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
@@ -89,7 +91,6 @@
 	// --- Account step state ---
 	let newEmail = $state('')
 	let newPassword = $state('')
-	let enableHubSync = $state(true)
 	let accountSubmitting = $state(false)
 	let accountError = $state('')
 	let showOssAccountDialog = $state(false)
@@ -99,7 +100,7 @@
 	let rtSyncStatus: 'idle' | 'loading' | 'success' | 'error' = $state('idle')
 	let rtSyncMessage = $state('')
 
-	async function syncCachedResourceTypes() {
+	async function syncResourceTypes() {
 		rtSyncStatus = 'loading'
 		rtSyncMessage = ''
 		try {
@@ -116,41 +117,24 @@
 		}
 	}
 
+	// --- Daily resource type sync (saved on finish) ---
+	const SYNC_DAILY_SETTING = 'sync_hub_resource_types_daily'
+	let syncResourceTypesDaily = $state(true)
+	SettingService.getGlobal({ key: SYNC_DAILY_SETTING })
+		.then((value) => {
+			if (typeof value === 'boolean') syncResourceTypesDaily = value
+		})
+		.catch(() => {})
+
 	$effect(() => {
 		if (
 			rtSyncStatus === 'idle' &&
 			((mode === 'wizard' && !isSettingsStep(wizardStep)) || (mode === 'full' && fullStep === 1))
 		) {
-			syncCachedResourceTypes()
+			syncResourceTypes()
 		}
 	})
 
-	// --- Live hub sync ---
-	let hubSyncStatus: 'idle' | 'loading' | 'success' | 'error' = $state('idle')
-	let hubSyncMessage = $state('')
-
-	async function syncFromHub() {
-		hubSyncStatus = 'loading'
-		hubSyncMessage = ''
-		try {
-			await JobService.runWaitResultScriptByPath({
-				workspace: 'admins',
-				path: 'u/admin/hub_sync',
-				requestBody: {}
-			})
-			hubSyncStatus = 'success'
-			hubSyncMessage = 'Resource types synced from hub successfully'
-		} catch (e: any) {
-			hubSyncMessage =
-				e?.body?.error?.message ||
-				e?.body?.message ||
-				(typeof e?.body === 'string' ? e.body : null) ||
-				e?.message ||
-				'Failed to sync from hub'
-			hubSyncStatus = 'error'
-		}
-	}
-
 	const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/
 	let emailValid = $derived(emailPattern.test(newEmail))
 	let passwordValid = $derived(newPassword.length >= 2)
@@ -196,7 +180,14 @@
 	}
 
 	// --- Settings search (full mode) ---
-	const searchableItems = buildSearchableSettingItems(setupNavigationGroups)
+	let externalOidcSigner = $state(false)
+	$effect(() => {
+		if ($enterpriseLicense) usesExternalOidcSigner().then((v) => (externalOidcSigner = v))
+	})
+	const navigationGroups = $derived(
+		listedNavigationGroups(setupNavigationGroups, externalOidcSigner)
+	)
+	const searchableItems = $derived(buildSearchableSettingItems(navigationGroups))
 
 	let scrollTimeout: ReturnType<typeof setTimeout> | undefined
 	let highlightTimeout: ReturnType<typeof setTimeout> | undefined
@@ -281,6 +272,12 @@
 		accountError = ''
 		accountSubmitting = true
 		try {
+			// Before the account switch: on CE it fails and setup ends with the default account.
+			await SettingService.setGlobal({
+				key: SYNC_DAILY_SETTING,
+				requestBody: { value: syncResourceTypesDaily }
+			})
+
 			let oldEmail = $superadmin
 			if (!oldEmail) {
 				oldEmail = await UserService.getCurrentEmail()
@@ -305,34 +302,6 @@
 			const { OpenAPI } = await import('$lib/gen')
 			OpenAPI.TOKEN = token
 
-			if (enableHubSync) {
-				try {
-					// Use direct fetch with token as query param to avoid the old session cookie
-					// overriding the Authorization header
-					const resp = await fetch(
-						`/api/w/admins/schedules/create?token=${encodeURIComponent(token)}`,
-						{
-							method: 'POST',
-							headers: { 'Content-Type': 'application/json' },
-							body: JSON.stringify({
-								path: 'g/all/hub_sync',
-								schedule: '0 0 0 * * *',
-								script_path: 'u/admin/hub_sync',
-								is_flow: false,
-								args: {},
-								enabled: true,
-								timezone: 'Etc/UTC'
-							})
-						}
-					)
-					if (!resp.ok) {
-						console.warn('Schedule creation failed:', await resp.text())
-					}
-				} catch (e: any) {
-					console.warn('Schedule creation failed:', e?.body ?? e)
-				}
-			}
-
 			try {
 				await UserService.globalUserDelete({ email: oldEmail })
 			} catch (e: any) {
@@ -403,51 +372,39 @@
 
 		<SettingCard
 			label="Resource Types"
-			description="Resource types bundled with the Docker image are synced automatically. You can also fetch the latest from the hub."
+			description="Resource types are synced from the Hub when you reach this step. Without access to a Hub, the ones bundled with the Docker image are used."
 		>
 			<div class="flex flex-col gap-3 mt-1">
 				{#if rtSyncStatus === 'loading'}
-					<Alert type="info" title="Syncing cached resource types..." />
+					<Alert type="info" title="Syncing resource types..." />
 				{:else if rtSyncStatus === 'success'}
-					<Alert type="success" title="Cached resource types synced">
+					<Alert type="success" title="Resource types synced">
 						{rtSyncMessage}
 					</Alert>
 				{:else if rtSyncStatus === 'error'}
-					<Alert type="error" title="Cached resource types sync failed">
+					<Alert type="error" title="Resource type sync failed">
 						{rtSyncMessage}
 					</Alert>
 				{/if}
 
-				<div class="flex items-center gap-2">
+				<div class="flex">
 					<Button
-						variant="accent"
+						variant="default"
 						unifiedSize="sm"
-						loading={hubSyncStatus === 'loading'}
-						onClick={syncFromHub}
+						loading={rtSyncStatus === 'loading'}
+						onClick={syncResourceTypes}
 					>
 						Sync latest from hub
 					</Button>
-					<p class="text-tertiary text-2xs">
-						Fetches the latest resource types directly from the Windmill Hub (requires internet
-						access).
-					</p>
 				</div>
-				{#if hubSyncStatus === 'success'}
-					<Alert type="success" title="Hub sync complete">
-						{hubSyncMessage}
-					</Alert>
-				{:else if hubSyncStatus === 'error'}
-					<Alert type="error" title="Hub sync failed">
-						{hubSyncMessage}
-					</Alert>
-				{/if}
 				<Toggle
-					bind:checked={enableHubSync}
+					bind:checked={syncResourceTypesDaily}
 					options={{ right: 'Sync resource types every day' }}
 					size="xs"
 				/>
 				<p class="text-tertiary text-2xs">
-					The daily schedule synchronizes resource types from the Hub every day at midnight UTC.
+					The server updates them from the Hub once a day, overwriting local edits to the types the
+					Hub also defines. You can change this later in the instance settings.
 				</p>
 			</div>
 		</SettingCard>
@@ -539,7 +496,7 @@
 						<div class="w-44 shrink-0 h-full overflow-auto pb-4 pr-4">
 							<SettingsSearchInput {searchableItems} onSelect={handleSearchSelect} class="mb-3" />
 							<SidebarNavigation
-								groups={setupNavigationGroups}
+								groups={navigationGroups}
 								selectedId={fullTab}
 								onNavigate={handleNavigate}
 							/>
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte
index 240eee8473..8bcd94ce24 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/login/+page.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { base } from '$app/paths'
 	import { goto } from '$lib/navigation'
 	import { page } from '$app/state'
 
@@ -111,7 +110,7 @@
 					goto(rd ?? '/')
 				}
 				// See (root)/+layout.svelte for why /projects/import skips the picker.
-			} else if (rd?.startsWith('/user/workspaces') || rd?.startsWith(`${base}/projects/import`)) {
+			} else if (rd?.startsWith('/user/workspaces') || rd?.startsWith('/projects/import')) {
 				goto(rd)
 			} else if (rd == '/#user-settings') {
 				goto(`/user/workspaces#user-settings`)
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte
index 75e31a9a00..c9623bc340 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/logout/+page@.svelte
@@ -1,4 +1,6 @@
 <script lang="ts">
+	// Resets to the root layout, which does not import it.
+	import '$lib/assets/app.css'
 	import { page } from '$app/state'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { clearUser } from '$lib/logout'
diff --git a/frontend/src/routes/(root)/(logged)/user/(user)/workspaces/+page.svelte b/frontend/src/routes/(root)/(logged)/user/(user)/workspaces/+page.svelte
index 32d2d3b00b..2c5e626578 100644
--- a/frontend/src/routes/(root)/(logged)/user/(user)/workspaces/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/(user)/workspaces/+page.svelte
@@ -3,7 +3,6 @@
 	import { run } from 'svelte/legacy'
 
 	import { goto } from '$lib/navigation'
-	import { base } from '$app/paths'
 	import { page } from '$app/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { logout, logoutWithRedirect } from '$lib/logoutKit'
@@ -379,7 +378,7 @@
 					>
 						<Button
 							unifiedSize="md"
-							href="{base}/user/create_workspace{rd ? `?rd=${encodeURIComponent(rd)}` : ''}"
+							href="/user/create_workspace{rd ? `?rd=${encodeURIComponent(rd)}` : ''}"
 							variant={onlyAdminsWorkspace || noWorkspaces ? 'accent' : 'default'}
 							wrapperClasses="w-full"
 							>+&nbsp;Create a new workspace
@@ -423,7 +422,7 @@
 							<Button
 								variant="accent"
 								size="xs2"
-								href="{base}/user/accept_invite?workspace={encodeURIComponent(
+								href="/user/accept_invite?workspace={encodeURIComponent(
 									invite.workspace_id
 								)}{rd ? `&rd=${encodeURIComponent(rd)}` : ''}"
 							>
@@ -491,7 +490,7 @@
 								<Button
 									variant="accent"
 									unifiedSize="xs"
-									href="{base}/user/accept_invite?workspace={encodeURIComponent(
+									href="/user/accept_invite?workspace={encodeURIComponent(
 										invite.workspace_id
 									)}{rd ? `&rd=${encodeURIComponent(rd)}` : ''}"
 								>
diff --git a/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte b/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte
index 645a928473..408a2c1d55 100644
--- a/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/cli-success/+page.svelte
@@ -8,4 +8,4 @@
 	goto('/')
 </script>
 
-<CenteredModal title="Redirecting to Home" loading={true}></CenteredModal>
+<CenteredModal title="Redirecting to Home" loading={true} inPage></CenteredModal>
diff --git a/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte b/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
index 010abe2bd8..9e9226d133 100644
--- a/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
@@ -2,7 +2,6 @@
 	import { untrack } from 'svelte'
 	import { UserService } from '$lib/gen'
 	import { page } from '$app/state'
-	import { base } from '$lib/base'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { Button } from '$lib/components/common'
 	import { userStore, workspaceStore } from '$lib/stores'
@@ -30,12 +29,12 @@
 	}
 </script>
 
-<CenteredModal title="Authorize login request">
+<CenteredModal title="Authorize login request" inPage>
 	<p class="text-center text-lg mb-6">
 		Token will be posted to {host == 'localhost' ? 'your local machine' : host} to port {port}
 	</p>
 	<div class="flex flex-row justify-around pt-4 gap-x-1">
-		<Button variant="default" destructive size="lg" href={base}>Decline</Button>
+		<Button variant="default" destructive size="lg" href="/">Decline</Button>
 		<Button variant="accent" size="lg" on:click={authorizeToken}>Authorize</Button>
 	</div>
 </CenteredModal>
diff --git a/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte b/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
index 2362b7f116..90705bbdd1 100644
--- a/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { page } from '$app/state'
-	import { base } from '$lib/base'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { Alert, Button } from '$lib/components/common'
 	import { UserService } from '$lib/gen'
@@ -73,7 +72,7 @@
 	}
 </script>
 
-<CenteredModal title="Authorize a deploy connection">
+<CenteredModal title="Authorize a deploy connection" inPage>
 	{#if framed}
 		<Alert type="error" title="Refused">
 			This page cannot be used inside another page. Open it in its own tab.
@@ -126,7 +125,7 @@
 	{/if}
 	{#if framed || invalid}
 		<div class="flex justify-center pt-4">
-			<Button variant="default" unifiedSize="md" href={base}>Go to Windmill</Button>
+			<Button variant="default" unifiedSize="md" href="/">Go to Windmill</Button>
 		</div>
 	{/if}
 </CenteredModal>
diff --git a/frontend/src/routes/(root)/(logged)/workers/+page.svelte b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
index f7e0f07a54..6c568b5b2d 100644
--- a/frontend/src/routes/(root)/(logged)/workers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
@@ -8,6 +8,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import PageHeader from '$lib/components/PageHeader.svelte'
 	import QueueMetricsDrawer from '$lib/components/QueueMetricsDrawer.svelte'
+	import HeaviestScriptsDrawer from '$lib/components/HeaviestScriptsDrawer.svelte'
 	import ManageTagsDrawer from '$lib/components/ManageTagsDrawer.svelte'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import Cell from '$lib/components/table/Cell.svelte'
@@ -34,6 +35,7 @@
 	import { displayDate, groupBy, pluralize, retrieveCommonWorkerPrefix, truncate } from '$lib/utils'
 	import {
 		ExternalLink,
+		Gauge,
 		LineChart,
 		Loader2,
 		Plus,
@@ -493,6 +495,7 @@
 	}
 
 	let queueMetricsDrawer: QueueMetricsDrawer | undefined = $state(undefined)
+	let heaviestScriptsDrawer: HeaviestScriptsDrawer | undefined = $state(undefined)
 	let manageTagsDrawer: ManageTagsDrawer | undefined = $state(undefined)
 	let selectedTab: string = $state('default')
 
@@ -604,6 +607,10 @@
 
 {#if $superadmin || $devopsRole}
 	<QueueMetricsDrawer bind:this={queueMetricsDrawer} />
+	<HeaviestScriptsDrawer
+		bind:this={heaviestScriptsDrawer}
+		workerGroups={groupedWorkers.map(([name]) => name)}
+	/>
 	<ManageTagsDrawer
 		bind:this={manageTagsDrawer}
 		bind:defaultTagPerWorkspace
@@ -775,6 +782,19 @@
 							Queue metrics
 						</Button>
 
+						<Button
+							unifiedSize="md"
+							variant="default"
+							startIcon={{
+								icon: Gauge
+							}}
+							on:click={() => {
+								heaviestScriptsDrawer?.openDrawer(selectedTab)
+							}}
+						>
+							Heaviest scripts
+						</Button>
+
 						<Button
 							unifiedSize="md"
 							variant="default"
@@ -1022,7 +1042,7 @@
 											</Cell>
 										</tr>
 										{#if workers}
-											{#each workers as { worker, custom_tags, last_ping, started_at, jobs_executed, last_job_id, last_job_workspace_id, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, occupancy_rate, wm_version, vcpus, memory, memory_usage, wm_memory_usage, native_mode }}
+											{#each workers as { worker, custom_tags, last_ping, started_at, jobs_executed, last_job_id, last_job_workspace_id, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, occupancy_rate, wm_version, vcpus, memory, memory_usage, wm_memory_usage, native_mode, draining }}
 												{@const isWorkerAlive = isWorkerMaybeAlive(last_ping)}
 												{@const tagMismatchInfo = getTagMismatchInfo(
 													custom_tags,
@@ -1087,6 +1107,15 @@
 															{#if native_mode}
 																<Badge color="blue" small>Native</Badge>
 															{/if}
+															{#if draining}
+																<MeltTooltip>
+																	<Badge color="yellow" small>Draining</Badge>
+																	{#snippet text()}
+																		This worker received a shutdown signal. It no longer pulls jobs
+																		and exits once its current job is done.
+																	{/snippet}
+																</MeltTooltip>
+															{/if}
 														</div>
 													</Cell>
 													{#if !config || !config.worker_tags || config.worker_tags.length === 0}
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index f055e92ca3..58f9d5d897 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -3,7 +3,7 @@
 	import { page } from '$app/stores'
 	import { isCloudHosted } from '$lib/cloud'
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Button, CopyButton, Section, Skeleton, Tab, Tabs } from '$lib/components/common'
+	import { Alert, Button, Section, Skeleton, Tab, Tabs } from '$lib/components/common'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 
@@ -13,7 +13,7 @@
 	import ErrorOrRecoveryHandler, {
 		handlerFullPath
 	} from '$lib/components/ErrorOrRecoveryHandler.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
+	import PageHeaderContent from '$lib/components/PageHeaderContent.svelte'
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 
 	import Tooltip from '$lib/components/Tooltip.svelte'
@@ -59,7 +59,6 @@
 		convertBackendSettingsToFrontendSettings,
 		type S3ResourceSettings
 	} from '$lib/workspace_settings'
-	import { base } from '$lib/base'
 	import ConnectionSection from '$lib/components/ConnectionSection.svelte'
 	import AISettings from '$lib/components/workspaceSettings/AISettings.svelte'
 	import SharedUiSettings from '$lib/components/workspaceSettings/SharedUiSettings.svelte'
@@ -827,7 +826,7 @@
 			})
 
 			// Redirect to OAuth flow
-			window.location.href = `${base}/api/oauth/connect_slack?workspace=${$workspaceStore}`
+			window.location.href = `/api/oauth/connect_slack?workspace=${$workspaceStore}`
 		} catch (e) {
 			sendUserToast('Failed to save Slack OAuth configuration', true)
 			console.error(e)
@@ -1134,10 +1133,14 @@
 	}
 
 	// Strip keys from extraArgs that are auto-managed by child components:
-	// - 'slack': computed by ErrorOrRecoveryHandler's $effect based on handler type
+	// - 'slack' while the Slack built-in is selected: set by ErrorOrRecoveryHandler's $effect
 	// - 'channel_name': display metadata stripped by SchemaForm's removeExtraKey()
-	function normalizeHandlerExtraArgs(args: Record<string, any>): Record<string, any> {
-		const { slack: _, channel_name: __, ...rest } = args
+	function normalizeHandlerExtraArgs(
+		args: Record<string, any>,
+		handlerSelected: ErrorHandler
+	): Record<string, any> {
+		const { channel_name: _, ...rest } = args
+		if (handlerSelected === 'slack') delete rest.slack
 		return rest
 	}
 
@@ -1147,7 +1150,10 @@
 			errorHandlerSelected: initialErrorHandlerSelected,
 			errorHandlerScriptPath: initialErrorHandlerScriptPath,
 			errorHandlerItemKind: initialErrorHandlerItemKind,
-			errorHandlerExtraArgs: normalizeHandlerExtraArgs(initialErrorHandlerExtraArgs),
+			errorHandlerExtraArgs: normalizeHandlerExtraArgs(
+				initialErrorHandlerExtraArgs,
+				initialErrorHandlerSelected
+			),
 			errorHandlerMutedOnCancel: initialErrorHandlerMutedOnCancel,
 			errorHandlerMutedOnUserPath: initialErrorHandlerMutedOnUserPath
 		}
@@ -1156,7 +1162,7 @@
 			errorHandlerSelected: errorHandlerSelected,
 			errorHandlerScriptPath: errorHandlerScriptPath,
 			errorHandlerItemKind: errorHandlerItemKind,
-			errorHandlerExtraArgs: normalizeHandlerExtraArgs(errorHandlerExtraArgs),
+			errorHandlerExtraArgs: normalizeHandlerExtraArgs(errorHandlerExtraArgs, errorHandlerSelected),
 			errorHandlerMutedOnCancel: errorHandlerMutedOnCancel,
 			errorHandlerMutedOnUserPath: errorHandlerMutedOnUserPath
 		}
@@ -1457,26 +1463,31 @@
 					}
 				]
 	)
+
+	// The label of the entry the sidebar highlights, so the breadcrumb and the sidebar name the
+	// same pane: both read `tab`, which resolves the URL's aliases (`teams`, `deploy_to`, …).
+	const tabLabel = $derived(
+		navigationGroups.flatMap((g) => g.items).find((i) => i.id === tab)?.label
+	)
 </script>
 
-<CenteredPage wrapperClasses="pb-0 h-screen" handleOverflow={false} class="flex flex-col h-full">
+<CenteredPage wrapperClasses="pb-0 h-full" handleOverflow={false} class="flex flex-col h-full">
 	{#if canAdmin || isForkOwner}
-		<PageHeader title="Workspace settings: {$workspaceStore}">
-			{#snippet titleActions()}
-				{#if $workspaceStore}
-					<CopyButton value={$workspaceStore} title={`Copy id: ${$workspaceStore}`} />
-				{/if}
-			{/snippet}
-			{#if $superadmin}
-				<Button variant="default" size="sm" on:click={() => goto('#superadmin-settings')}>
-					Instance settings
-				</Button>
-			{/if}</PageHeader
-		>
+		<!-- No title of its own: the band already says which workspace's settings these are, and the
+		     two controls that sat beside the title are the page's actions. The panes below scroll
+		     inside themselves, so the bar keeps its edge at rest rather than only under a scroll. -->
+		<PageHeaderContent
+			section={tabLabel ? { parent: 'Workspace settings', label: tabLabel } : undefined}
+			actions={settingsActions}
+			separator="always"
+		/>
 
 		<div class="flex grow min-h-0 pb-4">
 			<!-- Sidebar Navigation -->
-			<div class="w-60 shrink-0 h-full overflow-auto pb-4 pr-4 -ml-2">
+			<!-- The top padding belongs inside both scrollers, not above them: it is the gap under the
+			     separator at rest, and it has to travel with the content so what scrolls passes under
+			     the line rather than stopping short of it. -->
+			<div class="w-60 shrink-0 h-full overflow-auto pt-6 pb-4 pr-4 -ml-2">
 				<SidebarNavigation
 					groups={navigationGroups}
 					selectedId={tab}
@@ -1491,7 +1502,7 @@
 			<!-- Main Content -->
 			<div class="flex-1 min-w-0 h-full">
 				<div class="h-full overflow-auto">
-					<div class="h-fit px-6" style="scrollbar-gutter: stable both-edges;">
+					<div class="h-fit px-6 pt-6" style="scrollbar-gutter: stable both-edges;">
 						{#if !loadedSettings}
 							<Skeleton layout={[1, [40]]} />
 						{:else if tab == 'users'}
@@ -1549,7 +1560,7 @@
 									<Button
 										variant="default"
 										startIcon={{ icon: Target }}
-										onclick={() => goto(`${base}/forks/compare?mode=fork`)}
+										onclick={() => goto('/forks/compare?mode=fork')}
 									>
 										Merge into another workspace
 									</Button>
@@ -1587,7 +1598,7 @@
 													<Button
 														endIcon={{ icon: ExternalLink }}
 														variant="accent"
-														href="{base}/api/w/{$workspaceStore}/workspaces/billing_portal"
+														href="/api/w/{$workspaceStore}/workspaces/billing_portal"
 													>
 														Customer portal
 													</Button>
@@ -1639,9 +1650,9 @@
 											}
 										}}
 										onSelect={editSlackCommand}
-										connectHref="{base}/api/oauth/connect_slack"
-										createScriptHref="{base}/scripts/add?hub=hub%2F28071%2Fslack%2Fexample_of_responding_to_a_slack_command_slack"
-										createFlowHref="{base}/flows/add?hub=28"
+										connectHref="/api/oauth/connect_slack"
+										createScriptHref="/scripts/add?hub=hub%2F28071%2Fslack%2Fexample_of_responding_to_a_slack_command_slack"
+										createFlowHref="/flows/add?hub=28"
 										documentationLink="https://www.windmill.dev/docs/integrations/slack"
 										onLoadSettings={loadSettings}
 										display_name={slack_team_name}
@@ -1726,7 +1737,7 @@
 																Slack API
 															</a>. Set the redirect URI to:{' '}
 															<code class="bg-gray-100 dark:bg-gray-800 px-1 py-0.5 rounded">
-																{window.location.origin}{base}/oauth/callback_slack
+																{window.location.origin}/oauth/callback_slack
 															</code>
 														</div>
 													</CollapseLink>
@@ -1776,8 +1787,8 @@
 											}}
 											onSelect={editTeamsCommand}
 											connectHref={undefined}
-											createScriptHref="{base}/scripts/add?hub=hub%2F11591%2Fteams%2FExample%20of%20responding%20to%20a%20Microsoft%20Teams%20command"
-											createFlowHref="{base}/flows/add?hub=58"
+											createScriptHref="/scripts/add?hub=hub%2F11591%2Fteams%2FExample%20of%20responding%20to%20a%20Microsoft%20Teams%20command"
+											createFlowHref="/flows/add?hub=58"
 											documentationLink="https://www.windmill.dev/docs/integrations/teams"
 											onLoadSettings={loadSettings}
 											display_name={teams_team_name}
@@ -1830,7 +1841,7 @@
 								{:else}
 									<Button
 										size="sm"
-										href="{base}/api/w/{$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip"
+										href="/api/w/{$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip"
 										target="_blank"
 									>
 										Export workspace as zip file
@@ -2052,7 +2063,7 @@
 											/>
 											<Button
 												variant="default"
-												href={`${base}/scripts/add?lang=bun#` +
+												href={'/scripts/add?lang=bun#' +
 													encodeState({
 														path: 'f/success_handler',
 														summary: 'Workspace Success Handler',
@@ -2435,5 +2446,13 @@ export async function main(
 	tabMode={true}
 />
 
+{#snippet settingsActions()}
+	{#if $superadmin}
+		<Button variant="default" unifiedSize="sm" on:click={() => goto('#superadmin-settings')}>
+			Instance settings
+		</Button>
+	{/if}
+{/snippet}
+
 <style>
 </style>
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte
index b25b8db5c8..62c25fc6b3 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/checkout/+page.svelte
@@ -31,7 +31,7 @@
 </script>
 
 <!-- svelte-ignore missing_declaration -->
-<CenteredModal title="Subscription upgrade {success ? 'succeeded' : 'failed'}">
+<CenteredModal title="Subscription upgrade {success ? 'succeeded' : 'failed'}" inPage>
 	{#if !success}
 		<div class="my-2">
 			<Alert type="error" title="Checkout failed">
diff --git a/frontend/src/routes/(root)/+layout.svelte b/frontend/src/routes/(root)/+layout.svelte
index 06d7d570b2..f14f9e1043 100644
--- a/frontend/src/routes/(root)/+layout.svelte
+++ b/frontend/src/routes/(root)/+layout.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
-	import { base } from '$app/paths'
+	// First, so its rules precede every component's.
+	import '$lib/assets/app.css'
 	import { goto } from '$lib/navigation'
 	import { page } from '$app/state'
 	import { UserService, WorkspaceService } from '$lib/gen'
@@ -150,11 +151,11 @@
 			// The MCP consent page carries its own workspace picker, so it is left to
 			// run without one. Nothing sets `$userStore` on this branch, which is why
 			// that page must stay outside the (logged) layout — see its `@(root)` name.
-			!page.url.pathname.startsWith(`${base}/oauth/mcp_authorize`) &&
+			!page.url.pathname.startsWith('/oauth/mcp_authorize') &&
 			// The hub import wizard asks for the destination itself, and may end in a
 			// workspace that does not exist yet — bouncing it to the picker would
 			// force the very choice it exists to make.
-			!page.url.pathname.startsWith(`${base}/projects/import`)
+			!page.url.pathname.startsWith('/projects/import')
 		) {
 			goto(`/user/workspaces?rd=${encodeURIComponent(page.url.href.replace(page.url.origin, ''))}`)
 		}
diff --git a/frontend/src/routes/(styled)/+layout.svelte b/frontend/src/routes/(styled)/+layout.svelte
new file mode 100644
index 0000000000..ed3de92a31
--- /dev/null
+++ b/frontend/src/routes/(styled)/+layout.svelte
@@ -0,0 +1,9 @@
+<script lang="ts">
+	// The root layout leaves app.css to the layouts under it so that the public app routes
+	// can skip it; every other top-level route lives in this group to get it.
+	import '$lib/assets/app.css'
+
+	let { children }: { children?: import('svelte').Snippet } = $props()
+</script>
+
+{@render children?.()}
diff --git a/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte b/frontend/src/routes/(styled)/app_embed/[workspace]/[...path]/+page.svelte
similarity index 81%
rename from frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
rename to frontend/src/routes/(styled)/app_embed/[workspace]/[...path]/+page.svelte
index ee83869ee8..9b3a9c1e41 100644
--- a/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
+++ b/frontend/src/routes/(styled)/app_embed/[workspace]/[...path]/+page.svelte
@@ -78,23 +78,29 @@
 	}
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{app}
-			{workspace}
-			{notExists}
-			{noPermission}
-			jwtError={false}
-			inWorkspace
-			{hideRefreshBar}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<!-- Everything the viewer renders is `h-full`, so the route is what says how tall the app is:
+     nothing above it has a height (`app.html` wraps the body in `display: contents`), and an
+     unfloored app collapses to nothing. -->
+<div class="h-screen w-full">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{app}
+				{workspace}
+				user={$userStore}
+				{notExists}
+				{noPermission}
+				jwtError={false}
+				inWorkspace
+				{hideRefreshBar}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
diff --git a/frontend/src/routes/approve/[workspace]/[job]/+page.svelte b/frontend/src/routes/(styled)/approve/[workspace]/[job]/+page.svelte
similarity index 99%
rename from frontend/src/routes/approve/[workspace]/[job]/+page.svelte
rename to frontend/src/routes/(styled)/approve/[workspace]/[job]/+page.svelte
index e2b6b88c3f..a31fe76670 100644
--- a/frontend/src/routes/approve/[workspace]/[job]/+page.svelte
+++ b/frontend/src/routes/(styled)/approve/[workspace]/[job]/+page.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { type Job, JobService } from '$lib/gen'
-	import { base } from '$lib/base'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { sendUserToast } from '$lib/toast'
@@ -157,7 +156,7 @@
 	// approver this link serves, leaving `job` undefined — and `page.params.job` is the
 	// flow id the token is minted for anyway.
 	let runDetailsHref = $derived.by(() => {
-		let url = `${base}/run/${page.params.job}?workspace=${page.params.workspace}`
+		let url = `/run/${page.params.job}?workspace=${page.params.workspace}`
 		if (approvalInfo?.view_token) {
 			url += `&view_token=${encodeURIComponent(approvalInfo.view_token)}`
 		}
diff --git a/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte b/frontend/src/routes/(styled)/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
similarity index 99%
rename from frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
rename to frontend/src/routes/(styled)/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
index 18fe489a9a..c918df395b 100644
--- a/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
+++ b/frontend/src/routes/(styled)/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { type Job, JobService } from '$lib/gen'
-	import { base } from '$lib/base'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { sendUserToast } from '$lib/toast'
@@ -152,7 +151,7 @@
 	// Carry the share-read-link token so a workspace-member approver can open the run
 	// details of a flow they don't otherwise have read access to.
 	let runDetailsHref = $derived.by(() => {
-		let url = `${base}/run/${job?.id}?workspace=${job?.workspace_id}`
+		let url = `/run/${job?.id}?workspace=${job?.workspace_id}`
 		if (viewToken) {
 			url += `&view_token=${encodeURIComponent(viewToken)}`
 		}
diff --git a/frontend/src/routes/dev/+page.js b/frontend/src/routes/(styled)/dev/+page.js
similarity index 100%
rename from frontend/src/routes/dev/+page.js
rename to frontend/src/routes/(styled)/dev/+page.js
diff --git a/frontend/src/routes/dev/+page.svelte b/frontend/src/routes/(styled)/dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/dev/+page.svelte
rename to frontend/src/routes/(styled)/dev/+page.svelte
diff --git a/frontend/src/routes/flows/dev/+page.js b/frontend/src/routes/(styled)/flows/dev/+page.js
similarity index 100%
rename from frontend/src/routes/flows/dev/+page.js
rename to frontend/src/routes/(styled)/flows/dev/+page.js
diff --git a/frontend/src/routes/flows/dev/+page.svelte b/frontend/src/routes/(styled)/flows/dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/flows/dev/+page.svelte
rename to frontend/src/routes/(styled)/flows/dev/+page.svelte
diff --git a/frontend/src/routes/gh_success/+page.svelte b/frontend/src/routes/(styled)/gh_success/+page.svelte
similarity index 100%
rename from frontend/src/routes/gh_success/+page.svelte
rename to frontend/src/routes/(styled)/gh_success/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/deploy_animation/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/deploy_animation/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/deploy_animation/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/deploy_animation/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/icons/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/icons/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/icons/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/icons/+page.svelte
diff --git a/frontend/src/routes/kitchen_sink/login/+page.svelte b/frontend/src/routes/(styled)/kitchen_sink/login/+page.svelte
similarity index 100%
rename from frontend/src/routes/kitchen_sink/login/+page.svelte
rename to frontend/src/routes/(styled)/kitchen_sink/login/+page.svelte
diff --git a/frontend/src/routes/oauth/callback/[client_name]/+page.svelte b/frontend/src/routes/(styled)/oauth/callback/[client_name]/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback/[client_name]/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback/[client_name]/+page.svelte
diff --git a/frontend/src/routes/oauth/callback_slack/+page.svelte b/frontend/src/routes/(styled)/oauth/callback_slack/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback_slack/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback_slack/+page.svelte
diff --git a/frontend/src/routes/oauth/callback_slack/instance/+page.svelte b/frontend/src/routes/(styled)/oauth/callback_slack/instance/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback_slack/instance/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback_slack/instance/+page.svelte
diff --git a/frontend/src/routes/oauth/callback_supabase/+page.svelte b/frontend/src/routes/(styled)/oauth/callback_supabase/+page.svelte
similarity index 100%
rename from frontend/src/routes/oauth/callback_supabase/+page.svelte
rename to frontend/src/routes/(styled)/oauth/callback_supabase/+page.svelte
diff --git a/frontend/src/routes/pipeline_dev/+page.svelte b/frontend/src/routes/(styled)/pipeline_dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/pipeline_dev/+page.svelte
rename to frontend/src/routes/(styled)/pipeline_dev/+page.svelte
diff --git a/frontend/src/routes/public_run/[workspace]/[id]/+page.svelte b/frontend/src/routes/(styled)/public_run/[workspace]/[id]/+page.svelte
similarity index 98%
rename from frontend/src/routes/public_run/[workspace]/[id]/+page.svelte
rename to frontend/src/routes/(styled)/public_run/[workspace]/[id]/+page.svelte
index 9d70f27cad..6f917aeeb6 100644
--- a/frontend/src/routes/public_run/[workspace]/[id]/+page.svelte
+++ b/frontend/src/routes/(styled)/public_run/[workspace]/[id]/+page.svelte
@@ -2,7 +2,6 @@
 	import { page } from '$app/state'
 	import { onDestroy, untrack } from 'svelte'
 	import { ArrowRight, Globe } from 'lucide-svelte'
-	import { base } from '$lib/base'
 	import type { Job } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { setViewToken } from '$lib/viewToken'
@@ -117,7 +116,7 @@
 				unifiedSize="sm"
 				endIcon={{ icon: ArrowRight }}
 				wrapperClasses="ml-auto"
-				href={`${base}/run/${jobId}?workspace=${encodeURIComponent(workspace)}`}
+				href={`/run/${jobId}?workspace=${encodeURIComponent(workspace)}`}
 			>
 				Open full view
 			</Button>
diff --git a/frontend/src/routes/replay/+page.svelte b/frontend/src/routes/(styled)/replay/+page.svelte
similarity index 100%
rename from frontend/src/routes/replay/+page.svelte
rename to frontend/src/routes/(styled)/replay/+page.svelte
diff --git a/frontend/src/routes/scripts/dev/+page.js b/frontend/src/routes/(styled)/scripts/dev/+page.js
similarity index 100%
rename from frontend/src/routes/scripts/dev/+page.js
rename to frontend/src/routes/(styled)/scripts/dev/+page.js
diff --git a/frontend/src/routes/scripts/dev/+page.svelte b/frontend/src/routes/(styled)/scripts/dev/+page.svelte
similarity index 100%
rename from frontend/src/routes/scripts/dev/+page.svelte
rename to frontend/src/routes/(styled)/scripts/dev/+page.svelte
diff --git a/frontend/src/routes/scripts/p/[...path].svelte b/frontend/src/routes/(styled)/scripts/p/[...path].svelte
similarity index 100%
rename from frontend/src/routes/scripts/p/[...path].svelte
rename to frontend/src/routes/(styled)/scripts/p/[...path].svelte
diff --git a/frontend/src/routes/test_dev/+layout.svelte b/frontend/src/routes/(styled)/test_dev/+layout.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/+layout.svelte
rename to frontend/src/routes/(styled)/test_dev/+layout.svelte
diff --git a/frontend/src/routes/test_dev/TestDevHeader.svelte b/frontend/src/routes/(styled)/test_dev/TestDevHeader.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/TestDevHeader.svelte
rename to frontend/src/routes/(styled)/test_dev/TestDevHeader.svelte
diff --git a/frontend/src/routes/test_dev/diff-comparison/+page.svelte b/frontend/src/routes/(styled)/test_dev/diff-comparison/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/diff-comparison/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/diff-comparison/+page.svelte
diff --git a/frontend/src/routes/test_dev/kitchen_sink/+page.svelte b/frontend/src/routes/(styled)/test_dev/kitchen_sink/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/kitchen_sink/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/kitchen_sink/+page.svelte
diff --git a/frontend/src/routes/test_dev/public_app_imports/+page.svelte b/frontend/src/routes/(styled)/test_dev/public_app_imports/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/public_app_imports/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/public_app_imports/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_app/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_app/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_app/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_app/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_flow/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_flow/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_flow/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_flow/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_resource/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_resource/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_resource/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_resource/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_schema/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_schema/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_schema/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_schema/+page.svelte
diff --git a/frontend/src/routes/test_dev/sdk_script/+page.svelte b/frontend/src/routes/(styled)/test_dev/sdk_script/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/sdk_script/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/sdk_script/+page.svelte
diff --git a/frontend/src/routes/test_dev/test_dev_script/+page.svelte b/frontend/src/routes/(styled)/test_dev/test_dev_script/+page.svelte
similarity index 100%
rename from frontend/src/routes/test_dev/test_dev_script/+page.svelte
rename to frontend/src/routes/(styled)/test_dev/test_dev_script/+page.svelte
diff --git a/frontend/src/routes/user/close/+page.svelte b/frontend/src/routes/(styled)/user/close/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/close/+page.svelte
rename to frontend/src/routes/(styled)/user/close/+page.svelte
diff --git a/frontend/src/routes/user/forgot-password/+page.svelte b/frontend/src/routes/(styled)/user/forgot-password/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/forgot-password/+page.svelte
rename to frontend/src/routes/(styled)/user/forgot-password/+page.svelte
diff --git a/frontend/src/routes/user/login_callback/[client_name]/+page.svelte b/frontend/src/routes/(styled)/user/login_callback/[client_name]/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/login_callback/[client_name]/+page.svelte
rename to frontend/src/routes/(styled)/user/login_callback/[client_name]/+page.svelte
diff --git a/frontend/src/routes/user/login_link_expired/+page.svelte b/frontend/src/routes/(styled)/user/login_link_expired/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/login_link_expired/+page.svelte
rename to frontend/src/routes/(styled)/user/login_link_expired/+page.svelte
diff --git a/frontend/src/routes/user/reset-password/+page.svelte b/frontend/src/routes/(styled)/user/reset-password/+page.svelte
similarity index 100%
rename from frontend/src/routes/user/reset-password/+page.svelte
rename to frontend/src/routes/(styled)/user/reset-password/+page.svelte
diff --git a/frontend/src/routes/view_graph/+page.svelte b/frontend/src/routes/(styled)/view_graph/+page.svelte
similarity index 100%
rename from frontend/src/routes/view_graph/+page.svelte
rename to frontend/src/routes/(styled)/view_graph/+page.svelte
diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index fca03d39ec..bc3d9f09cb 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -1,8 +1,17 @@
+<script module lang="ts">
+	// app.css is imported by the layouts below this one, not here: the public app routes
+	// (`public/`, `a/`) load it only when they render more than a raw app's bundle.
+	// A production build links a layout's CSS ahead of its page's, but in dev a stylesheet
+	// lands when its module evaluates, and a page's can evaluate before its layout's. This
+	// module is imported at startup, so loading it here in dev keeps app.css first.
+	if (import.meta.env.DEV && !/^\/(public|a)\//.test(location.pathname)) {
+		import('$lib/assets/app.css')
+	}
+</script>
+
 <script lang="ts">
 	import { page } from '$app/state'
 
-	import { SvelteToast } from '@zerodevx/svelte-toast'
-	import '$lib/assets/app.css'
 	import { installDevPollingDormancy } from '$lib/utils/devPollingDormancy'
 	interface Props {
 		children?: import('svelte').Snippet
@@ -65,7 +74,9 @@
 {@render children?.()}
 
 <div class="wrap">
-	<SvelteToast options={toastOptions} />
+	{#await import('@zerodevx/svelte-toast') then { SvelteToast }}
+		<SvelteToast options={toastOptions} />
+	{/await}
 </div>
 
 <style>
diff --git a/frontend/src/routes/a/[...path]/+page.svelte b/frontend/src/routes/a/[...path]/+page.svelte
index e9fd20877c..8bfd08a820 100644
--- a/frontend/src/routes/a/[...path]/+page.svelte
+++ b/frontend/src/routes/a/[...path]/+page.svelte
@@ -1,19 +1,22 @@
 <script lang="ts">
 	import { BROWSER } from 'esm-env'
 
-	import { AppService, OpenAPI, type AppWithLastVersion } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { sendUserToast } from '$lib/toast'
-
-	import { setLicense } from '$lib/enterpriseUtils'
-
-	import { getUserExt } from '$lib/user'
+	import { OpenAPI } from '$lib/gen/core/OpenAPI'
+	import type { GuestEntry } from '$lib/gen/types.gen'
+	import type { UserExt } from '$lib/stores'
 	import { page } from '$app/state'
-	import { base } from '$lib/base'
 	import PublicApp from '$lib/components/apps/editor/PublicApp.svelte'
 	import PublicAppFrame from '$lib/components/apps/editor/PublicAppFrame.svelte'
+	import {
+		getLicenseOrUndefined,
+		getUserExtOrUndefined,
+		publicGet,
+		type PublicAppValue
+	} from '$lib/components/apps/editor/publicAppApi'
 
-	let app: (AppWithLastVersion & { value: any }) | undefined = $state(undefined)
+	let app: PublicAppValue | undefined = $state(undefined)
+	let user: UserExt | undefined = $state(undefined)
+	let license: string | undefined = $state(undefined)
 	let notExists = $state(false)
 	let noPermission = $state(false)
 	let jwtError = $state(false)
@@ -70,9 +73,10 @@
 	// read it. Captured once (not reactively): the embedder mirrors the app's
 	// hash/query back onto this page's URL, and re-deriving the src from it would
 	// reload the app on its every navigation.
-	const viewerUrl = `${base}/a/${parsedCustomPath.path}${page.url.search}${page.url.hash}`
+	const viewerUrl = `/a/${parsedCustomPath.path}${page.url.search}${page.url.hash}`
 
 	let workspace: string | undefined = $state(undefined)
+	let embedWorkspace: string | undefined
 	let refresh: (() => void) | undefined
 	/** `<workspace>/<app_path>` when this app is open to guests. Resolved eagerly:
 	 * PublicAppFrame renders its sign-in gate before `onViewerReady` fires. */
@@ -92,9 +96,9 @@
 		if (guestEntrySettled()) return
 		for (let attempt = 0; attempt < 3; attempt++) {
 			try {
-				const entry = await AppService.getGuestEntryByCustomPath({
-					customPath: parsedCustomPath.path
-				})
+				const entry = await publicGet<GuestEntry>(
+					`/apps_u/guest_entry_by_custom_path/${encodeURI(parsedCustomPath.path)}`
+				)
 				guestAppPath = `${entry.workspace_id}/${entry.app_path}`
 				guestEntry = 'guest'
 				return
@@ -123,46 +127,41 @@
 		} else if (parsedCustomPath.jwt) {
 			OpenAPI.TOKEN = 'jwt_ext_' + parsedCustomPath.jwt
 		}
-		const headers: Record<string, string> = {}
-		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
-			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
-		}
 		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
-		const res = await fetch(
-			`${OpenAPI.BASE}/apps_u/embed_token_by_custom_path/${parsedCustomPath.path}${consent}`,
-			{ headers }
+		const resp = await publicGet<{ token?: string; workspace_id?: string }>(
+			`/apps_u/embed_token_by_custom_path/${parsedCustomPath.path}${consent}`
 		)
-		if (!res.ok) {
-			const err: any = new Error('Failed to fetch embed token')
-			err.status = res.status
-			throw err
-		}
-		return await res.json()
+		embedWorkspace = resp.workspace_id ?? embedWorkspace
+		return resp
 	}
 
 	// Viewer side: load the app + user using the embed token handed to the iframe.
 	async function loadApp() {
 		try {
-			app = await AppService.getPublicAppByCustomPath({
-				customPath: parsedCustomPath.path
-			})
-			workspace = app.workspace_id
-			workspaceStore.set(app.workspace_id)
+			// The embed token names the workspace, so the user loads alongside the app
+			// rather than after it. The opaque viewer frame never fetches one.
+			const userLoad = embedWorkspace ? getUserExtOrUndefined(embedWorkspace) : undefined
+			const loaded = await publicGet<PublicAppValue>(
+				`/apps_u/public_app_by_custom_path/${encodeURI(parsedCustomPath.path)}`
+			)
+			const appWorkspace = loaded.workspace_id!
+			user = await (userLoad && embedWorkspace === appWorkspace
+				? userLoad
+				: getUserExtOrUndefined(appWorkspace))
+			import('$lib/stores').then(({ workspaceStore }) => workspaceStore.set(appWorkspace))
+			app = loaded
+			workspace = appWorkspace
 			noPermission = false
 			notExists = false
 			jwtError = false
-
-			try {
-				userStore.set(await getUserExt(app.workspace_id))
-				// A JWT in the custom path that fails to resolve a user is surfaced as a
-				// toast (matches the pre-sandbox custom-path viewer) rather than silently
-				// falling through to anonymous.
-				if (!$userStore && parsedCustomPath.jwt) {
-					jwtError = true
+			// A JWT in the custom path that fails to resolve a user is surfaced as a
+			// toast (matches the pre-sandbox custom-path viewer) rather than silently
+			// falling through to anonymous.
+			if (!user && parsedCustomPath.jwt) {
+				jwtError = true
+				import('$lib/toast').then(({ sendUserToast }) =>
 					sendUserToast('Could not authentify user with jwt token', true)
-				}
-			} catch (e) {
-				console.warn('Anonymous user')
+				)
 			}
 		} catch (e) {
 			if (e.status == 401) {
@@ -182,30 +181,37 @@
 	}
 
 	if (BROWSER) {
-		setLicense()
+		getLicenseOrUndefined().then((l) => (license = l))
 		loadGuestEntry()
 	}
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	{viewerUrl}
-	{guestAppPath}
-	{guestEntry}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{workspace}
-			{notExists}
-			{noPermission}
-			{jwtError}
-			{guestAppPath}
-			{app}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<!-- The route is what gives the app a height: nothing above it has one (`app.html` wraps the
+     body in `display: contents`), and the viewer's own boxes are full-height. Styled
+     inline: a raw app renders here without app.css. -->
+<div style="height: 100vh; width: 100%">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		{viewerUrl}
+		{guestAppPath}
+		{guestEntry}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{workspace}
+				{user}
+				{license}
+				{notExists}
+				{noPermission}
+				{jwtError}
+				{guestAppPath}
+				{app}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
diff --git a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
index b2a29b6316..fb32a8ac9b 100644
--- a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
+++ b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
@@ -1,18 +1,22 @@
 <script lang="ts">
 	import { BROWSER } from 'esm-env'
 
-	import { AppService, OpenAPI, type AppWithLastVersion } from '$lib/gen'
-	import { userStore } from '$lib/stores'
-
-	import { setLicense } from '$lib/enterpriseUtils'
-
-	import { getUserExt } from '$lib/user'
+	import { OpenAPI } from '$lib/gen/core/OpenAPI'
+	import type { GuestEntry } from '$lib/gen/types.gen'
+	import type { UserExt } from '$lib/stores'
 	import { page } from '$app/state'
-	import { base } from '$lib/base'
 	import PublicApp from '$lib/components/apps/editor/PublicApp.svelte'
 	import PublicAppFrame from '$lib/components/apps/editor/PublicAppFrame.svelte'
+	import {
+		getLicenseOrUndefined,
+		getUserExtOrUndefined,
+		publicGet,
+		type PublicAppValue
+	} from '$lib/components/apps/editor/publicAppApi'
 
-	let app: (AppWithLastVersion & { value: any }) | undefined = $state(undefined)
+	let app: PublicAppValue | undefined = $state(undefined)
+	let user: UserExt | undefined = $state(undefined)
+	let license: string | undefined = $state(undefined)
 	let notExists = $state(false)
 	let noPermission = $state(false)
 	let jwtError = $state(false)
@@ -58,7 +62,7 @@
 	// Captured once (not reactively): the embedder mirrors the app's hash/query
 	// back onto this page's URL, and re-deriving the src from it would reload the
 	// app on its every navigation.
-	const viewerUrl = `${base}/public/${workspace}/${parsedSecret.secret}${page.url.search}${page.url.hash}`
+	const viewerUrl = `/public/${workspace}/${parsedSecret.secret}${page.url.search}${page.url.hash}`
 
 	let refresh: (() => void) | undefined
 
@@ -70,35 +74,21 @@
 		} else if (parsedSecret.jwt) {
 			OpenAPI.TOKEN = 'jwt_ext_' + parsedSecret.jwt
 		}
-		const headers: Record<string, string> = {}
-		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
-			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
-		}
 		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
-		const res = await fetch(
-			`${OpenAPI.BASE}/w/${workspace}/apps_u/embed_token/${parsedSecret.secret}${consent}`,
-			{ headers }
-		)
-		if (!res.ok) {
-			const err: any = new Error('Failed to fetch embed token')
-			err.status = res.status
-			throw err
-		}
-		return await res.json()
+		return await publicGet(`/w/${workspace}/apps_u/embed_token/${parsedSecret.secret}${consent}`)
 	}
 
 	// Viewer side: load the app + user using the embed token handed to the iframe.
 	async function loadApp() {
+		// Neither waits on the other: `app.html` already requested both.
+		const userLoad = getUserExtOrUndefined(workspace)
+		const appLoad = publicGet<PublicAppValue>(
+			`/w/${workspace}/apps_u/public_app/${encodeURI(parsedSecret.secret)}`
+		)
+		appLoad.catch(() => {})
+		user = await userLoad
 		try {
-			userStore.set(await getUserExt(workspace))
-		} catch (e) {
-			console.warn('Anonymous user')
-		}
-		try {
-			app = await AppService.getPublicAppBySecret({
-				workspace,
-				path: parsedSecret.secret
-			})
+			app = await appLoad
 			noPermission = false
 			notExists = false
 		} catch (e) {
@@ -126,7 +116,9 @@
 		if (guestEntrySettled()) return
 		for (let attempt = 0; attempt < 3; attempt++) {
 			try {
-				const entry = await AppService.getGuestEntry({ workspace, path: parsedSecret.secret })
+				const entry = await publicGet<GuestEntry>(
+					`/w/${workspace}/apps_u/guest_entry/${encodeURI(parsedSecret.secret)}`
+				)
 				guestAppPath = `${workspace}/${entry.app_path}`
 				guestEntry = 'guest'
 				return
@@ -156,29 +148,36 @@
 	}
 
 	if (BROWSER) {
-		setLicense()
+		getLicenseOrUndefined().then((l) => (license = l))
 	}
 </script>
 
-<PublicAppFrame
-	{fetchEmbedToken}
-	{viewerUrl}
-	{guestAppPath}
-	{guestEntry}
-	onViewerReady={(_token, requestTokenRefresh) => {
-		refresh = requestTokenRefresh
-		loadApp()
-	}}
->
-	{#snippet viewer()}
-		<PublicApp
-			{app}
-			{workspace}
-			{notExists}
-			{noPermission}
-			{jwtError}
-			{guestAppPath}
-			onLoginSuccess={() => loadApp()}
-		></PublicApp>
-	{/snippet}
-</PublicAppFrame>
+<!-- The route is what gives the app a height: nothing above it has one (`app.html` wraps the
+     body in `display: contents`), and the viewer's own boxes are full-height. Styled
+     inline: a raw app renders here without app.css. -->
+<div style="height: 100vh; width: 100%">
+	<PublicAppFrame
+		{fetchEmbedToken}
+		{viewerUrl}
+		{guestAppPath}
+		{guestEntry}
+		onViewerReady={(_token, requestTokenRefresh) => {
+			refresh = requestTokenRefresh
+			loadApp()
+		}}
+	>
+		{#snippet viewer()}
+			<PublicApp
+				{app}
+				{workspace}
+				{user}
+				{license}
+				{notExists}
+				{noPermission}
+				{jwtError}
+				{guestAppPath}
+				onLoginSuccess={() => loadApp()}
+			></PublicApp>
+		{/snippet}
+	</PublicAppFrame>
+</div>
diff --git a/frontend/svelte.config.js b/frontend/svelte.config.js
index 15634551e6..64b39b5d7d 100644
--- a/frontend/svelte.config.js
+++ b/frontend/svelte.config.js
@@ -35,9 +35,6 @@ const config = {
 		// revisions (SvelteKit only full-page reloads on a missing chunk if this changed).
 		version: { name: process.env.WM_BUILD_VERSION || pkg.version },
 		prerender: { entries: [] },
-		paths: {
-			base: process.env.VITE_BASE_URL ?? ''
-		},
 		alias: {
 			$system_prompts: '../system_prompts/auto-generated',
 			$oauth_connect_registry: '../backend/oauth_connect.json',
diff --git a/frontend/vite.config.js b/frontend/vite.config.js
index 099dbe246a..a07034d2c1 100644
--- a/frontend/vite.config.js
+++ b/frontend/vite.config.js
@@ -108,25 +108,34 @@ const isClientBuild = (bundle) =>
 	Object.keys(bundle).some((file) => file.startsWith('_app/immutable/'))
 
 /**
- * Fail the build if a public app URL statically loads the low-code runtime or monaco.
+ * Fail the build if a public app URL statically loads more than a raw app needs.
  *
  * These pages also serve raw apps, which only need a small shell around their bundle's
- * iframe. One static import of AppPreview (or of anything reaching monaco) makes every
- * public app page preload ~650 chunks instead of ~55. See loadAppPreview.ts.
+ * iframe, and the page shows nothing until its static imports have loaded. One static
+ * import of AppPreview (or of anything reaching monaco) makes every public app page
+ * preload ~650 chunks; one of the generated client, `$lib/stores` or `$lib/utils` drags
+ * in most of the app shell. The root layout wraps these pages, so it must not import
+ * app.css either. See loadAppPreview.ts and publicAppApi.ts.
  */
 function assertLeanPublicAppRoutes() {
 	// Route directories, so +page.js counts as well as +page.svelte.
 	const routes = ['/src/routes/public/[workspace]/[...secret]/', '/src/routes/a/[...path]/']
 	const forbidden = [
 		'/src/lib/components/apps/editor/AppPreview.svelte',
-		'/node_modules/monaco-editor/'
+		'/node_modules/monaco-editor/',
+		'/src/lib/assets/app.css',
+		'/src/lib/gen/services.gen.ts',
+		'/src/lib/stores.ts',
+		'/src/lib/utils.ts',
+		'/src/lib/components/Login.svelte',
+		'/node_modules/@melt-ui/'
 	]
 	return {
 		name: 'wm-assert-lean-public-app-routes',
 		generateBundle(_options, bundle) {
 			if (!isClientBuild(bundle)) return
-			for (const route of routes) {
-				assertStaticClosureExcludes(this, bundle, route, forbidden, 'loadAppPreview.ts')
+			for (const route of [...routes, '/src/routes/+layout.svelte']) {
+				assertStaticClosureExcludes(this, bundle, route, forbidden, 'publicAppApi.ts')
 			}
 		}
 	}
@@ -210,6 +219,17 @@ function needsCrossOriginIsolation(url) {
 	)
 }
 
+// Normalized like the static server resolves it, so `//ui_builder/...` or an
+// encoded name can't reach the file without the header.
+function isPreviewShell(url) {
+	let path = url.split('?')[0]
+	try {
+		path = decodeURIComponent(path)
+	} catch {}
+	path = path.replace(/\/+/g, '/')
+	return path === '/ui_builder/app-preview.html'
+}
+
 let plugin = {
 	name: 'configure-response-headers',
 	enforce: 'pre',
@@ -219,6 +239,14 @@ let plugin = {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
 				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
 			}
+			// Mirrors `static_assets.rs`. Set before the static handler and the :4000
+			// proxy fallback alike, so both paths serve the shell sandboxed.
+			if (isPreviewShell(req.url ?? '')) {
+				res.setHeader(
+					'Content-Security-Policy',
+					'sandbox allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals allow-top-navigation'
+				)
+			}
 			// CORP on everything so dev assets stay loadable as subresources of
 			// isolated documents on other dev origins (e.g. 127.0.0.1 vs localhost).
 			res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin')
@@ -353,7 +381,19 @@ const config = {
 				// which makes the *chunk* graph cyclic where the module graph is not, and
 				// modules then evaluate against uninitialized bindings. See
 				// docs/frontend-import-cycles.md.
-				advancedChunks: { groups: [{ name: 'gen', test: /[\\/]src[\\/]lib[\\/]gen[\\/]/ }] }
+				// The client's config is split out for the public app routes, which set the
+				// credential without loading the client. It imports nothing at runtime, so
+				// its chunk cannot be part of a cycle.
+				advancedChunks: {
+					groups: [
+						{
+							name: 'gen-config',
+							test: /[\\/]src[\\/]lib[\\/]gen[\\/]core[\\/]OpenAPI\.ts$/,
+							priority: 1
+						},
+						{ name: 'gen', test: /[\\/]src[\\/]lib[\\/]gen[\\/]/ }
+					]
+				}
 			}
 		}
 	},
diff --git a/integration_tests/test/identity_script_test.py b/integration_tests/test/identity_script_test.py
index dc56c4956c..638919fb22 100644
--- a/integration_tests/test/identity_script_test.py
+++ b/integration_tests/test/identity_script_test.py
@@ -14,11 +14,6 @@ echo ${x}
 export async function main(x: number) {
   return x;
 }
-""",
-    "deno": """
-export async function main(x: number) {
-  return x;
-}
 """,
     "go": """
 package inner
@@ -72,11 +67,6 @@ class TestIdentityScript(unittest.TestCase):
         result = self._client.run_sync(path, {"x": 5})
         self.assertEqual(result, 5)
 
-    def test_deno(self):
-        path = PATH_TEMPLATE.format(lang="deno")
-        result = self._client.run_sync(path, {"x": 5})
-        self.assertEqual(result, 5)
-
     def test_go(self):
         path = PATH_TEMPLATE.format(lang="go")
         result = self._client.run_sync(path, {"x": 5})
diff --git a/integration_tests/test/increment_flow_test.py b/integration_tests/test/increment_flow_test.py
index c4682cb8b3..2a2f5b88d9 100644
--- a/integration_tests/test/increment_flow_test.py
+++ b/integration_tests/test/increment_flow_test.py
@@ -38,10 +38,10 @@ FLOW_VALUE = """
                 "value":
                 {
                     "tag": "",
-                    "lock": "{\\n  \\"version\\": \\"3\\",\\n  \\"remote\\": {}\\n}\\n",
+                    "lock": "{\\n  \\"dependencies\\": {}\\n}\\n//bun.lockb\\n<empty>",
                     "type": "rawscript",
                     "content": "export async function main(x: number) {\\n  return x + 1\\n}\\n",
-                    "language": "deno",
+                    "language": "bun",
                     "input_transforms":
                     {
                         "x":
diff --git a/integration_tests/test/windmill_sdk_test.py b/integration_tests/test/windmill_sdk_test.py
index 6b5dcefbe9..11a4fa7886 100644
--- a/integration_tests/test/windmill_sdk_test.py
+++ b/integration_tests/test/windmill_sdk_test.py
@@ -8,15 +8,6 @@ from .wmill_integration_test_utils import WindmillClient
 VARIABLE_PATH = "u/admin/test_variable"
 VARIABLE_VALUE = "Hello world!"
 
-DENO_SCRIPT_PATH = "u/admin/deno_sdk_test_script"
-DENO_SCRIPT_VALUE = """
-import * as wmill from "npm:windmill-client@{version}"
-export async function main() {{
-  const val = await wmill.getVariable('u/admin/test_variable')
-  return val;
-}}
-"""
-
 BUN_SCRIPT_PATH = "u/admin/bun_sdk_test_script"
 BUN_SCRIPT_VALUE = """
 import * as wmill from "windmill-client@{version}"
@@ -63,11 +54,6 @@ class TestWindmillSdk(unittest.TestCase):
                 path=VARIABLE_PATH,
                 value=VARIABLE_VALUE,
             )
-            cls._client.create_script(
-                path=DENO_SCRIPT_PATH,
-                content=DENO_SCRIPT_VALUE.format(version=cls._dev_version),
-                language="deno",
-            )
             # TODO: See skipped annotations below
             # cls._client.create_script(
             #     path=BUN_SCRIPT_PATH,
@@ -89,7 +75,6 @@ class TestWindmillSdk(unittest.TestCase):
     def tearDownClass(cls) -> None:
         if cls._running_latest:
             cls._client.set_npm_config_registry("")
-            cls._client.delete_script(path=DENO_SCRIPT_PATH)
             # TODO: See skipped annotations below
             # cls._client.delete_script(path=BUN_SCRIPT_PATH)
             # cls._client.delete_script(path=PYTHON_SCRIPT_PATH)
@@ -97,13 +82,6 @@ class TestWindmillSdk(unittest.TestCase):
             cls._client.delete_variable(path=VARIABLE_PATH)
             cls._client.set_npm_config_registry("")
 
-    @unittest.skipUnless(
-        os.environ.get("WMILL_RUNNING_DEV", "0") == "1", "Runs on dev version only"
-    )
-    def test_deno_sdk_usable(self):
-        result = self._client.run_sync(DENO_SCRIPT_PATH, {})
-        self.assertEqual(result, VARIABLE_VALUE)
-
     @unittest.skipUnless(
         # os.environ.get("WMILL_RUNNING_DEV", "0") == "1", "Runs on dev version only"
         False,
diff --git a/lsp/Pipfile b/lsp/Pipfile
index b90f9b3b74..4aee9bdf9f 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.821.0"
+wmill = ">=1.830.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/lsp/pyls_launcher.py b/lsp/pyls_launcher.py
index 9feec0033a..b3fbe7fd9a 100644
--- a/lsp/pyls_launcher.py
+++ b/lsp/pyls_launcher.py
@@ -1,6 +1,9 @@
+import asyncio
 import logging
+import shutil
 import subprocess
 import threading
+import time
 import os
 import urllib.request
 import urllib.error
@@ -149,8 +152,221 @@ class LanguageServerWebSocketHandler(websocket.WebSocketHandler):
 class PyrightLS(LanguageServerWebSocketHandler):
     procargs = ["pipenv", "run", "pyright-langserver", "--stdio"]
 
-class DiagnosticLS(LanguageServerWebSocketHandler):
-    procargs = ["diagnostic-languageserver", "--stdio", "--log-level", "4"]
+SHELLCHECK_BIN = shutil.which("shellcheck")
+# The linter is configured here rather than by the editor's initializationOptions.
+SHELLCHECK_ARGS = ["--norc", "--format=json1", "-"]
+SHELLCHECK_TIMEOUT_SECS = float(os.environ.get("SHELLCHECK_TIMEOUT_SECS", "10"))
+SHELLCHECK_MAX_DOC_CHARS = int(os.environ.get("SHELLCHECK_MAX_DOC_CHARS", "200000"))
+SHELLCHECK_MAX_DOCS_PER_CONN = 8
+# A document whose checks finish faster than this is checked on every change
+# with no pause; see ShellcheckLS._changed.
+SHELLCHECK_INSTANT_SECS = 0.05
+SHELLCHECK_MAX_DEBOUNCE_SECS = 1.0
+# Shared by every connection: shellcheck is CPU-bound and single-threaded, so
+# more concurrent runs than cores only makes all of them slower.
+_shellcheck_slots = asyncio.Semaphore(os.cpu_count() or 2)
+
+_SHELLCHECK_SEVERITIES = {"error": 1, "warning": 2, "info": 3, "style": 3}
+
+
+def _utf16_col(line, col):
+    """shellcheck counts code points, LSP positions count UTF-16 code units."""
+    col = max(col - 1, 0)
+    if line.isascii():
+        return col
+    return len(line[:col].encode("utf-16-le")) // 2
+
+
+def shellcheck_diagnostics(text, output):
+    lines = text.split("\n")
+
+    def position(line, col):
+        line = max(line - 1, 0)
+        return {
+            "line": line,
+            "character": _utf16_col(lines[line], col) if line < len(lines) else 0,
+        }
+
+    diagnostics = []
+    for c in json.loads(output).get("comments", []):
+        code = "SC%d" % c["code"]
+        diagnostics.append(
+            {
+                "range": {
+                    "start": position(c["line"], c["column"]),
+                    "end": position(c["endLine"], c["endColumn"]),
+                },
+                "severity": _SHELLCHECK_SEVERITIES.get(c["level"], 3),
+                "code": code,
+                "codeDescription": {"href": "https://www.shellcheck.net/wiki/" + code},
+                "source": "shellcheck",
+                "message": c["message"],
+            }
+        )
+    return diagnostics
+
+
+class ShellcheckLS(websocket.WebSocketHandler):
+    """Lints shell documents by running shellcheck itself, speaking only the
+    slice of LSP that takes: document sync in, diagnostics out."""
+
+    def open(self):
+        self.docs = {}
+        self.tasks = {}
+        self.cost = {}
+        self.linted = {}
+
+    def check_origin(self, origin):
+        return True
+
+    def on_message(self, message):
+        try:
+            msg = json.loads(message)
+            method = msg.get("method")
+            params = msg.get("params") or {}
+            if method == "initialize":
+                self._send(
+                    {
+                        "jsonrpc": "2.0",
+                        "id": msg.get("id"),
+                        "result": {
+                            "capabilities": {
+                                "textDocumentSync": {"openClose": True, "change": 1}
+                            },
+                            "serverInfo": {"name": "windmill-shellcheck"},
+                        },
+                    }
+                )
+            elif method == "textDocument/didOpen":
+                doc = params["textDocument"]
+                self._changed(doc["uri"], doc.get("version"), doc["text"])
+            elif method == "textDocument/didChange":
+                doc = params["textDocument"]
+                self._changed(
+                    doc["uri"], doc.get("version"), params["contentChanges"][-1]["text"]
+                )
+            elif method == "textDocument/didClose":
+                self._forget(params["textDocument"]["uri"])
+            elif method == "shutdown":
+                self._send({"jsonrpc": "2.0", "id": msg.get("id"), "result": None})
+            elif method is not None and "id" in msg:
+                self._send(
+                    {
+                        "jsonrpc": "2.0",
+                        "id": msg["id"],
+                        "error": {"code": -32601, "message": "Method not found"},
+                    }
+                )
+        except (ValueError, KeyError, IndexError, TypeError, AttributeError):
+            log.warning("shellcheck: dropping malformed message")
+
+    def on_close(self):
+        for uri in list(self.docs):
+            self._forget(uri)
+
+    def _send(self, msg):
+        try:
+            self.write_message(json.dumps(msg))
+        except websocket.WebSocketClosedError:
+            pass
+
+    def _forget(self, uri):
+        task = self.tasks.pop(uri, None)
+        if task:
+            task.cancel()
+        self.docs.pop(uri, None)
+        self.cost.pop(uri, None)
+        self.linted.pop(uri, None)
+
+    def _changed(self, uri, version, text):
+        if not isinstance(uri, str) or not isinstance(text, str):
+            raise TypeError
+        if uri not in self.docs and len(self.docs) >= SHELLCHECK_MAX_DOCS_PER_CONN:
+            return
+        if len(text) > SHELLCHECK_MAX_DOC_CHARS:
+            # Not checked, so not kept either: reported as having no findings.
+            text = None
+        self.docs[uri] = (version, text)
+        if uri in self.linted and self.linted[uri] == text:
+            return
+        running = self.tasks.pop(uri, None)
+        # The pause before a check is what that document's checks cost: one that
+        # is cheap is checked at once, one that is not waits out a typing burst
+        # rather than burning a core on results the next keystroke discards.
+        delay = self.cost.get(uri, 0)
+        if delay < SHELLCHECK_INSTANT_SECS:
+            delay = 0
+        if running and not running.done():
+            running.cancel()
+            delay = max(delay, SHELLCHECK_INSTANT_SECS)
+        self.tasks[uri] = asyncio.ensure_future(self._lint(uri, version, text, delay))
+
+    async def _lint(self, uri, version, text, delay):
+        if delay:
+            await asyncio.sleep(delay)
+        diagnostics = []
+        if SHELLCHECK_BIN and text is not None:
+            async with _shellcheck_slots:
+                started = time.monotonic()
+                try:
+                    output = await self._run(text)
+                    self.cost[uri] = 0
+                finally:
+                    # A killed check counts too, as a lower bound: it is the only
+                    # measure a document edited faster than it can be checked gets.
+                    if uri in self.docs:
+                        self.cost[uri] = min(
+                            max(time.monotonic() - started, self.cost.get(uri, 0)),
+                            SHELLCHECK_MAX_DEBOUNCE_SECS,
+                        )
+            if output is None:
+                return
+            try:
+                diagnostics = shellcheck_diagnostics(text, output)
+            except (ValueError, KeyError, TypeError) as e:
+                log.warning("shellcheck: unreadable output: %s", e)
+                return
+        if self.docs.get(uri) != (version, text):
+            return
+        self.linted[uri] = text
+        params = {"uri": uri, "diagnostics": diagnostics}
+        if version is not None:
+            params["version"] = version
+        self._send(
+            {
+                "jsonrpc": "2.0",
+                "method": "textDocument/publishDiagnostics",
+                "params": params,
+            }
+        )
+
+    async def _run(self, text):
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                SHELLCHECK_BIN,
+                *SHELLCHECK_ARGS,
+                stdin=asyncio.subprocess.PIPE,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.DEVNULL,
+            )
+        except OSError as e:
+            log.warning("shellcheck: could not start: %s", e)
+            return None
+        try:
+            output, _ = await asyncio.wait_for(
+                proc.communicate(text.encode("utf-8", "replace")),
+                SHELLCHECK_TIMEOUT_SECS,
+            )
+            return output
+        except asyncio.TimeoutError:
+            log.warning("shellcheck: timed out on a %d char document", len(text))
+            return None
+        finally:
+            # Also reached when a newer change cancels this check mid-run.
+            if proc.returncode is None:
+                proc.kill()
+                await proc.wait()
+
 
 class RuffLS(LanguageServerWebSocketHandler):
     procargs = ["ruff", "server"]
@@ -194,18 +410,21 @@ if __name__ == "__main__":
     go_mod_path = os.path.join(monaco_path, "go.mod")
     if not os.path.exists(go_mod_path):
         f = open(go_mod_path, "w")
-        f.write("module mymod\ngo 1.26")
+        f.write("module mymod\ngo 1.27")
         f.close()
 
     # Sync instance-level ruff config into /tmp/monaco/ruff.toml so every
     # spawned `ruff server` picks it up.
     start_ruff_config_poller()
 
+    if not SHELLCHECK_BIN:
+        log.warning("shellcheck is not on PATH: shell scripts will not be linted")
+
     port = int(os.environ.get("PORT", "3001"))
     app = web.Application(
         [
             (r"/ws/pyright", PyrightLS),
-            (r"/ws/diagnostic", DiagnosticLS),
+            (r"/ws/diagnostic", ShellcheckLS),
             (r"/ws/ruff", RuffLS),
             (r"/ws/deno", DenoLS),
             (r"/ws/go", GoLS),
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 0c992ef9c2..e3759ee6a6 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.821.0
+  version: 1.830.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
@@ -145,7 +145,7 @@ components:
               description: Seconds to wait between retries
         exponential:
           type: object
-          description: Retry with exponential backoff (delay doubles each time)
+          description: "Retry with exponential backoff: the n-th retry waits multiplier × seconds^n"
           properties:
             attempts:
               type: integer
@@ -156,7 +156,7 @@ components:
             seconds:
               type: integer
               minimum: 1
-              description: Initial delay in seconds
+              description: Base of the exponential (seconds); the n-th retry waits multiplier × seconds^n, where n counts constant retries too
             random_factor:
               type: integer
               minimum: 0
@@ -376,6 +376,12 @@ components:
         continue_on_error:
           type: boolean
           description: If true, flow continues even if this step fails
+        job_token_scopes:
+          type: array
+          nullable: true
+          items:
+            type: string
+          description: "Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."
         retry:
           description: Retry configuration if this step fails
           $ref: '#/components/schemas/Retry'
@@ -473,6 +479,8 @@ components:
         - togetherai
         - customai
         - aws_bedrock
+        - typesafe
+        - cloudflare
 
     ProviderConfig:
       type: object
@@ -679,6 +687,7 @@ components:
         - $ref: '#/components/schemas/BranchAll'
         - $ref: '#/components/schemas/Identity'
         - $ref: '#/components/schemas/AiAgent'
+        - $ref: '#/components/schemas/AiDecision'
       discriminator:
         propertyName: type
         mapping:
@@ -691,6 +700,7 @@ components:
           branchall: '#/components/schemas/BranchAll'
           identity: '#/components/schemas/Identity'
           aiagent: '#/components/schemas/AiAgent'
+          aidecision: '#/components/schemas/AiDecision'
 
     RawScript:
       type: object
@@ -999,6 +1009,12 @@ components:
         description:
           type: string
           description: Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.
+        job_token_scopes:
+          type: array
+          nullable: true
+          items:
+            type: string
+          description: "Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."
         value:
           $ref: '#/components/schemas/ToolValue'
       required:
@@ -1212,6 +1228,62 @@ components:
         - type
         - input_transforms
 
+    AiDecision:
+      type: object
+      description: |
+        AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's
+        Jev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a
+        state with calibrated probabilities, instead of generating text.
+        Prefer it over an AI agent to classify, route, score or check something: it is fast,
+        cheap and its answers are structured. Its result is { output: { <question name>: answer },
+        model, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on
+        the answers, follow it with a branchone whose branch exprs read
+        results.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent
+        supplies the state.
+      properties:
+        input_transforms:
+          type: object
+          description: Input parameters for the decision mapped to their values
+          properties:
+            # A provider config whose kind is 'typesafe' (model 'jev-latest' unless pinned),
+            # 'cloudflare' (model 'clef' or 'clef-flash') or 'openai' (model 'gpt-6-luna').
+            provider:
+              $ref: '#/components/schemas/ProviderTransform'
+            state:
+              allOf:
+                - $ref: '#/components/schemas/InputTransform'
+              description: |
+                What the questions are asked about: a string, an object or an array of strings.
+                An object with descriptive keys holding only what the questions need works best.
+                Example: { message: flow_input.message, plan: results.a.plan }
+            questions:
+              allOf:
+                - $ref: '#/components/schemas/InputTransform'
+              description: |
+                Object mapping each question name to { type, instructions, criteria }, where type is:
+                - 'choice': criteria maps each option to its description (up to 255); the answer
+                  has choice, probabilities and confidence
+                - 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer
+                  has score, legend, probabilities and confidence
+                - 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has
+                  noul, the probability of yes (0 to 1)
+                Example: { intent: { type: 'choice', instructions: 'What does the customer want?',
+                criteria: { refund: 'Money back', bug: 'Something is broken' } } }
+          required:
+            - provider
+            - state
+            - questions
+        type:
+          type: string
+          enum:
+            - aidecision
+        tag:
+          type: string
+          description: Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)
+      required:
+        - type
+        - input_transforms
+
     Identity:
       type: object
       description: Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 0dc862dff7..8385126639 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.821.0'
+    ModuleVersion     = '1.830.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 86b3e3cc22..411bc09cc8 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.821.0"
+version = "1.830.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill/tests/test_workflow.py b/python-client/wmill/tests/test_workflow.py
index ceed39bfeb..d32ae1458b 100644
--- a/python-client/wmill/tests/test_workflow.py
+++ b/python-client/wmill/tests/test_workflow.py
@@ -7,7 +7,7 @@ import pytest
 
 from datetime import datetime, timezone
 
-from wmill.client import WorkflowCtx, _StepSuspend, TaskError, workflow, task, step, sleep, parallel, wait_for_approval, _run_workflow, _run_workflow_async
+from wmill.client import WorkflowCtx, _StepSuspend, TaskError, workflow, task, task_script, step, sleep, parallel, wait_for_approval, _run_workflow, _run_workflow_async
 
 
 class _FakeItems(dict):
@@ -752,6 +752,84 @@ class TestChildModeParallel:
         assert result["result"] == 8
 
 
+class TestSdkCallsInsideTaskBody:
+    """A task body runs as one child job, so the SDK calls it makes cannot be
+    dispatched as steps of their own."""
+
+    def _run_child(self, wf, key):
+        async def bounded():
+            return await asyncio.wait_for(
+                _run_workflow_async(wf, {"completed_steps": {}, "_executing_key": key}, {}),
+                timeout=2,
+            )
+
+        return asyncio.run(bounded())
+
+    def test_nested_task_and_step_run_in_the_tasks_own_job(self):
+        @task
+        async def inner(x: str):
+            return f"inner:{x}"
+
+        @task
+        def sync_leaf(x: str):
+            return f"sync:{x}"
+
+        # A sync body calls its tasks without awaiting, whatever called it.
+        @task
+        def sync_inner(x: str):
+            return sync_leaf(x).upper().lower()
+
+        @task
+        async def outer(x: str):
+            via_task = await inner(x)
+            via_sync = await sync_inner(x)
+            via_step = await step("s", lambda: "stepped")
+            return f"{via_task}+{via_sync}+{via_step}"
+
+        @workflow
+        async def wf():
+            return await outer("a")
+
+        result = self._run_child(wf, "outer")
+        assert result == {"type": "complete", "result": "inner:a+sync:a+stepped"}
+
+    def test_sibling_task_of_the_workflow_body_is_not_run(self):
+        # The workflow body keeps replaying beside the task body, and its own
+        # calls must stay parked: running them would execute a sibling task in
+        # this job.
+        ran = []
+
+        @task
+        async def inner(x: str):
+            ran.append(x)
+            return x
+
+        @task
+        async def outer(x: str):
+            await asyncio.sleep(0)
+            return await inner("nested")
+
+        @workflow
+        async def wf():
+            return await asyncio.gather(outer("a"), inner("sibling"))
+
+        result = self._run_child(wf, "outer")
+        assert result == {"type": "complete", "result": "nested"}
+        assert ran == ["nested"]
+
+    def test_step_that_would_need_a_dispatch_fails_instead_of_hanging(self):
+        @task
+        async def dispatching():
+            return await task_script("f/other/script")()
+
+        @workflow
+        async def wf():
+            return await dispatching()
+
+        with pytest.raises(RuntimeError, match="cannot be called from inside a task"):
+            self._run_child(wf, "dispatching")
+
+
 class TestKeyDeterminism:
     def test_keys_consistent_across_replays(self):
         r1 = _run_workflow(det_wf, {}, {"n": 3})
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index 81e5b34e16..824db9741f 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -196,12 +196,15 @@ class Windmill:
         args: dict = None,
         scheduled_in_secs: int = None,
         tag: str = None,
+        retry: dict = None,
     ) -> str:
         """Internal helper for running scripts asynchronously."""
         args = args or {}
         params = {"scheduled_in_secs": scheduled_in_secs} if scheduled_in_secs else {}
         if tag:
             params["tag"] = tag
+        if retry:
+            params["retry"] = json.dumps(retry)
         if os.environ.get("WM_JOB_ID"):
             params["parent_job"] = os.environ.get("WM_JOB_ID")
         if os.environ.get("WM_ROOT_FLOW_JOB_ID"):
@@ -222,9 +225,15 @@ class Windmill:
         args: dict = None,
         scheduled_in_secs: int = None,
         tag: str = None,
+        retry: dict = None,
     ) -> str:
-        """Create a script job by path and return its job id."""
-        return self._run_script_async_internal(path=path, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag)
+        """Create a script job by path and return its job id.
+
+        ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+        e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+        the first attempt's; each retry is a job of its own, recorded as a child of it.
+        """
+        return self._run_script_async_internal(path=path, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag, retry=retry)
 
     def run_script_by_hash_async(
         self,
@@ -232,9 +241,10 @@ class Windmill:
         args: dict = None,
         scheduled_in_secs: int = None,
         tag: str = None,
+        retry: dict = None,
     ) -> str:
-        """Create a script job by hash and return its job id."""
-        return self._run_script_async_internal(hash_=hash_, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag)
+        """Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``."""
+        return self._run_script_async_internal(hash_=hash_, args=args, scheduled_in_secs=scheduled_in_secs, tag=tag, retry=retry)
 
     def run_flow_async(
         self,
@@ -813,6 +823,22 @@ class Windmill:
         else:
             return r.json()
 
+    def worker_is_draining(self, job_id: Optional[str] = None) -> bool:
+        """Whether the worker running the job has received its shutdown signal.
+
+        A draining worker waits for its current job to finish before exiting. A long-running
+        script can poll this and return early so the worker can be replaced.
+
+        Args:
+            job_id: Job ID (defaults to current WM_JOB_ID)
+
+        Returns:
+            True if the worker running the job is draining
+        """
+        job_id = job_id or os.environ.get("WM_JOB_ID")
+
+        return self.get(f"/w/{self.workspace}/jobs/worker_is_draining/{job_id}").json()
+
     def set_flow_user_state(self, key: str, value: Any) -> None:
         """Set the user state of a flow at a given key"""
         flow_id = self.get_root_job_id()
@@ -1618,6 +1644,7 @@ def run_script_by_path_async(
     args: Dict[str, Any] = None,
     scheduled_in_secs: Union[None, int] = None,
     tag: str = None,
+    retry: Dict[str, Any] = None,
 ) -> str:
     """Create a script job by path and return its job ID.
 
@@ -1626,6 +1653,8 @@ def run_script_by_path_async(
         args: Script arguments
         scheduled_in_secs: Delay before execution in seconds
         tag: Override the worker tag the job runs on
+        retry: Re-run the job when it fails, with the policy a schedule takes,
+            e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``
 
     Returns:
         Job ID string
@@ -1635,6 +1664,7 @@ def run_script_by_path_async(
         args=args,
         scheduled_in_secs=scheduled_in_secs,
         tag=tag,
+        retry=retry,
     )
 
 
@@ -1644,6 +1674,7 @@ def run_script_by_hash_async(
     args: Dict[str, Any] = None,
     scheduled_in_secs: Union[None, int] = None,
     tag: str = None,
+    retry: Dict[str, Any] = None,
 ) -> str:
     """Create a script job by hash and return its job ID.
 
@@ -1652,6 +1683,7 @@ def run_script_by_hash_async(
         args: Script arguments
         scheduled_in_secs: Delay before execution in seconds
         tag: Override the worker tag the job runs on
+        retry: Re-run the job when it fails, see ``run_script_by_path_async``
 
     Returns:
         Job ID string
@@ -1661,6 +1693,7 @@ def run_script_by_hash_async(
         args=args,
         scheduled_in_secs=scheduled_in_secs,
         tag=tag,
+        retry=retry,
     )
 
 
@@ -2010,6 +2043,17 @@ def get_progress(job_id: Optional[str] = None) -> Any:
     return _client.get_progress(job_id)
 
 
+@init_global_client
+def worker_is_draining(job_id: Optional[str] = None) -> bool:
+    """
+    Whether the worker running this job has received its shutdown signal.
+
+    A draining worker waits for its current job to finish before exiting. A long-running
+    script can poll this and return early so the worker can be replaced.
+    """
+    return _client.worker_is_draining(job_id)
+
+
 def set_shared_state_pickle(value: Any, path="state.pickle") -> None:
     """
     Set the state in the shared folder using pickle
@@ -2722,6 +2766,7 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]:
 
 import asyncio as _asyncio
 import contextvars as _contextvars
+import inspect as _inspect
 import sys as _sys
 import traceback as _traceback
 
@@ -2949,6 +2994,64 @@ _workflow_ctx: _contextvars.ContextVar["WorkflowCtx"] = _contextvars.ContextVar(
     "_workflow_ctx"
 )
 
+# Set while a task body runs in its child job: ``"async"`` or ``"sync"`` after
+# the kind of function the body is. A flag on the ctx cannot stand in: under
+# ``asyncio.gather`` the workflow body keeps replaying beside the task body, and
+# its calls must still park rather than run a sibling task's body in this job.
+_in_task_body: _contextvars.ContextVar[Optional[str]] = _contextvars.ContextVar(
+    "_in_task_body", default=None
+)
+
+
+def _dispatch_ctx() -> "WorkflowCtx | None":
+    """The ctx SDK calls dispatch through, or None where they run in place:
+    outside a workflow, and inside a task body, which is one job and has no
+    rounds of its own to dispatch or checkpoint a step in."""
+    if _in_task_body.get():
+        return None
+    return _workflow_ctx.get(None)
+
+
+async def _resolved(value):
+    return value
+
+
+def _call_in_task_body(func, caller: str, args, kwargs):
+    """Run a task called from inside a task body in place, round-tripping its
+    result as a dispatched one would be.
+
+    The workflow body awaits every task, sync ones included, so an async caller
+    gets an awaitable back either way; a sync caller gets the value. The scope
+    is re-marked for the nested body, which may be of the other kind."""
+
+    async def run_async(coro):
+        token = _in_task_body.set("async")
+        try:
+            return _json_round_trip(await coro)
+        finally:
+            _in_task_body.reset(token)
+
+    if _inspect.iscoroutinefunction(func):
+        return run_async(func(*args, **kwargs))
+    token = _in_task_body.set("sync")
+    try:
+        result = func(*args, **kwargs)
+    finally:
+        _in_task_body.reset(token)
+    if _asyncio.iscoroutine(result):
+        return run_async(result)
+    result = _json_round_trip(result)
+    return _resolved(result) if caller == "async" else result
+
+
+def _assert_not_inside_task_body(what: str) -> None:
+    if _in_task_body.get():
+        raise RuntimeError(
+            f"{what} cannot be called from inside a task: a task runs as a single "
+            "job and cannot suspend or dispatch steps. Call it from the @workflow "
+            "body instead."
+        )
+
 
 class WorkflowCtx:
     """Internal context for workflow replay/suspension.
@@ -3073,15 +3176,20 @@ class WorkflowCtx:
         raise _StepSuspend({"mode": "sleep", "key": key, "seconds": seconds, "steps": []})
 
     async def _resolved(self, value):
-        return value
+        return await _resolved(value)
 
     async def _execute_directly(self, func, **kwargs):
+        token = _in_task_body.set(
+            "async" if _inspect.iscoroutinefunction(func) else "sync"
+        )
         try:
             result = func(**kwargs)
             if _asyncio.iscoroutine(result):
                 result = await result
         except Exception as exc:
             raise _StepFailure(exc) from exc
+        finally:
+            _in_task_body.reset(token)
         raise _StepSuspend({"mode": "step_complete", "steps": [], "result": result})
 
     async def _never_resolve(self):
@@ -3323,7 +3431,9 @@ def task(
 
     - **v2 (inside @workflow)**: dispatches as a checkpoint step.
     - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-    - **Standalone**: executes the function body directly.
+    - **Standalone, or called from inside another v2 task**: executes the
+      function body directly. A task runs as a single job, so the tasks it
+      calls run in that same job, without their own options.
 
     A task runs as its own job, so its result is always encoded as JSON and
     decoded back before the caller sees it: a ``datetime`` comes back as a
@@ -3403,12 +3513,16 @@ def task(
         @functools.wraps(func)
         def wrapper(*args, **kwargs):
             # WAC v2: inside a @workflow context
-            ctx = _workflow_ctx.get(None)
+            ctx = _dispatch_ctx()
             if ctx is not None:
                 script = task_path if task_path else task_name
                 merged = _merge_args(args, kwargs)
                 return ctx._next_step(task_name, script, func, _task_options=_task_opts, **merged)
 
+            caller = _in_task_body.get()
+            if caller is not None:
+                return _call_in_task_body(func, caller, args, kwargs)
+
             # WAC v1: running inside a Windmill job but not in a @workflow
             if (
                 os.environ.get("WM_JOB_ID") is not None
@@ -3487,6 +3601,7 @@ def task_script(
     _opts = {k: v for k, v in {"timeout": timeout, "tag": tag, "cache_ttl": cache_ttl, "priority": priority, "concurrent_limit": concurrency_limit, "concurrency_key": concurrency_key, "concurrency_time_window_s": concurrency_time_window_s, "retry": _checked_retry(retry)}.items() if v is not None} or None
 
     def wrapper(**kwargs):
+        _assert_not_inside_task_body(f'task_script("{path}")')
         ctx = _workflow_ctx.get(None)
         if ctx is not None:
             return ctx._next_step(name, path, dispatch_type="script", _task_options=_opts, **kwargs)
@@ -3526,6 +3641,7 @@ def task_flow(
     _opts = {k: v for k, v in {"timeout": timeout, "tag": tag, "cache_ttl": cache_ttl, "priority": priority, "concurrent_limit": concurrency_limit, "concurrency_key": concurrency_key, "concurrency_time_window_s": concurrency_time_window_s, "retry": _checked_retry(retry)}.items() if v is not None} or None
 
     def wrapper(**kwargs):
+        _assert_not_inside_task_body(f'task_flow("{path}")')
         ctx = _workflow_ctx.get(None)
         if ctx is not None:
             return ctx._next_step(name, path, dispatch_type="flow", _task_options=_opts, **kwargs)
@@ -3560,8 +3676,11 @@ async def step(name: str, fn):
     ``fn``'s result is encoded as JSON and decoded back before it is returned,
     so the round that runs the body sees the same types every replay sees:
     a ``datetime`` comes back as a string, a tuple as a list.
+
+    Called from inside a task body, ``fn`` runs in place and nothing is
+    checkpointed: a task is a single job and is never replayed.
     """
-    ctx: WorkflowCtx | None = _workflow_ctx.get(None)
+    ctx = _dispatch_ctx()
     if ctx is not None:
         return await ctx._run_inline_step(name, fn)
     result = fn()
@@ -3576,9 +3695,9 @@ async def sleep(seconds: int):
     """Server-side sleep — suspend the workflow for the given duration without holding a worker.
 
     Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.
-    Outside a workflow, falls back to ``asyncio.sleep``.
+    Outside a workflow, or inside a task body, falls back to ``asyncio.sleep``.
     """
-    ctx: WorkflowCtx | None = _workflow_ctx.get(None)
+    ctx = _dispatch_ctx()
     if ctx is not None:
         return await ctx._sleep(seconds)
     await _asyncio.sleep(seconds)
@@ -3616,6 +3735,7 @@ async def wait_for_approval(
         await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
         result = await wait_for_approval(key="manager", timeout=3600)
     """
+    _assert_not_inside_task_body("wait_for_approval()")
     ctx: WorkflowCtx | None = _workflow_ctx.get(None)
     if ctx is not None:
         return await ctx._wait_for_approval(
diff --git a/python-client/wmill/wmill/s3_types.py b/python-client/wmill/wmill/s3_types.py
index cd6311692d..1b43b65972 100644
--- a/python-client/wmill/wmill/s3_types.py
+++ b/python-client/wmill/wmill/s3_types.py
@@ -1,6 +1,15 @@
 from typing import Optional
 
 
+def _item_as_attr(d: dict, attr: str):
+    # AttributeError, not KeyError: hasattr, copy and pickle probe optional
+    # attributes and only treat AttributeError as "absent".
+    try:
+        return d[attr]
+    except KeyError:
+        raise AttributeError(attr) from None
+
+
 class S3Object(dict):
     """S3 file reference with file key, optional storage identifier, and presigned token."""
     s3: str
@@ -8,7 +17,7 @@ class S3Object(dict):
     presigned: Optional[str]
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
 
 
 class S3FsClientKwargs(dict):
@@ -16,7 +25,7 @@ class S3FsClientKwargs(dict):
     region_name: str
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
 
 
 class S3FsArgs(dict):
@@ -29,7 +38,7 @@ class S3FsArgs(dict):
     client_kwargs: S3FsClientKwargs
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
 
 
 class StorageOptions(dict):
@@ -41,7 +50,7 @@ class StorageOptions(dict):
     aws_allow_http: str
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
 
 
 class PolarsConnectionSettings(dict):
@@ -50,7 +59,7 @@ class PolarsConnectionSettings(dict):
     storage_options: StorageOptions
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
 
 
 class Boto3ConnectionSettings(dict):
@@ -63,7 +72,7 @@ class Boto3ConnectionSettings(dict):
     aws_session_token: Optional[str]
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
 
 
 class DuckDbConnectionSettings(dict):
@@ -71,4 +80,4 @@ class DuckDbConnectionSettings(dict):
     connection_settings_str: str
 
     def __getattr__(self, attr):
-        return self[attr]
+        return _item_as_attr(self, attr)
diff --git a/rust-client/src/client.rs b/rust-client/src/client.rs
index 451dc58d85..bf47e7e95a 100644
--- a/rust-client/src/client.rs
+++ b/rust-client/src/client.rs
@@ -785,6 +785,7 @@ impl Windmill {
                 None,
                 None,
                 None,
+                None,
             )
             .await?
         } else {
@@ -808,6 +809,7 @@ impl Windmill {
                 None,
                 None,
                 None,
+                None,
             )
             .await?
         };
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index aa70a61e35..a1daf47e32 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -30,7 +30,7 @@ app related commands
 - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement
   - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)
   - `--host <host:string>` - Host to bind the dev server to
-  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
+  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte, index.tsx otherwise)
   - `--no-open` - Don't automatically open the browser
   - `--recording` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability
@@ -41,9 +41,9 @@ app related commands
 - `app new` - create a new raw app from a template
   - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
-  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.
+  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5. Skips the prompt when provided. Triggers non-interactive mode.
   - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.
-  - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.
+  - `--schema <schema:string>` - Schema to use with --datatable. If it doesn't exist yet, a sql_to_apply/ migration (CREATE SCHEMA IF NOT EXISTS) is written for it.
   - `--overwrite` - Overwrite the target directory if it already exists, without prompting.
   - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop.
 - `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace
@@ -124,6 +124,15 @@ Watch local file changes and live-reload the dev page for preview. Does NOT depl
 - `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)
 - `--no-open` - Do not open the browser automatically
 
+### digest
+
+Compute the content digest of local scripts and flows, as the `digest` and `root_digest` claims of job OIDC tokens carry it. Run from the root of a sync checkout, pulled after the deployment's dependency jobs completed: they write the lockfiles the digest covers. A flow also lists the digest of each inline step, as `<flow path>/<step id>`.
+
+**Arguments:** `<paths...:string>`
+
+**Options:**
+- `--json` - Output the digests as JSON
+
 ### docs
 
 Search Windmill documentation.
@@ -718,6 +727,8 @@ user related commands
 
 **Subcommands:**
 
+- `user list` - List the users of the workspace
+  - `--json` - Output as JSON (for piping to jq)
 - `user add <email:string> [password:string]` - Create a user
   - `--superadmin` - Specify to make the new user superadmin.
   - `--company <company:string>` - Specify to set the company of the new user.
diff --git a/system_prompts/auto-generated/flow.md b/system_prompts/auto-generated/flow.md
index c45089c723..e5dd862a3b 100644
--- a/system_prompts/auto-generated/flow.md
+++ b/system_prompts/auto-generated/flow.md
@@ -22,6 +22,7 @@ These are strict Windmill schema rules. Follow them exactly.
 - `preprocessor_module` and `failure_module` only support `script` or `rawscript`
 - `preprocessor_module` runs before normal modules and cannot reference `results.*`
 - `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`
+- A flow whose `failure_module` runs still ends as failed, unless the handler returns an object with `recover: true`: the flow then ends as a success. This also holds when the failing step is inside a loop, a branch or a subflow. `recover` never changes which steps run; whether a loop or branch carries on past a failure is still decided by its own settings (`skip_failures`, `continue_on_error`)
 
 Correct shape:
 
@@ -177,6 +178,98 @@ names, so neither is name-checked at all — leave those summaries as they are.
   whenever the name alone does not make that obvious; it overrides the description derived from the
   underlying script
 
+## AI Decision Modules
+
+An `aidecision` module asks a decision model (TypeSafe's Jev, Cloudflare's Clef or OpenAI's Decisions API) typed questions about a `state` and
+answers each with calibrated probabilities instead of text. Prefer it over an `aiagent` when the step
+is a judgment (classify, route, score or a yes/no check) that needs no tools and no free text: it
+is faster, cheaper, and its answers have a fixed shape.
+
+```json
+{
+  "id": "triage",
+  "summary": "Classify the ticket",
+  "value": {
+    "type": "aidecision",
+    "input_transforms": {
+      "provider": {
+        "type": "static",
+        "value": { "kind": "typesafe", "resource": "$res:f/ai/typesafe", "model": "jev-latest" }
+      },
+      "state": { "type": "javascript", "expr": "flow_input.message" },
+      "questions": {
+        "type": "static",
+        "value": {
+          "intent": {
+            "type": "choice",
+            "instructions": "What does the customer want?",
+            "criteria": { "refund": "Money back", "bug": "Something is broken", "other": "Anything else" }
+          },
+          "urgency": {
+            "type": "score",
+            "instructions": "How urgent is the ticket?",
+            "criteria": ["Can wait", "This week", "Today", "Right now"]
+          },
+          "angry": { "type": "noul", "instructions": "Is the customer angry?" }
+        }
+      }
+    }
+  }
+}
+```
+
+- `provider.kind` is `typesafe` (`model` `jev-latest` unless a version is pinned), `cloudflare`
+  (`model` `clef`, or `clef-flash` for faster answers) or `openai` (`model` `gpt-6-luna`, never a
+  chat model); the resource is of that same type
+- `state` is the content to evaluate: usually a text, such as the message to classify. To combine
+  several values, pass an object with descriptive keys holding only what the questions need
+  (`({ message: flow_input.message, plan: results.get_account.plan })`); an array of strings also works
+- `questions` maps each question name to `{ type, instructions, criteria }`:
+  - `choice`: `criteria` maps each option to its description (up to 255 options). The answer has
+    `choice`, `probabilities` and `confidence`
+  - `score`: `criteria` is an ordered array of 2 to 10 level descriptions. The answer has `score`,
+    `legend`, `probabilities` and `confidence`
+  - `noul`: yes/no, `criteria` optionally `{ "true": ..., "false": ... }` descriptions. The answer has
+    `noul`, the probability of yes from 0 to 1
+- The result is `{ output, model, usage }` with `output` keyed by question name, so a later step
+  reads `results.triage.output.intent.choice`, `results.triage.output.urgency.score` or
+  `results.triage.output.angry.noul > 0.7`
+- On `openai` the same `questions` are translated for its Decisions API and the answers read the
+  same way (`choice`, `score`, `noul`), except that `probabilities` is a list of
+  `{ value, probability }` (plus `label` on a score) and a score has no `legend`. A question OpenAI
+  refuses to answer fails the step. A `state` that is
+  an array of user messages (`[{ role: "user", content: [{ type: "input_text", text }, { type: "input_image", image_url: "data:image/png;base64,..." }] }]`)
+  is sent as is, which is how an image is evaluated; any other object or array is sent as JSON text
+
+### Branching on the Answers
+
+To route on the answers, put a `branchone` right after the decision, one branch per option, with
+each `expr` reading the decision by id:
+
+```json
+{
+  "id": "route",
+  "value": {
+    "type": "branchone",
+    "branches": [
+      { "summary": "refund", "expr": "results.triage.output.intent.choice === 'refund'", "modules": [...] },
+      { "summary": "bug", "expr": "results.triage.output.intent.choice === 'bug'", "modules": [...] }
+    ],
+    "default": [...]
+  }
+}
+```
+
+For a yes/no question, one branch with `"expr": "results.triage.output.angry.noul >= 0.5"` (tune the
+threshold as needed) and the `default` as the "no" path.
+
+### As an Agent Tool
+
+An `aidecision` can be a `flowmodule` tool of an `aiagent` (`"tool_type": "flowmodule", "type":
+"aidecision"`): set `state` to `{ "type": "ai" }` so the calling model supplies it, and only `output`
+goes back to the model. The Tool Naming Rules apply to its `summary`. Only a flow's own agent step
+can call one, not an agent used as a tool.
+
 ## Common Mistakes to Avoid
 
 - Missing `input_transforms` - Rawscript parameters won't receive values without them
@@ -191,6 +284,10 @@ names, so neither is name-checked at all — leave those summaries as they are.
 - `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope
 - `flow_input.iter.value` - Current iteration value inside a `forloopflow`; in a `whileloopflow` it is just the iteration index (a plain number, same as `flow_input.iter.index`)
 - `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - `resume` - the last resume payload (the resume form values); with `continue_on_disapprove_timeout`, a disapproval or timeout yields `{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }` instead
+  - `resumes` - every resume payload, in arrival order
+  - `approvers` - a plain array of strings, one per resume: for a resume through the `resume`/`cancel` URL from `getResumeUrls(approver)`, the `approver` passed there if any; otherwise (including the `approvalPage` link) the resuming user's username, else `"anonymous"`, e.g. `approvers[0]`. It is NOT the `{ resume_id, approver }` objects stored in the flow status, so `approvers[0].approver` is always undefined
 
 ## Loop Structure Rules
 
@@ -406,6 +503,10 @@ Unless the user asked for new code, look for a workspace script or flow that alr
 
 The step's `input_transforms` must cover the reused item's inputs, so read its input schema first.
 
+## Additional Prompt for AI
+
+A flow's input schema may carry a top-level `prompt_for_ai` string, as a script's can: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that flow, and keep it when you rewrite the schema.
+
 ## Organizing Flows: Groups and Notes
 
 Groups and notes shape how a flow reads in the editor; neither changes what it does.
@@ -497,4 +598,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 7e0eed5ca7..c3310351b7 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -8,6 +8,7 @@ export const SCRIPT_BASE = `# Windmill Script Writing Guide
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it \`main\` (\`Main\` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no \`main\`: their language section shows how they take arguments
 - Where the language has a Windmill client (\`wmill\`), use it to interact with the platform
+- A script's input schema may carry a top-level \`prompt_for_ai\` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -48,6 +49,7 @@ These are strict Windmill schema rules. Follow them exactly.
 - \`preprocessor_module\` and \`failure_module\` only support \`script\` or \`rawscript\`
 - \`preprocessor_module\` runs before normal modules and cannot reference \`results.*\`
 - \`failure_module\` can use the \`error\` object with \`error.message\`, \`error.step_id\`, \`error.name\`, and \`error.stack\`
+- A flow whose \`failure_module\` runs still ends as failed, unless the handler returns an object with \`recover: true\`: the flow then ends as a success. This also holds when the failing step is inside a loop, a branch or a subflow. \`recover\` never changes which steps run; whether a loop or branch carries on past a failure is still decided by its own settings (\`skip_failures\`, \`continue_on_error\`)
 
 Correct shape:
 
@@ -203,6 +205,98 @@ names, so neither is name-checked at all — leave those summaries as they are.
   whenever the name alone does not make that obvious; it overrides the description derived from the
   underlying script
 
+## AI Decision Modules
+
+An \`aidecision\` module asks a decision model (TypeSafe's Jev, Cloudflare's Clef or OpenAI's Decisions API) typed questions about a \`state\` and
+answers each with calibrated probabilities instead of text. Prefer it over an \`aiagent\` when the step
+is a judgment (classify, route, score or a yes/no check) that needs no tools and no free text: it
+is faster, cheaper, and its answers have a fixed shape.
+
+\`\`\`json
+{
+  "id": "triage",
+  "summary": "Classify the ticket",
+  "value": {
+    "type": "aidecision",
+    "input_transforms": {
+      "provider": {
+        "type": "static",
+        "value": { "kind": "typesafe", "resource": "$res:f/ai/typesafe", "model": "jev-latest" }
+      },
+      "state": { "type": "javascript", "expr": "flow_input.message" },
+      "questions": {
+        "type": "static",
+        "value": {
+          "intent": {
+            "type": "choice",
+            "instructions": "What does the customer want?",
+            "criteria": { "refund": "Money back", "bug": "Something is broken", "other": "Anything else" }
+          },
+          "urgency": {
+            "type": "score",
+            "instructions": "How urgent is the ticket?",
+            "criteria": ["Can wait", "This week", "Today", "Right now"]
+          },
+          "angry": { "type": "noul", "instructions": "Is the customer angry?" }
+        }
+      }
+    }
+  }
+}
+\`\`\`
+
+- \`provider.kind\` is \`typesafe\` (\`model\` \`jev-latest\` unless a version is pinned), \`cloudflare\`
+  (\`model\` \`clef\`, or \`clef-flash\` for faster answers) or \`openai\` (\`model\` \`gpt-6-luna\`, never a
+  chat model); the resource is of that same type
+- \`state\` is the content to evaluate: usually a text, such as the message to classify. To combine
+  several values, pass an object with descriptive keys holding only what the questions need
+  (\`({ message: flow_input.message, plan: results.get_account.plan })\`); an array of strings also works
+- \`questions\` maps each question name to \`{ type, instructions, criteria }\`:
+  - \`choice\`: \`criteria\` maps each option to its description (up to 255 options). The answer has
+    \`choice\`, \`probabilities\` and \`confidence\`
+  - \`score\`: \`criteria\` is an ordered array of 2 to 10 level descriptions. The answer has \`score\`,
+    \`legend\`, \`probabilities\` and \`confidence\`
+  - \`noul\`: yes/no, \`criteria\` optionally \`{ "true": ..., "false": ... }\` descriptions. The answer has
+    \`noul\`, the probability of yes from 0 to 1
+- The result is \`{ output, model, usage }\` with \`output\` keyed by question name, so a later step
+  reads \`results.triage.output.intent.choice\`, \`results.triage.output.urgency.score\` or
+  \`results.triage.output.angry.noul > 0.7\`
+- On \`openai\` the same \`questions\` are translated for its Decisions API and the answers read the
+  same way (\`choice\`, \`score\`, \`noul\`), except that \`probabilities\` is a list of
+  \`{ value, probability }\` (plus \`label\` on a score) and a score has no \`legend\`. A question OpenAI
+  refuses to answer fails the step. A \`state\` that is
+  an array of user messages (\`[{ role: "user", content: [{ type: "input_text", text }, { type: "input_image", image_url: "data:image/png;base64,..." }] }]\`)
+  is sent as is, which is how an image is evaluated; any other object or array is sent as JSON text
+
+### Branching on the Answers
+
+To route on the answers, put a \`branchone\` right after the decision, one branch per option, with
+each \`expr\` reading the decision by id:
+
+\`\`\`json
+{
+  "id": "route",
+  "value": {
+    "type": "branchone",
+    "branches": [
+      { "summary": "refund", "expr": "results.triage.output.intent.choice === 'refund'", "modules": [...] },
+      { "summary": "bug", "expr": "results.triage.output.intent.choice === 'bug'", "modules": [...] }
+    ],
+    "default": [...]
+  }
+}
+\`\`\`
+
+For a yes/no question, one branch with \`"expr": "results.triage.output.angry.noul >= 0.5"\` (tune the
+threshold as needed) and the \`default\` as the "no" path.
+
+### As an Agent Tool
+
+An \`aidecision\` can be a \`flowmodule\` tool of an \`aiagent\` (\`"tool_type": "flowmodule", "type":
+"aidecision"\`): set \`state\` to \`{ "type": "ai" }\` so the calling model supplies it, and only \`output\`
+goes back to the model. The Tool Naming Rules apply to its \`summary\`. Only a flow's own agent step
+can call one, not an agent used as a tool.
+
 ## Common Mistakes to Avoid
 
 - Missing \`input_transforms\` - Rawscript parameters won't receive values without them
@@ -217,6 +311,10 @@ names, so neither is name-checked at all — leave those summaries as they are.
 - \`results.step_id.property\` - Access specific property from a previous step output only when that step result is in scope
 - \`flow_input.iter.value\` - Current iteration value inside a \`forloopflow\`; in a \`whileloopflow\` it is just the iteration index (a plain number, same as \`flow_input.iter.index\`)
 - \`flow_input.iter.index\` - Current loop index when inside a loop (\`forloopflow\` or \`whileloopflow\`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - \`resume\` - the last resume payload (the resume form values); with \`continue_on_disapprove_timeout\`, a disapproval or timeout yields \`{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }\` instead
+  - \`resumes\` - every resume payload, in arrival order
+  - \`approvers\` - a plain array of strings, one per resume: for a resume through the \`resume\`/\`cancel\` URL from \`getResumeUrls(approver)\`, the \`approver\` passed there if any; otherwise (including the \`approvalPage\` link) the resuming user's username, else \`"anonymous"\`, e.g. \`approvers[0]\`. It is NOT the \`{ resume_id, approver }\` objects stored in the flow status, so \`approvers[0].approver\` is always undefined
 
 ## Loop Structure Rules
 
@@ -432,6 +530,10 @@ Unless the user asked for new code, look for a workspace script or flow that alr
 
 The step's \`input_transforms\` must cover the reused item's inputs, so read its input schema first.
 
+## Additional Prompt for AI
+
+A flow's input schema may carry a top-level \`prompt_for_ai\` string, as a script's can: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that flow, and keep it when you rewrite the schema.
+
 ## Organizing Flows: Groups and Notes
 
 Groups and notes shape how a flow reads in the editor; neither changes what it does.
@@ -788,7 +890,7 @@ def main(db: postgresql):
 
 export const RAW_APP_BASE = `# Windmill Raw Apps
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+Raw apps let you build custom frontends with React or Svelte that connect to Windmill backend runnables and datatables.
 
 ## App shape
 
@@ -798,11 +900,46 @@ A raw app has three logical parts:
 - **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
 - **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
 
+## Starting a new app
+
+A new app gets the setup Windmill's own new-app dialog gives one: a framework, then where its data lives.
+
+### Framework
+
+Use the framework the user named. When they named none, follow what there is to follow: the app being edited, or the apps the request points at. With nothing to follow, use **React 19**, the recommended default, **without asking**. React 18 and Svelte 5 are for when they are asked for. These three are the only frameworks the raw app bundler builds. When the user asks to build or convert an app in another framework, write no code in it: say it is not available and offer these three instead.
+
+### Data setup
+
+When a new app has to store data and the user did not say where, **ask before creating anything**: no app, no schema, no table. Where the data lives is the user's decision, and tables created in the wrong place stay there. Look up the workspace's data tables first so every choice you offer exists, then ask, as proposed answers rather than open questions:
+
+1. **Data table**: which one to use, the default first (\`main\` when it exists, otherwise the first listed). Skip this one when the workspace has a single data table.
+2. **Schema**: where the app's new tables go.
+   - A **new schema**, the usual choice, offered first. Suggest the first unused name among \`app1\`, \`app2\`, …
+   - An **existing schema** of that data table, by name.
+   - **None**: the tables go in \`public\`.
+3. **Tables**: only when that data table already holds tables the app could use, whether to **reuse** them (name them) or **create new ones**.
+
+Do not ask when:
+
+- the user already said where the data goes. A part they left out takes its default above: the default data table, a new \`appN\` schema, new tables;
+- the app, or its saved draft, already carries a data config (\`data.datatable\`, \`data.schema\` or \`data.tables\`). That config is the answer;
+- the app stores nothing.
+
+With no data table in the workspace there is nothing to choose: say that one has to be configured in the workspace settings before the app can store data.
+
+A question left unanswered or dismissed is not a go-ahead for the defaults: stop there and say what is still needed.
+
+Then build what was chosen: the data table and schema become the app's \`data.datatable\` and \`data.schema\`, the tables it uses, reused or new, go in \`data.tables\`, and a new schema is created (\`CREATE SCHEMA IF NOT EXISTS\`) before the tables that go in it.
+
+### An app that arrives already set up
+
+An app the user just started from the new-app dialog is already set up: its files are the framework template it was started with, and a \`data\` config it carries (\`data.datatable\`, \`data.schema\` or \`data.tables\`) is the data setup it was started with. Build that app in place, with that data config, and in that framework unless the user now names another. Do not ask for either, and do not create a second app. Only when it carries no data config and has to store data is the data setup still to ask.
+
 ## Frontend
 
 ### Entrypoint
 
-The entrypoint is \`index.tsx\` for React and \`index.ts\` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty \`<div id="root">\` and auto-renders nothing, so the entrypoint must mount a top-level \`App\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` / \`App.vue\` and keep the entrypoint as the mount shim.
+The entrypoint is \`index.tsx\` for React and \`index.ts\` for Svelte. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty \`<div id="root">\` and auto-renders nothing, so the entrypoint must mount a top-level \`App\` itself. Keep the UI in \`App.tsx\` / \`App.svelte\` and keep the entrypoint as the mount shim.
 
 React (\`index.tsx\`):
 
@@ -814,7 +951,7 @@ import App from './App'
 createRoot(document.getElementById('root')!).render(<App />)
 \`\`\`
 
-Svelte (\`index.ts\`): \`mount(App, { target: document.getElementById('root')! })\`. Vue (\`index.ts\`): \`createApp(App).mount('#root')\`.
+Svelte (\`index.ts\`): \`mount(App, { target: document.getElementById('root')! })\`.
 
 **Never replace the entrypoint with a bare component** (\`export default function App() { ... }\` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts \`App\` into \`#root\`.
 
@@ -887,16 +1024,16 @@ Apply it to customer data, internal notes and anything else a viewer of the demo
 
 ### Chat UIs over a flow in chat mode
 
-A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add \`windmill-chat\` to \`package.json\` and use it directly, it detects the app's Windmill and credential.
+A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add \`@windmill-labs/chat-sdk\` to \`package.json\` and use it directly, it detects the app's Windmill and credential.
 
 \`\`\`tsx
-import { useWindmillChat } from 'windmill-chat/react'
+import { useWindmillChat } from '@windmill-labs/chat-sdk/react'
 
 const chat = useWindmillChat({ flowPath: 'f/support/assistant' })
 // chat.messages ({ role, content, pending, success, tool? }), chat.status, chat.sendMessage(text), chat.stop()
 \`\`\`
 
-\`windmill-chat/ai-sdk\` gives a \`ChatTransport\` for the Vercel AI SDK's \`useChat\`, \`windmill-chat/assistant-ui\` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs \`jobs:run\` in its frontend SDK scopes, plus \`flow_conversations:write\` for the conversation sidebar; without them the chat keeps history in the browser.
+\`@windmill-labs/chat-sdk/ai-sdk\` gives a \`ChatTransport\` for the Vercel AI SDK's \`useChat\`, \`@windmill-labs/chat-sdk/assistant-ui\` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs \`jobs:run\` in its frontend SDK scopes, plus \`flow_conversations:write\` for the conversation sidebar; without them the chat keeps history in the browser.
 
 ## Backend runnables
 
@@ -979,6 +1116,10 @@ A draft app is reachable by nobody; deploying is what exposes it, and its backen
 Either one lets those people run the app's backend runnables, so never open an app up unless the user asks.
 When a deploy widens who may open the app, tell the user in plain words.
 
+## Sandbox isolation and frontend API access
+
+By default a deployed app's frontend runs with the viewer's own Windmill session. A sandboxed app is isolated from it: the frontend reaches Windmill only through its backend runnables, plus whatever frontend API scopes the app declares, which each viewer approves before the app runs. The scopes are \`jobs:run\`, \`jobs:read\`, \`users:read\`, \`resources:read\`, \`variables:read\`, \`flow_conversations:read\` and \`flow_conversations:write\`; grant only the ones the frontend calls.
+
 ## Data Tables
 
 Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the \`wmill\` client; the frontend never queries them directly. **When the app needs to store or persist data** (user data, settings, application state, records, logs), use a data table.
@@ -990,6 +1131,7 @@ Data tables are PostgreSQL databases managed by Windmill. Backend runnables quer
 3. **No DDL inside runnables**: runnables only read and write rows (SELECT, INSERT, UPDATE, DELETE) on existing tables. Never CREATE, ALTER or DROP a table from a runnable.
 4. **Qualify table names**: an unqualified name means the \`public\` schema, so write every other table as \`schema.table\`, in table creation and queries alike. The app's \`data\` config sets the default datatable and schema its tables go in; use them consistently across runnables.
 5. **Pass the role**: when the app's \`data.roles\` gives a data table a role, every \`wmill.datatable\` call on it passes that role (\`wmill.datatable('main', { role: 'analyst' })\` in TypeScript, \`wmill.datatable('main', role='analyst')\` in Python). The role only reaches what it was granted, so a query outside it fails with \`permission denied\`.
+6. **Per-viewer rows**: a data table with no entry in \`data.roles\` is called with no role. Unless its default role is \`admin\`, the connection then holds the default role, if it has one, plus every role the person using the app is a tenant of, and is refused when that is none. Row-level security policies written as \`pg_has_role(current_user, '<role>', 'member')\` return that viewer's rows with nothing added to the runnable. A role pins the connection to that one role for every viewer, so where rows should differ per viewer give the data table no \`data.roles\` entry.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -1041,7 +1183,7 @@ def main(user_id: str):
 7. **Mark sensitive UI with \`data-wm-no-record\`** — it is what keeps that data out of a recorded demo; passwords are handled for you.
 8. **Reach for \`backendAsync\` + \`waitJob\`** for long work — never a hand-written job-polling runnable.
 9. **Deploy what a path runnable points at** — a path runnable aimed at a draft fails at runtime; tell the user what needs deploying.
-10. **Use \`windmill-chat\` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
+10. **Use \`@windmill-labs/chat-sdk\` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
 `;
 
 export const PIPELINE_BASE = `# Data pipeline authoring
@@ -1053,10 +1195,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **\`duckdb\`** node that materializes its output into a **DuckLake** table with \`-- materialize ducklake://<name>/<table>\` (in a DuckDB node the annotation uses SQL \`--\` comment syntax; write the body as a bare \`SELECT\` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - \`postgresql\` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- \`bun\` / \`python3\` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- \`bun\` / \`python3\` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with \`wmill.ducklake()\`, or into a data table with \`wmill.datatable()\`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+\`\`\`python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+\`\`\`
+
+\`\`\`ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake\`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(\${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)\`.fetch()
+}
+\`\`\`
+
+- Use \`INSERT INTO <table> SELECT ...\` instead of \`CREATE OR REPLACE\` to append (an incremental pull), with a one-time \`CREATE TABLE IF NOT EXISTS\` first.
+- Assign the client to a variable (\`lake = wmill.ducklake()\`) and keep the SQL a **string literal** (Python) or a template without \`sql.raw\` (TS): that is what lets the graph record the node's write to \`ducklake://main/<table>\`. A chained \`wmill.ducklake().query(...)\` or SQL built in a variable records no output, so the downstream edge never forms.
+- \`wmill.ducklake("<name>")\` targets a non-default catalog; \`wmill.datatable("<name>")\` writes a Postgres data table the same way (Python \`db.query(sql, *args)\` with \`$1\` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: \`-- on ducklake://main/stripe_charges\`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and \`s3://\` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -1099,7 +1279,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the output via the SDK (\`wmill.writeS3File(...)\`, ducklake helpers, …) and let it be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
+> **A MANAGED \`// materialize\` is DuckDB-only**, and its target must be a DuckLake table (\`ducklake://<name>/<table>\`). Deploy **rejects** a \`ducklake://\` \`// materialize\` on any other language (\`python3\`, \`bun\`, \`postgresql\`). For a non-DuckDB node writing the lake, do **not** use \`// materialize\` — write the table itself with \`wmill.ducklake()\` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use \`duckdb\` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, where \`<warehouse>\` is a warehouse the workspace configures under Settings → dbt. \`manual\` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql \`CREATE TABLE\` / \`INSERT\`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a \`source\`: the declared relation and the dbt model land on ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when the ingestion node completes.
 
@@ -1252,6 +1432,8 @@ async def enrich(customer_id: str):
 
 In TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with \`@task()\` or \`@task\`.
 
+Only the workflow body dispatches steps. A task runs as a single job, so a task or \`step()\` called from inside a task body runs in place in that job, as a plain function call: no child job, no checkpoint, and its task options (retry, timeout, tag) do not apply. \`sleep()\` there waits in the job, and \`taskScript()\` / \`taskFlow()\` / \`waitForApproval()\` (\`task_script()\` / \`task_flow()\` / \`wait_for_approval()\`) throw. To get separate jobs, call the tasks one after another from the workflow body and pass results between them.
+
 For existing scripts:
 
 \`\`\`typescript
@@ -1515,21 +1697,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   \`{ scheduledInSeconds?, tag?, retry? }\`, e.g. \`{ retry: { constant: { attempts: 3, seconds: 10 } } }\`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -1585,6 +1769,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -1844,6 +2036,9 @@ async sleep(seconds: number): Promise<void>
  * \`fn\`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a \`Date\`
  * comes back as a string, a \`Map\` as \`{}\`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, \`fn\` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -2077,10 +2272,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# \`\`retry\`\` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. \`\`{"constant": {"attempts": 3, "seconds": 10}}\`\`. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See \`\`run_script_by_path_async\`\` for \`\`retry\`\`.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -2253,6 +2452,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -2670,7 +2881,9 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 # 
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a \`\`datetime\`\` comes back as a
@@ -2756,12 +2969,15 @@ def workflow(func)
 # \`\`fn\`\`'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a \`\`datetime\`\` comes back as a string, a tuple as a list.
+# 
+# Called from inside a task body, \`\`fn\`\` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 # 
 # Inside a @workflow, the parent job suspends and auto-resumes after \`\`seconds\`\`.
-# Outside a workflow, falls back to \`\`asyncio.sleep\`\`.
+# Outside a workflow, or inside a task body, falls back to \`\`asyncio.sleep\`\`.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
@@ -2883,8 +3099,9 @@ export async function getResumeUrls(approver?: string, flowLevel?: boolean): Pro
  * const call_api = task(fetchOrders, { retry: { attempts: 3, delay: 30, multiplier: 2 } });
  *
  * Inside a \`workflow()\`, calling a task dispatches it as a step.
- * Outside a workflow, the function body executes directly and
- * {@link TaskOptions} — retry included — does not apply.
+ * Outside a workflow, or called from inside another task, the function body
+ * executes directly and {@link TaskOptions} — retry included — does not apply:
+ * a task runs as a single job, so the tasks it calls run in that same job.
  *
  * A task runs as its own job, so its result is always encoded as JSON and
  * decoded back before the caller sees it: a \`Date\` comes back as a string, a
@@ -2928,6 +3145,9 @@ export function workflow<T>(fn: (...args: any[]) => Promise<T>)
  * \`fn\`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a \`Date\`
  * comes back as a string, a \`Map\` as \`{}\`. {@link Jsonified} is that shape.
+ *
+ * Called from inside a task body, \`fn\` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 export async function step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -3026,7 +3246,9 @@ def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 #
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 #
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a \`\`datetime\`\` comes back as a
@@ -3112,12 +3334,15 @@ def workflow(func)
 # \`\`fn\`\`'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a \`\`datetime\`\` comes back as a string, a tuple as a list.
+#
+# Called from inside a task body, \`\`fn\`\` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 #
 # Inside a @workflow, the parent job suspends and auto-resumes after \`\`seconds\`\`.
-# Outside a workflow, falls back to \`\`asyncio.sleep\`\`.
+# Outside a workflow, or inside a task body, falls back to \`\`asyncio.sleep\`\`.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
@@ -3342,7 +3567,7 @@ class SqlQuery:
 
 export const OPENFLOW_SCHEMA = `## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \\u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \\u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\\n\`memory_id\`). Without a memory id the agent runs without memory.\\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the \`memory_id\` here.\\nThe step's own \`memory_id\` is not read while this kind is set; switch the kind to \`window\`\\nto use it. Without a \`context_length\`, or with 0, it is \`off\` and reads \`previous_messages\`.\\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's \`memory_id\`), replacing\\nits older part with a summary as the conversation approaches the model's context window.\\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\\nWindmill does not know needs one; those fall back to 128000.\\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to \`off\` with \`previous_messages\` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see \`memory_id\`. While it is off, a step can supply its history in \`previous_messages\`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\\nflow.input syntax. Required unless memory is off and \`previous_messages\` supplies\\nthe prompt; image output always needs it.\\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\\nwas started with (the chat conversation, an app chat session or the \`memory_id\` run\\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\\nacross every run; an expression such as \`flow_input.customer_id\` keeps one memory per\\nkey. When it evaluates to an empty value the agent runs without memory. Read only\\nwhile \`memory\` is \`window\` or \`compaction\`: it is ignored when memory is off, and an\\nolder \`auto\` or \`manual\` memory reads neither history input.\\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\\nand the user message. Read only while \`memory\` is off or absent: managed memory\\nignores it, and an older \`auto\` or \`manual\` memory reads neither history input.\\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in \`tools\` the agent may call\\nthis run. Leaving it unset carries every one of them; an empty array carries none.\\nA tool is named as the model is shown it. An entry the model is shown nothing of is\\nnamed by what identifies it instead: an MCP server by its resource path, carrying\\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\\n(no tool may take that name).\\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\\nstate with calibrated probabilities, instead of generating text.\\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\\nthe answers, follow it with a branchone whose branch exprs read\\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\\nsupplies the state.\\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\\nAn object with descriptive keys holding only what the questions need works best.\\nExample: { message: flow_input.message, plan: results.a.plan }\\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\\n- 'choice': criteria maps each option to its description (up to 255); the answer\\n  has choice, probabilities and confidence\\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\\n  has score, legend, probabilities and confidence\\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\\n  noul, the probability of yes (0 to 1)\\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default \`flow\`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
 
 export const CLI_COMMANDS = `# Windmill CLI Commands
 
@@ -3376,7 +3601,7 @@ app related commands
 - \`app dev [app_folder:string]\` - Start a development server for building apps with live reload and hot module replacement
   - \`--port <port:number>\` - Port to run the dev server on (will find next available port if occupied)
   - \`--host <host:string>\` - Host to bind the dev server to
-  - \`--entry <entry:string>\` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
+  - \`--entry <entry:string>\` - Entry point file (default: index.ts for Svelte, index.tsx otherwise)
   - \`--no-open\` - Don't automatically open the browser
   - \`--recording\` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - \`app lint [app_folder:string]\` - Lint a raw app folder to validate structure and buildability
@@ -3387,9 +3612,9 @@ app related commands
 - \`app new\` - create a new raw app from a template
   - \`--summary <summary:string>\` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - \`--path <path:string>\` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
-  - \`--framework <framework:string>\` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.
+  - \`--framework <framework:string>\` - Framework template: react19 | react18 | svelte5. Skips the prompt when provided. Triggers non-interactive mode.
   - \`--datatable <datatable:string>\` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.
-  - \`--schema <schema:string>\` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.
+  - \`--schema <schema:string>\` - Schema to use with --datatable. If it doesn't exist yet, a sql_to_apply/ migration (CREATE SCHEMA IF NOT EXISTS) is written for it.
   - \`--overwrite\` - Overwrite the target directory if it already exists, without prompting.
   - \`--no-open-in-desktop\` - Do not prompt to open the new app in Claude Desktop.
 - \`app generate-agents [app_folder:string]\` - regenerate AGENTS.md and DATATABLES.md from remote workspace
@@ -3470,6 +3695,15 @@ Watch local file changes and live-reload the dev page for preview. Does NOT depl
 - \`--path <path:string>\` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)
 - \`--no-open\` - Do not open the browser automatically
 
+### digest
+
+Compute the content digest of local scripts and flows, as the \`digest\` and \`root_digest\` claims of job OIDC tokens carry it. Run from the root of a sync checkout, pulled after the deployment's dependency jobs completed: they write the lockfiles the digest covers. A flow also lists the digest of each inline step, as \`<flow path>/<step id>\`.
+
+**Arguments:** \`<paths...:string>\`
+
+**Options:**
+- \`--json\` - Output the digests as JSON
+
 ### docs
 
 Search Windmill documentation.
@@ -4064,6 +4298,8 @@ user related commands
 
 **Subcommands:**
 
+- \`user list\` - List the users of the workspace
+  - \`--json\` - Output as JSON (for piping to jq)
 - \`user add <email:string> [password:string]\` - Create a user
   - \`--superadmin\` - Specify to make the new user superadmin.
   - \`--company <company:string>\` - Specify to set the company of the new user.
@@ -5584,6 +5820,27 @@ Name the parameters by adding comments before the statement:
 SELECT * FROM users WHERE name = ? AND age > ?;
 \`\`\`
 
+## Array parameters
+
+Declare a list with a \`[]\` suffix on the element type (\`(varchar[])\`,
+\`(int[])\`), or \`(array)\` for an untyped one. Snowflake cannot bind an array
+directly, so Windmill binds the list as JSON text: wrap the placeholder with
+\`PARSE_JSON(?)\`, and cast to \`ARRAY\` where a function expects one.
+
+\`\`\`sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+WHERE ARRAY_CONTAINS(o.owner_group::VARIANT, PARSE_JSON(?)::ARRAY);
+\`\`\`
+
+Or join on the elements with \`FLATTEN\`:
+
+\`\`\`sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+JOIN TABLE(FLATTEN(input => PARSE_JSON(?))) g ON g.value::STRING = o.owner_group;
+\`\`\`
+
 ## Receiving an S3Object as a script parameter
 
 Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
diff --git a/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml b/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
index 70a955d16d..5d5b0f8a0d 100644
--- a/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/amqp_trigger.schema.yaml
@@ -84,7 +84,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -95,7 +96,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml b/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
index d21d006e8d..e57c92ebc3 100644
--- a/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
@@ -71,7 +71,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -82,7 +83,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/email_trigger.schema.yaml b/system_prompts/auto-generated/schemas/email_trigger.schema.yaml
index 1d4e81ac2c..79786fc8db 100644
--- a/system_prompts/auto-generated/schemas/email_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/email_trigger.schema.yaml
@@ -54,7 +54,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -65,7 +66,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml b/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml
index f35b33ad74..6755d6545c 100644
--- a/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/gcp_trigger.schema.yaml
@@ -94,7 +94,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -105,7 +106,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/http_trigger.schema.yaml b/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
index f484366783..b428fbf390 100644
--- a/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
@@ -133,7 +133,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -144,7 +145,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml b/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml
index 09217692e5..6549ce1b10 100644
--- a/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/kafka_trigger.schema.yaml
@@ -135,7 +135,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -146,7 +147,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml b/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml
index 2801cc9a73..f167e2965f 100644
--- a/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/mqtt_trigger.schema.yaml
@@ -96,7 +96,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -107,7 +108,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml b/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml
index 239d568fcc..e7620683e6 100644
--- a/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/nats_trigger.schema.yaml
@@ -70,7 +70,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -81,7 +82,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml b/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml
index be196a7bc3..79cca28595 100644
--- a/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/postgres_trigger.schema.yaml
@@ -63,7 +63,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -74,7 +75,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/schedule.schema.yaml b/system_prompts/auto-generated/schemas/schedule.schema.yaml
index d0ea85d6fe..7097be7d25 100644
--- a/system_prompts/auto-generated/schemas/schedule.schema.yaml
+++ b/system_prompts/auto-generated/schemas/schedule.schema.yaml
@@ -69,7 +69,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -80,7 +81,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml b/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml
index 4f41c32421..32d6400973 100644
--- a/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/sqs_trigger.schema.yaml
@@ -69,7 +69,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -80,7 +81,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml b/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml
index 780b0f2245..8184d3815a 100644
--- a/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/websocket_trigger.schema.yaml
@@ -172,7 +172,8 @@ properties:
             description: Seconds to wait between retries
       exponential:
         type: object
-        description: Retry with exponential backoff (delay doubles each time)
+        description: 'Retry with exponential backoff: the n-th retry waits multiplier
+          × seconds^n'
         properties:
           attempts:
             type: integer
@@ -183,7 +184,8 @@ properties:
           seconds:
             type: integer
             minimum: 1
-            description: Initial delay in seconds
+            description: Base of the exponential (seconds); the n-th retry waits multiplier
+              × seconds^n, where n counts constant retries too
           random_factor:
             type: integer
             minimum: 0
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index 46ae438164..d178ddb6c0 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -6,6 +6,7 @@
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -1408,6 +1409,27 @@ Name the parameters by adding comments before the statement:
 SELECT * FROM users WHERE name = ? AND age > ?;
 ```
 
+## Array parameters
+
+Declare a list with a `[]` suffix on the element type (`(varchar[])`,
+`(int[])`), or `(array)` for an untyped one. Snowflake cannot bind an array
+directly, so Windmill binds the list as JSON text: wrap the placeholder with
+`PARSE_JSON(?)`, and cast to `ARRAY` where a function expects one.
+
+```sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+WHERE ARRAY_CONTAINS(o.owner_group::VARIANT, PARSE_JSON(?)::ARRAY);
+```
+
+Or join on the elements with `FLATTEN`:
+
+```sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+JOIN TABLE(FLATTEN(input => PARSE_JSON(?))) g ON g.value::STRING = o.owner_group;
+```
+
 ## Receiving an S3Object as a script parameter
 
 Declare the arg with type `(s3object)`. Windmill renders an S3 file picker for
@@ -1566,21 +1588,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -1636,6 +1660,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -1895,6 +1927,9 @@ async sleep(seconds: number): Promise<void>
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -2128,10 +2163,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -2304,6 +2343,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -2721,7 +2772,9 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 # 
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a ``datetime`` comes back as a
@@ -2807,12 +2860,15 @@ def workflow(func)
 # ``fn``'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a ``datetime`` comes back as a string, a tuple as a list.
+# 
+# Called from inside a task body, ``fn`` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 # 
 # Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.
-# Outside a workflow, falls back to ``asyncio.sleep``.
+# Outside a workflow, or inside a task body, falls back to ``asyncio.sleep``.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
diff --git a/system_prompts/auto-generated/sdks/python.md b/system_prompts/auto-generated/sdks/python.md
index 97db78b3d4..1964c88685 100644
--- a/system_prompts/auto-generated/sdks/python.md
+++ b/system_prompts/auto-generated/sdks/python.md
@@ -60,10 +60,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -236,6 +240,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -653,7 +669,9 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 # 
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a ``datetime`` comes back as a
@@ -739,12 +757,15 @@ def workflow(func)
 # ``fn``'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a ``datetime`` comes back as a string, a tuple as a list.
+# 
+# Called from inside a task body, ``fn`` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 # 
 # Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.
-# Outside a workflow, falls back to ``asyncio.sleep``.
+# Outside a workflow, or inside a task body, falls back to ``asyncio.sleep``.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
diff --git a/system_prompts/auto-generated/sdks/typescript.md b/system_prompts/auto-generated/sdks/typescript.md
index 55f59b1f36..da9e79ec94 100644
--- a/system_prompts/auto-generated/sdks/typescript.md
+++ b/system_prompts/auto-generated/sdks/typescript.md
@@ -124,21 +124,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -194,6 +196,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -453,6 +463,9 @@ async sleep(seconds: number): Promise<void>
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
diff --git a/system_prompts/auto-generated/sdks/wac-python.md b/system_prompts/auto-generated/sdks/wac-python.md
index a8e98a9d4f..6dd307dd24 100644
--- a/system_prompts/auto-generated/sdks/wac-python.md
+++ b/system_prompts/auto-generated/sdks/wac-python.md
@@ -36,7 +36,9 @@ def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 #
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 #
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a ``datetime`` comes back as a
@@ -122,12 +124,15 @@ def workflow(func)
 # ``fn``'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a ``datetime`` comes back as a string, a tuple as a list.
+#
+# Called from inside a task body, ``fn`` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 #
 # Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.
-# Outside a workflow, falls back to ``asyncio.sleep``.
+# Outside a workflow, or inside a task body, falls back to ``asyncio.sleep``.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
diff --git a/system_prompts/auto-generated/sdks/wac-typescript.md b/system_prompts/auto-generated/sdks/wac-typescript.md
index 608d75d18c..dd04a64de0 100644
--- a/system_prompts/auto-generated/sdks/wac-typescript.md
+++ b/system_prompts/auto-generated/sdks/wac-typescript.md
@@ -67,8 +67,9 @@ export async function getResumeUrls(approver?: string, flowLevel?: boolean): Pro
  * const call_api = task(fetchOrders, { retry: { attempts: 3, delay: 30, multiplier: 2 } });
  *
  * Inside a `workflow()`, calling a task dispatches it as a step.
- * Outside a workflow, the function body executes directly and
- * {@link TaskOptions} — retry included — does not apply.
+ * Outside a workflow, or called from inside another task, the function body
+ * executes directly and {@link TaskOptions} — retry included — does not apply:
+ * a task runs as a single job, so the tasks it calls run in that same job.
  *
  * A task runs as its own job, so its result is always encoded as JSON and
  * decoded back before the caller sees it: a `Date` comes back as a string, a
@@ -112,6 +113,9 @@ export function workflow<T>(fn: (...args: any[]) => Promise<T>)
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ *
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 export async function step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 6ff0a1022b..95bbbc657b 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -35,7 +35,7 @@ app related commands
 - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement
   - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)
   - `--host <host:string>` - Host to bind the dev server to
-  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
+  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte, index.tsx otherwise)
   - `--no-open` - Don't automatically open the browser
   - `--recording` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability
@@ -46,9 +46,9 @@ app related commands
 - `app new` - create a new raw app from a template
   - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
-  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.
+  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5. Skips the prompt when provided. Triggers non-interactive mode.
   - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.
-  - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.
+  - `--schema <schema:string>` - Schema to use with --datatable. If it doesn't exist yet, a sql_to_apply/ migration (CREATE SCHEMA IF NOT EXISTS) is written for it.
   - `--overwrite` - Overwrite the target directory if it already exists, without prompting.
   - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop.
 - `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace
@@ -129,6 +129,15 @@ Watch local file changes and live-reload the dev page for preview. Does NOT depl
 - `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)
 - `--no-open` - Do not open the browser automatically
 
+### digest
+
+Compute the content digest of local scripts and flows, as the `digest` and `root_digest` claims of job OIDC tokens carry it. Run from the root of a sync checkout, pulled after the deployment's dependency jobs completed: they write the lockfiles the digest covers. A flow also lists the digest of each inline step, as `<flow path>/<step id>`.
+
+**Arguments:** `<paths...:string>`
+
+**Options:**
+- `--json` - Output the digests as JSON
+
 ### docs
 
 Search Windmill documentation.
@@ -723,6 +732,8 @@ user related commands
 
 **Subcommands:**
 
+- `user list` - List the users of the workspace
+  - `--json` - Output as JSON (for piping to jq)
 - `user add <email:string> [password:string]` - Create a user
   - `--superadmin` - Specify to make the new user superadmin.
   - `--company <company:string>` - Specify to set the company of the new user.
diff --git a/system_prompts/auto-generated/skills/raw-app/SKILL.md b/system_prompts/auto-generated/skills/raw-app/SKILL.md
index fe9f57c55d..bd21352995 100644
--- a/system_prompts/auto-generated/skills/raw-app/SKILL.md
+++ b/system_prompts/auto-generated/skills/raw-app/SKILL.md
@@ -11,47 +11,53 @@ This guide covers raw apps from the terminal: scaffolding via `wmill app new`, t
 
 **You — the AI agent — create the app yourself by running `wmill app new` with the right flags. Do NOT tell the user to "run `wmill app new` and follow the prompts" or wait for them to do it.** The bare `wmill app new` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
 
-### Step 1 — Gather the three required values by asking the user
+### Step 1 — Settle the setup
 
-You need three things to run the command:
+You need three values to run the command:
 
 1. **summary** — a short description of the app
 2. **path** — the windmill path, e.g. `f/folder/my_app` or `u/username/my_app`
-3. **framework** — one of `react19` (recommended), `react18`, `svelte5`, `vue`
+3. **framework** — one of `react19` (recommended), `react18`, `svelte5`
 
-If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+**summary and path**: if the user's request did not supply them, ask. Do not guess values and do not invent paths.
 
-Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+**framework**: never ask. Use the one the user named, otherwise the one the project's existing apps use, otherwise `react19` (see "Starting a new app" in the authoring guide).
+
+**data setup**: when the app has to store data and the user did not say where, ask which data table, which schema and which tables, as "Data setup" in the authoring guide lays out. `wmill datatable list` gives the data tables to offer.
+
+Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group everything missing into a single round-trip so the user answers at once:
 
-- For `framework` — multiple-choice with the four allowed values; mark `react19` as `(Recommended)` and put it first.
 - For `summary` and `path` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+- For the data setup — the choices the authoring guide lists, the default first.
 
-Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+Only proceed once every value is concrete. If the user replies with something ambiguous, ask again rather than guessing.
 
 ### Step 2 — Run the command yourself
 
-Once you have summary + path + framework, run it:
+Once the setup is settled, run it:
 
 ```bash
 wmill app new \
   --summary "Customer dashboard" \
   --path f/sales/dashboard \
-  --framework react19
+  --framework react19 \
+  --datatable main \
+  --schema app1
 ```
 
-That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of `--summary`/`--path`/`--framework` puts the command in non-interactive mode.
+`--summary`, `--path` and `--framework` are the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of them puts the command in non-interactive mode, so the data setup only reaches the app through the flags below.
 
 ### Optional flags
 
-Layer these in only when the user asked for them:
-
 | Flag | When to add it |
 |---|---|
-| `--datatable <name>` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
-| `--schema <name>` | Together with `--datatable`. Creates the schema with `CREATE SCHEMA IF NOT EXISTS` if it doesn't already exist. |
+| `--datatable <name>` | The app stores data: the data table settled in step 1. Without it, the app is created with no datatable. |
+| `--schema <name>` | Together with `--datatable`, when the app's tables go in a schema, new or existing. If the schema doesn't exist yet, writes a `sql_to_apply/` migration with `CREATE SCHEMA IF NOT EXISTS`, applied like any other migration (see "SQL Migrations" below). Leave it out for `public`. |
 | `--overwrite` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
 | `--no-open-in-desktop` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
 
+Existing tables the app reuses have no flag: list them under `data.tables` in `raw_app.yaml` (see "Data tables" below).
+
 ### Step 3 — Offer the visual preview
 
 After `wmill app new` and any initial edits to `App.tsx` / `index.tsx`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a `launch.json` entry when an embedded preview tool is in play) the user should consent to.
@@ -62,8 +68,9 @@ For apps the preview command runs from the app folder (`cd <app_path>__raw_app &
 
 - ❌ Running `wmill app new` with no flags (the prompt will hang).
 - ❌ Telling the user to "run `wmill app new` and follow the prompts" — that's a step backwards from what you can do directly.
-- ❌ Inventing a path/summary/framework instead of asking the user.
-- ❌ Defaulting to `react19` because the user didn't say — even sensible defaults must be confirmed.
+- ❌ Inventing a path or summary instead of asking the user.
+- ❌ Asking which framework to use — `react19` is the default when nothing says otherwise.
+- ❌ Creating a schema or tables for a new app before the user has said where its data goes.
 - ❌ Passing `--overwrite` automatically when the directory exists — confirm with the user first.
 
 ### Interactive (only when a human is at the terminal)
@@ -82,7 +89,7 @@ my_app__raw_app/
 ├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
 ├── raw_app.yaml           # App configuration (summary, path, data settings)
 ├── index.tsx              # Frontend entry point
-├── App.tsx                # Main React/Svelte/Vue component
+├── App.tsx                # Main React/Svelte component
 ├── index.css              # Styles
 ├── package.json           # Frontend dependencies
 ├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
@@ -181,7 +188,7 @@ data:
 - `<datatable>/<table>` — Specific table in public schema
 - `<datatable>/<schema>:<table>` — Table in specific schema
 
-**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. `roles` records the role the app uses each datatable through; the app's code must pass the same role: `wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python. A datatable without an entry is used as its default role.
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. `roles` records the role the app uses each datatable through; the app's code must pass the same role: `wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python. A datatable without an entry is used as its default role, if it has one, plus the roles of whoever is using the app unless that default is `admin`.
 
 ## SQL Migrations (sql_to_apply/)
 
@@ -240,7 +247,7 @@ For the rest, tell the user which command fits their intent and let them run it
 
 # Windmill Raw Apps
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+Raw apps let you build custom frontends with React or Svelte that connect to Windmill backend runnables and datatables.
 
 ## App shape
 
@@ -250,11 +257,43 @@ A raw app has three logical parts:
 - **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
 - **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
 
+## Starting a new app
+
+A new app gets the setup Windmill's own new-app dialog gives one: a framework, then where its data lives.
+
+### Framework
+
+Use the framework the user named. When they named none, follow what there is to follow: the app being edited, or the apps the request points at. With nothing to follow, use **React 19**, the recommended default, **without asking**. React 18 and Svelte 5 are for when they are asked for. These three are the only frameworks the raw app bundler builds. When the user asks to build or convert an app in another framework, write no code in it: say it is not available and offer these three instead.
+
+### Data setup
+
+When a new app has to store data and the user did not say where, **ask before creating anything**: no app, no schema, no table. Where the data lives is the user's decision, and tables created in the wrong place stay there. Look up the workspace's data tables first so every choice you offer exists, then ask, as proposed answers rather than open questions:
+
+1. **Data table**: which one to use, the default first (`main` when it exists, otherwise the first listed). Skip this one when the workspace has a single data table.
+2. **Schema**: where the app's new tables go.
+   - A **new schema**, the usual choice, offered first. Suggest the first unused name among `app1`, `app2`, …
+   - An **existing schema** of that data table, by name.
+   - **None**: the tables go in `public`.
+3. **Tables**: only when that data table already holds tables the app could use, whether to **reuse** them (name them) or **create new ones**.
+
+Do not ask when:
+
+- the user already said where the data goes. A part they left out takes its default above: the default data table, a new `appN` schema, new tables;
+- the app, or its saved draft, already carries a data config (`data.datatable`, `data.schema` or `data.tables`). That config is the answer;
+- the app stores nothing.
+
+With no data table in the workspace there is nothing to choose: say that one has to be configured in the workspace settings before the app can store data.
+
+A question left unanswered or dismissed is not a go-ahead for the defaults: stop there and say what is still needed.
+
+Then build what was chosen: the data table and schema become the app's `data.datatable` and `data.schema`, the tables it uses, reused or new, go in `data.tables`, and a new schema is created (`CREATE SCHEMA IF NOT EXISTS`) before the tables that go in it.
+`wmill app new --datatable <name> --schema <name>` records both and, for a schema that does not exist yet, writes the migration in `sql_to_apply/` that creates it: nothing exists in the database until `wmill app dev` applies that migration, so the app's table migrations come after it.
+
 ## Frontend
 
 ### Entrypoint
 
-The entrypoint is `index.tsx` for React and `index.ts` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty `<div id="root">` and auto-renders nothing, so the entrypoint must mount a top-level `App` itself. Keep the UI in `App.tsx` / `App.svelte` / `App.vue` and keep the entrypoint as the mount shim.
+The entrypoint is `index.tsx` for React and `index.ts` for Svelte. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty `<div id="root">` and auto-renders nothing, so the entrypoint must mount a top-level `App` itself. Keep the UI in `App.tsx` / `App.svelte` and keep the entrypoint as the mount shim.
 
 React (`index.tsx`):
 
@@ -266,7 +305,7 @@ import App from './App'
 createRoot(document.getElementById('root')!).render(<App />)
 ```
 
-Svelte (`index.ts`): `mount(App, { target: document.getElementById('root')! })`. Vue (`index.ts`): `createApp(App).mount('#root')`.
+Svelte (`index.ts`): `mount(App, { target: document.getElementById('root')! })`.
 
 **Never replace the entrypoint with a bare component** (`export default function App() { ... }` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts `App` into `#root`.
 
@@ -339,16 +378,16 @@ Apply it to customer data, internal notes and anything else a viewer of the demo
 
 ### Chat UIs over a flow in chat mode
 
-A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add `windmill-chat` to `package.json` and use it directly, it detects the app's Windmill and credential.
+A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add `@windmill-labs/chat-sdk` to `package.json` and use it directly, it detects the app's Windmill and credential.
 
 ```tsx
-import { useWindmillChat } from 'windmill-chat/react'
+import { useWindmillChat } from '@windmill-labs/chat-sdk/react'
 
 const chat = useWindmillChat({ flowPath: 'f/support/assistant' })
 // chat.messages ({ role, content, pending, success, tool? }), chat.status, chat.sendMessage(text), chat.stop()
 ```
 
-`windmill-chat/ai-sdk` gives a `ChatTransport` for the Vercel AI SDK's `useChat`, `windmill-chat/assistant-ui` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs `jobs:run` in its frontend SDK scopes, plus `flow_conversations:write` for the conversation sidebar; without them the chat keeps history in the browser.
+`@windmill-labs/chat-sdk/ai-sdk` gives a `ChatTransport` for the Vercel AI SDK's `useChat`, `@windmill-labs/chat-sdk/assistant-ui` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs `jobs:run` in its frontend SDK scopes, plus `flow_conversations:write` for the conversation sidebar; without them the chat keeps history in the browser.
 
 ## Backend runnables
 
@@ -432,6 +471,18 @@ A draft app is reachable by nobody; deploying is what exposes it, and its backen
 Either one lets those people run the app's backend runnables, so never open an app up unless the user asks.
 `public: true` in `raw_app.yaml` deploys the app for anonymous users, and `guests: true` for guests. Remove the line and the next push closes the app again.
 
+## Sandbox isolation and frontend API access
+
+By default a deployed app's frontend runs with the viewer's own Windmill session. A sandboxed app is isolated from it: the frontend reaches Windmill only through its backend runnables, plus whatever frontend API scopes the app declares, which each viewer approves before the app runs. The scopes are `jobs:run`, `jobs:read`, `users:read`, `resources:read`, `variables:read`, `flow_conversations:read` and `flow_conversations:write`; grant only the ones the frontend calls.
+In `raw_app.yaml`:
+
+```yaml
+sandbox: true
+frontend_api: [jobs:run, users:read]
+```
+
+A file with a `sandbox` key states both settings: `sandbox: false` turns isolation off, and a missing `frontend_api` means no scopes. A file without the key leaves the deployed app's isolation and scopes as they are, so removing `sandbox: true` does not unsandbox it. `frontend_api` needs `sandbox: true`; the push fails otherwise.
+
 ## Data Tables
 
 Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the `wmill` client; the frontend never queries them directly. **When the app needs to store or persist data** (user data, settings, application state, records, logs), use a data table.
@@ -443,6 +494,7 @@ Data tables are PostgreSQL databases managed by Windmill. Backend runnables quer
 3. **No DDL inside runnables**: runnables only read and write rows (SELECT, INSERT, UPDATE, DELETE) on existing tables. Never CREATE, ALTER or DROP a table from a runnable.
 4. **Qualify table names**: an unqualified name means the `public` schema, so write every other table as `schema.table`, in table creation and queries alike. The app's `data` config sets the default datatable and schema its tables go in; use them consistently across runnables.
 5. **Pass the role**: when the app's `data.roles` gives a data table a role, every `wmill.datatable` call on it passes that role (`wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python). The role only reaches what it was granted, so a query outside it fails with `permission denied`.
+6. **Per-viewer rows**: a data table with no entry in `data.roles` is called with no role. Unless its default role is `admin`, the connection then holds the default role, if it has one, plus every role the person using the app is a tenant of, and is refused when that is none. Row-level security policies written as `pg_has_role(current_user, '<role>', 'member')` return that viewer's rows with nothing added to the runnable. A role pins the connection to that one role for every viewer, so where rows should differ per viewer give the data table no `data.roles` entry.
 
 `wmill datatable list` lists the workspace's data tables. Create or change tables with a migration in `sql_to_apply/` (see "SQL Migrations" above), then add them to `data.tables` in `raw_app.yaml`.
 
@@ -496,4 +548,4 @@ def main(user_id: str):
 7. **Mark sensitive UI with `data-wm-no-record`** — it is what keeps that data out of a recorded demo; passwords are handled for you.
 8. **Reach for `backendAsync` + `waitJob`** for long work — never a hand-written job-polling runnable.
 9. **Deploy what a path runnable points at** — a path runnable aimed at a draft fails at runtime; tell the user what needs deploying.
-10. **Use `windmill-chat` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
+10. **Use `@windmill-labs/chat-sdk` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index d259948e56..4b0889c3d8 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -109,6 +109,7 @@ These are strict Windmill schema rules. Follow them exactly.
 - `preprocessor_module` and `failure_module` only support `script` or `rawscript`
 - `preprocessor_module` runs before normal modules and cannot reference `results.*`
 - `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`
+- A flow whose `failure_module` runs still ends as failed, unless the handler returns an object with `recover: true`: the flow then ends as a success. This also holds when the failing step is inside a loop, a branch or a subflow. `recover` never changes which steps run; whether a loop or branch carries on past a failure is still decided by its own settings (`skip_failures`, `continue_on_error`)
 
 Correct shape:
 
@@ -264,6 +265,98 @@ names, so neither is name-checked at all — leave those summaries as they are.
   whenever the name alone does not make that obvious; it overrides the description derived from the
   underlying script
 
+## AI Decision Modules
+
+An `aidecision` module asks a decision model (TypeSafe's Jev, Cloudflare's Clef or OpenAI's Decisions API) typed questions about a `state` and
+answers each with calibrated probabilities instead of text. Prefer it over an `aiagent` when the step
+is a judgment (classify, route, score or a yes/no check) that needs no tools and no free text: it
+is faster, cheaper, and its answers have a fixed shape.
+
+```json
+{
+  "id": "triage",
+  "summary": "Classify the ticket",
+  "value": {
+    "type": "aidecision",
+    "input_transforms": {
+      "provider": {
+        "type": "static",
+        "value": { "kind": "typesafe", "resource": "$res:f/ai/typesafe", "model": "jev-latest" }
+      },
+      "state": { "type": "javascript", "expr": "flow_input.message" },
+      "questions": {
+        "type": "static",
+        "value": {
+          "intent": {
+            "type": "choice",
+            "instructions": "What does the customer want?",
+            "criteria": { "refund": "Money back", "bug": "Something is broken", "other": "Anything else" }
+          },
+          "urgency": {
+            "type": "score",
+            "instructions": "How urgent is the ticket?",
+            "criteria": ["Can wait", "This week", "Today", "Right now"]
+          },
+          "angry": { "type": "noul", "instructions": "Is the customer angry?" }
+        }
+      }
+    }
+  }
+}
+```
+
+- `provider.kind` is `typesafe` (`model` `jev-latest` unless a version is pinned), `cloudflare`
+  (`model` `clef`, or `clef-flash` for faster answers) or `openai` (`model` `gpt-6-luna`, never a
+  chat model); the resource is of that same type
+- `state` is the content to evaluate: usually a text, such as the message to classify. To combine
+  several values, pass an object with descriptive keys holding only what the questions need
+  (`({ message: flow_input.message, plan: results.get_account.plan })`); an array of strings also works
+- `questions` maps each question name to `{ type, instructions, criteria }`:
+  - `choice`: `criteria` maps each option to its description (up to 255 options). The answer has
+    `choice`, `probabilities` and `confidence`
+  - `score`: `criteria` is an ordered array of 2 to 10 level descriptions. The answer has `score`,
+    `legend`, `probabilities` and `confidence`
+  - `noul`: yes/no, `criteria` optionally `{ "true": ..., "false": ... }` descriptions. The answer has
+    `noul`, the probability of yes from 0 to 1
+- The result is `{ output, model, usage }` with `output` keyed by question name, so a later step
+  reads `results.triage.output.intent.choice`, `results.triage.output.urgency.score` or
+  `results.triage.output.angry.noul > 0.7`
+- On `openai` the same `questions` are translated for its Decisions API and the answers read the
+  same way (`choice`, `score`, `noul`), except that `probabilities` is a list of
+  `{ value, probability }` (plus `label` on a score) and a score has no `legend`. A question OpenAI
+  refuses to answer fails the step. A `state` that is
+  an array of user messages (`[{ role: "user", content: [{ type: "input_text", text }, { type: "input_image", image_url: "data:image/png;base64,..." }] }]`)
+  is sent as is, which is how an image is evaluated; any other object or array is sent as JSON text
+
+### Branching on the Answers
+
+To route on the answers, put a `branchone` right after the decision, one branch per option, with
+each `expr` reading the decision by id:
+
+```json
+{
+  "id": "route",
+  "value": {
+    "type": "branchone",
+    "branches": [
+      { "summary": "refund", "expr": "results.triage.output.intent.choice === 'refund'", "modules": [...] },
+      { "summary": "bug", "expr": "results.triage.output.intent.choice === 'bug'", "modules": [...] }
+    ],
+    "default": [...]
+  }
+}
+```
+
+For a yes/no question, one branch with `"expr": "results.triage.output.angry.noul >= 0.5"` (tune the
+threshold as needed) and the `default` as the "no" path.
+
+### As an Agent Tool
+
+An `aidecision` can be a `flowmodule` tool of an `aiagent` (`"tool_type": "flowmodule", "type":
+"aidecision"`): set `state` to `{ "type": "ai" }` so the calling model supplies it, and only `output`
+goes back to the model. The Tool Naming Rules apply to its `summary`. Only a flow's own agent step
+can call one, not an agent used as a tool.
+
 ## Common Mistakes to Avoid
 
 - Missing `input_transforms` - Rawscript parameters won't receive values without them
@@ -278,6 +371,10 @@ names, so neither is name-checked at all — leave those summaries as they are.
 - `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope
 - `flow_input.iter.value` - Current iteration value inside a `forloopflow`; in a `whileloopflow` it is just the iteration index (a plain number, same as `flow_input.iter.index`)
 - `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - `resume` - the last resume payload (the resume form values); with `continue_on_disapprove_timeout`, a disapproval or timeout yields `{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }` instead
+  - `resumes` - every resume payload, in arrival order
+  - `approvers` - a plain array of strings, one per resume: for a resume through the `resume`/`cancel` URL from `getResumeUrls(approver)`, the `approver` passed there if any; otherwise (including the `approvalPage` link) the resuming user's username, else `"anonymous"`, e.g. `approvers[0]`. It is NOT the `{ resume_id, approver }` objects stored in the flow status, so `approvers[0].approver` is always undefined
 
 ## Loop Structure Rules
 
@@ -494,6 +591,10 @@ Unless the user asked for new code, look for a workspace script or flow that alr
 The step's `input_transforms` must cover the reused item's inputs, so read its input schema first.
 Find candidates in the local tree (a `.script.yaml` sits next to each script and holds its input schema, a `flow.yaml` in each flow folder) and on the workspace with `wmill script list` / `wmill flow list`; `wmill script get <path>` and `wmill flow get <path>` show an item's details.
 
+## Additional Prompt for AI
+
+A flow's input schema may carry a top-level `prompt_for_ai` string, as a script's can: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that flow, and keep it when you rewrite the schema.
+
 ## Organizing Flows: Groups and Notes
 
 Groups and notes shape how a flow reads in the editor; neither changes what it does.
@@ -585,4 +686,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff: the n-th retry waits multiplier \u00d7 seconds^n","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Base of the exponential (seconds); the n-th retry waits multiplier \u00d7 seconds^n, where n counts constant retries too"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Any other value renders unstyled."},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes. 'group' notes are deprecated; segment a flow with FlowValue.groups instead."},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor, one of: yellow, blue, green, purple, pink, orange, red, cyan, lime, gray. Omit it to let the editor pick one."}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"},"skin":{"type":"string","enum":["detailed","minimal"],"description":"How the approval request is presented, on the approval page and in Slack/Teams approval messages. 'detailed' (used when unset) shows the flow details (arguments, graph, approvers); 'minimal' shows only the request: the step description, form and approve/reject actions"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools)."},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock","typesafe","cloudflare"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryWindow":{"type":"object","description":"Keeps the most recent messages of the memory named by the run's memory id (or the step's\n`memory_id`). Without a memory id the agent runs without memory.\n","properties":{"kind":{"type":"string","enum":["window"]},"context_length":{"type":"integer","description":"Number of most recent messages to load and store. 0 turns memory off."}},"required":["kind","context_length"]},"MemoryAuto":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written: the run's memory id, else the `memory_id` here.\nThe step's own `memory_id` is not read while this kind is set; switch the kind to `window`\nto use it. Without a `context_length`, or with 0, it is `off` and reads `previous_messages`.\n","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryCompaction":{"type":"object","description":"Keeps the whole memory named by the run's memory id (or the step's `memory_id`), replacing\nits older part with a summary as the conversation approaches the model's context window.\nWithout a memory id the agent runs without memory, and compaction bounds the run's own loop.\n","properties":{"kind":{"type":"string","enum":["compaction"]},"context_window":{"type":"integer","description":"Overrides the context window looked up from the model, in tokens. Only a model\nWindmill does not know needs one; those fall back to 128000.\n"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","deprecated":true,"description":"Deprecated, still read as it was written. Move the step to `off` with `previous_messages` instead.","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Managed memory, stored by Windmill and replayed with each request. The memory is named by a memory id, see `memory_id`. While it is off, a step can supply its history in `previous_messages`.","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryWindow"},{"$ref":"#/components/schemas/MemoryCompaction"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","window":"#/components/schemas/MemoryWindow","compaction":"#/components/schemas/MemoryCompaction","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"},{"$ref":"#/components/schemas/AiDecision"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent","aidecision":"#/components/schemas/AiDecision"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"The name the AI agent calls this tool by, not a human label. On a flowmodule tool it must match ^[a-zA-Z0-9_]+$ - letters, numbers and underscores only (e.g. 'search_documentation', not 'Search documentation') - and always be set; on an mcp or websearch tool it is a plain label. Put the human-readable explanation in 'description'."},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"job_token_scopes":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with\nflow.input syntax. Required unless memory is off and `previous_messages` supplies\nthe prompt; image output always needs it.\n"},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"memory_id":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"String. Names the memory this step reads and writes, overriding the memory id the run\nwas started with (the chat conversation, an app chat session or the `memory_id` run\nparameter). Leave unset to use the run's memory id. A fixed value shares one memory\nacross every run; an expression such as `flow_input.customer_id` keeps one memory per\nkey. When it evaluates to an empty value the agent runs without memory. Read only\nwhile `memory` is `window` or `compaction`: it is ignored when memory is off, and an\nolder `auto` or `manual` memory reads neither history input.\n"},"previous_messages":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of MemoryMessage. History supplied by the flow, sent between the system prompt\nand the user message. Read only while `memory` is off or absent: managed memory\nignores it, and an older `auto` or `manual` memory reads neither history input.\n"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"enabled_tools":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of strings naming which of the tools configured in `tools` the agent may call\nthis run. Leaving it unset carries every one of them; an empty array carries none.\nA tool is named as the model is shown it. An entry the model is shown nothing of is\nnamed by what identifies it instead: an MCP server by its resource path, carrying\nevery tool it exposes (which of them stays that entry's include_tools/exclude_tools),\nand a websearch entry by the reserved name '__wm_web_search', whatever summary it carries\n(no tool may take that name).\nExample: ['get_user', 'u/admin/github_mcp', '__wm_web_search']\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}}},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message, user_attachments, enabled_tools and the history inputs memory_id and previous_messages).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"AiDecision":{"type":"object","description":"AI decision step: one call to a decision model (TypeSafe's Jev, Cloudflare's\nJev-compatible Clef, or OpenAI's Decisions API) that answers typed questions about a\nstate with calibrated probabilities, instead of generating text.\nPrefer it over an AI agent to classify, route, score or check something: it is fast,\ncheap and its answers are structured. Its result is { output: { <question name>: answer },\nmodel, usage }, so a later step reads e.g. results.<id>.output.intent.choice. To route on\nthe answers, follow it with a branchone whose branch exprs read\nresults.<id>.output.<question>.choice. Usable as an AI agent tool, where the calling agent\nsupplies the state.\n","properties":{"input_transforms":{"type":"object","description":"Input parameters for the decision mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"state":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"What the questions are asked about: a string, an object or an array of strings.\nAn object with descriptive keys holding only what the questions need works best.\nExample: { message: flow_input.message, plan: results.a.plan }\n"},"questions":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Object mapping each question name to { type, instructions, criteria }, where type is:\n- 'choice': criteria maps each option to its description (up to 255); the answer\n  has choice, probabilities and confidence\n- 'score': criteria is an ordered array of 2 to 10 level descriptions; the answer\n  has score, legend, probabilities and confidence\n- 'noul': yes/no, criteria optionally { true, false } descriptions; the answer has\n  noul, the probability of yes (0 to 1)\nExample: { intent: { type: 'choice', instructions: 'What does the customer want?',\ncriteria: { refund: 'Money back', bug: 'Something is broken' } } }\n"}},"required":["provider","state","questions"]},"type":{"type":"string","enum":["aidecision"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the step runs on the flow's tag (default `flow`)"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
diff --git a/system_prompts/auto-generated/skills/write-pipeline/SKILL.md b/system_prompts/auto-generated/skills/write-pipeline/SKILL.md
index 064dc600ac..4c339e6222 100644
--- a/system_prompts/auto-generated/skills/write-pipeline/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-pipeline/SKILL.md
@@ -12,10 +12,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **`duckdb`** node that materializes its output into a **DuckLake** table with `-- materialize ducklake://<name>/<table>` (in a DuckDB node the annotation uses SQL `--` comment syntax; write the body as a bare `SELECT` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - `postgresql` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- `bun` / `python3` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- `bun` / `python3` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with `wmill.ducklake()`, or into a data table with `wmill.datatable()`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+```python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+```
+
+```ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)`.fetch()
+}
+```
+
+- Use `INSERT INTO <table> SELECT ...` instead of `CREATE OR REPLACE` to append (an incremental pull), with a one-time `CREATE TABLE IF NOT EXISTS` first.
+- Assign the client to a variable (`lake = wmill.ducklake()`) and keep the SQL a **string literal** (Python) or a template without `sql.raw` (TS): that is what lets the graph record the node's write to `ducklake://main/<table>`. A chained `wmill.ducklake().query(...)` or SQL built in a variable records no output, so the downstream edge never forms.
+- `wmill.ducklake("<name>")` targets a non-default catalog; `wmill.datatable("<name>")` writes a Postgres data table the same way (Python `db.query(sql, *args)` with `$1` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: `-- on ducklake://main/stripe_charges`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and `s3://` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -59,7 +97,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the output via the SDK (`wmill.writeS3File(...)`, ducklake helpers, …) and let it be inferred. Use `duckdb` when a node should materialize a DuckLake table.
+> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the table itself with `wmill.ducklake()` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use `duckdb` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: `// materialize manual dbt://<warehouse>/<schema>/<name>`, where `<warehouse>` is a warehouse the workspace configures under Settings → dbt. `manual` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql `CREATE TABLE` / `INSERT`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a `source`: the declared relation and the dbt model land on ONE graph node, and a downstream `// on dbt://<warehouse>/<schema>/<name>` fires when the ingestion node completes.
 
diff --git a/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md b/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md
index e6683248db..9bb87cb4a1 100644
--- a/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-ansible/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-bash/SKILL.md b/system_prompts/auto-generated/skills/write-script-bash/SKILL.md
index 42bbd7bc01..0c4634b775 100644
--- a/system_prompts/auto-generated/skills/write-script-bash/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bash/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md b/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md
index dc3e19c0c9..497336b001 100644
--- a/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bigquery/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index 6d82183b88..055b1613b2 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -319,21 +320,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -389,6 +392,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -648,6 +659,9 @@ async sleep(seconds: number): Promise<void>
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
diff --git a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
index fd6b21dc60..beaf7817bb 100644
--- a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -331,21 +332,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -401,6 +404,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -660,6 +671,9 @@ async sleep(seconds: number): Promise<void>
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
diff --git a/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md b/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md
index d755483abb..389c683f7c 100644
--- a/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-csharp/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index eec2f25dfa..afefb7e987 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -321,21 +322,23 @@ async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
-async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
+async runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null | RunScriptAsyncOptions = null, tag: string | null = null): Promise<string>
 
 /**
  * Run a flow asynchronously by its path
@@ -391,6 +394,14 @@ async setProgress(percent: number, jobId?: any): Promise<void>
  */
 async getProgress(jobId?: any): Promise<number | null>
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+async workerIsDraining(jobId?: string): Promise<boolean>
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -650,6 +661,9 @@ async sleep(seconds: number): Promise<void>
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ * 
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 async step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
diff --git a/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md b/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md
index b2b841d0eb..2ffcf4607c 100644
--- a/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-duckdb/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-go/SKILL.md b/system_prompts/auto-generated/skills/write-script-go/SKILL.md
index 31a60a7548..1707fcda4c 100644
--- a/system_prompts/auto-generated/skills/write-script-go/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-go/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md b/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md
index 9924e72f7f..c928dea3bc 100644
--- a/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-graphql/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-java/SKILL.md b/system_prompts/auto-generated/skills/write-script-java/SKILL.md
index a28d7763cb..a768a5faa5 100644
--- a/system_prompts/auto-generated/skills/write-script-java/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-java/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md b/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md
index 75f3827440..9215f06906 100644
--- a/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-mssql/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md b/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md
index c2f034c4f6..d682cce351 100644
--- a/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-mysql/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-php/SKILL.md b/system_prompts/auto-generated/skills/write-script-php/SKILL.md
index 1052944b8e..16c68834dc 100644
--- a/system_prompts/auto-generated/skills/write-script-php/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-php/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md b/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md
index 8937c078f4..b0e14a6b12 100644
--- a/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-postgresql/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md b/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md
index c3e2bd7500..540776c68a 100644
--- a/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-powershell/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
index b030ff4316..ee50b6d62d 100644
--- a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -267,10 +268,14 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 def create_token(duration = dt.timedelta(days=1)) -> str
 
 # Create a script job by path and return its job id.
-def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# 
+# ``retry`` re-runs the job when it fails, with the policy a schedule takes,
+# e.g. ``{"constant": {"attempts": 3, "seconds": 10}}``. The returned id is
+# the first attempt's; each retry is a job of its own, recorded as a child of it.
+def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
-# Create a script job by hash and return its job id.
-def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
+# Create a script job by hash and return its job id. See ``run_script_by_path_async`` for ``retry``.
+def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None, retry: dict = None) -> str
 
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
@@ -443,6 +448,18 @@ def set_progress(value: int, job_id: Optional[str] = None)
 #     Progress value (0-100) or None if not set
 def get_progress(job_id: Optional[str] = None) -> Any
 
+# Whether the worker running the job has received its shutdown signal.
+# 
+# A draining worker waits for its current job to finish before exiting. A long-running
+# script can poll this and return early so the worker can be replaced.
+# 
+# Args:
+#     job_id: Job ID (defaults to current WM_JOB_ID)
+# 
+# Returns:
+#     True if the worker running the job is draining
+def worker_is_draining(job_id: Optional[str] = None) -> bool
+
 # Set the user state of a flow at a given key
 def set_flow_user_state(key: str, value: Any) -> None
 
@@ -860,7 +877,9 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 # 
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a ``datetime`` comes back as a
@@ -946,12 +965,15 @@ def workflow(func)
 # ``fn``'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a ``datetime`` comes back as a string, a tuple as a list.
+# 
+# Called from inside a task body, ``fn`` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 # 
 # Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.
-# Outside a workflow, falls back to ``asyncio.sleep``.
+# Outside a workflow, or inside a task body, falls back to ``asyncio.sleep``.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
diff --git a/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md b/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md
index 626b602749..061e1dcc45 100644
--- a/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-rlang/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-rust/SKILL.md b/system_prompts/auto-generated/skills/write-script-rust/SKILL.md
index 0f4a95bbe2..d9b599dffa 100644
--- a/system_prompts/auto-generated/skills/write-script-rust/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-rust/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md b/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md
index 99af11e419..cd79a1f5d4 100644
--- a/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-snowflake/SKILL.md
@@ -56,6 +56,7 @@ Use `wmill resource-type list --schema` to discover available resource types.
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
@@ -83,6 +84,27 @@ Name the parameters by adding comments before the statement:
 SELECT * FROM users WHERE name = ? AND age > ?;
 ```
 
+## Array parameters
+
+Declare a list with a `[]` suffix on the element type (`(varchar[])`,
+`(int[])`), or `(array)` for an untyped one. Snowflake cannot bind an array
+directly, so Windmill binds the list as JSON text: wrap the placeholder with
+`PARSE_JSON(?)`, and cast to `ARRAY` where a function expects one.
+
+```sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+WHERE ARRAY_CONTAINS(o.owner_group::VARIANT, PARSE_JSON(?)::ARRAY);
+```
+
+Or join on the elements with `FLATTEN`:
+
+```sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+JOIN TABLE(FLATTEN(input => PARSE_JSON(?))) g ON g.value::STRING = o.owner_group;
+```
+
 ## Receiving an S3Object as a script parameter
 
 Declare the arg with type `(s3object)`. Windmill renders an S3 file picker for
diff --git a/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md b/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
index 13d305c74e..09789b388a 100644
--- a/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-workflow-as-code/SKILL.md
@@ -143,6 +143,8 @@ async def enrich(customer_id: str):
 
 In TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with `@task()` or `@task`.
 
+Only the workflow body dispatches steps. A task runs as a single job, so a task or `step()` called from inside a task body runs in place in that job, as a plain function call: no child job, no checkpoint, and its task options (retry, timeout, tag) do not apply. `sleep()` there waits in the job, and `taskScript()` / `taskFlow()` / `waitForApproval()` (`task_script()` / `task_flow()` / `wait_for_approval()`) throw. To get separate jobs, call the tasks one after another from the workflow body and pass results between them.
+
 For existing scripts:
 
 ```typescript
@@ -308,8 +310,9 @@ export async function getResumeUrls(approver?: string, flowLevel?: boolean): Pro
  * const call_api = task(fetchOrders, { retry: { attempts: 3, delay: 30, multiplier: 2 } });
  *
  * Inside a `workflow()`, calling a task dispatches it as a step.
- * Outside a workflow, the function body executes directly and
- * {@link TaskOptions} — retry included — does not apply.
+ * Outside a workflow, or called from inside another task, the function body
+ * executes directly and {@link TaskOptions} — retry included — does not apply:
+ * a task runs as a single job, so the tasks it calls run in that same job.
  *
  * A task runs as its own job, so its result is always encoded as JSON and
  * decoded back before the caller sees it: a `Date` comes back as a string, a
@@ -353,6 +356,9 @@ export function workflow<T>(fn: (...args: any[]) => Promise<T>)
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ *
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 export async function step<T>(name: string, fn: () => T | Promise<T>,): Promise<Jsonified<Awaited<T>>>
 
@@ -451,7 +457,9 @@ def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 #
 # - **v2 (inside @workflow)**: dispatches as a checkpoint step.
 # - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.
-# - **Standalone**: executes the function body directly.
+# - **Standalone, or called from inside another v2 task**: executes the
+#   function body directly. A task runs as a single job, so the tasks it
+#   calls run in that same job, without their own options.
 #
 # A task runs as its own job, so its result is always encoded as JSON and
 # decoded back before the caller sees it: a ``datetime`` comes back as a
@@ -537,12 +545,15 @@ def workflow(func)
 # ``fn``'s result is encoded as JSON and decoded back before it is returned,
 # so the round that runs the body sees the same types every replay sees:
 # a ``datetime`` comes back as a string, a tuple as a list.
+#
+# Called from inside a task body, ``fn`` runs in place and nothing is
+# checkpointed: a task is a single job and is never replayed.
 async def step(name: str, fn)
 
 # Server-side sleep — suspend the workflow for the given duration without holding a worker.
 #
 # Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.
-# Outside a workflow, falls back to ``asyncio.sleep``.
+# Outside a workflow, or inside a task body, falls back to ``asyncio.sleep``.
 async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
diff --git a/system_prompts/base/flow-base.md b/system_prompts/base/flow-base.md
index b0a8998604..ff10f38062 100644
--- a/system_prompts/base/flow-base.md
+++ b/system_prompts/base/flow-base.md
@@ -22,6 +22,7 @@ These are strict Windmill schema rules. Follow them exactly.
 - `preprocessor_module` and `failure_module` only support `script` or `rawscript`
 - `preprocessor_module` runs before normal modules and cannot reference `results.*`
 - `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`
+- A flow whose `failure_module` runs still ends as failed, unless the handler returns an object with `recover: true`: the flow then ends as a success. This also holds when the failing step is inside a loop, a branch or a subflow. `recover` never changes which steps run; whether a loop or branch carries on past a failure is still decided by its own settings (`skip_failures`, `continue_on_error`)
 
 Correct shape:
 
@@ -182,6 +183,98 @@ names, so neither is name-checked at all — leave those summaries as they are.
   whenever the name alone does not make that obvious; it overrides the description derived from the
   underlying script
 
+## AI Decision Modules
+
+An `aidecision` module asks a decision model (TypeSafe's Jev, Cloudflare's Clef or OpenAI's Decisions API) typed questions about a `state` and
+answers each with calibrated probabilities instead of text. Prefer it over an `aiagent` when the step
+is a judgment (classify, route, score or a yes/no check) that needs no tools and no free text: it
+is faster, cheaper, and its answers have a fixed shape.
+
+```json
+{
+  "id": "triage",
+  "summary": "Classify the ticket",
+  "value": {
+    "type": "aidecision",
+    "input_transforms": {
+      "provider": {
+        "type": "static",
+        "value": { "kind": "typesafe", "resource": "$res:f/ai/typesafe", "model": "jev-latest" }
+      },
+      "state": { "type": "javascript", "expr": "flow_input.message" },
+      "questions": {
+        "type": "static",
+        "value": {
+          "intent": {
+            "type": "choice",
+            "instructions": "What does the customer want?",
+            "criteria": { "refund": "Money back", "bug": "Something is broken", "other": "Anything else" }
+          },
+          "urgency": {
+            "type": "score",
+            "instructions": "How urgent is the ticket?",
+            "criteria": ["Can wait", "This week", "Today", "Right now"]
+          },
+          "angry": { "type": "noul", "instructions": "Is the customer angry?" }
+        }
+      }
+    }
+  }
+}
+```
+
+- `provider.kind` is `typesafe` (`model` `jev-latest` unless a version is pinned), `cloudflare`
+  (`model` `clef`, or `clef-flash` for faster answers) or `openai` (`model` `gpt-6-luna`, never a
+  chat model); the resource is of that same type
+- `state` is the content to evaluate: usually a text, such as the message to classify. To combine
+  several values, pass an object with descriptive keys holding only what the questions need
+  (`({ message: flow_input.message, plan: results.get_account.plan })`); an array of strings also works
+- `questions` maps each question name to `{ type, instructions, criteria }`:
+  - `choice`: `criteria` maps each option to its description (up to 255 options). The answer has
+    `choice`, `probabilities` and `confidence`
+  - `score`: `criteria` is an ordered array of 2 to 10 level descriptions. The answer has `score`,
+    `legend`, `probabilities` and `confidence`
+  - `noul`: yes/no, `criteria` optionally `{ "true": ..., "false": ... }` descriptions. The answer has
+    `noul`, the probability of yes from 0 to 1
+- The result is `{ output, model, usage }` with `output` keyed by question name, so a later step
+  reads `results.triage.output.intent.choice`, `results.triage.output.urgency.score` or
+  `results.triage.output.angry.noul > 0.7`
+- On `openai` the same `questions` are translated for its Decisions API and the answers read the
+  same way (`choice`, `score`, `noul`), except that `probabilities` is a list of
+  `{ value, probability }` (plus `label` on a score) and a score has no `legend`. A question OpenAI
+  refuses to answer fails the step. A `state` that is
+  an array of user messages (`[{ role: "user", content: [{ type: "input_text", text }, { type: "input_image", image_url: "data:image/png;base64,..." }] }]`)
+  is sent as is, which is how an image is evaluated; any other object or array is sent as JSON text
+
+### Branching on the Answers
+
+To route on the answers, put a `branchone` right after the decision, one branch per option, with
+each `expr` reading the decision by id:
+
+```json
+{
+  "id": "route",
+  "value": {
+    "type": "branchone",
+    "branches": [
+      { "summary": "refund", "expr": "results.triage.output.intent.choice === 'refund'", "modules": [...] },
+      { "summary": "bug", "expr": "results.triage.output.intent.choice === 'bug'", "modules": [...] }
+    ],
+    "default": [...]
+  }
+}
+```
+
+For a yes/no question, one branch with `"expr": "results.triage.output.angry.noul >= 0.5"` (tune the
+threshold as needed) and the `default` as the "no" path.
+
+### As an Agent Tool
+
+An `aidecision` can be a `flowmodule` tool of an `aiagent` (`"tool_type": "flowmodule", "type":
+"aidecision"`): set `state` to `{ "type": "ai" }` so the calling model supplies it, and only `output`
+goes back to the model. The Tool Naming Rules apply to its `summary`. Only a flow's own agent step
+can call one, not an agent used as a tool.
+
 ## Common Mistakes to Avoid
 
 - Missing `input_transforms` - Rawscript parameters won't receive values without them
@@ -196,6 +289,10 @@ names, so neither is name-checked at all — leave those summaries as they are.
 - `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope
 - `flow_input.iter.value` - Current iteration value inside a `forloopflow`; in a `whileloopflow` it is just the iteration index (a plain number, same as `flow_input.iter.index`)
 - `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)
+- After a suspend step (approval), the next step's javascript expressions also get:
+  - `resume` - the last resume payload (the resume form values); with `continue_on_disapprove_timeout`, a disapproval or timeout yields `{ error: { name: "SuspendedDisapproved" | "SuspendedTimedOut", message } }` instead
+  - `resumes` - every resume payload, in arrival order
+  - `approvers` - a plain array of strings, one per resume: for a resume through the `resume`/`cancel` URL from `getResumeUrls(approver)`, the `approver` passed there if any; otherwise (including the `approvalPage` link) the resuming user's username, else `"anonymous"`, e.g. `approvers[0]`. It is NOT the `{ resume_id, approver }` objects stored in the flow status, so `approvers[0].approver` is always undefined
 
 ## Loop Structure Rules
 
@@ -414,6 +511,10 @@ The step's `input_transforms` must cover the reused item's inputs, so read its i
 Find candidates in the local tree (a `.script.yaml` sits next to each script and holds its input schema, a `flow.yaml` in each flow folder) and on the workspace with `wmill script list` / `wmill flow list`; `wmill script get <path>` and `wmill flow get <path>` show an item's details.
 <!-- /cli-only -->
 
+## Additional Prompt for AI
+
+A flow's input schema may carry a top-level `prompt_for_ai` string, as a script's can: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that flow, and keep it when you rewrite the schema.
+
 ## Organizing Flows: Groups and Notes
 
 Groups and notes shape how a flow reads in the editor; neither changes what it does.
diff --git a/system_prompts/base/pipeline-base.md b/system_prompts/base/pipeline-base.md
index 01e9797e32..59924faf41 100644
--- a/system_prompts/base/pipeline-base.md
+++ b/system_prompts/base/pipeline-base.md
@@ -7,10 +7,48 @@ A **data pipeline** is NOT a flow. A flow is one runnable that orchestrates step
 A pipeline node that produces a table should almost always be a **`duckdb`** node that materializes its output into a **DuckLake** table with `-- materialize ducklake://<name>/<table>` (in a DuckDB node the annotation uses SQL `--` comment syntax; write the body as a bare `SELECT` and let the runtime do the write). DuckLake is the default lakehouse store for pipelines and is the shape the pipeline editor is built around, so prefer it unless the work specifically calls for something else:
 
 - `postgresql` / data tables — only for row-level, OLTP-style mutations against an existing Postgres data table (frequent single-row upserts/updates, transactional reads that an app queries live).
-- `bun` / `python3` — only for non-tabular work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node still produces tabular data for downstream steps, land it in DuckLake (write it with the wmill SDK / ducklake helpers) rather than inventing a parallel store.
+- `bun` / `python3` — only for work that doesn't map to SQL: calling an external API, wrangling files, arbitrary glue. When such a node produces tabular data for downstream steps, write it **straight into DuckLake** (or a data table) from the same script — see "Ingesting from Python / TypeScript" below — rather than inventing a parallel store.
 
 Do not spread a pipeline across postgres, S3, and DuckLake when one DuckLake lake would do; a consistent DuckLake lakehouse is the goal.
 
+## Ingesting from Python / TypeScript
+
+A node that fetches data in code (an API, a SaaS export, a scraper) writes the rows **directly** into their DuckLake table with `wmill.ducklake()`, or into a data table with `wmill.datatable()`. DuckLake already stores every table as parquet files in the workspace object storage, so **never stage the raw payload first** — no intermediate JSON / CSV / parquet file in S3 and no second "load the raw file" node. One ingestion node, one table.
+
+Pass the rows as a query argument (a list of dicts / array of objects is sent as JSON) and let SQL unnest them; declare the column types so the table gets a real schema:
+
+```python
+# pipeline
+# on schedule
+import wmill
+
+def main():
+    rows = fetch_charges()  # list[dict]
+    lake = wmill.ducklake()
+    lake.query("""
+        CREATE OR REPLACE TABLE stripe_charges AS
+        SELECT unnest(from_json($rows, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)
+    """, rows=rows).fetch()
+```
+
+```ts
+// pipeline
+// on schedule
+import * as wmill from "windmill-client"
+
+export async function main() {
+  const rows = await fetchCharges()
+  const lake = wmill.ducklake()
+  await lake`CREATE OR REPLACE TABLE stripe_charges AS
+    SELECT unnest(from_json(${rows}, '[{"id":"VARCHAR","amount":"BIGINT","created":"BIGINT"}]'), recursive := true)`.fetch()
+}
+```
+
+- Use `INSERT INTO <table> SELECT ...` instead of `CREATE OR REPLACE` to append (an incremental pull), with a one-time `CREATE TABLE IF NOT EXISTS` first.
+- Assign the client to a variable (`lake = wmill.ducklake()`) and keep the SQL a **string literal** (Python) or a template without `sql.raw` (TS): that is what lets the graph record the node's write to `ducklake://main/<table>`. A chained `wmill.ducklake().query(...)` or SQL built in a variable records no output, so the downstream edge never forms.
+- `wmill.ducklake("<name>")` targets a non-default catalog; `wmill.datatable("<name>")` writes a Postgres data table the same way (Python `db.query(sql, *args)` with `$1` placeholders, TS the same template form) — use it only when the data belongs in Postgres (see above).
+- The downstream node triggers on the table itself: `-- on ducklake://main/stripe_charges`.
+
 ## Storage prerequisites
 
 A DuckLake pipeline only runs once the workspace has **object storage** (S3 / Azure Blob / GCS) **and a DuckLake catalog** configured — DuckLake tables and `s3://` assets can't be materialized or read without it. Check which DuckLake catalogs the workspace has before you build.
@@ -56,7 +94,7 @@ The key must be a **string literal** — the graph parser is static and cannot f
 
 ## Materialize (the managed output)
 
-> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the output via the SDK (`wmill.writeS3File(...)`, ducklake helpers, …) and let it be inferred. Use `duckdb` when a node should materialize a DuckLake table.
+> **A MANAGED `// materialize` is DuckDB-only**, and its target must be a DuckLake table (`ducklake://<name>/<table>`). Deploy **rejects** a `ducklake://` `// materialize` on any other language (`python3`, `bun`, `postgresql`). For a non-DuckDB node writing the lake, do **not** use `// materialize` — write the table itself with `wmill.ducklake()` (see "Ingesting from Python / TypeScript") and let the output be inferred. Use `duckdb` when a node should materialize a DuckLake table.
 >
 > The one target ANY language may declare (except a dbt script, whose writes come from its manifest) is a **warehouse relation**: `// materialize manual dbt://<warehouse>/<schema>/<name>`, where `<warehouse>` is a warehouse the workspace configures under Settings → dbt. `manual` is the only mode it has — nothing generates warehouse DDL, so the node issues its own write (a postgresql `CREATE TABLE` / `INSERT`, an SDK load, …) and the annotation records the outcome. Use it on an ingestion node whose output a dbt project reads as a `source`: the declared relation and the dbt model land on ONE graph node, and a downstream `// on dbt://<warehouse>/<schema>/<name>` fires when the ingestion node completes.
 
diff --git a/system_prompts/base/raw-app-cli.md b/system_prompts/base/raw-app-cli.md
index 0ff11a2b74..e22de102f6 100644
--- a/system_prompts/base/raw-app-cli.md
+++ b/system_prompts/base/raw-app-cli.md
@@ -6,47 +6,53 @@ This guide covers raw apps from the terminal: scaffolding via `wmill app new`, t
 
 **You — the AI agent — create the app yourself by running `wmill app new` with the right flags. Do NOT tell the user to "run `wmill app new` and follow the prompts" or wait for them to do it.** The bare `wmill app new` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
 
-### Step 1 — Gather the three required values by asking the user
+### Step 1 — Settle the setup
 
-You need three things to run the command:
+You need three values to run the command:
 
 1. **summary** — a short description of the app
 2. **path** — the windmill path, e.g. `f/folder/my_app` or `u/username/my_app`
-3. **framework** — one of `react19` (recommended), `react18`, `svelte5`, `vue`
+3. **framework** — one of `react19` (recommended), `react18`, `svelte5`
 
-If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+**summary and path**: if the user's request did not supply them, ask. Do not guess values and do not invent paths.
 
-Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+**framework**: never ask. Use the one the user named, otherwise the one the project's existing apps use, otherwise `react19` (see "Starting a new app" in the authoring guide).
+
+**data setup**: when the app has to store data and the user did not say where, ask which data table, which schema and which tables, as "Data setup" in the authoring guide lays out. `wmill datatable list` gives the data tables to offer.
+
+Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group everything missing into a single round-trip so the user answers at once:
 
-- For `framework` — multiple-choice with the four allowed values; mark `react19` as `(Recommended)` and put it first.
 - For `summary` and `path` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+- For the data setup — the choices the authoring guide lists, the default first.
 
-Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+Only proceed once every value is concrete. If the user replies with something ambiguous, ask again rather than guessing.
 
 ### Step 2 — Run the command yourself
 
-Once you have summary + path + framework, run it:
+Once the setup is settled, run it:
 
 ```bash
 wmill app new \
   --summary "Customer dashboard" \
   --path f/sales/dashboard \
-  --framework react19
+  --framework react19 \
+  --datatable main \
+  --schema app1
 ```
 
-That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of `--summary`/`--path`/`--framework` puts the command in non-interactive mode.
+`--summary`, `--path` and `--framework` are the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of them puts the command in non-interactive mode, so the data setup only reaches the app through the flags below.
 
 ### Optional flags
 
-Layer these in only when the user asked for them:
-
 | Flag | When to add it |
 |---|---|
-| `--datatable <name>` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
-| `--schema <name>` | Together with `--datatable`. Creates the schema with `CREATE SCHEMA IF NOT EXISTS` if it doesn't already exist. |
+| `--datatable <name>` | The app stores data: the data table settled in step 1. Without it, the app is created with no datatable. |
+| `--schema <name>` | Together with `--datatable`, when the app's tables go in a schema, new or existing. If the schema doesn't exist yet, writes a `sql_to_apply/` migration with `CREATE SCHEMA IF NOT EXISTS`, applied like any other migration (see "SQL Migrations" below). Leave it out for `public`. |
 | `--overwrite` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
 | `--no-open-in-desktop` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
 
+Existing tables the app reuses have no flag: list them under `data.tables` in `raw_app.yaml` (see "Data tables" below).
+
 ### Step 3 — Offer the visual preview
 
 After `wmill app new` and any initial edits to `App.tsx` / `index.tsx`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a `launch.json` entry when an embedded preview tool is in play) the user should consent to.
@@ -57,8 +63,9 @@ For apps the preview command runs from the app folder (`cd <app_path>__raw_app &
 
 - ❌ Running `wmill app new` with no flags (the prompt will hang).
 - ❌ Telling the user to "run `wmill app new` and follow the prompts" — that's a step backwards from what you can do directly.
-- ❌ Inventing a path/summary/framework instead of asking the user.
-- ❌ Defaulting to `react19` because the user didn't say — even sensible defaults must be confirmed.
+- ❌ Inventing a path or summary instead of asking the user.
+- ❌ Asking which framework to use — `react19` is the default when nothing says otherwise.
+- ❌ Creating a schema or tables for a new app before the user has said where its data goes.
 - ❌ Passing `--overwrite` automatically when the directory exists — confirm with the user first.
 
 ### Interactive (only when a human is at the terminal)
@@ -77,7 +84,7 @@ my_app__raw_app/
 ├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
 ├── raw_app.yaml           # App configuration (summary, path, data settings)
 ├── index.tsx              # Frontend entry point
-├── App.tsx                # Main React/Svelte/Vue component
+├── App.tsx                # Main React/Svelte component
 ├── index.css              # Styles
 ├── package.json           # Frontend dependencies
 ├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
@@ -176,7 +183,7 @@ data:
 - `<datatable>/<table>` — Specific table in public schema
 - `<datatable>/<schema>:<table>` — Table in specific schema
 
-**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. `roles` records the role the app uses each datatable through; the app's code must pass the same role: `wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python. A datatable without an entry is used as its default role.
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. `roles` records the role the app uses each datatable through; the app's code must pass the same role: `wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python. A datatable without an entry is used as its default role, if it has one, plus the roles of whoever is using the app unless that default is `admin`.
 
 ## SQL Migrations (sql_to_apply/)
 
diff --git a/system_prompts/base/raw-app.md b/system_prompts/base/raw-app.md
index 56c6e900d4..0979000b2a 100644
--- a/system_prompts/base/raw-app.md
+++ b/system_prompts/base/raw-app.md
@@ -1,6 +1,6 @@
 # Windmill Raw Apps
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+Raw apps let you build custom frontends with React or Svelte that connect to Windmill backend runnables and datatables.
 
 ## App shape
 
@@ -10,11 +10,51 @@ A raw app has three logical parts:
 - **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
 - **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
 
+## Starting a new app
+
+A new app gets the setup Windmill's own new-app dialog gives one: a framework, then where its data lives.
+
+### Framework
+
+Use the framework the user named. When they named none, follow what there is to follow: the app being edited, or the apps the request points at. With nothing to follow, use **React 19**, the recommended default, **without asking**. React 18 and Svelte 5 are for when they are asked for. These three are the only frameworks the raw app bundler builds. When the user asks to build or convert an app in another framework, write no code in it: say it is not available and offer these three instead.
+
+### Data setup
+
+When a new app has to store data and the user did not say where, **ask before creating anything**: no app, no schema, no table. Where the data lives is the user's decision, and tables created in the wrong place stay there. Look up the workspace's data tables first so every choice you offer exists, then ask, as proposed answers rather than open questions:
+
+1. **Data table**: which one to use, the default first (`main` when it exists, otherwise the first listed). Skip this one when the workspace has a single data table.
+2. **Schema**: where the app's new tables go.
+   - A **new schema**, the usual choice, offered first. Suggest the first unused name among `app1`, `app2`, …
+   - An **existing schema** of that data table, by name.
+   - **None**: the tables go in `public`.
+3. **Tables**: only when that data table already holds tables the app could use, whether to **reuse** them (name them) or **create new ones**.
+
+Do not ask when:
+
+- the user already said where the data goes. A part they left out takes its default above: the default data table, a new `appN` schema, new tables;
+- the app, or its saved draft, already carries a data config (`data.datatable`, `data.schema` or `data.tables`). That config is the answer;
+- the app stores nothing.
+
+With no data table in the workspace there is nothing to choose: say that one has to be configured in the workspace settings before the app can store data.
+
+A question left unanswered or dismissed is not a go-ahead for the defaults: stop there and say what is still needed.
+
+Then build what was chosen: the data table and schema become the app's `data.datatable` and `data.schema`, the tables it uses, reused or new, go in `data.tables`, and a new schema is created (`CREATE SCHEMA IF NOT EXISTS`) before the tables that go in it.
+<!-- cli-only -->
+`wmill app new --datatable <name> --schema <name>` records both and, for a schema that does not exist yet, writes the migration in `sql_to_apply/` that creates it: nothing exists in the database until `wmill app dev` applies that migration, so the app's table migrations come after it.
+<!-- /cli-only -->
+<!-- chat-only -->
+
+### An app that arrives already set up
+
+An app the user just started from the new-app dialog is already set up: its files are the framework template it was started with, and a `data` config it carries (`data.datatable`, `data.schema` or `data.tables`) is the data setup it was started with. Build that app in place, with that data config, and in that framework unless the user now names another. Do not ask for either, and do not create a second app. Only when it carries no data config and has to store data is the data setup still to ask.
+<!-- /chat-only -->
+
 ## Frontend
 
 ### Entrypoint
 
-The entrypoint is `index.tsx` for React and `index.ts` for Svelte and Vue. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty `<div id="root">` and auto-renders nothing, so the entrypoint must mount a top-level `App` itself. Keep the UI in `App.tsx` / `App.svelte` / `App.vue` and keep the entrypoint as the mount shim.
+The entrypoint is `index.tsx` for React and `index.ts` for Svelte. It is both the bundling entrypoint (the bundler is esbuild) and the **mount** entrypoint: the preview executes the bundle against an empty `<div id="root">` and auto-renders nothing, so the entrypoint must mount a top-level `App` itself. Keep the UI in `App.tsx` / `App.svelte` and keep the entrypoint as the mount shim.
 
 React (`index.tsx`):
 
@@ -26,7 +66,7 @@ import App from './App'
 createRoot(document.getElementById('root')!).render(<App />)
 ```
 
-Svelte (`index.ts`): `mount(App, { target: document.getElementById('root')! })`. Vue (`index.ts`): `createApp(App).mount('#root')`.
+Svelte (`index.ts`): `mount(App, { target: document.getElementById('root')! })`.
 
 **Never replace the entrypoint with a bare component** (`export default function App() { ... }` and no mount call). A component that is defined but never mounted renders a blank screen with **no error thrown** — it never executes, so nothing reaches the console or the error overlay. If an app renders blank, check that the entrypoint still mounts `App` into `#root`.
 
@@ -99,16 +139,16 @@ Apply it to customer data, internal notes and anything else a viewer of the demo
 
 ### Chat UIs over a flow in chat mode
 
-A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add `windmill-chat` to `package.json` and use it directly, it detects the app's Windmill and credential.
+A flow deployed with chat mode on is a chat backend (streaming answer, tool calls, memory, conversation history). Do not drive it through a runnable: add `@windmill-labs/chat-sdk` to `package.json` and use it directly, it detects the app's Windmill and credential.
 
 ```tsx
-import { useWindmillChat } from 'windmill-chat/react'
+import { useWindmillChat } from '@windmill-labs/chat-sdk/react'
 
 const chat = useWindmillChat({ flowPath: 'f/support/assistant' })
 // chat.messages ({ role, content, pending, success, tool? }), chat.status, chat.sendMessage(text), chat.stop()
 ```
 
-`windmill-chat/ai-sdk` gives a `ChatTransport` for the Vercel AI SDK's `useChat`, `windmill-chat/assistant-ui` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs `jobs:run` in its frontend SDK scopes, plus `flow_conversations:write` for the conversation sidebar; without them the chat keeps history in the browser.
+`@windmill-labs/chat-sdk/ai-sdk` gives a `ChatTransport` for the Vercel AI SDK's `useChat`, `@windmill-labs/chat-sdk/assistant-ui` a runtime for assistant-ui. The flow must be deployed, not a draft. A sandboxed app needs `jobs:run` in its frontend SDK scopes, plus `flow_conversations:write` for the conversation sidebar; without them the chat keeps history in the browser.
 
 ## Backend runnables
 
@@ -199,6 +239,20 @@ Either one lets those people run the app's backend runnables, so never open an a
 When a deploy widens who may open the app, tell the user in plain words.
 <!-- /chat-only -->
 
+## Sandbox isolation and frontend API access
+
+By default a deployed app's frontend runs with the viewer's own Windmill session. A sandboxed app is isolated from it: the frontend reaches Windmill only through its backend runnables, plus whatever frontend API scopes the app declares, which each viewer approves before the app runs. The scopes are `jobs:run`, `jobs:read`, `users:read`, `resources:read`, `variables:read`, `flow_conversations:read` and `flow_conversations:write`; grant only the ones the frontend calls.
+<!-- cli-only -->
+In `raw_app.yaml`:
+
+```yaml
+sandbox: true
+frontend_api: [jobs:run, users:read]
+```
+
+A file with a `sandbox` key states both settings: `sandbox: false` turns isolation off, and a missing `frontend_api` means no scopes. A file without the key leaves the deployed app's isolation and scopes as they are, so removing `sandbox: true` does not unsandbox it. `frontend_api` needs `sandbox: true`; the push fails otherwise.
+<!-- /cli-only -->
+
 ## Data Tables
 
 Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the `wmill` client; the frontend never queries them directly. **When the app needs to store or persist data** (user data, settings, application state, records, logs), use a data table.
@@ -210,6 +264,7 @@ Data tables are PostgreSQL databases managed by Windmill. Backend runnables quer
 3. **No DDL inside runnables**: runnables only read and write rows (SELECT, INSERT, UPDATE, DELETE) on existing tables. Never CREATE, ALTER or DROP a table from a runnable.
 4. **Qualify table names**: an unqualified name means the `public` schema, so write every other table as `schema.table`, in table creation and queries alike. The app's `data` config sets the default datatable and schema its tables go in; use them consistently across runnables.
 5. **Pass the role**: when the app's `data.roles` gives a data table a role, every `wmill.datatable` call on it passes that role (`wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python). The role only reaches what it was granted, so a query outside it fails with `permission denied`.
+6. **Per-viewer rows**: a data table with no entry in `data.roles` is called with no role. Unless its default role is `admin`, the connection then holds the default role, if it has one, plus every role the person using the app is a tenant of, and is refused when that is none. Row-level security policies written as `pg_has_role(current_user, '<role>', 'member')` return that viewer's rows with nothing added to the runnable. A role pins the connection to that one role for every viewer, so where rows should differ per viewer give the data table no `data.roles` entry.
 <!-- cli-only -->
 
 `wmill datatable list` lists the workspace's data tables. Create or change tables with a migration in `sql_to_apply/` (see "SQL Migrations" above), then add them to `data.tables` in `raw_app.yaml`.
@@ -265,4 +320,4 @@ def main(user_id: str):
 7. **Mark sensitive UI with `data-wm-no-record`** — it is what keeps that data out of a recorded demo; passwords are handled for you.
 8. **Reach for `backendAsync` + `waitJob`** for long work — never a hand-written job-polling runnable.
 9. **Deploy what a path runnable points at** — a path runnable aimed at a draft fails at runtime; tell the user what needs deploying.
-10. **Use `windmill-chat` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
+10. **Use `@windmill-labs/chat-sdk` for a chat over a chat-mode flow** — never a runnable that runs the flow and polls its stream.
diff --git a/system_prompts/base/script-base.md b/system_prompts/base/script-base.md
index 2641d7cd0a..9bd878ea9b 100644
--- a/system_prompts/base/script-base.md
+++ b/system_prompts/base/script-base.md
@@ -6,6 +6,7 @@
 - Libraries are installed automatically - do not show installation instructions
 - In a language with an entrypoint function (TypeScript, Python, Go, Rust, PHP, R, …), name it `main` (`Main` in C#) and do not call it; in TypeScript it must be async. SQL, GraphQL, Bash, PowerShell and Ansible scripts have no `main`: their language section shows how they take arguments
 - Where the language has a Windmill client (`wmill`), use it to interact with the platform
+- A script's input schema may carry a top-level `prompt_for_ai` string: its author's instructions to an AI choosing the inputs. Follow it when you pick arguments to run that script, and keep it when you rewrite the schema
 
 ## Return Values
 
diff --git a/system_prompts/base/workflow-as-code.md b/system_prompts/base/workflow-as-code.md
index 0e529f6803..efc29df360 100644
--- a/system_prompts/base/workflow-as-code.md
+++ b/system_prompts/base/workflow-as-code.md
@@ -95,6 +95,8 @@ async def enrich(customer_id: str):
 
 In TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with `@task()` or `@task`.
 
+Only the workflow body dispatches steps. A task runs as a single job, so a task or `step()` called from inside a task body runs in place in that job, as a plain function call: no child job, no checkpoint, and its task options (retry, timeout, tag) do not apply. `sleep()` there waits in the job, and `taskScript()` / `taskFlow()` / `waitForApproval()` (`task_script()` / `task_flow()` / `wait_for_approval()`) throw. To get separate jobs, call the tasks one after another from the workflow body and pass results between them.
+
 For existing scripts:
 
 ```typescript
diff --git a/system_prompts/languages/snowflake.md b/system_prompts/languages/snowflake.md
index 8ded76eb3c..b7798e3461 100644
--- a/system_prompts/languages/snowflake.md
+++ b/system_prompts/languages/snowflake.md
@@ -10,6 +10,27 @@ Name the parameters by adding comments before the statement:
 SELECT * FROM users WHERE name = ? AND age > ?;
 ```
 
+## Array parameters
+
+Declare a list with a `[]` suffix on the element type (`(varchar[])`,
+`(int[])`), or `(array)` for an untyped one. Snowflake cannot bind an array
+directly, so Windmill binds the list as JSON text: wrap the placeholder with
+`PARSE_JSON(?)`, and cast to `ARRAY` where a function expects one.
+
+```sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+WHERE ARRAY_CONTAINS(o.owner_group::VARIANT, PARSE_JSON(?)::ARRAY);
+```
+
+Or join on the elements with `FLATTEN`:
+
+```sql
+-- ? groups (varchar[])
+SELECT o.* FROM orders o
+JOIN TABLE(FLATTEN(input => PARSE_JSON(?))) g ON g.value::STRING = o.owner_group;
+```
+
 ## Receiving an S3Object as a script parameter
 
 Declare the arg with type `(s3object)`. Windmill renders an S3 file picker for
diff --git a/typescript-client/build.jsr.sh b/typescript-client/build.jsr.sh
index 08c06f586f..41a8eac37e 100755
--- a/typescript-client/build.jsr.sh
+++ b/typescript-client/build.jsr.sh
@@ -22,6 +22,6 @@ cp "${script_dirpath}/sqlUtils.ts" "${script_dirpath}/src/"
 echo "" >> "${script_dirpath}/src/index.ts"
 echo 'export type { DenoS3LightClientSettings } from "./s3Types";' >> "${script_dirpath}/src/index.ts"
 echo "" >> "${script_dirpath}/src/index.ts"
-echo 'export { type Base64, setClient, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI } from "./client";' >> "${script_dirpath}/src/index.ts"
+echo 'export { type Base64, setClient, getWorkspace, workerHasInternalServer, SHARED_FOLDER, getStatePath, getInternalState, setInternalState, getResumeEndpoints, getResult, getResultMaybe, resolveDefaultResource, databaseUrlFromResource, base64ToUint8Array, uint8ArrayToBase64, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, workerIsDraining, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, type RunScriptAsyncOptions, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI } from "./client";' >> "${script_dirpath}/src/index.ts"
 
 
diff --git a/typescript-client/build.sh b/typescript-client/build.sh
index 40c19d873c..f927acd26e 100755
--- a/typescript-client/build.sh
+++ b/typescript-client/build.sh
@@ -46,7 +46,7 @@ cp "${script_dirpath}/sqlUtils.ts" "${script_dirpath}/src/"
 echo "" >> "${script_dirpath}/src/index.ts"
 echo 'export type { DenoS3LightClientSettings } from "./s3Types";' >> "${script_dirpath}/src/index.ts"
 echo "" >> "${script_dirpath}/src/index.ts"
-echo 'export { type Base64, setClient, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, taskScript, taskFlow, workflow, step, sleep, parallel, waitForApproval, getApprovalUrls, type TaskOptions, type TaskRetry, type Jsonified, type JsonifiedFn, WorkflowCtx, _workflowCtx, setWorkflowCtx, StepSuspend, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI, commitKafkaOffsets } from "./client";' >> "${script_dirpath}/src/index.ts"
+echo 'export { type Base64, setClient, getWorkspace, workerHasInternalServer, SHARED_FOLDER, getStatePath, getInternalState, setInternalState, getResumeEndpoints, getResult, getResultMaybe, resolveDefaultResource, databaseUrlFromResource, base64ToUint8Array, uint8ArrayToBase64, getVariable, setVariable, getResource, setResource, getResumeUrls, setState, setProgress, getProgress, workerIsDraining, getState, getIdToken, denoS3LightClientSettings, cancelJob, loadS3FileStream, loadS3File, writeS3File, deleteS3File, signS3Objects, signS3Object, getPresignedS3PublicUrls, getPresignedS3PublicUrl, task, taskScript, taskFlow, workflow, step, sleep, parallel, waitForApproval, getApprovalUrls, type TaskOptions, type TaskRetry, type Jsonified, type JsonifiedFn, WorkflowCtx, _workflowCtx, setWorkflowCtx, StepSuspend, runScript, runScriptAsync, runScriptByPath, runScriptByHash, runScriptByPathAsync, runScriptByHashAsync, type RunScriptAsyncOptions, runFlow, runFlowAsync, waitJob, getRootJobId, setFlowUserState, getFlowUserState, usernameToEmail, requestInteractiveSlackApproval, type Sql, requestInteractiveTeamsApproval, appendToResultStream, streamResult, datatable, ducklake, upsertPartition, appendPartition, type DucklakeMaterializeOptions, type SqlStatement, type DatatableSqlTemplateFunction, type SqlTemplateFunction, type S3Object, type S3ObjectRecord, type S3ObjectURI, commitKafkaOffsets } from "./client";' >> "${script_dirpath}/src/index.ts"
 
 # Build default export by combining client utilities + services
 # This preserves backward compatibility for `import wmill from "windmill-client"`
@@ -63,6 +63,7 @@ import {
   setState,
   setProgress,
   getProgress,
+  workerIsDraining,
   getState,
   getIdToken,
   denoS3LightClientSettings,
@@ -153,6 +154,7 @@ const wmill = {
   setState,
   setProgress,
   getProgress,
+  workerIsDraining,
   getState,
   getIdToken,
   denoS3LightClientSettings,
diff --git a/typescript-client/client.ts b/typescript-client/client.ts
index 7e84320346..da957239cf 100644
--- a/typescript-client/client.ts
+++ b/typescript-client/client.ts
@@ -11,6 +11,7 @@ import {
   UserService,
   KafkaTriggerService,
 } from "./services.gen";
+import type { Retry } from "./types.gen";
 import { OpenAPI } from "./core/OpenAPI";
 import { isSuspendSignal, stepErrorMarker, taskErrorFromMarker } from "./wacError";
 // import type { DenoS3LightClientSettings } from "./index";
@@ -420,12 +421,26 @@ export async function runScriptAsync(
   return _runScriptAsyncInternal(path, hash_, args, scheduledInSeconds, tag);
 }
 
+/** Options for {@link runScriptByPathAsync} and {@link runScriptByHashAsync}, passed in
+ *  place of `scheduledInSeconds`; a positional `tag` is then ignored. */
+export interface RunScriptAsyncOptions {
+  /** Schedule execution for a future time (in seconds) */
+  scheduledInSeconds?: number;
+  /** Override the worker tag the job runs on */
+  tag?: string;
+  /** Re-run the job when it fails, with the same policy a schedule takes, e.g.
+   *  `{ constant: { attempts: 3, seconds: 10 } }`. The returned id is the first
+   *  attempt's; each retry is a job of its own, recorded as a child of it. */
+  retry?: Retry;
+}
+
 async function _runScriptAsyncInternal(
   path: string | null = null,
   hash_: string | null = null,
   args: Record<string, any> | null = null,
   scheduledInSeconds: number | null = null,
-  tag: string | null = null
+  tag: string | null = null,
+  retry: Retry | null = null
 ): Promise<string> {
   // Create a script job and return its job id.
   args = args || {};
@@ -439,6 +454,10 @@ async function _runScriptAsyncInternal(
     params["tag"] = tag;
   }
 
+  if (retry) {
+    params["retry"] = JSON.stringify(retry);
+  }
+
   let parentJobId = getEnv("WM_JOB_ID");
   if (parentJobId !== undefined) {
     params["parent_job"] = parentJobId;
@@ -475,34 +494,47 @@ async function _runScriptAsyncInternal(
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
 export async function runScriptByPathAsync(
   path: string,
   args: Record<string, any> | null = null,
-  scheduledInSeconds: number | null = null,
+  scheduledInSeconds: number | null | RunScriptAsyncOptions = null,
   tag: string | null = null
 ): Promise<string> {
-  return _runScriptAsyncInternal(path, null, args, scheduledInSeconds, tag);
+  const o = asyncRunOptions(scheduledInSeconds, tag);
+  return _runScriptAsyncInternal(path, null, args, o.scheduledInSeconds, o.tag, o.retry);
 }
 
 /**
  * Run a script asynchronously by its hash
  * @param hash_ - Script hash in Windmill
  * @param args - Arguments to pass to the script
- * @param scheduledInSeconds - Schedule execution for a future time (in seconds)
+ * @param scheduledInSeconds - Schedule execution for a future time (in seconds), or {@link RunScriptAsyncOptions}
+ *   `{ scheduledInSeconds?, tag?, retry? }`, e.g. `{ retry: { constant: { attempts: 3, seconds: 10 } } }`
  * @param tag - Override the worker tag the job runs on
  * @returns Job ID of the created job
  */
 export async function runScriptByHashAsync(
   hash_: string,
   args: Record<string, any> | null = null,
-  scheduledInSeconds: number | null = null,
+  scheduledInSeconds: number | null | RunScriptAsyncOptions = null,
   tag: string | null = null
 ): Promise<string> {
-  return _runScriptAsyncInternal(null, hash_, args, scheduledInSeconds, tag);
+  const o = asyncRunOptions(scheduledInSeconds, tag);
+  return _runScriptAsyncInternal(null, hash_, args, o.scheduledInSeconds, o.tag, o.retry);
+}
+
+function asyncRunOptions(
+  scheduledInSeconds: number | null | RunScriptAsyncOptions,
+  tag: string | null
+): RunScriptAsyncOptions {
+  return typeof scheduledInSeconds === "object" && scheduledInSeconds !== null
+    ? scheduledInSeconds
+    : { scheduledInSeconds: scheduledInSeconds ?? undefined, tag: tag ?? undefined };
 }
 
 /**
@@ -692,6 +724,19 @@ export async function getProgress(jobId?: any): Promise<number | null> {
   });
 }
 
+/**
+ * Whether the worker running this job has received its shutdown signal.
+ * A draining worker waits for its current job to finish before exiting, so a
+ * long-running script can poll this and return early to let the worker be replaced.
+ * @param jobId? Job to check, defaults to the current job
+ */
+export async function workerIsDraining(jobId?: string): Promise<boolean> {
+  return await JobService.workerIsDraining({
+    id: jobId ?? getEnv("WM_JOB_ID") ?? "NO_JOB_ID",
+    workspace: getWorkspace(),
+  });
+}
+
 /**
  * Set a flow user state
  * @param key key of the state
@@ -1787,6 +1832,52 @@ export function setWorkflowCtx(ctx: WorkflowCtx | null) {
   Reflect.set(globalThis, "__wmill_wf_ctx", ctx);
 }
 
+type TaskBodyScope = { run<R>(store: true, fn: () => R): R; getStore(): true | undefined };
+
+/** Marks the async context of a task body running in its child job. A flag on
+ *  the ctx cannot stand in: the workflow body keeps replaying beside the task
+ *  body (`Promise.all([a(), b()])`), and its calls must still park rather than
+ *  run a sibling task's body in this job. Kept on `globalThis`, like the ctx,
+ *  so a bundle holding two copies of this module shares one scope. Resolved
+ *  through `process.getBuiltinModule` because a `node:` import would break
+ *  browser bundles of this package. */
+function taskBodyScope(): TaskBodyScope | null {
+  const existing = Reflect.get(globalThis, "__wmill_wf_task_body");
+  if (existing !== undefined) return existing;
+  let scope: TaskBodyScope | null = null;
+  try {
+    const AsyncLocalStorage = (globalThis as any).process?.getBuiltinModule?.("node:async_hooks")?.AsyncLocalStorage;
+    if (AsyncLocalStorage) scope = new AsyncLocalStorage();
+  } catch {}
+  Reflect.set(globalThis, "__wmill_wf_task_body", scope);
+  return scope;
+}
+
+function runTaskBody<R>(fn: () => R): R {
+  const scope = taskBodyScope();
+  return scope ? scope.run(true, fn) : fn();
+}
+
+function insideTaskBody(): boolean {
+  return taskBodyScope()?.getStore() === true;
+}
+
+/** The ctx SDK calls dispatch through, or null where they run in place: outside
+ *  a workflow, and inside a task body, which is one job and has no rounds of its
+ *  own to dispatch or checkpoint a step in. */
+function dispatchCtx(): WorkflowCtx | null {
+  if (insideTaskBody()) return null;
+  return _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+}
+
+function assertNotInsideTaskBody(what: string): void {
+  if (insideTaskBody()) {
+    throw new Error(
+      `${what} cannot be called from inside a task: a task runs as a single job and cannot suspend or dispatch steps. Call it from the workflow() body instead.`,
+    );
+  }
+}
+
 
 export class WorkflowCtx {
   private completed: Record<string, any>;
@@ -2259,11 +2350,11 @@ export class WorkflowCtx {
 }
 
 export async function sleep(seconds: number): Promise<void> {
-  const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+  const ctx = dispatchCtx();
   if (ctx) {
     return ctx._sleep(seconds) as Promise<void>;
   }
-  // Outside workflow context, just wait locally
+  // Outside a workflow, or inside a task body, just wait locally
   await new Promise((r) => setTimeout(r, seconds * 1000));
 }
 
@@ -2274,12 +2365,15 @@ export async function sleep(seconds: number): Promise<void> {
  * `fn`'s result is encoded as JSON and decoded back before it is returned, so
  * the round that runs the body sees the same types every replay sees: a `Date`
  * comes back as a string, a `Map` as `{}`. {@link Jsonified} is that shape.
+ *
+ * Called from inside a task body, `fn` runs in place and nothing is
+ * checkpointed: a task is a single job and is never replayed.
  */
 export async function step<T>(
   name: string,
   fn: () => T | Promise<T>,
 ): Promise<Jsonified<Awaited<T>>> {
-  const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+  const ctx = dispatchCtx();
   if (ctx) {
     return ctx._runInlineStep(name, fn) as Promise<Jsonified<Awaited<T>>>;
   }
@@ -2297,8 +2391,9 @@ export async function step<T>(
  * const call_api = task(fetchOrders, { retry: { attempts: 3, delay: 30, multiplier: 2 } });
  *
  * Inside a `workflow()`, calling a task dispatches it as a step.
- * Outside a workflow, the function body executes directly and
- * {@link TaskOptions} — retry included — does not apply.
+ * Outside a workflow, or called from inside another task, the function body
+ * executes directly and {@link TaskOptions} — retry included — does not apply:
+ * a task runs as a single job, so the tasks it calls run in that same job.
  *
  * A task runs as its own job, so its result is always encoded as JSON and
  * decoded back before the caller sees it: a `Date` comes back as a string, a
@@ -2332,7 +2427,7 @@ export function task<T extends (...args: any[]) => Promise<any>>(
   // .then() which throws StepSuspend and empties pending before the caller
   // can flush.
   const wrapper = function (...args: any[]) {
-    const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+    const ctx = dispatchCtx();
     if (ctx) {
       // Inside a workflow with checkpoint/replay context — dispatch as step
       const script = taskPath ?? taskName;
@@ -2352,7 +2447,7 @@ export function task<T extends (...args: any[]) => Promise<any>>(
         return (async () => {
           let result: any;
           try {
-            result = await fn(...args);
+            result = await runTaskBody(() => fn(...args));
           } catch (e) {
             if (isSuspendSignal(e, StepSuspend)) throw e;
             ctx._raiseStepFailure(e);
@@ -2361,7 +2456,7 @@ export function task<T extends (...args: any[]) => Promise<any>>(
         })();
       }
       return stepResult;
-    } else if (getEnv("WM_JOB_ID") && !getEnv("WM_FLOW_JOB_ID")) {
+    } else if (!insideTaskBody() && getEnv("WM_JOB_ID") && !getEnv("WM_FLOW_JOB_ID")) {
       // Inside a Windmill root job without checkpoint context — v1 HTTP dispatch
       // WM_FLOW_JOB_ID is set on child jobs, so we skip dispatch for those
       return (async () => {
@@ -2411,7 +2506,8 @@ export function taskScript(path: string, options?: TaskOptions): (...args: any[]
   assertUsableRetry(options?.retry);
   const name = path.split("/").pop() || path;
   const wrapper = function (...args: any[]) {
-    const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+    assertNotInsideTaskBody(`taskScript("${path}")`);
+    const ctx = dispatchCtx();
     if (ctx) {
       const kwargs = args.length === 1 && typeof args[0] === "object" && args[0] !== null
         ? args[0]
@@ -2437,7 +2533,8 @@ export function taskFlow(path: string, options?: TaskOptions): (...args: any[])
   assertUsableRetry(options?.retry);
   const name = path.split("/").pop() || path;
   const wrapper = function (...args: any[]) {
-    const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+    assertNotInsideTaskBody(`taskFlow("${path}")`);
+    const ctx = dispatchCtx();
     if (ctx) {
       const kwargs = args.length === 1 && typeof args[0] === "object" && args[0] !== null
         ? args[0]
@@ -2490,7 +2587,8 @@ export function waitForApproval(options?: {
   skin?: "detailed" | "minimal";
   description?: string | object;
 }): PromiseLike<{ value: any; approver: string; approved: boolean }> {
-  const ctx: WorkflowCtx | null = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
+  assertNotInsideTaskBody("waitForApproval()");
+  const ctx = dispatchCtx();
   if (!ctx) {
     throw new Error("waitForApproval can only be called inside a workflow()");
   }
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 4453b07b66..ffd7c2300a 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.821.0",
+  "version": "1.830.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index ec2b8bcd94..9adbfcec62 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.821.0",
+  "version": "1.830.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/typescript-client/tests/workflow_nested_task.test.ts b/typescript-client/tests/workflow_nested_task.test.ts
new file mode 100644
index 0000000000..39ac2185d8
--- /dev/null
+++ b/typescript-client/tests/workflow_nested_task.test.ts
@@ -0,0 +1,91 @@
+/**
+ * A task body runs as one child job, so the SDK calls it makes cannot be
+ * dispatched as steps of their own. Against the real client.
+ *
+ * Run with: bun test typescript-client/tests/workflow_nested_task.test.ts
+ */
+import { expect, test, describe, mock, afterEach } from "bun:test";
+
+mock.module("../services.gen", () => ({
+  ResourceService: {},
+  VariableService: {},
+  JobService: {},
+  HelpersService: {},
+  AppService: {},
+  MetricsService: {},
+  OidcService: {},
+  UserService: {},
+  KafkaTriggerService: {},
+}));
+mock.module("../core/OpenAPI", () => ({
+  OpenAPI: { BASE: "http://localhost:8000/api", TOKEN: "tok" },
+}));
+
+const { WorkflowCtx, StepSuspend, task, taskScript, step, setWorkflowCtx } = await import(
+  "../client.ts"
+);
+
+let ran: string[] = [];
+
+const inner = task(async function inner(x: string) {
+  ran.push("inner");
+  return `inner:${x}`;
+});
+
+const outer = task(async function outer(x: string) {
+  ran.push("outer");
+  await Promise.resolve();
+  const viaTask = await inner(x);
+  const viaStep = await step("s", () => "stepped");
+  return `${viaTask}+${viaStep}`;
+});
+
+const dispatching = task(async function dispatching() {
+  return await taskScript("f/other/script")({});
+});
+
+/** Run `body` as the child round executing `key`, and hand back what it raised. */
+async function childRound(key: string, body: () => Promise<unknown>): Promise<any> {
+  setWorkflowCtx(new WorkflowCtx({ completed_steps: {}, _executing_key: key }));
+  const hung = new Promise((r) => setTimeout(() => r("hung"), 500));
+  return await Promise.race([body().then(() => "returned", (e) => e), hung]);
+}
+
+afterEach(() => {
+  ran = [];
+  setWorkflowCtx(null);
+});
+
+describe("SDK calls inside a task body", () => {
+  test("a nested task and step run in the task's own job", async () => {
+    const raised = await childRound("outer", async () => {
+      await outer("a");
+    });
+
+    expect(raised).toBeInstanceOf(StepSuspend);
+    expect(raised.dispatchInfo).toMatchObject({
+      mode: "step_complete",
+      result: "inner:a+stepped",
+    });
+  });
+
+  // The workflow body keeps replaying beside the task body, and its own calls
+  // must stay parked: running them would execute a sibling task in this job.
+  test("a sibling task of the workflow body is not run", async () => {
+    const raised = await childRound("outer", async () => {
+      await Promise.all([outer("a"), inner("sibling")]);
+    });
+
+    expect(raised.dispatchInfo).toMatchObject({ mode: "step_complete" });
+    expect(ran).toEqual(["outer", "inner"]);
+  });
+
+  test("a step that would need a dispatch fails instead of hanging", async () => {
+    const raised = await childRound("dispatching", async () => {
+      await dispatching();
+    });
+
+    expect(raised).toBeInstanceOf(Error);
+    expect(raised.message).toContain("cannot be called from inside a task");
+  });
+});
diff --git a/version.txt b/version.txt
index 7254c11d2d..54f09db472 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.821.0
+1.830.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index d3e98974ef..95c5128a13 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.821.0",
+  "version": "1.830.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.821.0",
+      "version": "1.830.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index 3fcc603a52..6f2c2d7fed 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.821.0",
+  "version": "1.830.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",